Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe
-
Size
455KB
-
MD5
8b0b63ddbc9509733be91eb1ea52283f
-
SHA1
69331d6f01f6252fe7bf463603efd3ae91516bfb
-
SHA256
2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57
-
SHA512
861c3058288590cf034cb40ca821ea139fbc7d0d5799c1e585f07d26de8e8d15562a4449f265d9e9800d8368d5d23427cdf88a76b1d2b43b2246455ec77994f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-74-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-92-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1232-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/440-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-280-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2828-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-447-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1604-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-515-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/600-516-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1152-519-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-576-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2208-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-770-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 lrlrxfr.exe 2692 xxrxflx.exe 2408 nnnbbb.exe 2576 xrlrflx.exe 2716 tnnbhh.exe 2560 vpjpv.exe 2092 rlrlxfr.exe 1952 xrlfrxf.exe 2860 hhhnhh.exe 2916 ddvjd.exe 1280 ttnnnt.exe 756 bhnbbb.exe 2284 rlxxffr.exe 1904 llfrffr.exe 664 hhbhbh.exe 2884 1vdjv.exe 1232 fflrllx.exe 1676 ppjpp.exe 2452 xxxxrrx.exe 1764 tnntnt.exe 2172 flffxxf.exe 440 1pjpd.exe 1832 xxxlrxr.exe 1684 xrfxxrr.exe 1616 xxxxxxl.exe 2952 hhbnbb.exe 236 vvppj.exe 1856 bththn.exe 3000 vjdjp.exe 1716 hhtbnn.exe 2828 vpddd.exe 2380 9nhhtt.exe 1484 jdvdj.exe 2248 nhnntb.exe 2804 btbbhn.exe 2576 jvvvd.exe 2716 9xllflr.exe 480 nnhbtt.exe 1020 7pjvv.exe 1924 llrrffr.exe 2036 tnhnnn.exe 2720 ppddj.exe 2912 jvjjp.exe 2376 3rllrfl.exe 2016 btnnbn.exe 2604 ppjpv.exe 768 dvjjd.exe 1216 7lxfrxx.exe 1904 5btbnn.exe 1056 9vpjp.exe 992 1frxrrf.exe 1436 tthhbh.exe 2976 1nbbtb.exe 1676 ddjpd.exe 1556 9rrfrxl.exe 2452 btntnn.exe 1764 bthnbb.exe 2252 vvvdp.exe 1696 1frrrxf.exe 1936 tnbhnt.exe 2508 1pjpv.exe 1604 9pjjd.exe 600 lfxfrxf.exe 1152 hhthbn.exe -
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-110-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1904-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/440-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-440-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2452-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-480-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1936-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-770-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2772 2688 2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe 31 PID 2688 wrote to memory of 2772 2688 2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe 31 PID 2688 wrote to memory of 2772 2688 2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe 31 PID 2688 wrote to memory of 2772 2688 2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe 31 PID 2772 wrote to memory of 2692 2772 lrlrxfr.exe 32 PID 2772 wrote to memory of 2692 2772 lrlrxfr.exe 32 PID 2772 wrote to memory of 2692 2772 lrlrxfr.exe 32 PID 2772 wrote to memory of 2692 2772 lrlrxfr.exe 32 PID 2692 wrote to memory of 2408 