Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-12-2024 00:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe
-
Size
456KB
-
MD5
dbe348da744b30037024dd7262361b8e
-
SHA1
5e7852ab769e3bce8cd22044f22c25000fea1399
-
SHA256
a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2
-
SHA512
98d00dfa5284a8488aa8c25cb634546ed03e8e5734e99d5bfa809c7b301c99917c589d41495168ddfc1a226fb145e0d73790d1e3ee76a664a1ebf272228c7e8e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeO:q7Tc2NYHUrAwfMp3CDO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-38-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-172-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1896-173-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1896-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-203-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1604-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-239-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-316-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-320-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2736-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-339-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-432-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2908-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-452-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2248-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1544-529-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-542-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2208-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1592-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-685-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1108-710-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1556-730-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2324-751-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-750-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-777-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2200-834-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1520-861-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 bbhnnn.exe 2812 pdddd.exe 2804 llffflx.exe 2876 jdddd.exe 2628 jpjvj.exe 1656 llflflf.exe 2676 1jdvd.exe 2472 xxrflxl.exe 2884 pjdjv.exe 2256 fllxlrl.exe 2520 vvpjv.exe 2504 rrlfxfr.exe 2004 vvvdj.exe 1912 3rxxlxf.exe 1904 1hbhtt.exe 1496 rrlrlrr.exe 1916 hbtntt.exe 1896 xllfrxl.exe 1508 hbbnbh.exe 2332 rlflrxl.exe 2268 ttnthn.exe 2016 rlxfrfl.exe 1604 3bttbt.exe 1536 rrllxxl.exe 2400 pjvvv.exe 772 xfxrxlf.exe 3028 pjjjv.exe 3032 btnnnn.exe 1676 ppppd.exe 1740 xxlrfrf.exe 2292 dvpvd.exe 2316 tthhnn.exe 2744 3vjpp.exe 2800 7rxxxfr.exe 2760 ttbbhn.exe 2736 1jdjp.exe 2636 xrflrxr.exe 2828 7xlxrrf.exe 1576 3thhhn.exe 2600 ppjjv.exe 2276 lxrrxfx.exe 1620 bhbbhb.exe 3048 ppjpd.exe 2452 3xrrxfr.exe 1448 tntttb.exe 2852 5vpdj.exe 1988 fflfllr.exe 1996 rxxfffl.exe 2372 ttbnnb.exe 2976 vvvdp.exe 840 xfflxxl.exe 2704 7btbhn.exe 2908 nthhht.exe 568 vpjjv.exe 1260 5lffrrf.exe 580 bhtnnt.exe 1504 djjdp.exe 2284 djpjv.exe 2248 3fxfllr.exe 496 bthhbb.exe 904 jpjpj.exe 1544 xfxrfff.exe 1840 btntbn.exe 1688 1btbht.exe -
resource yara_rule behavioral1/memory/2316-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-339-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2828-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-452-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/2248-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-542-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2208-572-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1592-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-665-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2780-685-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2324-751-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2324-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-834-0x00000000002B0000-0x00000000002DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2696 