Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:02
Behavioral task
behavioral1
Sample
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe
-
Size
406KB
-
MD5
a54435cfa0729aba573f4eb2abd3f827
-
SHA1
3d8968b4c79a64ac0e61ad27808301b65e74c5ff
-
SHA256
dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518
-
SHA512
f86dae4b94c54600a1a10aea59b325ca4269f49e2319330f492fb47b20ec82b295f48b7771cb86c539436cdd7d9274d07a098dc86e156e51306057292bb3282d
-
SSDEEP
6144:0cm4FmowdHoSH5BCwdyPUVn1/PRN2kIHVtS6o:C4wFHoS3C8Vnnqo6o
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2124-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2536-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2340-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-54-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2864-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2864-64-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2468-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-89-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2652-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-94-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2616-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1484-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-133-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2700-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1220-187-0x0000000000340000-0x0000000000367000-memory.dmp family_blackmoon behavioral1/memory/2924-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-206-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2220-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-215-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/908-220-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1500-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/628-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2920-464-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1148-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2796-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/844-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-701-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1920-712-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-881-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1716-894-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2044-950-0x00000000003B0000-0x00000000003D7000-memory.dmp family_blackmoon behavioral1/memory/2824-1380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 rrlfrrf.exe 2536 bbnntt.exe 2556 1xfrxll.exe 2340 hhtthb.exe 2704 dvjjj.exe 2864 fxrxfff.exe 2468 dvpvp.exe 2928 xrllxxl.exe 2652 pdppj.exe 2616 bnntbb.exe 3068 btntnn.exe 1484 rfxxflx.exe 2564 nhbnbh.exe 2700 vjjjj.exe 2496 llflflf.exe 1792 dvpvj.exe 2792 lfffrrf.exe 1996 xlxrffr.exe 1220 vvvjp.exe 2924 1htbbh.exe 2220 9jvdp.exe 2164 dvpvd.exe 908 hbnttt.exe 3008 lfxflrx.exe 1500 nntttb.exe 1612 nbhnth.exe 2972 9fllrff.exe 3016 7jdjp.exe 1672 rlfrxrx.exe 1512 bttbnn.exe 1152 vppvd.exe 1560 hbnbnn.exe 2108 1dvvp.exe 2508 dvddp.exe 2312 xlflxxf.exe 2208 hbthth.exe 2492 nnbhnn.exe 2856 vvppv.exe 2728 fxflrxx.exe 2976 rlflrrx.exe 2632 tnbbbb.exe 2344 hbhnhn.exe 2800 dvjjd.exe 2608 xrflrrx.exe 2768 flffllr.exe 2640 btttbh.exe 556 9vppd.exe 628 vpjjd.exe 1760 xrrflxl.exe 2020 flxfrlr.exe 836 nthtbh.exe 1288 bnhhhh.exe 2496 dvppv.exe 268 7xrxxfr.exe 1928 xxxxxff.exe 2024 tnhhnn.exe 2960 jvjjv.exe 2920 vvdpd.exe 2940 rlrxflx.exe 2416 nhhnbt.exe 1856 hbtthh.exe 448 3dddj.exe 1036 1dppd.exe 1756 xrxrflx.exe -
resource yara_rule behavioral1/memory/2124-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/2108-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015fc4-18.dat upx behavioral1/memory/2108-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016031-27.dat upx behavioral1/memory/2536-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2340-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000800000001620e-38.dat upx behavioral1/memory/2704-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001650a-47.dat upx behavioral1/files/0x0007000000016593-55.dat upx behavioral1/files/0x00070000000167dc-66.dat upx behavioral1/memory/2864-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2468-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c3d-75.dat upx behavioral1/memory/2928-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016d50-85.dat upx