Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe
-
Size
456KB
-
MD5
ef605d78c631dabd16caf4ab30a2f35b
-
SHA1
70aadb02d97141f354336789fc56b0d44adcd88a
-
SHA256
06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6
-
SHA512
fe906cccfa82877760b48a394996fa5c04aaf6f6fef0336ef93d5659b545d22f829dd0d52b7c49445e1cc641324e1ed33359f147da86b9a4b514e5f88eba1a28
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRS:q7Tc2NYHUrAwfMp3CDRS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2872-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-124-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2604-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-163-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1804-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-363-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1656-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-436-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-458-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2776-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-732-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1844-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-817-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2820-888-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/944-1122-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2300-1210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1852-1349-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2916 djdjd.exe 2300 5lrlflf.exe 2348 vpppj.exe 2332 rfxffrl.exe 1752 ntnbtb.exe 2356 pppdd.exe 2896 1lxfxlx.exe 2592 tbntbh.exe 2704 djdjv.exe 2608 5xrxrrf.exe 2644 vpjjd.exe 2512 frrrxxl.exe 2280 hbnntb.exe 2604 hhhtht.exe 2892 3jdjd.exe 2444 vpdpd.exe 2040 7llxrxl.exe 1904 lfffxlx.exe 1804 9jdjp.exe 1844 vpdjv.exe 1636 fxrrflf.exe 1640 thbbnn.exe 1060 jdvvd.exe 2124 bthntt.exe 832 1vddj.exe 2164 ttnbht.exe 1956 tbbnhn.exe 1376 rlffrrf.exe 3004 hbtthn.exe 2276 pppvp.exe 1684 nhttbb.exe 1148 ppjdv.exe 2820 nnntnh.exe 880 jddpp.exe 1716 dvvjv.exe 2032 rfrxlrf.exe 2812 tnnttn.exe 2432 ppvpj.exe 2272 dppvj.exe 2108 9xrxlrf.exe 2796 bbttbb.exe 2292 nhbnhn.exe 2568 7pjvp.exe 1656 1fxfrrx.exe 2948 bbbnbh.exe 2592 1tnntn.exe 2632 3pddp.exe 2712 lllrxxl.exe 2956 7flllff.exe 2492 tthntb.exe 2652 pjvdp.exe 2480 xfxlxlx.exe 2560 fxlxrxl.exe 2264 nnnhbh.exe 836 jvjdd.exe 776 xfrlrxf.exe 2384 ffxllxl.exe 1932 hntbbn.exe 752 ddvdp.exe 1200 fxlrxrx.exe 1756 thbnnt.exe 800 5btbhh.exe 2776 jddjv.exe 1636 lfxfxfx.exe -
resource yara_rule behavioral1/memory/2872-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-282-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2820-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-734-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2040-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-1062-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-1096-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-1115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/744-1141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-1297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-1310-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2916 2872 06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe 28 PID 2872 wrote to memory of 2916 2872 06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe 28 PID 2872 wrote to memory of 2916 2872 06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe 28 PID 2872 wrote to memory of 2916 2872 