Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 02:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe
-
Size
348KB
-
MD5
cfe37d94b619b82303018cdcf2568d42
-
SHA1
7cb5917f0bae5492d442140e769b832ad7c3030b
-
SHA256
c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6
-
SHA512
c066c3290c16a1d0ba43bf53a88b834a40a97bed7d7f8c4b5574af798699e4e294a31760fdfe96692f80517232b84df88c9d47d110f4df05d23c7331a9e52e59
-
SSDEEP
6144:Xcm7ImGddXgYW5fNZWB5hFfci3Add4kGYAa0:l7TcbWXZshJX2VGdb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2556-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1640-17-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2696-28-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2064-37-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2256-46-0x00000000003B0000-0x00000000003D8000-memory.dmp family_blackmoon behavioral1/memory/2256-48-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2808-57-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2808-56-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2768-68-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2768-67-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2632-90-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2724-98-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2684-110-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1516-119-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1084-131-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2360-148-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1296-166-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2180-169-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2268-186-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2204-194-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2124-203-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2236-213-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/640-231-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1288-240-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2052-262-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/768-260-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1712-298-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1712-323-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2456-344-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2744-359-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2936-367-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2788-380-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2608-388-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/1252-430-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1252-428-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1044-458-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2552-477-0x00000000002C0000-0x00000000002E8000-memory.dmp family_blackmoon behavioral1/memory/1508-535-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/2272-542-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2280-557-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral1/memory/3028-564-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/1548-610-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2840-658-0x0000000000220000-0x0000000000248000-memory.dmp family_blackmoon behavioral1/memory/2420-744-0x00000000003C0000-0x00000000003E8000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 3bttnh.exe 2696 jdjpp.exe 2064 htbbbt.exe 2256 vpdvp.exe 2808 rlxrrll.exe 2768 5nbbhh.exe 2856 dpddv.exe 2632 xlfflfl.exe 2724 btbbbb.exe 2684 fxxllll.exe 1516 nbhbhb.exe 1084 pjjpd.exe 2888 rflrlxl.exe 2360 ntbnbb.exe 2596 lflrxff.exe 1296 3ffxfxx.exe 2180 jjddp.exe 2268 xrlrxfl.exe 2204 3httbb.exe 2124 jvvpv.exe 2236 xrfffxx.exe 1608 hhtbhh.exe 640 jjppj.exe 1288 frffffl.exe 1668 ntbbbt.exe 768 lxfxfff.exe 2052 tnbbhh.exe 2412 1bbhhn.exe 2112 lrxxxxr.exe 1712 3hnhtt.exe 2012 vvppj.exe 1584 xlxxffr.exe 2576 9hnhht.exe 2692 jpdvv.exe 2064 3frlrll.exe 2456 xrxxxxx.exe 2716 htbhhb.exe 2744 9djjd.exe 2872 vjjdd.exe 2936 lfrrffr.exe 2788 hhtbhh.exe 2608 nbhhnn.exe 2724 vjvvd.exe 2200 1lxxlll.exe 1340 9hhhnh.exe 2948 ppdjd.exe 2908 pddpv.exe 1252 xrxxlrx.exe 580 btttbb.exe 2360 hthnnh.exe 2596 vjdvd.exe 2136 9ffxxxf.exe 1044 5xlfxxf.exe 1848 tnbbhh.exe 2552 pdjjv.exe 2708 1jpjd.exe 2204 xrxrrrr.exe 1636 bnbbhh.exe 848 9ntttn.exe 928 dvjdj.exe 1612 3pdpj.exe 1784 rlxxfxx.exe 2504 llrrrlr.exe 1508 nbhntt.exe -