2692 xxrxflx.exe 33 PID 2692 wrote to memory of 2408 2692 xxrxflx.exe 33 PID 2692 wrote to memory of 2408 2692 xxrxflx.exe 33 PID 2692 wrote to memory of 2408 2692 xxrxflx.exe 33 PID 2408 wrote to memory of 2576 2408 nnnbbb.exe 34 PID 2408 wrote to memory of 2576 2408 nnnbbb.exe 34 PID 2408 wrote to memory of 2576 2408 nnnbbb.exe 34 PID 2408 wrote to memory of 2576 2408 nnnbbb.exe 34 PID 2576 wrote to memory of 2716 2576 xrlrflx.exe 35 PID 2576 wrote to memory of 2716 2576 xrlrflx.exe 35 PID 2576 wrote to memory of 2716 2576 xrlrflx.exe 35 PID 2576 wrote to memory of 2716 2576 xrlrflx.exe 35 PID 2716 wrote to memory of 2560 2716 tnnbhh.exe 36 PID 2716 wrote to memory of 2560 2716 tnnbhh.exe 36 PID 2716 wrote to memory of 2560 2716 tnnbhh.exe 36 PID 2716 wrote to memory of 2560 2716 tnnbhh.exe 36 PID 2560 wrote to memory of 2092 2560 vpjpv.exe 37 PID 2560 wrote to memory of 2092 2560 vpjpv.exe 37 PID 2560 wrote to memory of 2092 2560 vpjpv.exe 37 PID 2560 wrote to memory of 2092 2560 vpjpv.exe 37 PID 2092 wrote to memory of 1952 2092 rlrlxfr.exe 38 PID 2092 wrote to memory of 1952 2092 rlrlxfr.exe 38 PID 2092 wrote to memory of 1952 2092 rlrlxfr.exe 38 PID 2092 wrote to memory of 1952 2092 rlrlxfr.exe 38 PID 1952 wrote to memory of 2860 1952 xrlfrxf.exe 39 PID 1952 wrote to memory of 2860 1952 xrlfrxf.exe 39 PID 1952 wrote to memory of 2860 1952 xrlfrxf.exe 39 PID 1952 wrote to memory of 2860 1952 xrlfrxf.exe 39 PID 2860 wrote to memory of 2916 2860 hhhnhh.exe 40 PID 2860 wrote to memory of 2916 2860 hhhnhh.exe 40 PID 2860 wrote to memory of 2916 2860 hhhnhh.exe 40 PID 2860 wrote to memory of 2916 2860 hhhnhh.exe 40 PID 2916 wrote to memory of 1280 2916 ddvjd.exe 41 PID 2916 wrote to memory of 1280 2916 ddvjd.exe 41 PID 2916 wrote to memory of 1280 2916 ddvjd.exe 41 PID 2916 wrote to memory of 1280 2916 ddvjd.exe 41 PID 1280 wrote to memory of 756 1280 ttnnnt.exe 42 PID 1280 wrote to memory of 756 1280 ttnnnt.exe 42 PID 1280 wrote to memory of 756 1280 ttnnnt.exe 42 PID 1280 wrote to memory of 756 1280 ttnnnt.exe 42 PID 756 wrote to memory of 2284 756 bhnbbb.exe 43 PID 756 wrote to memory of 2284 756 bhnbbb.exe 43 PID 756 wrote to memory of 2284 756 bhnbbb.exe 43 PID 756 wrote to memory of 2284 756 bhnbbb.exe 43 PID 2284 wrote to memory of 1904 2284 rlxxffr.exe 44 PID 2284 wrote to memory of 1904 2284 rlxxffr.exe 44 PID 2284 wrote to memory of 1904 2284 rlxxffr.exe 44 PID 2284 wrote to memory of 1904 2284 rlxxffr.exe 44 PID 1904 wrote to memory of 664 1904 llfrffr.exe 45 PID 1904 wrote to memory of 664 1904 llfrffr.exe 45 PID 1904 wrote to memory of 664 1904 llfrffr.exe 45 PID 1904 wrote to memory of 664 1904 llfrffr.exe 45 PID 664 wrote to memory of 2884 664 hhbhbh.exe 46 PID 664 wrote to memory of 2884 664 hhbhbh.exe 46 PID 664 wrote to memory of 2884 664 hhbhbh.exe 46 PID 664 wrote to memory of 2884 664 hhbhbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe"C:\Users\Admin\AppData\Local\Temp\2314ce19b6b4de5b58a8dc9bf78f460fdd07865856b6589ece188ee0b4281a57.