Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe
-
Size
454KB
-
MD5
9b75724fbeca4f69021aa0b85dab37c0
-
SHA1
11d83416871bcbc8633c9459a878d7018fa7e543
-
SHA256
9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e
-
SHA512
dfd37a1ad16dac7a32311183238406d0a80ff0239cac7626640812f9ff8a784825e5c3f74fb3ff951b1cb8b7064b10537b1b14adefb6d844467aeaf084748228
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT8:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1884-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-53-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-111-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1280-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-137-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/600-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-240-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1008-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-356-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2744-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-450-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1888-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-476-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2192-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-539-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-742-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-791-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/708-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-971-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2548 1bnhhb.exe 1804 3djpp.exe 2496 rrrffxl.exe 2240 5llrffr.exe 2920 hhntnn.exe 2780 xlfxlff.exe 2148 bbthnn.exe 2660 lxllrlr.exe 2744 tttnnh.exe 2664 fxflfrr.exe 2492 5bthhn.exe 1988 xxrxlxf.exe 1280 btnthn.exe 600 3bnbtb.exe 2868 3vppd.exe 604 ttbntn.exe 1892 7ddjv.exe 2400 llfrxfx.exe 2020 vdjjd.exe 1352 tnhnbb.exe 2140 3vvdp.exe 1264 9bbbnt.exe 1384 btntbb.exe 1544 llfflxl.exe 1376 5hhtht.exe 1008 9vdjv.exe 1696 rrrrlxl.exe 1916 1vpvj.exe 2116 xlxfllx.exe 2076 hbtnbb.exe 2980 fxflrxl.exe 1732 xfrrxfl.exe 1876 7dvpv.exe 2520 rlllxlf.exe 1628 5nttbh.exe 2316 dvjjd.exe 2496 dddjv.exe 2936 xxxflxx.exe 2212 9bbhtt.exe 2740 9hbnnt.exe 2448 jjdjv.exe 2656 xlxlxfx.exe 2828 bbthbn.exe 2680 htntbh.exe 2744 jdpvd.exe 2312 lxllrfr.exe 2800 5rlrrrf.exe 2492 nntnnh.exe 1520 vvpdj.exe 2824 3rrxlxf.exe 1260 lfxxffl.exe 1516 7ntbhh.exe 2068 pppdp.exe 2868 xffrlxx.exe 1888 xrlxfrl.exe 2972 bbnnhn.exe 2124 pvvjd.exe 2532 rrxrrfr.exe 2428 xxlxrfr.exe 276 bhbhth.exe 2192 vpjvj.exe 1064 vvdpv.exe 1036 7frxlrf.exe 1640 9nntbh.exe -
resource yara_rule behavioral1/memory/1884-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-356-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2744-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-920-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-971-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/648-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frxxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxlfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2548 1884 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 30 PID 1884 wrote to memory of 2548 1884 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 30 PID 1884 wrote to memory of 2548 1884 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 30 PID 1884 wrote to memory of 2548 1884 9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe 30 PID 2548 wrote to memory of 1804 2548 1bnhhb.exe 31 PID 2548 wrote to memory of 1804 2548 1bnhhb.exe 31 PID 2548 wrote