behavioral1/files/0x0006000000016d9f-98.dat upx behavioral1/memory/2616-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2652-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dad-106.dat upx behavioral1/memory/2616-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1484-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016dc8-116.dat upx behavioral1/memory/2564-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016e74-125.dat upx behavioral1/files/0x0006000000016f9c-135.dat upx behavioral1/files/0x000600000001739a-143.dat upx behavioral1/memory/2700-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001739c-154.dat upx behavioral1/memory/2496-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173aa-163.dat upx behavioral1/memory/1792-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000173e4-172.dat upx behavioral1/files/0x0008000000015daa-179.dat upx behavioral1/memory/1220-187-0x0000000000340000-0x0000000000367000-memory.dmp upx behavioral1/files/0x00060000000173fb-188.dat upx behavioral1/files/0x0006000000017403-197.dat upx behavioral1/memory/2924-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017409-207.dat upx behavioral1/memory/2220-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001747b-216.dat upx behavioral1/files/0x000600000001748f-225.dat upx behavioral1/files/0x00060000000174ac-233.dat upx behavioral1/files/0x000600000001752f-243.dat upx behavioral1/memory/1500-242-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x001500000001866d-251.dat upx behavioral1/memory/1612-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000018678-259.dat upx behavioral1/memory/3016-260-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018690-268.dat upx behavioral1/files/0x000500000001879b-276.dat upx behavioral1/files/0x00060000000190cd-284.dat upx behavioral1/memory/1152-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000190d6-292.dat upx behavioral1/memory/2508-313-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-333-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/628-394-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2496-430-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1928-439-0x00000000001B0000-0x00000000001D7000-memory.dmp upx behavioral1/memory/1928-444-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 2108 2124 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 2124 wrote to memory of 2108 2124 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 2124 wrote to memory of 2108 2124 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 2124 wrote to memory of 2108 2124 dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe 30 PID 2108 wrote to memory of 2536 2108 rrlfrrf.exe 31 PID 2108 wrote to memory of 2536 2108 rrlfrrf.exe 31 PID 2108 wrote to memory of 2536 2108 rrlfrrf.exe 31 PID 2108 wrote to memory of 2536 2108 rrlfrrf.exe 31 PID 2536 wrote to memory of 2556 2536 bbnntt.exe 32 PID 2536 wrote to memory of 2556 2536 bbnntt.exe 32 PID 2536 wrote to memory of 2556 2536 bbnntt.exe 32 PID 2536 wrote to memory of 2556 2536 bbnntt.exe 32 PID 2556 wrote to memory of 2340 2556 1xfrxll.exe 33 PID 2556 wrote to memory of 2340 2556 1xfrxll.exe 33 PID 2556 wrote to memory of 2340 2556 1xfrxll.exe 33 PID 2556 wrote to memory of 2340 2556 1xfrxll.exe 33 PID 2340 wrote to memory of 2704 2340 hhtthb.exe 34 PID 2340 wrote to memory of 2704 2340 hhtthb.exe 34 PID 2340 wrote to memory of 2704 2340 hhtthb.exe 34 PID 2340 wrote to memory of 2704 2340 hhtthb.exe 34 PID 2704 wrote to memory of 2864 2704 dvjjj.exe 35 PID 2704 wrote to memory of 2864 2704 dvjjj.exe 35 PID 2704 wrote to memory of 2864 2704 dvjjj.exe 35 PID 2704 wrote to memory of 2864 2704 dvjjj.exe 35 PID 2864 wrote to memory of 2468 2864 fxrxfff.exe 36 PID 2864 wrote to memory of 2468 2864 fxrxfff.exe 36 PID 2864 wrote to memory of 2468 2864 fxrxfff.exe 36 PID 2864 wrote to memory of 2468 2864 fxrxfff.exe 36 PID 2468 wrote to memory of 2928 2468 dvpvp.exe 37 PID 2468 wrote to memory of 2928 2468 dvpvp.exe 37 PID 2468 wrote to memory of 2928 2468 dvpvp.exe 37 PID 2468 wrote to memory of 2928 2468 dvpvp.exe 37 PID 2928 wrote to memory of 2652 2928 xrllxxl.exe 38 PID 2928 wrote to memory of 2652 2928 xrllxxl.exe 38 PID 2928 wrote to memory of 2652 2928 xrllxxl.exe 38 PID 2928 wrote to memory of 2652 2928 xrllxxl.exe 38 PID 2652 wrote to memory of 2616 2652 pdppj.exe 39 PID 2652 wrote to memory of 2616 2652 pdppj.exe 