06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe 28 PID 2916 wrote to memory of 2300 2916 djdjd.exe 29 PID 2916 wrote to memory of 2300 2916 djdjd.exe 29 PID 2916 wrote to memory of 2300 2916 djdjd.exe 29 PID 2916 wrote to memory of 2300 2916 djdjd.exe 29 PID 2300 wrote to memory of 2348 2300 5lrlflf.exe 30 PID 2300 wrote to memory of 2348 2300 5lrlflf.exe 30 PID 2300 wrote to memory of 2348 2300 5lrlflf.exe 30 PID 2300 wrote to memory of 2348 2300 5lrlflf.exe 30 PID 2348 wrote to memory of 2332 2348 vpppj.exe 31 PID 2348 wrote to memory of 2332 2348 vpppj.exe 31 PID 2348 wrote to memory of 2332 2348 vpppj.exe 31 PID 2348 wrote to memory of 2332 2348 vpppj.exe 31 PID 2332 wrote to memory of 1752 2332 rfxffrl.exe 32 PID 2332 wrote to memory of 1752 2332 rfxffrl.exe 32 PID 2332 wrote to memory of 1752 2332 rfxffrl.exe 32 PID 2332 wrote to memory of 1752 2332 rfxffrl.exe 32 PID 1752 wrote to memory of 2356 1752 ntnbtb.exe 33 PID 1752 wrote to memory of 2356 1752 ntnbtb.exe 33 PID 1752 wrote to memory of 2356 1752 ntnbtb.exe 33 PID 1752 wrote to memory of 2356 1752 ntnbtb.exe 33 PID 2356 wrote to memory of 2896 2356 pppdd.exe 34 PID 2356 wrote to memory of 2896 2356 pppdd.exe 34 PID 2356 wrote to memory of 2896 2356 pppdd.exe 34 PID 2356 wrote to memory of 2896 2356 pppdd.exe 34 PID 2896 wrote to memory of 2592 2896 1lxfxlx.exe 35 PID 2896 wrote to memory of 2592 2896 1lxfxlx.exe 35 PID 2896 wrote to memory of 2592 2896 1lxfxlx.exe 35 PID 2896 wrote to memory of 2592 2896 1lxfxlx.exe 35 PID 2592 wrote to memory of 2704 2592 tbntbh.exe 36 PID 2592 wrote to memory of 2704 2592 tbntbh.exe 36 PID 2592 wrote to memory of 2704 2592 tbntbh.exe 36 PID 2592 wrote to memory of 2704 2592 tbntbh.exe 36 PID 2704 wrote to memory of 2608 2704 djdjv.exe 37 PID 2704 wrote to memory of 2608 2704 djdjv.exe 37 PID 2704 wrote to memory of 2608 2704 djdjv.exe 37 PID 2704 wrote to memory of 2608 2704 djdjv.exe 37 PID 2608 wrote to memory of 2644 2608 5xrxrrf.exe 38 PID 2608 wrote to memory of 2644 2608 5xrxrrf.exe 38 PID 2608 wrote to memory of 2644 2608 5xrxrrf.exe 38 PID 2608 wrote to memory of 2644 2608 5xrxrrf.exe 38 PID 2644 wrote to memory of 2512 2644 vpjjd.exe 39 PID 2644 wrote to memory of 2512 2644 vpjjd.exe 39 PID 2644 wrote to memory of 2512 2644 vpjjd.exe 39 PID 2644 wrote to memory of 2512 2644 vpjjd.exe 39 PID 2512 wrote to memory of 2280 2512 frrrxxl.exe 40 PID 2512 wrote to memory of 2280 2512 frrrxxl.exe 40 PID 2512 wrote to memory of 2280 2512 frrrxxl.exe 40 PID 2512 wrote to memory of 2280 2512 frrrxxl.exe 40 PID 2280 wrote to memory of 2604 2280 hbnntb.exe 41 PID 2280 wrote to memory of 2604 2280 hbnntb.exe 41 PID 2280 wrote to memory of 2604 2280 hbnntb.exe 41 PID 2280 wrote to memory of 2604 2280 hbnntb.exe 41 PID 2604 wrote to memory of 2892 2604 hhhtht.exe 42 PID 2604 wrote to memory of 2892 2604 hhhtht.exe 42 PID 2604 wrote to memory of 2892 2604 hhhtht.exe 42 PID 2604 wrote to memory of 2892 2604 hhhtht.exe 42 PID 2892 wrote to memory of 2444 2892 3jdjd.exe 43 PID 2892 wrote to memory of 2444 2892 3jdjd.exe 43 PID 2892 wrote to memory of 2444 2892 3jdjd.exe 43 PID 2892 wrote to memory of 2444 2892 