resource yara_rule behavioral1/memory/2556-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1640-9-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1640-17-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2696-28-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2064-37-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2256-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2808-56-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2768-67-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2632-79-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2632-90-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2684-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2724-98-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2684-110-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1516-119-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1084-131-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2360-148-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1296-166-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2180-169-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2268-186-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2204-194-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2236-213-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/640-231-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1288-240-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1668-241-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1668-249-0x00000000001B0000-0x00000000001D8000-memory.dmp upx behavioral1/memory/2052-262-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/768-260-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1712-298-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2576-316-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2456-344-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2744-359-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2936-367-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2788-381-0x00000000003C0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/2788-380-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2608-388-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1044-458-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2552-477-0x00000000002C0000-0x00000000002E8000-memory.dmp upx behavioral1/memory/2204-484-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/848-497-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2504-522-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1508-535-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2504-544-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2280-550-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2280-557-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/2840-658-0x0000000000220000-0x0000000000248000-memory.dmp upx behavioral1/memory/2420-744-0x00000000003C0000-0x00000000003E8000-memory.dmp upx behavioral1/memory/2792-788-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral1/memory/1352-795-0x0000000000400000-0x0000000000428000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 1640 2556 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 30 PID 2556 wrote to memory of 1640 2556 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 30 PID 2556 wrote to memory of 1640 2556 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 30 PID 2556 wrote to memory of 1640 2556 c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe 30 PID 1640 wrote to memory of 2696 1640 3bttnh.exe 31 PID 1640 wrote to memory of 2696 1640 3bttnh.exe 31 PID 1640 wrote to memory of 2696 1640 3bttnh.exe 31 PID 1640 wrote to memory of 2696 1640 3bttnh.exe 31 PID 2696 wrote to memory of 2064 2696 jdjpp.exe 32 PID 2696 wrote to memory of 2064 2696 jdjpp.exe 32 PID 2696 wrote to memory of 2064 2696 jdjpp.exe 32 PID 2696 wrote to memory of 2064 2696 jdjpp.exe 32 PID 2064 wrote to memory of 2256 2064 htbbbt.exe 33 PID 2064 wrote to memory of 2256 2064 htbbbt.exe 33 PID 2064 wrote to memory of 2256 2064 htbbbt.exe 33 PID 2064 wrote to memory of 2256 2064 htbbbt.exe 33 PID 2256 wrote to memory of 2808 2256 vpdvp.exe 34 PID 2256 wrote to memory of 2808 2256 vpdvp.exe 34 PID 2256 wrote to memory of 2808 2256 vpdvp.exe 34 PID 2256 wrote to memory of 2808 2256 vpdvp.exe 34 PID 2808 wrote to memory of 2768 2808 rlxrrll.exe 35 PID 2808 wrote to memory of 2768 2808 rlxrrll.exe 35 PID 2808 wrote to memory of 2768 2808 rlxrrll.exe 35 PID 2808 wrote to memory of 2768 2808 rlxrrll.exe 35 PID 2768 wrote to memory of 2856 2768 5nbbhh.exe 36 PID 2768 wrote to memory of 2856 2768 5nbbhh.exe 36 PID 2768 wrote to memory of 2856 2768 5nbbhh.exe 36 PID 2768 wrote to memory of 2856 2768 5nbbhh.exe 36 PID 2856 wrote to memory of 2632 2856 