39 PID 2652 wrote to memory of 2616 2652 pdppj.exe 39 PID 2652 wrote to memory of 2616 2652 pdppj.exe 39 PID 2616 wrote to memory of 3068 2616 bnntbb.exe 40 PID 2616 wrote to memory of 3068 2616 bnntbb.exe 40 PID 2616 wrote to memory of 3068 2616 bnntbb.exe 40 PID 2616 wrote to memory of 3068 2616 bnntbb.exe 40 PID 3068 wrote to memory of 1484 3068 btntnn.exe 41 PID 3068 wrote to memory of 1484 3068 btntnn.exe 41 PID 3068 wrote to memory of 1484 3068 btntnn.exe 41 PID 3068 wrote to memory of 1484 3068 btntnn.exe 41 PID 1484 wrote to memory of 2564 1484 rfxxflx.exe 42 PID 1484 wrote to memory of 2564 1484 rfxxflx.exe 42 PID 1484 wrote to memory of 2564 1484 rfxxflx.exe 42 PID 1484 wrote to memory of 2564 1484 rfxxflx.exe 42 PID 2564 wrote to memory of 2700 2564 nhbnbh.exe 43 PID 2564 wrote to memory of 2700 2564 nhbnbh.exe 43 PID 2564 wrote to memory of 2700 2564 nhbnbh.exe 43 PID 2564 wrote to memory of 2700 2564 nhbnbh.exe 43 PID 2700 wrote to memory of 2496 2700 vjjjj.exe 44 PID 2700 wrote to memory of 2496 2700 vjjjj.exe 44 PID 2700 wrote to memory of 2496 2700 vjjjj.exe 44 PID 2700 wrote to memory of 2496 2700 vjjjj.exe 44 PID 2496 wrote to memory of 1792 2496 llflflf.exe 45 PID 2496 wrote to memory of 1792 2496 llflflf.exe 45 PID 2496 wrote to memory of 1792 2496 llflflf.exe 45 PID 2496 wrote to memory of 1792 2496 llflflf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe"C:\Users\Admin\AppData\Local\Temp\dba6988841f86d18a62df5ab724e9d96b170ea0071d5f5f03b6bcf34e2171518.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\bbnntt.exec:\bbnntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1xfrxll.exec:\1xfrxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\hhtthb.exec:\hhtthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\dvjjj.exec:\dvjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\fxrxfff.exec:\fxrxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\dvpvp.exec:\dvpvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\xrllxxl.exec:\xrllxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pdppj.exec:\pdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\bnntbb.exec:\bnntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\btntnn.exec:\btntnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\rfxxflx.exec:\rfxxflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\nhbnbh.exec:\nhbnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vjjjj.exec:\vjjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\llflflf.exec:\llflflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\dvpvj.exec:\dvpvj.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\lfffrrf.exec:\lfffrrf.exe18⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xlxrffr.exec:\xlxrffr.exe19⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvvjp.exec:\vvvjp.exe20⤵
- Executes dropped EXE
PID:1220 -
\??\c:\1htbbh.exec:\1htbbh.exe21⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9jvdp.exec:\9jvdp.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\dvpvd.exec:\dvpvd.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hbnttt.exec:\hbnttt.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\lfxflrx.exec:\lfxflrx.exe25⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nntttb.exec:\nntttb.exe26⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nbhnth.exec:\nbhnth.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9fllrff.exec:\9fllrff.exe28⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7jdjp.exec:\7jdjp.exe29⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rlfrxrx.exec:\rlfrxrx.exe30⤵
- Executes dropped EXE
PID:1672 -
\??\c:\bttbnn.exec:\bttbnn.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\vppvd.exec:\vppvd.exe32⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hbnbnn.exec:\hbnbnn.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\1dvvp.exec:\1dvvp.exe34⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvddp.exec:\dvddp.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\xlflxxf.exec:\xlflxxf.exe36⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbthth.exec:\hbthth.exe37⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nnbhnn.exec:\nnbhnn.exe38⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vvppv.exec:\vvppv.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxflrxx.exec:\fxflrxx.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rlflrrx.exec:\rlflrrx.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tnbbbb.exec:\tnbbbb.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbhnhn.exec:\hbhnhn.exe43⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dvjjd.exec:\dvjjd.exe44⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xrflrrx.exec:\xrflrrx.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\flffllr.exec:\flffllr.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\btttbh.exec:\btttbh.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9vppd.exec:\9vppd.exe48⤵
