Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe
-
Size
455KB
-
MD5
e2eaeed2f8c74985496c64f341384f52
-
SHA1
c2153162ca33589e4eaa168bfc25c31516f5897a
-
SHA256
395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c
-
SHA512
375333c3c02801aaa569b5ff5e14bc0d13b6ee7453719220c7c31dcc775ff3c847c748cd54e129491d5132790928998a0b7c04cdb2ae0050ee2d73ee0ca5fcef
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1992-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-78-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2772-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1980-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-195-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1548-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1776-245-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1432-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-307-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2392-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-331-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2732-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-458-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3044-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-706-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-909-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-1058-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/684-1256-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1696 xrlrxfr.exe 1216 nnhtnt.exe 2540 vvdjv.exe 2700 dvppd.exe 2844 9frlxrf.exe 2760 rrfxllr.exe 2804 bbtbhn.exe 2644 lllxffr.exe 2772 frxfrxf.exe 2628 9lxxllr.exe 2168 hhhhtb.exe 2436 xrllxfr.exe 908 frlfrll.exe 2784 tnhtnn.exe 2708 jvjvd.exe 1980 xlxxflx.exe 2292 7ffffrr.exe 2696 dvjpd.exe 2208 rrlxlrr.exe 2304 dddjd.exe 2232 1rlxxlx.exe 3000 7nbhnn.exe 940 3vjjj.exe 1548 vjvdd.exe 1392 xrrxlrx.exe 1776 3xlxlfl.exe 696 jdpjd.exe 1432 xrlrllf.exe 572 jdvpv.exe 1308 bbthbb.exe 872 jpjpj.exe 1620 1vjjd.exe 2092 1btbhn.exe 2104 lfrfrrl.exe 2544 xlfxfrr.exe 2392 hbntnn.exe 2460 vdvpp.exe 2848 rlfrlrf.exe 3036 nhtbnn.exe 2732 5vdpp.exe 2824 jjdjv.exe 2740 1fxrllx.exe 1320 thbbhb.exe 2776 nhhtbn.exe 2684 ddvdp.exe 2164 rrlrxxl.exe 1720 flrrlff.exe 2012 hbbhtb.exe 1860 djdpd.exe 908 xxrrxxf.exe 1828 lllrflx.exe 2372 hnhnbn.exe 1624 jjdjv.exe 2988 ppdjv.exe 2972 fxrrflf.exe 2704 nnhnbn.exe 800 hhbnhn.exe 2208 ddvdj.exe 1120 9xrxxxl.exe 3044 ffxlxfx.exe 808 7ttbtb.exe 944 vvpdp.exe 2512 7vjpd.exe 1280 rrflrxl.exe -
resource yara_rule behavioral1/memory/1992-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-130-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1980-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-195-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1548-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-458-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/3044-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-909-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-971-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-1231-0x0000000000260000-0x000000000028A000-memory.dmp upx behavioral1/memory/2872-1236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1696 1992 395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe 30 PID 1992 wrote to memory of 1696 1992 395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe 30 PID 1992 wrote to memory of 1696 1992 395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe 30 PID 1992 wrote to memory of 1696 1992 