dpddv.exe 37 PID 2856 wrote to memory of 2632 2856 dpddv.exe 37 PID 2856 wrote to memory of 2632 2856 dpddv.exe 37 PID 2856 wrote to memory of 2632 2856 dpddv.exe 37 PID 2632 wrote to memory of 2724 2632 xlfflfl.exe 38 PID 2632 wrote to memory of 2724 2632 xlfflfl.exe 38 PID 2632 wrote to memory of 2724 2632 xlfflfl.exe 38 PID 2632 wrote to memory of 2724 2632 xlfflfl.exe 38 PID 2724 wrote to memory of 2684 2724 btbbbb.exe 39 PID 2724 wrote to memory of 2684 2724 btbbbb.exe 39 PID 2724 wrote to memory of 2684 2724 btbbbb.exe 39 PID 2724 wrote to memory of 2684 2724 btbbbb.exe 39 PID 2684 wrote to memory of 1516 2684 fxxllll.exe 40 PID 2684 wrote to memory of 1516 2684 fxxllll.exe 40 PID 2684 wrote to memory of 1516 2684 fxxllll.exe 40 PID 2684 wrote to memory of 1516 2684 fxxllll.exe 40 PID 1516 wrote to memory of 1084 1516 nbhbhb.exe 41 PID 1516 wrote to memory of 1084 1516 nbhbhb.exe 41 PID 1516 wrote to memory of 1084 1516 nbhbhb.exe 41 PID 1516 wrote to memory of 1084 1516 nbhbhb.exe 41 PID 1084 wrote to memory of 2888 1084 pjjpd.exe 42 PID 1084 wrote to memory of 2888 1084 pjjpd.exe 42 PID 1084 wrote to memory of 2888 1084 pjjpd.exe 42 PID 1084 wrote to memory of 2888 1084 pjjpd.exe 42 PID 2888 wrote to memory of 2360 2888 rflrlxl.exe 43 PID 2888 wrote to memory of 2360 2888 rflrlxl.exe 43 PID 2888 wrote to memory of 2360 2888 rflrlxl.exe 43 PID 2888 wrote to memory of 2360 2888 rflrlxl.exe 43 PID 2360 wrote to memory of 2596 2360 ntbnbb.exe 44 PID 2360 wrote to memory of 2596 2360 ntbnbb.exe 44 PID 2360 wrote to memory of 2596 2360 ntbnbb.exe 44 PID 2360 wrote to memory of 2596 2360 ntbnbb.exe 44 PID 2596 wrote to memory of 1296 2596 lflrxff.exe 45 PID 2596 wrote to memory of 1296 2596 lflrxff.exe 45 PID 2596 wrote to memory of 1296 2596 lflrxff.exe 45 PID 2596 wrote to memory of 1296 2596 lflrxff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe"C:\Users\Admin\AppData\Local\Temp\c5d86e61764613234eaa1b89a072cbf49c567e4cc81e0a400526386aeaa82ba6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3bttnh.exec:\3bttnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jdjpp.exec:\jdjpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\htbbbt.exec:\htbbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vpdvp.exec:\vpdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\rlxrrll.exec:\rlxrrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5nbbhh.exec:\5nbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dpddv.exec:\dpddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\xlfflfl.exec:\xlfflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\btbbbb.exec:\btbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\fxxllll.exec:\fxxllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\nbhbhb.exec:\nbhbhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\pjjpd.exec:\pjjpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\rflrlxl.exec:\rflrlxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ntbnbb.exec:\ntbnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\lflrxff.exec:\lflrxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\3ffxfxx.exec:\3ffxfxx.exe17⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jjddp.exec:\jjddp.exe18⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe19⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3httbb.exec:\3httbb.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jvvpv.exec:\jvvpv.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xrfffxx.exec:\xrfffxx.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hhtbhh.exec:\hhtbhh.exe23⤵
- Executes dropped EXE
PID:1608 -
\??\c:\jjppj.exec:\jjppj.exe24⤵
- Executes dropped EXE
PID:640 -
\??\c:\frffffl.exec:\frffffl.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ntbbbt.exec:\ntbbbt.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lxfxfff.exec:\lxfxfff.exe27⤵
- Executes dropped EXE
PID:768 -
\??\c:\tnbbhh.exec:\tnbbhh.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1bbhhn.exec:\1bbhhn.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lrxxxxr.exec:\lrxxxxr.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3hnhtt.exec:\3hnhtt.exe31⤵
- Executes dropped EXE
PID:1712 -
\??\c:\vvppj.exec:\vvppj.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\xlxxffr.exec:\xlxxffr.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9hnhht.exec:\9hnhht.exe34⤵
- Executes dropped EXE
PID:2576 -