2316 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 30 PID 2316 wrote to memory of 2696 2316 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 30 PID 2316 wrote to memory of 2696 2316 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 30 PID 2316 wrote to memory of 2696 2316 a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe 30 PID 2696 wrote to memory of 2812 2696 bbhnnn.exe 31 PID 2696 wrote to memory of 2812 2696 bbhnnn.exe 31 PID 2696 wrote to memory of 2812 2696 bbhnnn.exe 31 PID 2696 wrote to memory of 2812 2696 bbhnnn.exe 31 PID 2812 wrote to memory of 2804 2812 pdddd.exe 32 PID 2812 wrote to memory of 2804 2812 pdddd.exe 32 PID 2812 wrote to memory of 2804 2812 pdddd.exe 32 PID 2812 wrote to memory of 2804 2812 pdddd.exe 32 PID 2804 wrote to memory of 2876 2804 llffflx.exe 33 PID 2804 wrote to memory of 2876 2804 llffflx.exe 33 PID 2804 wrote to memory of 2876 2804 llffflx.exe 33 PID 2804 wrote to memory of 2876 2804 llffflx.exe 33 PID 2876 wrote to memory of 2628 2876 jdddd.exe 34 PID 2876 wrote to memory of 2628 2876 jdddd.exe 34 PID 2876 wrote to memory of 2628 2876 jdddd.exe 34 PID 2876 wrote to memory of 2628 2876 jdddd.exe 34 PID 2628 wrote to memory of 1656 2628 jpjvj.exe 35 PID 2628 wrote to memory of 1656 2628 jpjvj.exe 35 PID 2628 wrote to memory of 1656 2628 jpjvj.exe 35 PID 2628 wrote to memory of 1656 2628 jpjvj.exe 35 PID 1656 wrote to memory of 2676 1656 llflflf.exe 36 PID 1656 wrote to memory of 2676 1656 llflflf.exe 36 PID 1656 wrote to memory of 2676 1656 llflflf.exe 36 PID 1656 wrote to memory of 2676 1656 llflflf.exe 36 PID 2676 wrote to memory of 2472 2676 1jdvd.exe 37 PID 2676 wrote to memory of 2472 2676 1jdvd.exe 37 PID 2676 wrote to memory of 2472 2676 1jdvd.exe 37 PID 2676 wrote to memory of 2472 2676 1jdvd.exe 37 PID 2472 wrote to memory of 2884 2472 xxrflxl.exe 38 PID 2472 wrote to memory of 2884 2472 xxrflxl.exe 38 PID 2472 wrote to memory of 2884 2472 xxrflxl.exe 38 PID 2472 wrote to memory of 2884 2472 xxrflxl.exe 38 PID 2884 wrote to memory of 2256 2884 pjdjv.exe 39 PID 2884 wrote to memory of 2256 2884 pjdjv.exe 39 PID 2884 wrote to memory of 2256 2884 pjdjv.exe 39 PID 2884 wrote to memory of 2256 2884 pjdjv.exe 39 PID 2256 wrote to memory of 2520 2256 fllxlrl.exe 40 PID 2256 wrote to memory of 2520 2256 fllxlrl.exe 40 PID 2256 wrote to memory of 2520 2256 fllxlrl.exe 40 PID 2256 wrote to memory of 2520 2256 fllxlrl.exe 40 PID 2520 wrote to memory of 2504 2520 vvpjv.exe 41 PID 2520 wrote to memory of 2504 2520 vvpjv.exe 41 PID 2520 wrote to memory of 2504 2520 vvpjv.exe 41 PID 2520 wrote to memory of 2504 2520 vvpjv.exe 41 PID 2504 wrote to memory of 2004 2504 rrlfxfr.exe 42 PID 2504 wrote to memory of 2004 2504 rrlfxfr.exe 42 PID 2504 wrote to memory of 2004 2504 rrlfxfr.exe 42 PID 2504 wrote to memory of 2004 2504 rrlfxfr.exe 42 PID 2004 wrote to memory of 1912 2004 vvvdj.exe 43 PID 2004 wrote to memory of 1912 2004 vvvdj.exe 43 PID 2004 wrote to memory of 1912 2004 vvvdj.exe 43 PID 2004 wrote to memory of 1912 2004 vvvdj.exe 43 PID 1912 wrote to memory of 1904 1912 3rxxlxf.exe 44 PID 1912 wrote to memory of 1904 1912 3rxxlxf.exe 44 PID 1912 wrote to memory of 1904 1912 3rxxlxf.exe 44 PID 1912 wrote to memory of 1904 1912 3rxxlxf.exe 44 PID 1904 wrote to memory of 1496 1904 1hbhtt.exe 45 PID 1904 wrote to memory of 1496 1904 1hbhtt.exe 45 PID 1904 wrote to memory of 1496 1904 1hbhtt.exe 45 PID 1904 wrote to memory of 