Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe
-
Size
453KB
-
MD5
5d0de506f390fc44daed045414089f2f
-
SHA1
be0e5700f6be24b44cd2a66e034c279797b1339d
-
SHA256
d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e
-
SHA512
5f967b0521dc3edfc8b5f08a7a6cf033847cd59075b40cb3b7f889b665da5250273e47d264d5df4cadb4db9ce79d2cc19c4c6625c0ed737d6bdef3b59a507b78
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/860-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-24-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-39-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2264-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-59-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2896-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2244-125-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/2244-124-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/2932-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-242-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1444-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-317-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2104-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-352-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-412-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-689-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2932-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-714-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-725-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-905-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1276 bnhhtt.exe 1152 3vjjv.exe 1296 rlrxffl.exe 2264 9lflrrf.exe 2908 5nhnnn.exe 2896 lfxlflx.exe 2920 xrxflrf.exe 2776 lfxfrrl.exe 2628 fxrxffr.exe 2164 xrrxxxf.exe 988 ffrfrxl.exe 2244 bbthth.exe 2932 lfxxrrf.exe 3020 jdjvp.exe 3012 rlrlxfl.exe 1960 vppvd.exe 992 5xrxffl.exe 1372 jdddv.exe 1756 fxrxlrx.exe 2060 ppjpd.exe 1920 fxxrffr.exe 1132 1htnnt.exe 1160 7jvdj.exe 292 lfrxflf.exe 1588 9nhhbh.exe 1668 jjvdp.exe 2484 7bhhnn.exe 1244 lxxxllr.exe 1444 bbtnnh.exe 692 pjdjp.exe 1740 3fxlflx.exe 2280 hbntbh.exe 2396 9rrfrrx.exe 1996 nhnbhn.exe 1276 tthhtb.exe 2936 vpdjp.exe 2260 xrllrrf.exe 2876 1nbhtb.exe 2104 nhnthh.exe 3044 ddpjv.exe 2648 9ffxffl.exe 3004 1llrlrr.exe 2920 htbbbb.exe 2608 9jjjp.exe 2784 5dppp.exe 2628 rfxrxxx.exe 2848 nhtbnn.exe 1848 3tntbb.exe 2960 jdvvd.exe 2828 lflffxf.exe 2968 ffrflrf.exe 1864 tbtbhh.exe 2376 5jvvd.exe 2844 7dvdd.exe 1964 1flrffl.exe 264 hbnntt.exe 780 7bntbt.exe 568 ddpvd.exe 2592 rlflrrx.exe 1496 xrlrrrf.exe 2468 3hbbhh.exe 1920 3dvjp.exe 1132 vvjdp.exe 2584 rlrrxxf.exe -
resource yara_rule behavioral1/memory/860-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-24-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-220-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/292-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-352-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3004-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-412-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-628-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2676-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-689-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2932-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-714-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1736-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-905-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-1122-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/3004-1206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-1319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-1356-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 