Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe
-
Size
453KB
-
MD5
483c5dbbd2ad5cfedd2e7e1c0ed6b6ac
-
SHA1
21778785e8b4e0875817b1e07f059c2e95f18be5
-
SHA256
3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4
-
SHA512
c479e66f7b441e96c897913a1e6ffa20a88ab194ef4e771a31359a2c6ab165a7057fdb43ea84859f37b475b57a29210650d20c0df81ebcf12d9c116a846b4a94
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeG:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2688-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-221-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/900-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-821-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/980-1036-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1204-1095-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2600 rxlrxxl.exe 2704 7pdvp.exe 2348 lxxrfxx.exe 2544 9xfrrlf.exe 2440 1ddjp.exe 2512 ttnhnt.exe 2628 xrlxrxr.exe 2984 xrlrrxr.exe 2804 vvjpd.exe 2844 hhtnht.exe 1532 9xlxlxx.exe 1060 tthhtt.exe 1088 jjdvd.exe 480 xxxllxr.exe 1684 9bbtnh.exe 1776 fxrxfff.exe 2128 jppdd.exe 2144 hththt.exe 2236 jvjjj.exe 1420 rrffxrr.exe 1988 rllrxfx.exe 932 xxrxrrr.exe 900 dvjvj.exe 688 3bbbhh.exe 1352 rxrfrxf.exe 1036 jjdpd.exe 784 1rllflf.exe 2360 nnthbh.exe 2124 lfflfrf.exe 1648 pppvp.exe 888 xlllrxf.exe 2168 1hnhtn.exe 2364 fffxrxx.exe 2656 hhnbnb.exe 2728 3xlxfxl.exe 2744 xxrfxlx.exe 2764 ntbnbt.exe 2724 ddpdj.exe 2736 xxrxlrf.exe 2540 hnttbt.exe 2572 9jdpp.exe 2968 rlfrllx.exe 2388 7lfrlxx.exe 2800 tbbtbt.exe 2816 3jdjv.exe 2856 3xlfxff.exe 2844 tthnbh.exe 1300 nnnhbh.exe 1660 jjjvd.exe 1972 9flxlrf.exe 2400 5htbbn.exe 1500 ttnbth.exe 1684 vvvdp.exe 864 rlxxlrl.exe 1516 3xflflx.exe 2128 bbbnhh.exe 2140 9vdpd.exe 2080 3ffrlxx.exe 2200 3bbnhn.exe 952 9vdpj.exe 616 vdvdj.exe 1864 xxfxlxr.exe 564 thbtth.exe 900 ppvdj.exe -
resource yara_rule behavioral1/memory/2688-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/616-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-819-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2688-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1081-0x0000000000250000-0x000000000027A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2600 2688 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 30 PID 2688 wrote to memory of 2600 2688 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 30 PID 2688 wrote to memory of 2600 2688 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 30 PID 2688 wrote to memory of 2600 2688 3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe 30 PID 2600 wrote to memory of 2704 2600 rxlrxxl.exe 31 PID 2600 wrote to memory of 2704 2600 rxlrxxl.exe 31 PID 2600 wrote to memory of 2704 2600 rxlrxxl.exe 31 PID 2600 wrote to memory of 2704 2600 rxlrxxl.exe 31 PID 2704 wrote to memory of 2348 2704 7pdvp.exe 32 PID 2704 wrote to memory of 2348 2704 7pdvp.exe 32 PID 2704 wrote to memory of 2348 2704 7pdvp.exe 32 PID 2704 wrote to memory of 2348 2704 7pdvp.exe 32 PID 2348 wrote to memory of 2544 2348 lxxrfxx.exe 33 PID 2348 wrote to memory of 2544 2348 lxxrfxx.exe 33 PID 2348 wrote to memory of 2544 2348 lxxrfxx.exe 33 PID 2348 wrote to memory of 2544 2348 lxxrfxx.exe 33 PID 2544 wrote to memory of 2440 2544 9xfrrlf.exe 34 PID 2544 wrote to memory of 2440 2544 9xfrrlf.exe 