3jdjd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe"C:\Users\Admin\AppData\Local\Temp\06ce0a4723aea353ca28112322d9733caaaea946b51c8683221ac636a57a83f6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\djdjd.exec:\djdjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\5lrlflf.exec:\5lrlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\vpppj.exec:\vpppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rfxffrl.exec:\rfxffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\ntnbtb.exec:\ntnbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\pppdd.exec:\pppdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\1lxfxlx.exec:\1lxfxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\tbntbh.exec:\tbntbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\djdjv.exec:\djdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\5xrxrrf.exec:\5xrxrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\vpjjd.exec:\vpjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\frrrxxl.exec:\frrrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\hbnntb.exec:\hbnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hhhtht.exec:\hhhtht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\3jdjd.exec:\3jdjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vpdpd.exec:\vpdpd.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\7llxrxl.exec:\7llxrxl.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\lfffxlx.exec:\lfffxlx.exe19⤵
- Executes dropped EXE
PID:1904 -
\??\c:\9jdjp.exec:\9jdjp.exe20⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vpdjv.exec:\vpdjv.exe21⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fxrrflf.exec:\fxrrflf.exe22⤵
- Executes dropped EXE
PID:1636 -
\??\c:\thbbnn.exec:\thbbnn.exe23⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jdvvd.exec:\jdvvd.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\bthntt.exec:\bthntt.exe25⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1vddj.exec:\1vddj.exe26⤵
- Executes dropped EXE
PID:832 -
\??\c:\ttnbht.exec:\ttnbht.exe27⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tbbnhn.exec:\tbbnhn.exe28⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rlffrrf.exec:\rlffrrf.exe29⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hbtthn.exec:\hbtthn.exe30⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pppvp.exec:\pppvp.exe31⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhttbb.exec:\nhttbb.exe32⤵
- Executes dropped EXE
PID:1684 -
\??\c:\ppjdv.exec:\ppjdv.exe33⤵
- Executes dropped EXE
PID:1148 -
\??\c:\nnntnh.exec:\nnntnh.exe34⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jddpp.exec:\jddpp.exe35⤵
- Executes dropped EXE
PID:880 -
\??\c:\dvvjv.exec:\dvvjv.exe36⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnnttn.exec:\tnnttn.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ppvpj.exec:\ppvpj.exe39⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dppvj.exec:\dppvj.exe40⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9xrxlrf.exec:\9xrxlrf.exe41⤵
- Executes dropped EXE
PID:2108 -
\??\c:\bbttbb.exec:\bbttbb.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhbnhn.exec:\nhbnhn.exe43⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7pjvp.exec:\7pjvp.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1fxfrrx.exec:\1fxfrrx.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbbnbh.exec:\bbbnbh.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\1tnntn.exec:\1tnntn.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3pddp.exec:\3pddp.exe48⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lllrxxl.exec:\lllrxxl.exe49⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7flllff.exec:\7flllff.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\tthntb.exec:\tthntb.exe51⤵
- Executes dropped EXE
PID:2492 -