395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe 30 PID 1696 wrote to memory of 1216 1696 xrlrxfr.exe 31 PID 1696 wrote to memory of 1216 1696 xrlrxfr.exe 31 PID 1696 wrote to memory of 1216 1696 xrlrxfr.exe 31 PID 1696 wrote to memory of 1216 1696 xrlrxfr.exe 31 PID 1216 wrote to memory of 2540 1216 nnhtnt.exe 32 PID 1216 wrote to memory of 2540 1216 nnhtnt.exe 32 PID 1216 wrote to memory of 2540 1216 nnhtnt.exe 32 PID 1216 wrote to memory of 2540 1216 nnhtnt.exe 32 PID 2540 wrote to memory of 2700 2540 vvdjv.exe 33 PID 2540 wrote to memory of 2700 2540 vvdjv.exe 33 PID 2540 wrote to memory of 2700 2540 vvdjv.exe 33 PID 2540 wrote to memory of 2700 2540 vvdjv.exe 33 PID 2700 wrote to memory of 2844 2700 dvppd.exe 34 PID 2700 wrote to memory of 2844 2700 dvppd.exe 34 PID 2700 wrote to memory of 2844 2700 dvppd.exe 34 PID 2700 wrote to memory of 2844 2700 dvppd.exe 34 PID 2844 wrote to memory of 2760 2844 9frlxrf.exe 35 PID 2844 wrote to memory of 2760 2844 9frlxrf.exe 35 PID 2844 wrote to memory of 2760 2844 9frlxrf.exe 35 PID 2844 wrote to memory of 2760 2844 9frlxrf.exe 35 PID 2760 wrote to memory of 2804 2760 rrfxllr.exe 36 PID 2760 wrote to memory of 2804 2760 rrfxllr.exe 36 PID 2760 wrote to memory of 2804 2760 rrfxllr.exe 36 PID 2760 wrote to memory of 2804 2760 rrfxllr.exe 36 PID 2804 wrote to memory of 2644 2804 bbtbhn.exe 37 PID 2804 wrote to memory of 2644 2804 bbtbhn.exe 37 PID 2804 wrote to memory of 2644 2804 bbtbhn.exe 37 PID 2804 wrote to memory of 2644 2804 bbtbhn.exe 37 PID 2644 wrote to memory of 2772 2644 lllxffr.exe 38 PID 2644 wrote to memory of 2772 2644 lllxffr.exe 38 PID 2644 wrote to memory of 2772 2644 lllxffr.exe 38 PID 2644 wrote to memory of 2772 2644 lllxffr.exe 38 PID 2772 wrote to memory of 2628 2772 frxfrxf.exe 39 PID 2772 wrote to memory of 2628 2772 frxfrxf.exe 39 PID 2772 wrote to memory of 2628 2772 frxfrxf.exe 39 PID 2772 wrote to memory of 2628 2772 frxfrxf.exe 39 PID 2628 wrote to memory of 2168 2628 9lxxllr.exe 40 PID 2628 wrote to memory of 2168 2628 9lxxllr.exe 40 PID 2628 wrote to memory of 2168 2628 9lxxllr.exe 40 PID 2628 wrote to memory of 2168 2628 9lxxllr.exe 40 PID 2168 wrote to memory of 2436 2168 hhhhtb.exe 41 PID 2168 wrote to memory of 2436 2168 hhhhtb.exe 41 PID 2168 wrote to memory of 2436 2168 hhhhtb.exe 41 PID 2168 wrote to memory of 2436 2168 hhhhtb.exe 41 PID 2436 wrote to memory of 908 2436 xrllxfr.exe 42 PID 2436 wrote to memory of 908 2436 xrllxfr.exe 42 PID 2436 wrote to memory of 908 2436 xrllxfr.exe 42 PID 2436 wrote to memory of 908 2436 xrllxfr.exe 42 PID 908 wrote to memory of 2784 908 frlfrll.exe 43 PID 908 wrote to memory of 2784 908 frlfrll.exe 43 PID 908 wrote to memory of 2784 908 frlfrll.exe 43 PID 908 wrote to memory of 2784 908 frlfrll.exe 43 PID 2784 wrote to memory of 2708 2784 tnhtnn.exe 44 PID 2784 wrote to memory of 2708 2784 tnhtnn.exe 44 PID 2784 wrote to memory of 2708 2784 tnhtnn.exe 44 PID 2784 wrote to memory of 2708 2784 tnhtnn.exe 44 PID 2708 wrote to memory of 1980 2708 jvjvd.exe 45 PID 2708 wrote to memory of 1980 2708 jvjvd.exe 45 PID 2708 wrote to memory of 1980 2708 jvjvd.exe 45 PID 2708 wrote to memory of 1980 2708 jvjvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe"C:\Users\Admin\AppData\Local\Temp\395e956c1a07cb14c77ed9eb3541fc31c51a38a2d3e378a2155a42030b50308c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\nnhtnt.exec:\nnhtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\vvdjv.exec:\vvdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dvppd.exec:\dvppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\9frlxrf.exec:\9frlxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\rrfxllr.exec:\rrfxllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bbtbhn.exec:\bbtbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lllxffr.exec:\lllxffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\frxfrxf.exec:\frxfrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9lxxllr.exec:\9lxxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hhhhtb.exec:\hhhhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xrllxfr.exec:\xrllxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\frlfrll.exec:\frlfrll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\tnhtnn.exec:\tnhtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jvjvd.exec:\jvjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xlxxflx.exec:\xlxxflx.exe17⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7ffffrr.exec:\7ffffrr.exe18⤵
- Executes dropped EXE
PID:2292 -
\??\c:\dvjpd.exec:\dvjpd.exe19⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rrlxlrr.exec:\rrlxlrr.exe20⤵
- Executes dropped EXE
PID:2208 -
\??\c:\dddjd.exec:\dddjd.exe21⤵
- Executes dropped EXE
PID:2304 -
\??\c:\1rlxxlx.exec:\1rlxxlx.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7nbhnn.exec:\7nbhnn.exe23⤵
- Executes dropped EXE
PID:3000 -
\??\c:\3vjjj.exec:\3vjjj.exe24⤵
- Executes dropped EXE
PID:940 -
\??\c:\vjvdd.exec:\vjvdd.exe25⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xrrxlrx.exec:\xrrxlrx.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\3xlxlfl.exec:\3xlxlfl.exe27⤵
- Executes dropped EXE
PID:1776 -
\??\c:\jdpjd.exec:\jdpjd.exe28⤵
- Executes dropped EXE
PID:696 -
\??\c:\xrlrllf.exec:\xrlrllf.exe29⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jdvpv.exec:\jdvpv.exe30⤵
- Executes dropped EXE
PID:572 -
\??\c:\bbthbb.exec:\bbthbb.exe31⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jpjpj.exec:\jpjpj.exe32⤵
- Executes dropped EXE
PID:872 -
\??\c:\1vjjd.exec:\1vjjd.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1btbhn.exec:\1btbhn.exe34⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lfrfrrl.exec:\lfrfrrl.exe35⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xlfxfrr.exec:\xlfxfrr.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbntnn.exec:\hbntnn.exe37⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vdvpp.exec:\vdvpp.exe38⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\nhtbnn.exec:\nhtbnn.exe40⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5vdpp.exec:\5vdpp.exe41⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jjdjv.exec:\jjdjv.exe42⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1fxrllx.exec:\1fxrllx.exe43⤵
- Executes dropped EXE
PID:2740 -
\??\c:\thbbhb.exec:\thbbhb.exe44⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nhhtbn.exec:\nhhtbn.exe45⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddvdp.exec:\ddvdp.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe47⤵
- Executes dropped EXE
PID:2164 -
\??\c:\flrrlff.exec:\flrrlff.exe48⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbbhtb.exec:\hbbhtb.exe49⤵
- Executes dropped EXE
PID:2012 -
\??\c:\djdpd.exec:\djdpd.exe50⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe51⤵
- Executes dropped EXE
PID:908 -
\??\c:\lllrflx.exec:\lllrflx.exe52⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hnhnbn.exec:\hnhnbn.exe53⤵
- Executes dropped EXE
PID:2372 -