1496 1904 1hbhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe"C:\Users\Admin\AppData\Local\Temp\a27e4fb4a4b822d163b2771b12c1411d7c82adbdb860b45b6c5965dceff0aeb2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\bbhnnn.exec:\bbhnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pdddd.exec:\pdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\llffflx.exec:\llffflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jdddd.exec:\jdddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jpjvj.exec:\jpjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\llflflf.exec:\llflflf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\1jdvd.exec:\1jdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xxrflxl.exec:\xxrflxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\pjdjv.exec:\pjdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\fllxlrl.exec:\fllxlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\vvpjv.exec:\vvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vvvdj.exec:\vvvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\3rxxlxf.exec:\3rxxlxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\1hbhtt.exec:\1hbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\rrlrlrr.exec:\rrlrlrr.exe17⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hbtntt.exec:\hbtntt.exe18⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xllfrxl.exec:\xllfrxl.exe19⤵
- Executes dropped EXE
PID:1896 -
\??\c:\hbbnbh.exec:\hbbnbh.exe20⤵
- Executes dropped EXE
PID:1508 -
\??\c:\rlflrxl.exec:\rlflrxl.exe21⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ttnthn.exec:\ttnthn.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlxfrfl.exec:\rlxfrfl.exe23⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3bttbt.exec:\3bttbt.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rrllxxl.exec:\rrllxxl.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\pjvvv.exec:\pjvvv.exe26⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xfxrxlf.exec:\xfxrxlf.exe27⤵
- Executes dropped EXE
PID:772 -
\??\c:\pjjjv.exec:\pjjjv.exe28⤵
- Executes dropped EXE
PID:3028 -
\??\c:\btnnnn.exec:\btnnnn.exe29⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ppppd.exec:\ppppd.exe30⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xxlrfrf.exec:\xxlrfrf.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\dvpvd.exec:\dvpvd.exe32⤵
- Executes dropped EXE
PID:2292 -
\??\c:\tthhnn.exec:\tthhnn.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3vjpp.exec:\3vjpp.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7rxxxfr.exec:\7rxxxfr.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ttbbhn.exec:\ttbbhn.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\1jdjp.exec:\1jdjp.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrflrxr.exec:\xrflrxr.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\7xlxrrf.exec:\7xlxrrf.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3thhhn.exec:\3thhhn.exe40⤵
- Executes dropped EXE
PID:1576 -
\??\c:\ppjjv.exec:\ppjjv.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lxrrxfx.exec:\lxrrxfx.exe42⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bhbbhb.exec:\bhbbhb.exe43⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ppjpd.exec:\ppjpd.exe44⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3xrrxfr.exec:\3xrrxfr.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tntttb.exec:\tntttb.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\5vpdj.exec:\5vpdj.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fflfllr.exec:\fflfllr.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rxxfffl.exec:\rxxfffl.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ttbnnb.exec:\ttbnnb.exe50⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vvvdp.exec:\vvvdp.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xfflxxl.exec:\xfflxxl.exe52⤵