- Executes dropped EXE
PID:556 -
\??\c:\vpjjd.exec:\vpjjd.exe49⤵
- Executes dropped EXE
PID:628 -
\??\c:\xrrflxl.exec:\xrrflxl.exe50⤵
- Executes dropped EXE
PID:1760 -
\??\c:\flxfrlr.exec:\flxfrlr.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nthtbh.exec:\nthtbh.exe52⤵
- Executes dropped EXE
PID:836 -
\??\c:\bnhhhh.exec:\bnhhhh.exe53⤵
- Executes dropped EXE
PID:1288 -
\??\c:\dvppv.exec:\dvppv.exe54⤵
- Executes dropped EXE
PID:2496 -
\??\c:\7xrxxfr.exec:\7xrxxfr.exe55⤵
- Executes dropped EXE
PID:268 -
\??\c:\xxxxxff.exec:\xxxxxff.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnhhnn.exec:\tnhhnn.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvjjv.exec:\jvjjv.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vvdpd.exec:\vvdpd.exe59⤵
- Executes dropped EXE
PID:2920 -
\??\c:\rlrxflx.exec:\rlrxflx.exe60⤵
- Executes dropped EXE
PID:2940 -
\??\c:\nhhnbt.exec:\nhhnbt.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hbtthh.exec:\hbtthh.exe62⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3dddj.exec:\3dddj.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\1dppd.exec:\1dppd.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xrxrflx.exec:\xrxrflx.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\tnbbhn.exec:\tnbbhn.exe66⤵PID:1360
-
\??\c:\tnnntt.exec:\tnnntt.exe67⤵PID:1312
-
\??\c:\3vjpv.exec:\3vjpv.exe68⤵PID:1784
-
\??\c:\ppjdj.exec:\ppjdj.exe69⤵PID:2460
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe70⤵PID:1232
-
\??\c:\hbtbnn.exec:\hbtbnn.exe71⤵PID:3016
-
\??\c:\nnhnbb.exec:\nnhnbb.exe72⤵PID:2464
-
\??\c:\dvvdj.exec:\dvvdj.exe73⤵PID:1148
-
\??\c:\3pjpv.exec:\3pjpv.exe74⤵PID:2120
-
\??\c:\rllllrx.exec:\rllllrx.exe75⤵PID:1692
-
\??\c:\hhbbhn.exec:\hhbbhn.exe76⤵PID:1560
-
\??\c:\htbbhn.exec:\htbbhn.exe77⤵PID:2396
-
\??\c:\7vjdd.exec:\7vjdd.exe78⤵
- System Location Discovery: System Language Discovery
PID:1820 -
\??\c:\fxllxxl.exec:\fxllxxl.exe79⤵PID:1812
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe80⤵PID:2880
-
\??\c:\7thhnt.exec:\7thhnt.exe81⤵PID:2820
-
\??\c:\bnbhth.exec:\bnbhth.exe82⤵PID:2824
-
\??\c:\pvdvp.exec:\pvdvp.exe83⤵PID:2988
-
\??\c:\9xrlxfr.exec:\9xrlxfr.exe84⤵PID:2604
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe85⤵PID:2796
-
\??\c:\hhhhnn.exec:\hhhhnn.exe86⤵PID:2872
-
\??\c:\vpjdj.exec:\vpjdj.exe87⤵PID:2600
-
\??\c:\pjjpd.exec:\pjjpd.exe88⤵PID:2676
-
\??\c:\rrfrflf.exec:\rrfrflf.exe89⤵PID:1836
-
\??\c:\tnbhnt.exec:\tnbhnt.exe90⤵PID:2216
-
\??\c:\5bthtt.exec:\5bthtt.exe91⤵PID:1484
-
\??\c:\pjjpv.exec:\pjjpv.exe92⤵PID:844
-
\??\c:\fxllxxl.exec:\fxllxxl.exe93⤵PID:1932
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe94⤵PID:1720
-
\??\c:\bthhnt.exec:\bthhnt.exe95⤵PID:836
-
\??\c:\7vjjp.exec:\7vjjp.exe96⤵PID:1864
-
\??\c:\ppddp.exec:\ppddp.exe97⤵PID:1824
-
\??\c:\7xxlxxr.exec:\7xxlxxr.exe98⤵PID:1256
-
\??\c:\1hthnt.exec:\1hthnt.exe99⤵PID:1920
-
\??\c:\hbtttn.exec:\hbtttn.exe100⤵PID:1244
-
\??\c:\dvjjp.exec:\dvjjp.exe101⤵PID:2192
-
\??\c:\5fxrrlx.exec:\5fxrrlx.exe102⤵PID:2168
-
\??\c:\frxxllr.exec:\frxxllr.exe103⤵PID:2940
-
\??\c:\nhnntb.exec:\nhnntb.exe104⤵PID:1548
-
\??\c:\pjvvj.exec:\pjvvj.exe105⤵PID:2280
-
\??\c:\5jppp.exec:\5jppp.exe106⤵PID:2996
-
\??\c:\9lfrxrr.exec:\9lfrxrr.exe107⤵PID:1036
-
\??\c:\rlfxffr.exec:\rlfxffr.exe108⤵PID:1756
-
\??\c:\btnnnb.exec:\btnnnb.exe109⤵PID:1360
-
\??\c:\tntttt.exec:\tntttt.exe110⤵PID:2260
-
\??\c:\5vpvj.exec:\5vpvj.exe111⤵PID:1784
-
\??\c:\7rrflrf.exec:\7rrflrf.exe112⤵PID:2460
-
\??\c:\7rflrrf.exec:\7rflrrf.exe113⤵PID:1232
-
\??\c:\bthnbb.exec:\bthnbb.exe114⤵PID:1120
-
\??\c:\vvpvj.exec:\vvpvj.exe115⤵PID:2404
-
\??\c:\3dvvj.exec:\3dvvj.exe116⤵PID:1148
-
\??\c:\lllrffx.exec:\lllrffx.exe117⤵PID:1588
-
\??\c:\3rlfxxx.exec:\3rlfxxx.exe118⤵PID:2364
-
\??\c:\5tbbnt.exec:\5tbbnt.exe119⤵PID:2876
-
\??\c:\dpjvv.exec:\dpjvv.exe120⤵PID:2396
-
\??\c:\dpppv.exec:\dpppv.exe121⤵PID:2096
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-