1276 860 d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe 30 PID 860 wrote to memory of 1276 860 d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe 30 PID 860 wrote to memory of 1276 860 d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe 30 PID 860 wrote to memory of 1276 860 d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe 30 PID 1276 wrote to memory of 1152 1276 bnhhtt.exe 31 PID 1276 wrote to memory of 1152 1276 bnhhtt.exe 31 PID 1276 wrote to memory of 1152 1276 bnhhtt.exe 31 PID 1276 wrote to memory of 1152 1276 bnhhtt.exe 31 PID 1152 wrote to memory of 1296 1152 3vjjv.exe 32 PID 1152 wrote to memory of 1296 1152 3vjjv.exe 32 PID 1152 wrote to memory of 1296 1152 3vjjv.exe 32 PID 1152 wrote to memory of 1296 1152 3vjjv.exe 32 PID 1296 wrote to memory of 2264 1296 rlrxffl.exe 33 PID 1296 wrote to memory of 2264 1296 rlrxffl.exe 33 PID 1296 wrote to memory of 2264 1296 rlrxffl.exe 33 PID 1296 wrote to memory of 2264 1296 rlrxffl.exe 33 PID 2264 wrote to memory of 2908 2264 9lflrrf.exe 34 PID 2264 wrote to memory of 2908 2264 9lflrrf.exe 34 PID 2264 wrote to memory of 2908 2264 9lflrrf.exe 34 PID 2264 wrote to memory of 2908 2264 9lflrrf.exe 34 PID 2908 wrote to memory of 2896 2908 5nhnnn.exe 35 PID 2908 wrote to memory of 2896 2908 5nhnnn.exe 35 PID 2908 wrote to memory of 2896 2908 5nhnnn.exe 35 PID 2908 wrote to memory of 2896 2908 5nhnnn.exe 35 PID 2896 wrote to memory of 2920 2896 lfxlflx.exe 36 PID 2896 wrote to memory of 2920 2896 lfxlflx.exe 36 PID 2896 wrote to memory of 2920 2896 lfxlflx.exe 36 PID 2896 wrote to memory of 2920 2896 lfxlflx.exe 36 PID 2920 wrote to memory of 2776 2920 xrxflrf.exe 37 PID 2920 wrote to memory of 2776 2920 xrxflrf.exe 37 PID 2920 wrote to memory of 2776 2920 xrxflrf.exe 37 PID 2920 wrote to memory of 2776 2920 xrxflrf.exe 37 PID 2776 wrote to memory of 2628 2776 lfxfrrl.exe 38 PID 2776 wrote to memory of 2628 2776 lfxfrrl.exe 38 PID 2776 wrote to memory of 2628 2776 lfxfrrl.exe 38 PID 2776 wrote to memory of 2628 2776 lfxfrrl.exe 38 PID 2628 wrote to memory of 2164 2628 fxrxffr.exe 39 PID 2628 wrote to memory of 2164 2628 fxrxffr.exe 39 PID 2628 wrote to memory of 2164 2628 fxrxffr.exe 39 PID 2628 wrote to memory of 2164 2628 fxrxffr.exe 39 PID 2164 wrote to memory of 988 2164 xrrxxxf.exe 40 PID 2164 wrote to memory of 988 2164 xrrxxxf.exe 40 PID 2164 wrote to memory of 988 2164 xrrxxxf.exe 40 PID 2164 wrote to memory of 988 2164 xrrxxxf.exe 40 PID 988 wrote to memory of 2244 988 ffrfrxl.exe 41 PID 988 wrote to memory of 2244 988 ffrfrxl.exe 41 PID 988 wrote to memory of 2244 988 ffrfrxl.exe 41 PID 988 wrote to memory of 2244 988 ffrfrxl.exe 41 PID 2244 wrote to memory of 2932 2244 bbthth.exe 42 PID 2244 wrote to memory of 2932 2244 bbthth.exe 42 PID 2244 wrote to memory of 2932 2244 bbthth.exe 42 PID 2244 wrote to memory of 2932 2244 bbthth.exe 42 PID 2932 wrote to memory of 3020 2932 lfxxrrf.exe 43 PID 2932 wrote to memory of 3020 2932 lfxxrrf.exe 43 PID 2932 wrote to memory of 3020 2932 lfxxrrf.exe 43 PID 2932 wrote to memory of 3020 2932 lfxxrrf.exe 43 PID 3020 wrote to memory of 3012 3020 jdjvp.exe 44 PID 3020 wrote to memory of 3012 3020 jdjvp.exe 44 PID 3020 wrote to memory of 3012 3020 jdjvp.exe 44 PID 3020 wrote to memory of 3012 3020 jdjvp.exe 44 PID 3012 wrote to memory of 1960 3012 rlrlxfl.exe 45 PID 3012 wrote to memory of 1960 3012 rlrlxfl.exe 45 PID 3012 wrote to memory of 1960 3012 rlrlxfl.exe 45 PID 3012 wrote to memory of 1960 3012 rlrlxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe"C:\Users\Admin\AppData\Local\Temp\d08b42e2890d978b3acd7b3050bc9384a11e7577356ccaf2d48394c6d324977e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\bnhhtt.exec:\bnhhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\3vjjv.exec:\3vjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\rlrxffl.exec:\rlrxffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\9lflrrf.exec:\9lflrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\5nhnnn.exec:\5nhnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\lfxlflx.exec:\lfxlflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xrxflrf.exec:\xrxflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lfxfrrl.exec:\lfxfrrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\fxrxffr.exec:\fxrxffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\bbthth.exec:\bbthth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\lfxxrrf.exec:\lfxxrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\jdjvp.exec:\jdjvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\rlrlxfl.exec:\rlrlxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\vppvd.exec:\vppvd.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\5xrxffl.exec:\5xrxffl.exe18⤵
- Executes dropped EXE
PID:992 -
\??\c:\jdddv.exec:\jdddv.exe19⤵
- Executes dropped EXE
PID:1372 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe20⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ppjpd.exec:\ppjpd.exe21⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxxrffr.exec:\fxxrffr.exe22⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1htnnt.exec:\1htnnt.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\7jvdj.exec:\7jvdj.exe24⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lfrxflf.exec:\lfrxflf.exe25⤵
- Executes dropped EXE
PID:292 -
\??\c:\9nhhbh.exec:\9nhhbh.exe26⤵
- Executes dropped EXE
PID:1588 -
\??\c:\jjvdp.exec:\jjvdp.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7bhhnn.exec:\7bhhnn.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lxxxllr.exec:\lxxxllr.exe29⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bbtnnh.exec:\bbtnnh.exe30⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pjdjp.exec:\pjdjp.exe31⤵
- Executes dropped EXE
PID:692 -
\??\c:\3fxlflx.exec:\3fxlflx.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hbntbh.exec:\hbntbh.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9rrfrrx.exec:\9rrfrrx.exe34⤵
- Executes dropped EXE
PID:2396 -
\??\c:\nhnbhn.exec:\nhnbhn.exe35⤵
- Executes dropped EXE
PID:1996 -
\??\c:\tthhtb.exec:\tthhtb.exe36⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vpdjp.exec:\vpdjp.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xrllrrf.exec:\xrllrrf.exe38⤵
- Executes dropped EXE
PID:2260 -
\??\c:\1nbhtb.exec:\1nbhtb.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhnthh.exec:\nhnthh.exe40⤵
- Executes dropped EXE
PID:2104 -
\??\c:\ddpjv.exec:\ddpjv.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9ffxffl.exec:\9ffxffl.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\1llrlrr.exec:\1llrlrr.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\htbbbb.exec:\htbbbb.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\9jjjp.exec:\9jjjp.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\5dppp.exec:\5dppp.exe46⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rfxrxxx.exec:\rfxrxxx.exe47⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nhtbnn.exec:\nhtbnn.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3tntbb.exec:\3tntbb.exe49⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jdvvd.exec:\jdvvd.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lflffxf.exec:\lflffxf.exe51⤵