\??\c:\jpdvv.exec:\jpdvv.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3frlrll.exec:\3frlrll.exe36⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\htbhhb.exec:\htbhhb.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9djjd.exec:\9djjd.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vjjdd.exec:\vjjdd.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lfrrffr.exec:\lfrrffr.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hhtbhh.exec:\hhtbhh.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\nbhhnn.exec:\nbhhnn.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vjvvd.exec:\vjvvd.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1lxxlll.exec:\1lxxlll.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9hhhnh.exec:\9hhhnh.exe46⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ppdjd.exec:\ppdjd.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pddpv.exec:\pddpv.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\xrxxlrx.exec:\xrxxlrx.exe49⤵
- Executes dropped EXE
PID:1252 -
\??\c:\btttbb.exec:\btttbb.exe50⤵
- Executes dropped EXE
PID:580 -
\??\c:\hthnnh.exec:\hthnnh.exe51⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vjdvd.exec:\vjdvd.exe52⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9ffxxxf.exec:\9ffxxxf.exe53⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5xlfxxf.exec:\5xlfxxf.exe54⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tnbbhh.exec:\tnbbhh.exe55⤵
- Executes dropped EXE
PID:1848 -
\??\c:\pdjjv.exec:\pdjjv.exe56⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1jpjd.exec:\1jpjd.exe57⤵
- Executes dropped EXE
PID:2708 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe58⤵
- Executes dropped EXE
PID:2204 -
\??\c:\bnbbhh.exec:\bnbbhh.exe59⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9ntttn.exec:\9ntttn.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\dvjdj.exec:\dvjdj.exe61⤵
- Executes dropped EXE
PID:928 -
\??\c:\3pdpj.exec:\3pdpj.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe63⤵
- Executes dropped EXE
PID:1784 -
\??\c:\llrrrlr.exec:\llrrrlr.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nbhntt.exec:\nbhntt.exe65⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dpvpv.exec:\dpvpv.exe66⤵PID:2272
-
\??\c:\pjvdd.exec:\pjvdd.exe67⤵PID:1672
-
\??\c:\xlxrfff.exec:\xlxrfff.exe68⤵PID:2280
-
\??\c:\bnbbhh.exec:\bnbbhh.exe69⤵PID:3028
-
\??\c:\3jpjj.exec:\3jpjj.exe70⤵
- System Location Discovery: System Language Discovery
PID:1864 -
\??\c:\3jppj.exec:\3jppj.exe71⤵PID:3032
-
\??\c:\frrllfx.exec:\frrllfx.exe72⤵PID:2356
-
\??\c:\1ntntb.exec:\1ntntb.exe73⤵PID:1548
-
\??\c:\thbntt.exec:\thbntt.exe74⤵PID:2212
-
\??\c:\pjddj.exec:\pjddj.exe75⤵PID:2404
-
\??\c:\vjvvj.exec:\vjvvj.exe76⤵PID:2576
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe77⤵PID:2692
-
\??\c:\hnhbbb.exec:\hnhbbb.exe78⤵PID:2968
-
\??\c:\9thhhh.exec:\9thhhh.exe79⤵PID:2832
-
\??\c:\jdddd.exec:\jdddd.exe80⤵PID:2984
-
\??\c:\frfxffr.exec:\frfxffr.exe81⤵PID:2736
-
\??\c:\frllxrr.exec:\frllxrr.exe82⤵PID:2980
-
\??\c:\htbbhb.exec:\htbbhb.exe83⤵PID:1224
-
\??\c:\jdjjd.exec:\jdjjd.exe84⤵PID:2840
-
\??\c:\pjvpv.exec:\pjvpv.exe85⤵PID:2604
-
\??\c:\xlxxfxr.exec:\xlxxfxr.exe86⤵PID:2612
-
\??\c:\flrrffr.exec:\flrrffr.exe87⤵PID:2724
-
\??\c:\thhttt.exec:\thhttt.exe88⤵PID:2328
-
\??\c:\dvjjp.exec:\dvjjp.exe89⤵PID:1516
-
\??\c:\1vvpj.exec:\1vvpj.exe90⤵PID:2956
-
\??\c:\fxlfflr.exec:\fxlfflr.exe91⤵PID:300
-
\??\c:\hbbbhb.exec:\hbbbhb.exe92⤵PID:1080
-
\??\c:\pjvpd.exec:\pjvpd.exe93⤵PID:1328
-
\??\c:\jvddd.exec:\jvddd.exe94⤵PID:2932
-
\??\c:\xrxxffl.exec:\xrxxffl.exe95⤵PID:1700
-
\??\c:\xfxlxlr.exec:\xfxlxlr.exe96⤵PID:1572
-
\??\c:\bbhhtt.exec:\bbhhtt.exe97⤵PID:1296
-
\??\c:\1nnhbt.exec:\1nnhbt.exe98⤵PID:2420
-
\??\c:\jvvpv.exec:\jvvpv.exe99⤵PID:2196
-
\??\c:\rfxflfl.exec:\rfxflfl.exe100⤵PID:1852
-
\??\c:\rlxxrlr.exec:\rlxxrlr.exe101⤵PID:2140
-
\??\c:\7hnntt.exec:\7hnntt.exe102⤵PID:3000
-
\??\c:\hthhhh.exec:\hthhhh.exe103⤵PID:2124
-
\??\c:\dvddp.exec:\dvddp.exe104⤵PID:2004
-
\??\c:\rlfflrr.exec:\rlfflrr.exe105⤵PID:692
-
\??\c:\rfrrllr.exec:\rfrrllr.exe106⤵PID:2792
-
\??\c:\hhtbht.exec:\hhtbht.exe107⤵PID:1352
-
\??\c:\dvvvp.exec:\dvvvp.exe108⤵PID:2472
-
\??\c:\ddppv.exec:\ddppv.exe109⤵PID:2496
-
\??\c:\lxfrrrr.exec:\lxfrrrr.exe110⤵PID:1708
-
\??\c:\thnnbb.exec:\thnnbb.exe111⤵PID:2396
-
\??\c:\hntntn.exec:\hntntn.exe112⤵PID:2976
-
\??\c:\dpvjp.exec:\dpvjp.exe113⤵PID:1696
-
\??\c:\rlxflff.exec:\rlxflff.exe114⤵PID:1944
-
\??\c:\fxlxfff.exec:\fxlxfff.exe115⤵PID:1840
-
\??\c:\5nbbbb.exec:\5nbbbb.exe116⤵PID:1704
-
\??\c:\jvppd.exec:\jvppd.exe117⤵PID:1556
-
\??\c:\vpdjv.exec:\vpdjv.exe118⤵PID:2044
-
\??\c:\rlxfxll.exec:\rlxfxll.exe119⤵PID:1988
-
\??\c:\fxfxlrr.exec:\fxfxlrr.exe120⤵PID:2404
-
\??\c:\bntbhh.exec:\bntbhh.exe121⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-