\??\c:\pjvdp.exec:\pjvdp.exe52⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xfxlxlx.exec:\xfxlxlx.exe53⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fxlxrxl.exec:\fxlxrxl.exe54⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nnnhbh.exec:\nnnhbh.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jvjdd.exec:\jvjdd.exe56⤵
- Executes dropped EXE
PID:836 -
\??\c:\xfrlrxf.exec:\xfrlrxf.exe57⤵
- Executes dropped EXE
PID:776 -
\??\c:\ffxllxl.exec:\ffxllxl.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hntbbn.exec:\hntbbn.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ddvdp.exec:\ddvdp.exe60⤵
- Executes dropped EXE
PID:752 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\thbnnt.exec:\thbnnt.exe62⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5btbhh.exec:\5btbhh.exe63⤵
- Executes dropped EXE
PID:800 -
\??\c:\jddjv.exec:\jddjv.exe64⤵
- Executes dropped EXE
PID:2776 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe65⤵
- Executes dropped EXE
PID:1636 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe66⤵PID:2544
-
\??\c:\bthhtt.exec:\bthhtt.exe67⤵PID:1300
-
\??\c:\pdppv.exec:\pdppv.exe68⤵PID:2328
-
\??\c:\vppjv.exec:\vppjv.exe69⤵PID:2464
-
\??\c:\xlrlllr.exec:\xlrlllr.exe70⤵PID:1724
-
\??\c:\thttnt.exec:\thttnt.exe71⤵PID:600
-
\??\c:\nbhnbh.exec:\nbhnbh.exe72⤵PID:1512
-
\??\c:\jvpjp.exec:\jvpjp.exe73⤵PID:1516
-
\??\c:\xlxlllr.exec:\xlxlllr.exe74⤵PID:1232
-
\??\c:\flrfxrl.exec:\flrfxrl.exe75⤵PID:1528
-
\??\c:\thtbbb.exec:\thtbbb.exe76⤵PID:1468
-
\??\c:\pvjpv.exec:\pvjpv.exe77⤵PID:3000
-
\??\c:\9rlllfr.exec:\9rlllfr.exe78⤵PID:1684
-
\??\c:\1frxlrr.exec:\1frxlrr.exe79⤵PID:464
-
\??\c:\tnbtnh.exec:\tnbtnh.exe80⤵PID:1736
-
\??\c:\pdjjv.exec:\pdjjv.exe81⤵PID:392
-
\??\c:\jdpdj.exec:\jdpdj.exe82⤵PID:2260
-
\??\c:\lxllfff.exec:\lxllfff.exe83⤵PID:1688
-
\??\c:\hbnhtt.exec:\hbnhtt.exe84⤵PID:2284
-
\??\c:\bntntt.exec:\bntntt.exe85⤵PID:1748
-
\??\c:\jvjjp.exec:\jvjjp.exe86⤵PID:2348
-
\??\c:\lrxrxxl.exec:\lrxrxxl.exe87⤵PID:2052
-
\??\c:\xlxlffl.exec:\xlxlffl.exe88⤵PID:284
-
\??\c:\tbnhtb.exec:\tbnhtb.exe89⤵PID:1604
-
\??\c:\jjvpv.exec:\jjvpv.exe90⤵PID:2356
-
\??\c:\xxflrff.exec:\xxflrff.exe91⤵PID:2104
-
\??\c:\rrlxffr.exec:\rrlxffr.exe92⤵PID:2612
-
\??\c:\hbnbbb.exec:\hbnbbb.exe93⤵PID:2948
-
\??\c:\9jdpv.exec:\9jdpv.exe94⤵PID:2592
-
\??\c:\djdpj.exec:\djdpj.exe95⤵PID:2632
-
\??\c:\xlrrffl.exec:\xlrrffl.exe96⤵PID:2760
-
\??\c:\hthhbb.exec:\hthhbb.exe97⤵PID:2956
-
\??\c:\1htbnn.exec:\1htbnn.exe98⤵PID:2540
-
\??\c:\dpddj.exec:\dpddj.exe99⤵PID:2652
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe100⤵PID:2480
-
\??\c:\1rxrflx.exec:\1rxrflx.exe101⤵PID:2484
-
\??\c:\5ttthb.exec:\5ttthb.exe102⤵PID:2604
-
\??\c:\7jddd.exec:\7jddd.exe103⤵PID:2888
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe104⤵PID:1792
-
\??\c:\lxlxlfl.exec:\lxlxlfl.exe105⤵PID:2040
-
\??\c:\5tttbn.exec:\5tttbn.exe106⤵PID:1932
-
\??\c:\vpdpd.exec:\vpdpd.exe107⤵PID:2400
-
\??\c:\xrllxrx.exec:\xrllxrx.exe108⤵PID:1036
-
\??\c:\rlffxxl.exec:\rlffxxl.exe109⤵PID:1844
-
\??\c:\hnhtbt.exec:\hnhtbt.exe110⤵PID:800
-
\??\c:\jdjpv.exec:\jdjpv.exe111⤵PID:2776
-
\??\c:\1vjdd.exec:\1vjdd.exe112⤵PID:1220
-
\??\c:\rfxxlrx.exec:\rfxxlrx.exe113⤵PID:2544
-
\??\c:\3bhhhh.exec:\3bhhhh.exe114⤵PID:1304
-
\??\c:\vvpdj.exec:\vvpdj.exe115⤵PID:2328
-
\??\c:\vvdjv.exec:\vvdjv.exe116⤵PID:1960
-
\??\c:\9xrxflx.exec:\9xrxflx.exe117⤵PID:1724
-
\??\c:\5bnhhb.exec:\5bnhhb.exe118⤵PID:3056
-
\??\c:\1bbhtb.exec:\1bbhtb.exe119⤵PID:1512
-
\??\c:\jdpvd.exec:\jdpvd.exe120⤵PID:744
-
\??\c:\1frflrl.exec:\1frflrl.exe121⤵PID:1232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-