- Executes dropped EXE
PID:2828 -
\??\c:\ffrflrf.exec:\ffrflrf.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tbtbhh.exec:\tbtbhh.exe53⤵
- Executes dropped EXE
PID:1864 -
\??\c:\5jvvd.exec:\5jvvd.exe54⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7dvdd.exec:\7dvdd.exe55⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1flrffl.exec:\1flrffl.exe56⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hbnntt.exec:\hbnntt.exe57⤵
- Executes dropped EXE
PID:264 -
\??\c:\7bntbt.exec:\7bntbt.exe58⤵
- Executes dropped EXE
PID:780 -
\??\c:\ddpvd.exec:\ddpvd.exe59⤵
- Executes dropped EXE
PID:568 -
\??\c:\rlflrrx.exec:\rlflrrx.exe60⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe61⤵
- Executes dropped EXE
PID:1496 -
\??\c:\3hbbhh.exec:\3hbbhh.exe62⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3dvjp.exec:\3dvjp.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\vvjdp.exec:\vvjdp.exe64⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbnthh.exec:\bbnthh.exe66⤵PID:612
-
\??\c:\nhttbb.exec:\nhttbb.exe67⤵PID:2820
-
\??\c:\pjvpv.exec:\pjvpv.exe68⤵PID:1184
-
\??\c:\lfrlrxr.exec:\lfrlrxr.exe69⤵PID:1716
-
\??\c:\fxfrxfl.exec:\fxfrxfl.exe70⤵PID:1156
-
\??\c:\9btthn.exec:\9btthn.exe71⤵PID:1816
-
\??\c:\ntbbtt.exec:\ntbbtt.exe72⤵PID:3052
-
\??\c:\jpjpd.exec:\jpjpd.exe73⤵PID:1944
-
\??\c:\3hbbbb.exec:\3hbbbb.exe74⤵PID:1444
-
\??\c:\tnbbbb.exec:\tnbbbb.exe75⤵PID:2108
-
\??\c:\pjpdd.exec:\pjpdd.exe76⤵PID:876
-
\??\c:\7xrlrrx.exec:\7xrlrrx.exe77⤵PID:2536
-
\??\c:\xxxxlfr.exec:\xxxxlfr.exe78⤵PID:1692
-
\??\c:\tnbhnt.exec:\tnbhnt.exe79⤵PID:2396
-
\??\c:\9dppp.exec:\9dppp.exe80⤵PID:1996
-
\??\c:\vjdjp.exec:\vjdjp.exe81⤵PID:1912
-
\??\c:\9xxflrf.exec:\9xxflrf.exe82⤵PID:2180
-
\??\c:\9bthbh.exec:\9bthbh.exe83⤵PID:2880
-
\??\c:\1btnnn.exec:\1btnnn.exe84⤵PID:2872
-
\??\c:\dddvd.exec:\dddvd.exe85⤵PID:2912
-
\??\c:\jjdjp.exec:\jjdjp.exe86⤵PID:2900
-
\??\c:\xrxxlfl.exec:\xrxxlfl.exe87⤵PID:2956
-
\??\c:\tnttbb.exec:\tnttbb.exe88⤵PID:2724
-
\??\c:\tnnnbh.exec:\tnnnbh.exe89⤵PID:2616
-
\??\c:\pvjvv.exec:\pvjvv.exe90⤵PID:2676
-
\??\c:\rrlxrxf.exec:\rrlxrxf.exe91⤵PID:2348
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe92⤵PID:2672
-
\??\c:\bthhnn.exec:\bthhnn.exe93⤵PID:1800
-
\??\c:\dpddd.exec:\dpddd.exe94⤵PID:988
-
\??\c:\9jdjp.exec:\9jdjp.exe95⤵PID:2924
-
\??\c:\llxxlrf.exec:\llxxlrf.exe96⤵PID:2988
-
\??\c:\ffxflrx.exec:\ffxflrx.exe97⤵PID:2932
-
\??\c:\nnbhnn.exec:\nnbhnn.exe98⤵PID:3016
-
\??\c:\dvvvj.exec:\dvvvj.exe99⤵PID:1736
-
\??\c:\vdpdj.exec:\vdpdj.exe100⤵PID:3012
-
\??\c:\ffxflrx.exec:\ffxflrx.exe101⤵PID:2132
-
\??\c:\bhttbt.exec:\bhttbt.exe102⤵PID:1624
-
\??\c:\tntntb.exec:\tntntb.exe103⤵PID:1192
-
\??\c:\vpjdp.exec:\vpjdp.exe104⤵PID:568
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe105⤵PID:636
-
\??\c:\9lxlrlr.exec:\9lxlrlr.exe106⤵PID:2176
-
\??\c:\ttbhnt.exec:\ttbhnt.exe107⤵PID:1720
-
\??\c:\9nhhnb.exec:\9nhhnb.exe108⤵PID:2324
-
\??\c:\jjdjp.exec:\jjdjp.exe109⤵PID:2652
-
\??\c:\ffrxllr.exec:\ffrxllr.exe110⤵PID:960
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe111⤵PID:2012
-
\??\c:\bnbbbh.exec:\bnbbbh.exe112⤵PID:1356
-
\??\c:\bnbtbb.exec:\bnbtbb.exe113⤵PID:1588
-
\??\c:\pdvdp.exec:\pdvdp.exe114⤵PID:908
-
\??\c:\lxlfflr.exec:\lxlfflr.exe115⤵PID:840
-
\??\c:\3xlllxx.exec:\3xlllxx.exe116⤵PID:2588
-
\??\c:\tbnnbb.exec:\tbnnbb.exe117⤵PID:2432
-
\??\c:\jdjjp.exec:\jdjjp.exe118⤵PID:1944
-
\??\c:\ddvdj.exec:\ddvdj.exe119⤵PID:2124
-
\??\c:\xlxrfxf.exec:\xlxrfxf.exe120⤵PID:2332
-
\??\c:\7ttbhn.exec:\7ttbhn.exe121⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-