34 PID 2544 wrote to memory of 2440 2544 9xfrrlf.exe 34 PID 2544 wrote to memory of 2440 2544 9xfrrlf.exe 34 PID 2440 wrote to memory of 2512 2440 1ddjp.exe 35 PID 2440 wrote to memory of 2512 2440 1ddjp.exe 35 PID 2440 wrote to memory of 2512 2440 1ddjp.exe 35 PID 2440 wrote to memory of 2512 2440 1ddjp.exe 35 PID 2512 wrote to memory of 2628 2512 ttnhnt.exe 36 PID 2512 wrote to memory of 2628 2512 ttnhnt.exe 36 PID 2512 wrote to memory of 2628 2512 ttnhnt.exe 36 PID 2512 wrote to memory of 2628 2512 ttnhnt.exe 36 PID 2628 wrote to memory of 2984 2628 xrlxrxr.exe 37 PID 2628 wrote to memory of 2984 2628 xrlxrxr.exe 37 PID 2628 wrote to memory of 2984 2628 xrlxrxr.exe 37 PID 2628 wrote to memory of 2984 2628 xrlxrxr.exe 37 PID 2984 wrote to memory of 2804 2984 xrlrrxr.exe 38 PID 2984 wrote to memory of 2804 2984 xrlrrxr.exe 38 PID 2984 wrote to memory of 2804 2984 xrlrrxr.exe 38 PID 2984 wrote to memory of 2804 2984 xrlrrxr.exe 38 PID 2804 wrote to memory of 2844 2804 vvjpd.exe 39 PID 2804 wrote to memory of 2844 2804 vvjpd.exe 39 PID 2804 wrote to memory of 2844 2804 vvjpd.exe 39 PID 2804 wrote to memory of 2844 2804 vvjpd.exe 39 PID 2844 wrote to memory of 1532 2844 hhtnht.exe 40 PID 2844 wrote to memory of 1532 2844 hhtnht.exe 40 PID 2844 wrote to memory of 1532 2844 hhtnht.exe 40 PID 2844 wrote to memory of 1532 2844 hhtnht.exe 40 PID 1532 wrote to memory of 1060 1532 9xlxlxx.exe 41 PID 1532 wrote to memory of 1060 1532 9xlxlxx.exe 41 PID 1532 wrote to memory of 1060 1532 9xlxlxx.exe 41 PID 1532 wrote to memory of 1060 1532 9xlxlxx.exe 41 PID 1060 wrote to memory of 1088 1060 tthhtt.exe 42 PID 1060 wrote to memory of 1088 1060 tthhtt.exe 42 PID 1060 wrote to memory of 1088 1060 tthhtt.exe 42 PID 1060 wrote to memory of 1088 1060 tthhtt.exe 42 PID 1088 wrote to memory of 480 1088 jjdvd.exe 43 PID 1088 wrote to memory of 480 1088 jjdvd.exe 43 PID 1088 wrote to memory of 480 1088 jjdvd.exe 43 PID 1088 wrote to memory of 480 1088 jjdvd.exe 43 PID 480 wrote to memory of 1684 480 xxxllxr.exe 44 PID 480 wrote to memory of 1684 480 xxxllxr.exe 44 PID 480 wrote to memory of 1684 480 xxxllxr.exe 44 PID 480 wrote to memory of 1684 480 xxxllxr.exe 44 PID 1684 wrote to memory of 1776 1684 9bbtnh.exe 45 PID 1684 wrote to memory of 1776 1684 9bbtnh.exe 45 PID 1684 wrote to memory of 1776 1684 9bbtnh.exe 45 PID 1684 wrote to memory of 1776 1684 9bbtnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe"C:\Users\Admin\AppData\Local\Temp\3194648a861f3bbbf39799bc5425568321a60e749dc53f8be940c0608e3d94a4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rxlrxxl.exec:\rxlrxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\7pdvp.exec:\7pdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lxxrfxx.exec:\lxxrfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\9xfrrlf.exec:\9xfrrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1ddjp.exec:\1ddjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\ttnhnt.exec:\ttnhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xrlrrxr.exec:\xrlrrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vvjpd.exec:\vvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hhtnht.exec:\hhtnht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\9xlxlxx.exec:\9xlxlxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\tthhtt.exec:\tthhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\jjdvd.exec:\jjdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\xxxllxr.exec:\xxxllxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\9bbtnh.exec:\9bbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\fxrxfff.exec:\fxrxfff.exe17⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jppdd.exec:\jppdd.