to memory of 1804 2548 1bnhhb.exe 31 PID 2548 wrote to memory of 1804 2548 1bnhhb.exe 31 PID 1804 wrote to memory of 2496 1804 3djpp.exe 32 PID 1804 wrote to memory of 2496 1804 3djpp.exe 32 PID 1804 wrote to memory of 2496 1804 3djpp.exe 32 PID 1804 wrote to memory of 2496 1804 3djpp.exe 32 PID 2496 wrote to memory of 2240 2496 rrrffxl.exe 33 PID 2496 wrote to memory of 2240 2496 rrrffxl.exe 33 PID 2496 wrote to memory of 2240 2496 rrrffxl.exe 33 PID 2496 wrote to memory of 2240 2496 rrrffxl.exe 33 PID 2240 wrote to memory of 2920 2240 5llrffr.exe 34 PID 2240 wrote to memory of 2920 2240 5llrffr.exe 34 PID 2240 wrote to memory of 2920 2240 5llrffr.exe 34 PID 2240 wrote to memory of 2920 2240 5llrffr.exe 34 PID 2920 wrote to memory of 2780 2920 hhntnn.exe 35 PID 2920 wrote to memory of 2780 2920 hhntnn.exe 35 PID 2920 wrote to memory of 2780 2920 hhntnn.exe 35 PID 2920 wrote to memory of 2780 2920 hhntnn.exe 35 PID 2780 wrote to memory of 2148 2780 xlfxlff.exe 36 PID 2780 wrote to memory of 2148 2780 xlfxlff.exe 36 PID 2780 wrote to memory of 2148 2780 xlfxlff.exe 36 PID 2780 wrote to memory of 2148 2780 xlfxlff.exe 36 PID 2148 wrote to memory of 2660 2148 bbthnn.exe 37 PID 2148 wrote to memory of 2660 2148 bbthnn.exe 37 PID 2148 wrote to memory of 2660 2148 bbthnn.exe 37 PID 2148 wrote to memory of 2660 2148 bbthnn.exe 37 PID 2660 wrote to memory of 2744 2660 lxllrlr.exe 38 PID 2660 wrote to memory of 2744 2660 lxllrlr.exe 38 PID 2660 wrote to memory of 2744 2660 lxllrlr.exe 38 PID 2660 wrote to memory of 2744 2660 lxllrlr.exe 38 PID 2744 wrote to memory of 2664 2744 tttnnh.exe 39 PID 2744 wrote to memory of 2664 2744 tttnnh.exe 39 PID 2744 wrote to memory of 2664 2744 tttnnh.exe 39 PID 2744 wrote to memory of 2664 2744 tttnnh.exe 39 PID 2664 wrote to memory of 2492 2664 fxflfrr.exe 40 PID 2664 wrote to memory of 2492 2664 fxflfrr.exe 40 PID 2664 wrote to memory of 2492 2664 fxflfrr.exe 40 PID 2664 wrote to memory of 2492 2664 fxflfrr.exe 40 PID 2492 wrote to memory of 1988 2492 5bthhn.exe 41 PID 2492 wrote to memory of 1988 2492 5bthhn.exe 41 PID 2492 wrote to memory of 1988 2492 5bthhn.exe 41 PID 2492 wrote to memory of 1988 2492 5bthhn.exe 41 PID 1988 wrote to memory of 1280 1988 xxrxlxf.exe 42 PID 1988 wrote to memory of 1280 1988 xxrxlxf.exe 42 PID 1988 wrote to memory of 1280 1988 xxrxlxf.exe 42 PID 1988 wrote to memory of 1280 1988 xxrxlxf.exe 42 PID 1280 wrote to memory of 600 1280 btnthn.exe 43 PID 1280 wrote to memory of 600 1280 btnthn.exe 43 PID 1280 wrote to memory of 600 1280 btnthn.exe 43 PID 1280 wrote to memory of 600 1280 btnthn.exe 43 PID 600 wrote to memory of 2868 600 3bnbtb.exe 44 PID 600 wrote to memory of 2868 600 3bnbtb.exe 44 PID 600 wrote to memory of 2868 600 3bnbtb.exe 44 PID 600 wrote to memory of 2868 600 3bnbtb.exe 44 PID 2868 wrote to memory of 604 2868 3vppd.exe 45 PID 2868 wrote to memory of 604 2868 3vppd.exe 45 PID 2868 wrote to memory of 604 2868 3vppd.exe 45 PID 2868 wrote to memory of 604 2868 3vppd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe"C:\Users\Admin\AppData\Local\Temp\9fc21b0e96d85ca8b4594e119613536cb44630d7a4b64a38b377f44ab4ca8d1e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\1bnhhb.exec:\1bnhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\3djpp.exec:\3djpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\rrrffxl.exec:\rrrffxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\5llrffr.exec:\5llrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hhntnn.exec:\hhntnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\xlfxlff.