- Executes dropped EXE
PID:840 -
\??\c:\7btbhn.exec:\7btbhn.exe53⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nthhht.exec:\nthhht.exe54⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpjjv.exec:\vpjjv.exe55⤵
- Executes dropped EXE
PID:568 -
\??\c:\5lffrrf.exec:\5lffrrf.exe56⤵
- Executes dropped EXE
PID:1260 -
\??\c:\bhtnnt.exec:\bhtnnt.exe57⤵
- Executes dropped EXE
PID:580 -
\??\c:\djjdp.exec:\djjdp.exe58⤵
- Executes dropped EXE
PID:1504 -
\??\c:\djpjv.exec:\djpjv.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\3fxfllr.exec:\3fxfllr.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bthhbb.exec:\bthhbb.exe61⤵
- Executes dropped EXE
PID:496 -
\??\c:\jpjpj.exec:\jpjpj.exe62⤵
- Executes dropped EXE
PID:904 -
\??\c:\xfxrfff.exec:\xfxrfff.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\btntbn.exec:\btntbn.exe64⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1btbht.exec:\1btbht.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ddppd.exec:\ddppd.exe66⤵PID:2688
-
\??\c:\flfllxl.exec:\flfllxl.exe67⤵PID:628
-
\??\c:\hbntbh.exec:\hbntbh.exe68⤵PID:3028
-
\??\c:\5jdpv.exec:\5jdpv.exe69⤵PID:796
-
\??\c:\jjjpd.exec:\jjjpd.exe70⤵PID:1632
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe71⤵PID:2072
-
\??\c:\tnthnn.exec:\tnthnn.exe72⤵PID:3056
-
\??\c:\9dvpd.exec:\9dvpd.exe73⤵PID:2208
-
\??\c:\jjjpv.exec:\jjjpv.exe74⤵PID:1592
-
\??\c:\7xrrxfr.exec:\7xrrxfr.exe75⤵PID:2836
-
\??\c:\tthbtt.exec:\tthbtt.exe76⤵PID:2164
-
\??\c:\ddppv.exec:\ddppv.exe77⤵PID:2732
-
\??\c:\pppvv.exec:\pppvv.exe78⤵PID:2764
-
\??\c:\lxrrflf.exec:\lxrrflf.exe79⤵PID:2944
-
\??\c:\nnhhtb.exec:\nnhhtb.exe80⤵PID:2856
-
\??\c:\jjdjd.exec:\jjdjd.exe81⤵PID:2828
-
\??\c:\jpjpp.exec:\jpjpp.exe82⤵PID:2724
-
\??\c:\xlflxxr.exec:\xlflxxr.exe83⤵PID:2652
-
\??\c:\7tnntt.exec:\7tnntt.exe84⤵PID:2676
-
\??\c:\7bhhnt.exec:\7bhhnt.exe85⤵PID:2472
-
\??\c:\dvpvd.exec:\dvpvd.exe86⤵PID:1804
-
\??\c:\fxrxflx.exec:\fxrxflx.exe87⤵PID:2312
-
\??\c:\rrlrflx.exec:\rrlrflx.exe88⤵PID:2880
-
\??\c:\nnhttb.exec:\nnhttb.exe89⤵PID:316
-
\??\c:\dpjdp.exec:\dpjdp.exe90⤵PID:2780
-
\??\c:\lrlxlrf.exec:\lrlxlrf.exe91⤵PID:1776
-
\??\c:\hbnhnh.exec:\hbnhnh.exe92⤵PID:2896
-
\??\c:\nbnttt.exec:\nbnttt.exe93⤵PID:1060
-
\??\c:\dvjdj.exec:\dvjdj.exe94⤵PID:1108
-
\??\c:\lrllfxx.exec:\lrllfxx.exe95⤵PID:2968
-
\??\c:\tnthtb.exec:\tnthtb.exe96⤵PID:1900
-
\??\c:\7bthnt.exec:\7bthnt.exe97⤵PID:1556
-
\??\c:\djvdp.exec:\djvdp.exe98⤵PID:544
-
\??\c:\llxxxfr.exec:\llxxxfr.exe99⤵PID:3020
-
\??\c:\ttnbbb.exec:\ttnbbb.exe100⤵PID:2324
-
\??\c:\hhhtht.exec:\hhhtht.exe101⤵PID:2332
-
\??\c:\jdppv.exec:\jdppv.exe102⤵PID:2268
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe103⤵PID:1480
-
\??\c:\xxxfxxr.exec:\xxxfxxr.exe104⤵PID:2476
-
\??\c:\nnhhtb.exec:\nnhhtb.exe105⤵PID:1664
-
\??\c:\vjjjj.exec:\vjjjj.exe106⤵
- System Location Discovery: System Language Discovery
PID:2192 -
\??\c:\9dvvd.exec:\9dvvd.exe107⤵PID:880
-
\??\c:\llxfrrr.exec:\llxfrrr.exe108⤵PID:2872
-
\??\c:\tnhnbb.exec:\tnhnbb.exe109⤵PID:2688
-
\??\c:\ddvjv.exec:\ddvjv.exe110⤵PID:2068
-
\??\c:\tnhbhb.exec:\tnhbhb.exe111⤵PID:1044
-
\??\c:\jpdpd.exec:\jpdpd.exe112⤵PID:1736
-
\??\c:\pjpvv.exec:\pjpvv.exe113⤵PID:2200
-
\??\c:\xrfffff.exec:\xrfffff.exe114⤵PID:1520
-
\??\c:\9fxrxfx.exec:\9fxrxfx.exe115⤵PID:2788
-
\??\c:\btbbht.exec:\btbbht.exe116⤵PID:1600
-
\??\c:\vpvvv.exec:\vpvvv.exe117⤵PID:2708
-
\??\c:\rlxfflx.exec:\rlxfflx.exe118⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\bntbhn.exec:\bntbhn.exe119⤵PID:2860
-
\??\c:\hbthtn.exec:\hbthtn.exe120⤵PID:2728
-
\??\c:\dpjpv.exec:\dpjpv.exe121⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-