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\hththt.exec:\hththt.exe19⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jvjjj.exec:\jvjjj.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rrffxrr.exec:\rrffxrr.exe21⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rllrxfx.exec:\rllrxfx.exe22⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xxrxrrr.exec:\xxrxrrr.exe23⤵
- Executes dropped EXE
PID:932 -
\??\c:\dvjvj.exec:\dvjvj.exe24⤵
- Executes dropped EXE
PID:900 -
\??\c:\3bbbhh.exec:\3bbbhh.exe25⤵
- Executes dropped EXE
PID:688 -
\??\c:\rxrfrxf.exec:\rxrfrxf.exe26⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jjdpd.exec:\jjdpd.exe27⤵
- Executes dropped EXE
PID:1036 -
\??\c:\1rllflf.exec:\1rllflf.exe28⤵
- Executes dropped EXE
PID:784 -
\??\c:\nnthbh.exec:\nnthbh.exe29⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lfflfrf.exec:\lfflfrf.exe30⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pppvp.exec:\pppvp.exe31⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xlllrxf.exec:\xlllrxf.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\1hnhtn.exec:\1hnhtn.exe33⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fffxrxx.exec:\fffxrxx.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhnbnb.exec:\hhnbnb.exe35⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3xlxfxl.exec:\3xlxfxl.exe36⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ntbnbt.exec:\ntbnbt.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ddpdj.exec:\ddpdj.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hnttbt.exec:\hnttbt.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9jdpp.exec:\9jdpp.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlfrllx.exec:\rlfrllx.exe43⤵
- Executes dropped EXE
PID:2968 -
\??\c:\7lfrlxx.exec:\7lfrlxx.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tbbtbt.exec:\tbbtbt.exe45⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3jdjv.exec:\3jdjv.exe46⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3xlfxff.exec:\3xlfxff.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tthnbh.exec:\tthnbh.exe48⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nnnhbh.exec:\nnnhbh.exe49⤵
- Executes dropped EXE
PID:1300 -
\??\c:\jjjvd.exec:\jjjvd.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\9flxlrf.exec:\9flxlrf.exe51⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5htbbn.exec:\5htbbn.exe52⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ttnbth.exec:\ttnbth.exe53⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vvvdp.exec:\vvvdp.exe54⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rlxxlrl.exec:\rlxxlrl.exe55⤵
- Executes dropped EXE
PID:864 -
\??\c:\3xflflx.exec:\3xflflx.exe56⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bbbnhh.exec:\bbbnhh.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\9vdpd.exec:\9vdpd.exe58⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3ffrlxx.exec:\3ffrlxx.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3bbnhn.exec:\3bbnhn.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9vdpj.exec:\9vdpj.exe61⤵