exec:\xlfxlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bbthnn.exec:\bbthnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\lxllrlr.exec:\lxllrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\tttnnh.exec:\tttnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\fxflfrr.exec:\fxflfrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\5bthhn.exec:\5bthhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\xxrxlxf.exec:\xxrxlxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\btnthn.exec:\btnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\3bnbtb.exec:\3bnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\3vppd.exec:\3vppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\ttbntn.exec:\ttbntn.exe17⤵
- Executes dropped EXE
PID:604 -
\??\c:\7ddjv.exec:\7ddjv.exe18⤵
- Executes dropped EXE
PID:1892 -
\??\c:\llfrxfx.exec:\llfrxfx.exe19⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vdjjd.exec:\vdjjd.exe20⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnhnbb.exec:\tnhnbb.exe21⤵
- Executes dropped EXE
PID:1352 -
\??\c:\3vvdp.exec:\3vvdp.exe22⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9bbbnt.exec:\9bbbnt.exe23⤵
- Executes dropped EXE
PID:1264 -
\??\c:\btntbb.exec:\btntbb.exe24⤵
- Executes dropped EXE
PID:1384 -
\??\c:\llfflxl.exec:\llfflxl.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\5hhtht.exec:\5hhtht.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\9vdjv.exec:\9vdjv.exe27⤵
- Executes dropped EXE
PID:1008 -
\??\c:\rrrrlxl.exec:\rrrrlxl.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1vpvj.exec:\1vpvj.exe29⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xlxfllx.exec:\xlxfllx.exe30⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbtnbb.exec:\hbtnbb.exe31⤵
- Executes dropped EXE
PID:2076 -
\??\c:\fxflrxl.exec:\fxflrxl.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\xfrrxfl.exec:\xfrrxfl.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7dvpv.exec:\7dvpv.exe34⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rlllxlf.exec:\rlllxlf.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5nttbh.exec:\5nttbh.exe36⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dvjjd.exec:\dvjjd.exe37⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dddjv.exec:\dddjv.exe38⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xxxflxx.exec:\xxxflxx.exe39⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9bbhtt.exec:\9bbhtt.exe40⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9hbnnt.exec:\9hbnnt.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjdjv.exec:\jjdjv.exe42⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xlxlxfx.exec:\xlxlxfx.exe43⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbthbn.exec:\bbthbn.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\htntbh.exec:\htntbh.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\jdpvd.exec:\jdpvd.exe46⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lxllrfr.exec:\lxllrfr.exe47⤵
- Executes dropped EXE
PID:2312 -
\??\c:\5rlrrrf.exec:\5rlrrrf.exe48⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nntnnh.exec:\nntnnh.exe49⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vvpdj.exec:\vvpdj.exe50⤵
- Executes dropped EXE
PID:1520 -
\??\c:\3rrxlxf.exec:\3rrxlxf.exe51⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lfxxffl.exec:\lfxxffl.exe52⤵
- Executes dropped EXE
PID:1260 -
\??\c:\7ntbhh.exec:\7ntbhh.exe53⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pppdp.exec:\pppdp.exe54⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xffrlxx.exec:\xffrlxx.exe55⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xrlxfrl.exec:\xrlxfrl.exe56⤵