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lrlrxfr.exec:\lrlrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xxrxflx.exec:\xxrxflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nnnbbb.exec:\nnnbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xrlrflx.exec:\xrlrflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tnnbhh.exec:\tnnbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vpjpv.exec:\vpjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\rlrlxfr.exec:\rlrlxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\hhhnhh.exec:\hhhnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ddvjd.exec:\ddvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\ttnnnt.exec:\ttnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\bhnbbb.exec:\bhnbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\rlxxffr.exec:\rlxxffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\llfrffr.exec:\llfrffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\hhbhbh.exec:\hhbhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\1vdjv.exec:\1vdjv.exe17⤵
- Executes dropped EXE
PID:2884 -
\??\c:\fflrllx.exec:\fflrllx.exe18⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ppjpp.exec:\ppjpp.exe19⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xxxxrrx.exec:\xxxxrrx.exe20⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnntnt.exec:\tnntnt.exe21⤵
- Executes dropped EXE
PID:1764 -
\??\c:\flffxxf.exec:\flffxxf.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\1pjpd.exec:\1pjpd.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:440 -
\??\c:\xxxlrxr.exec:\xxxlrxr.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xxxxxxl.exec:\xxxxxxl.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hhbnbb.exec:\hhbnbb.exe27⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vvppj.exec:\vvppj.exe28⤵
- Executes dropped EXE
PID:236 -
\??\c:\bththn.exec:\bththn.exe29⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vjdjp.exec:\vjdjp.exe30⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hhtbnn.exec:\hhtbnn.exe31⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vpddd.exec:\vpddd.exe32⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9nhhtt.exec:\9nhhtt.exe33⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jdvdj.exec:\jdvdj.exe34⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nhnntb.exec:\nhnntb.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\btbbhn.exec:\btbbhn.exe36⤵
- Executes dropped EXE
PID:2804 -
\??\c:\jvvvd.exec:\jvvvd.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9xllflr.exec:\9xllflr.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnhbtt.exec:\nnhbtt.exe39⤵
- Executes dropped EXE
PID:480 -
\??\c:\7pjvv.exec:\7pjvv.exe40⤵
- Executes dropped EXE
PID:1020 -
\??\c:\llrrffr.exec:\llrrffr.exe41⤵
- Executes dropped EXE
PID:1924 -
\??\c:\tnhnnn.exec:\tnhnnn.exe42⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ppddj.exec:\ppddj.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\jvjjp.exec:\jvjjp.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3rllrfl.exec:\3rllrfl.exe45⤵
- Executes dropped EXE
PID:2376 -
\??\c:\btnnbn.exec:\btnnbn.exe46⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ppjpv.exec:\ppjpv.exe47⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvjjd.exec:\dvjjd.exe48⤵
- Executes dropped EXE
PID:768 -
\??\c:\7lxfrxx.exec:\7lxfrxx.exe49⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5btbnn.exec:\5btbnn.exe50⤵
- Executes dropped EXE
PID:1904 -
\??\c:\9vpjp.exec:\9vpjp.exe51⤵
- Executes dropped EXE
PID:1056 -
\??\c:\1frxrrf.exec:\1frxrrf.exe52⤵
- Executes dropped EXE
PID:992 -
\??\c:\tthhbh.exec:\tthhbh.exe53⤵
- Executes dropped EXE
PID:1436 -
\??\c:\1nbbtb.exec:\1nbbtb.exe54⤵