\??\c:\jjdjv.exec:\jjdjv.exe54⤵
- Executes dropped EXE
PID:1624 -
\??\c:\ppdjv.exec:\ppdjv.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fxrrflf.exec:\fxrrflf.exe56⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nnhnbn.exec:\nnhnbn.exe57⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hhbnhn.exec:\hhbnhn.exe58⤵
- Executes dropped EXE
PID:800 -
\??\c:\ddvdj.exec:\ddvdj.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9xrxxxl.exec:\9xrxxxl.exe60⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ffxlxfx.exec:\ffxlxfx.exe61⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7ttbtb.exec:\7ttbtb.exe62⤵
- Executes dropped EXE
PID:808 -
\??\c:\vvpdp.exec:\vvpdp.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\7vjpd.exec:\7vjpd.exe64⤵
- Executes dropped EXE
PID:2512 -
\??\c:\rrflrxl.exec:\rrflrxl.exe65⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hnttbb.exec:\hnttbb.exe66⤵PID:844
-
\??\c:\9bntth.exec:\9bntth.exe67⤵PID:1080
-
\??\c:\vpjjv.exec:\vpjjv.exe68⤵PID:1752
-
\??\c:\lrxxfxx.exec:\lrxxfxx.exe69⤵PID:352
-
\??\c:\thbthh.exec:\thbthh.exe70⤵PID:1316
-
\??\c:\ntthtt.exec:\ntthtt.exe71⤵PID:1564
-
\??\c:\7ddjp.exec:\7ddjp.exe72⤵PID:572
-
\??\c:\1rlrrxf.exec:\1rlrrxf.exe73⤵PID:2404
-
\??\c:\rxxlfrx.exec:\rxxlfrx.exe74⤵PID:2088
-
\??\c:\ttnbnt.exec:\ttnbnt.exe75⤵PID:2312
-
\??\c:\tbntnn.exec:\tbntnn.exe76⤵PID:1716
-
\??\c:\dvpvj.exec:\dvpvj.exe77⤵PID:1584
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe78⤵PID:1592
-
\??\c:\nbnnhh.exec:\nbnnhh.exe79⤵PID:2148
-
\??\c:\nnhhtb.exec:\nnhhtb.exe80⤵PID:2392
-
\??\c:\jdppv.exec:\jdppv.exe81⤵PID:576
-
\??\c:\vdvdv.exec:\vdvdv.exe82⤵PID:264
-
\??\c:\rfflfxl.exec:\rfflfxl.exe83⤵PID:2844
-
\??\c:\btntnt.exec:\btntnt.exe84⤵PID:2172
-
\??\c:\3bhhtb.exec:\3bhhtb.exe85⤵PID:2896
-
\??\c:\5dvjd.exec:\5dvjd.exe86⤵PID:3024
-
\??\c:\ffflrrr.exec:\ffflrrr.exe87⤵PID:2832
-
\??\c:\lffrxlr.exec:\lffrxlr.exe88⤵PID:2332
-
\??\c:\thbbbb.exec:\thbbbb.exe89⤵PID:2776
-
\??\c:\5nbbhh.exec:\5nbbhh.exe90⤵PID:2652
-
\??\c:\dvpvd.exec:\dvpvd.exe91⤵PID:1512
-
\??\c:\rxrfrfx.exec:\rxrfrfx.exe92⤵PID:664
-
\??\c:\1hbthn.exec:\1hbthn.exe93⤵PID:1088
-
\??\c:\hbnntt.exec:\hbnntt.exe94⤵PID:2792
-
\??\c:\vvpdp.exec:\vvpdp.exe95⤵PID:1916
-
\??\c:\5llrxfl.exec:\5llrxfl.exe96⤵PID:2004
-
\??\c:\rllxffr.exec:\rllxffr.exe97⤵PID:1740
-
\??\c:\bhbnbh.exec:\bhbnbh.exe98⤵PID:2872
-
\??\c:\vvpdj.exec:\vvpdj.exe99⤵PID:2308
-
\??\c:\rfxflfr.exec:\rfxflfr.exe100⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\7nhntb.exec:\7nhntb.exe101⤵PID:2380
-
\??\c:\5hbhhn.exec:\5hbhhn.exe102⤵PID:880
-
\??\c:\jjpvp.exec:\jjpvp.exe103⤵PID:1524
-
\??\c:\rrfrflx.exec:\rrfrflx.exe104⤵PID:2864
-
\??\c:\5rrlrfr.exec:\5rrlrfr.exe105⤵PID:2976
-
\??\c:\tnhtbb.exec:\tnhtbb.exe106⤵PID:1304
-
\??\c:\pjvpv.exec:\pjvpv.exe107⤵PID:1276
-
\??\c:\ppdjv.exec:\ppdjv.exe108⤵PID:1300
-
\??\c:\ffflflf.exec:\ffflflf.exe109⤵PID:1748
-
\??\c:\hnbttb.exec:\hnbttb.exe110⤵PID:3048
-
\??\c:\bnhbhn.exec:\bnhbhn.exe111⤵PID:2480
-
\??\c:\pjddj.exec:\pjddj.exe112⤵PID:2204
-
\??\c:\rlxxffr.exec:\rlxxffr.exe113⤵PID:3032
-
\??\c:\xrlrflx.exec:\xrlrflx.exe114⤵PID:1644
-
\??\c:\hnbhbt.exec:\hnbhbt.exe115⤵PID:1564
-
\??\c:\jdppd.exec:\jdppd.exe116⤵PID:468
-
\??\c:\5dvdp.exec:\5dvdp.exe117⤵PID:2404
-
\??\c:\9frrxxf.exec:\9frrxxf.exe118⤵
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\nhbhnb.exec:\nhbhnb.exe119⤵PID:2312
-
\??\c:\bbnthh.exec:\bbnthh.exe120⤵PID:1716
-
\??\c:\vvjvd.exec:\vvjvd.exe121⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-