- Executes dropped EXE
PID:1888 -
\??\c:\bbnnhn.exec:\bbnnhn.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pvvjd.exec:\pvvjd.exe58⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rrxrrfr.exec:\rrxrrfr.exe59⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxlxrfr.exec:\xxlxrfr.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bhbhth.exec:\bhbhth.exe61⤵
- Executes dropped EXE
PID:276 -
\??\c:\vpjvj.exec:\vpjvj.exe62⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vvdpv.exec:\vvdpv.exe63⤵
- Executes dropped EXE
PID:1064 -
\??\c:\7frxlrf.exec:\7frxlrf.exe64⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9nntbh.exec:\9nntbh.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ttnbtt.exec:\ttnbtt.exe66⤵PID:2128
-
\??\c:\3dvdj.exec:\3dvdj.exe67⤵PID:1784
-
\??\c:\xxxxxxl.exec:\xxxxxxl.exe68⤵PID:1672
-
\??\c:\1nbnbh.exec:\1nbnbh.exe69⤵PID:1756
-
\??\c:\nnhtnb.exec:\nnhtnb.exe70⤵PID:2544
-
\??\c:\9flxxfl.exec:\9flxxfl.exe71⤵PID:620
-
\??\c:\9xfxlxf.exec:\9xfxlxf.exe72⤵PID:1844
-
\??\c:\nnnthn.exec:\nnnthn.exe73⤵PID:2116
-
\??\c:\djjpp.exec:\djjpp.exe74⤵PID:2088
-
\??\c:\lrlxlrx.exec:\lrlxlrx.exe75⤵PID:2980
-
\??\c:\fxrxrrx.exec:\fxrxrrx.exe76⤵PID:2580
-
\??\c:\nnnbtb.exec:\nnnbtb.exe77⤵PID:2276
-
\??\c:\9ddpj.exec:\9ddpj.exe78⤵PID:2476
-
\??\c:\7xxlrxx.exec:\7xxlrxx.exe79⤵PID:2812
-
\??\c:\hbbntb.exec:\hbbntb.exe80⤵PID:2252
-
\??\c:\nhtthn.exec:\nhtthn.exe81⤵PID:2724
-
\??\c:\7pvjv.exec:\7pvjv.exe82⤵PID:2788
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe83⤵PID:2756
-
\??\c:\3xrxlxr.exec:\3xrxlxr.exe84⤵PID:2780
-
\??\c:\9nbntb.exec:\9nbntb.exe85⤵PID:2944
-
\??\c:\dddvv.exec:\dddvv.exe86⤵PID:2952
-
\??\c:\ppppd.exec:\ppppd.exe87⤵
- System Location Discovery: System Language Discovery
PID:1912 -
\??\c:\fxxfxxr.exec:\fxxfxxr.exe88⤵PID:2644
-
\??\c:\3hbbnt.exec:\3hbbnt.exe89⤵PID:2704
-
\??\c:\nnhbhh.exec:\nnhbhh.exe90⤵PID:2676
-
\??\c:\vpjpd.exec:\vpjpd.exe91⤵PID:2312
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe92⤵
- System Location Discovery: System Language Discovery
PID:560 -
\??\c:\7xxfrxl.exec:\7xxfrxl.exe93⤵PID:2888
-
\??\c:\ntnhnt.exec:\ntnhnt.exe94⤵PID:2860
-
\??\c:\jjdjv.exec:\jjdjv.exe95⤵PID:956
-
\??\c:\pvjvj.exec:\pvjvj.exe96⤵PID:320
-
\??\c:\rffrxlx.exec:\rffrxlx.exe97⤵PID:2876
-
\??\c:\nththt.exec:\nththt.exe98⤵PID:2848
-
\??\c:\5ddpd.exec:\5ddpd.exe99⤵
- System Location Discovery: System Language Discovery
PID:648 -
\??\c:\jjvjp.exec:\jjvjp.exe100⤵PID:1892
-
\??\c:\xxxrflf.exec:\xxxrflf.exe101⤵PID:2400
-
\??\c:\ttnthn.exec:\ttnthn.exe102⤵PID:2728
-
\??\c:\jpppd.exec:\jpppd.exe103⤵PID:1448
-
\??\c:\xxrxrxl.exec:\xxrxrxl.exe104⤵PID:2428
-
\??\c:\nhhtth.exec:\nhhtth.exe105⤵PID:2140
-
\??\c:\hbthnt.exec:\hbthnt.exe106⤵PID:2192
-
\??\c:\9jpjd.exec:\9jpjd.exe107⤵PID:1548
-
\??\c:\5rllflx.exec:\5rllflx.exe108⤵PID:1932
-
\??\c:\xrlrflx.exec:\xrlrflx.exe109⤵PID:1568
-
\??\c:\nnnbtt.exec:\nnnbtt.exe110⤵PID:496
-
\??\c:\dvdpd.exec:\dvdpd.exe111⤵PID:236
-
\??\c:\5xllrxl.exec:\5xllrxl.exe112⤵PID:2480
-
\??\c:\1rfflrl.exec:\1rfflrl.exe113⤵PID:2096
-
\??\c:\htntbb.exec:\htntbb.exe114⤵PID:1916
-
\??\c:\vvjjp.exec:\vvjjp.exe115⤵PID:708
-
\??\c:\pppdp.exec:\pppdp.exe116⤵PID:2200
-
\??\c:\lrrfrfr.exec:\lrrfrfr.exe117⤵PID:1540
-
\??\c:\ttbthn.exec:\ttbthn.exe118⤵PID:1684
-
\??\c:\jppjd.exec:\jppjd.exe119⤵PID:2092
-
\??\c:\1lxlfrx.exec:\1lxlfrx.exe120⤵
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\bthnnh.exec:\bthnnh.exe121⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-