- Executes dropped EXE
PID:2976 -
\??\c:\ddjpd.exec:\ddjpd.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9rrfrxl.exec:\9rrfrxl.exe56⤵
- Executes dropped EXE
PID:1556 -
\??\c:\btntnn.exec:\btntnn.exe57⤵
- Executes dropped EXE
PID:2452 -
\??\c:\bthnbb.exec:\bthnbb.exe58⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vvvdp.exec:\vvvdp.exe59⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1frrrxf.exec:\1frrrxf.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tnbhnt.exec:\tnbhnt.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\1pjpv.exec:\1pjpv.exe62⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9pjjd.exec:\9pjjd.exe63⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe64⤵
- Executes dropped EXE
PID:600 -
\??\c:\hhthbn.exec:\hhthbn.exe65⤵
- Executes dropped EXE
PID:1152 -
\??\c:\5djjj.exec:\5djjj.exe66⤵PID:2992
-
\??\c:\fflrfxl.exec:\fflrfxl.exe67⤵PID:2500
-
\??\c:\hnthbn.exec:\hnthbn.exe68⤵PID:1672
-
\??\c:\hhhhtt.exec:\hhhhtt.exe69⤵PID:872
-
\??\c:\jjjpd.exec:\jjjpd.exe70⤵PID:1256
-
\??\c:\3lxxrfl.exec:\3lxxrfl.exe71⤵PID:1016
-
\??\c:\tthbht.exec:\tthbht.exe72⤵PID:2824
-
\??\c:\jjddp.exec:\jjddp.exe73⤵PID:1500
-
\??\c:\xrlrffr.exec:\xrlrffr.exe74⤵PID:2408
-
\??\c:\lfrxllx.exec:\lfrxllx.exe75⤵PID:2416
-
\??\c:\1hthtb.exec:\1hthtb.exe76⤵PID:2676
-
\??\c:\pjjvj.exec:\pjjvj.exe77⤵PID:2656
-
\??\c:\7xllrlx.exec:\7xllrlx.exe78⤵PID:2552
-
\??\c:\tbthth.exec:\tbthth.exe79⤵PID:2600
-
\??\c:\nnbhbn.exec:\nnbhbn.exe80⤵PID:2012
-
\??\c:\frlxfll.exec:\frlxfll.exe81⤵PID:828
-
\??\c:\tbttnb.exec:\tbttnb.exe82⤵PID:1640
-
\??\c:\hbntht.exec:\hbntht.exe83⤵PID:1460
-
\??\c:\pjjjv.exec:\pjjjv.exe84⤵PID:2932
-
\??\c:\lxlrffl.exec:\lxlrffl.exe85⤵PID:2164
-
\??\c:\7tnbhn.exec:\7tnbhn.exe86⤵PID:1280
-
\??\c:\dvdjv.exec:\dvdjv.exe87⤵PID:1220
-
\??\c:\lrfxxfr.exec:\lrfxxfr.exe88⤵PID:2632
-
\??\c:\nbbhtt.exec:\nbbhtt.exe89⤵PID:1840
-
\??\c:\jjdvd.exec:\jjdvd.exe90⤵PID:2880
-
\??\c:\3vjpv.exec:\3vjpv.exe91⤵PID:2864
-
\??\c:\rrllflx.exec:\rrllflx.exe92⤵PID:2128
-
\??\c:\hhbhth.exec:\hhbhth.exe93⤵PID:2784
-
\??\c:\vvpvd.exec:\vvpvd.exe94⤵PID:1544
-
\??\c:\ffxflrr.exec:\ffxflrr.exe95⤵PID:2112
-
\??\c:\ntnntt.exec:\ntnntt.exe96⤵PID:1300
-
\??\c:\3ntbhh.exec:\3ntbhh.exe97⤵PID:2208
-
\??\c:\vvvvv.exec:\vvvvv.exe98⤵PID:2452
-
\??\c:\lflxlrx.exec:\lflxlrx.exe99⤵PID:2172
-
\??\c:\nhhbtb.exec:\nhhbtb.exe100⤵PID:268
-
\??\c:\1nntnt.exec:\1nntnt.exe101⤵PID:1696
-
\??\c:\vpjpv.exec:\vpjpv.exe102⤵PID:760
-
\??\c:\rlflffr.exec:\rlflffr.exe103⤵PID:1648
-
\??\c:\rrllxxl.exec:\rrllxxl.exe104⤵PID:2392
-
\??\c:\5nbnbh.exec:\5nbnbh.exe105⤵PID:680
-
\??\c:\3djpd.exec:\3djpd.exe106⤵PID:1152
-
\??\c:\1lxxllx.exec:\1lxxllx.exe107⤵PID:1824
-
\??\c:\9rrrlrf.exec:\9rrrlrf.exe108⤵PID:1664
-
\??\c:\ttntbh.exec:\ttntbh.exe109⤵PID:2848
-
\??\c:\5pvdd.exec:\5pvdd.exe110⤵PID:2776
-
\??\c:\ddppv.exec:\ddppv.exe111⤵PID:2772
-
\??\c:\9lrfxxl.exec:\9lrfxxl.exe112⤵PID:2780
-
\??\c:\bbbnbh.exec:\bbbnbh.exe113⤵PID:2548
-
\??\c:\jdvjp.exec:\jdvjp.exe114⤵PID:2648
-
\??\c:\5xxflrx.exec:\5xxflrx.exe115⤵PID:2748
-
\??\c:\3nhnth.exec:\3nhnth.exe116⤵PID:2736
-
\??\c:\jdpvj.exec:\jdpvj.exe117⤵PID:2680
-
\??\c:\lfflllx.exec:\lfflllx.exe118⤵PID:2608
-
\??\c:\bbnnbh.exec:\bbnnbh.exe119⤵PID:2716
-
\??\c:\nnhhnt.exec:\nnhhnt.exe120⤵PID:3028
-
\??\c:\dvppj.exec:\dvppj.exe121⤵PID:1020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-