- Executes dropped EXE
PID:952 -
\??\c:\vdvdj.exec:\vdvdj.exe62⤵
- Executes dropped EXE
PID:616 -
\??\c:\xxfxlxr.exec:\xxfxlxr.exe63⤵
- Executes dropped EXE
PID:1864 -
\??\c:\thbtth.exec:\thbtth.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\ppvdj.exec:\ppvdj.exe65⤵
- Executes dropped EXE
PID:900 -
\??\c:\rrllxlx.exec:\rrllxlx.exe66⤵PID:1816
-
\??\c:\7lxfxfx.exec:\7lxfxfx.exe67⤵PID:308
-
\??\c:\nnnhhn.exec:\nnnhhn.exe68⤵PID:1028
-
\??\c:\9pvjd.exec:\9pvjd.exe69⤵PID:1948
-
\??\c:\llfxxrl.exec:\llfxxrl.exe70⤵PID:784
-
\??\c:\7ffrfxf.exec:\7ffrfxf.exe71⤵PID:1204
-
\??\c:\hbnthn.exec:\hbnthn.exe72⤵PID:612
-
\??\c:\pjddp.exec:\pjddp.exe73⤵PID:1188
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe74⤵
- System Location Discovery: System Language Discovery
PID:1648 -
\??\c:\3lflfrx.exec:\3lflfrx.exe75⤵PID:2688
-
\??\c:\nnhbth.exec:\nnhbth.exe76⤵PID:2120
-
\??\c:\3vvjp.exec:\3vvjp.exe77⤵PID:2364
-
\??\c:\fxxlxlf.exec:\fxxlxlf.exe78⤵PID:2704
-
\??\c:\7bhnnb.exec:\7bhnnb.exe79⤵PID:2712
-
\??\c:\ntthbt.exec:\ntthbt.exe80⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\jpjpd.exec:\jpjpd.exe81⤵PID:336
-
\??\c:\3lflxfl.exec:\3lflxfl.exe82⤵PID:2008
-
\??\c:\hbhnnn.exec:\hbhnnn.exe83⤵PID:2776
-
\??\c:\vpjjj.exec:\vpjjj.exe84⤵PID:2056
-
\??\c:\xllrllx.exec:\xllrllx.exe85⤵PID:2572
-
\??\c:\lrrllxx.exec:\lrrllxx.exe86⤵PID:2968
-
\??\c:\3hhbtn.exec:\3hhbtn.exe87⤵PID:2756
-
\??\c:\vpjpj.exec:\vpjpj.exe88⤵PID:2988
-
\??\c:\rrrxlxr.exec:\rrrxlxr.exe89⤵PID:2956
-
\??\c:\flffxfr.exec:\flffxfr.exe90⤵PID:1724
-
\??\c:\hnttth.exec:\hnttth.exe91⤵PID:1656
-
\??\c:\vdjvd.exec:\vdjvd.exe92⤵PID:1916
-
\??\c:\lrxrrrx.exec:\lrxrrrx.exe93⤵PID:1628
-
\??\c:\rxfxlxr.exec:\rxfxlxr.exe94⤵PID:532
-
\??\c:\1hhhbh.exec:\1hhhbh.exe95⤵PID:1740
-
\??\c:\5vdpd.exec:\5vdpd.exe96⤵
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\pvddv.exec:\pvddv.exe97⤵PID:1456
-
\??\c:\lrllrrr.exec:\lrllrrr.exe98⤵PID:864
-
\??\c:\9hntnn.exec:\9hntnn.exe99⤵PID:2908
-
\??\c:\jpvdv.exec:\jpvdv.exe100⤵PID:1944
-
\??\c:\fffrlxx.exec:\fffrlxx.exe101⤵PID:1480
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe102⤵PID:2236
-
\??\c:\ntbbtn.exec:\ntbbtn.exe103⤵PID:2200
-
\??\c:\jjvvp.exec:\jjvvp.exe104⤵PID:1344
-
\??\c:\flflrxr.exec:\flflrxr.exe105⤵PID:2460
-
\??\c:\nthhbn.exec:\nthhbn.exe106⤵PID:932
-
\??\c:\pjjdp.exec:\pjjdp.exe107⤵PID:1696
-
\??\c:\xllxffl.exec:\xllxffl.exe108⤵PID:2184
-
\??\c:\nnthht.exec:\nnthht.exe109⤵PID:2328
-
\??\c:\llfxrfx.exec:\llfxrfx.exe110⤵PID:1548
-
\??\c:\tbtthn.exec:\tbtthn.exe111⤵PID:2288
-
\??\c:\bbntnt.exec:\bbntnt.exe112⤵PID:1372
-
\??\c:\9jjpj.exec:\9jjpj.exe113⤵PID:2360
-
\??\c:\fllfxfx.exec:\fllfxfx.exe114⤵PID:2124
-
\??\c:\9rrllrl.exec:\9rrllrl.exe115⤵PID:2468
-
\??\c:\bhntnt.exec:\bhntnt.exe116⤵PID:1512
-
\??\c:\vjjjv.exec:\vjjjv.exe117⤵PID:1648
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe118⤵
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\5ttbnn.exec:\5ttbnn.exe119⤵PID:2120
-
\??\c:\9tnnbb.exec:\9tnnbb.exe120⤵PID:2656
-
\??\c:\9pvjj.exec:\9pvjj.exe121⤵PID:2640
-
\??\c:\5fxflrf.exec:\5fxflrf.exe122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-