Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe
-
Size
453KB
-
MD5
ce417fdd5c854baf6e47a136ddee9eae
-
SHA1
545b12a384d80b59ba13dcd2a354f7045fe89b30
-
SHA256
d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789
-
SHA512
1809ae6ef8e36605f194387c2c9e3a12c1023b34f2699fc991b5af06d0a3fda399a9c0536dfbb8c4fb48274382611458bc38ee129d5353cade0591bba34bbb04
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2316-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-150-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1612-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-214-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2136-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-243-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1724-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-370-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1528-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-378-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-505-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-519-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1080-528-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/556-535-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2484-563-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1804-577-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2592-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-656-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-678-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-734-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1048-762-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 9llrflf.exe 2876 bthtbh.exe 2712 vvdpp.exe 2612 flrxrxx.exe 2716 vjdjj.exe 2572 9rfffff.exe 1976 5ppdv.exe 1988 xffxxxx.exe 2068 1jdpv.exe 2184 fxrlrlr.exe 2224 pppjd.exe 2648 xflxlxl.exe 2776 jvjpd.exe 2636 bhbnbn.exe 2304 rrxlxfx.exe 1612 3xlxrxf.exe 1524 pvpvv.exe 1608 lfrrxlf.exe 1480 vppdj.exe 1484 hhbhbh.exe 1128 1dvdj.exe 2404 lflrrrf.exe 2060 ddvdp.exe 2136 rlxfrrl.exe 2260 ddvdp.exe 684 thbbbt.exe 1728 vpjpj.exe 1748 rlxxxxf.exe 1420 dpvvd.exe 2056 rlfrflr.exe 2660 7ntntt.exe 1724 pjddd.exe 3008 btntbh.exe 1572 jjdjv.exe 2732 fxrflrf.exe 2876 7tnnnt.exe 2604 5bthnt.exe 2852 9pvdv.exe 2112 fxrxflx.exe 2744 nhbhnh.exe 2700 vpdvd.exe 1528 1pddp.exe 1896 lrlxlrl.exe 1692 nnhbnt.exe 2212 5jjjp.exe 2168 1ffrlfr.exe 2784 xrxffrr.exe 2924 hbnnbh.exe 1880 jvpvj.exe 2776 rfrfxxl.exe 2920 htbntt.exe 2092 bbbhnt.exe 2304 ddvdv.exe 680 llxxllx.exe 1096 tbtnth.exe 3020 dppvp.exe 1608 lxxlrxf.exe 1480 xxxflrl.exe 1704 nnhnbb.exe 2172 1vjjp.exe 948 lrlxrxf.exe 1036 5nnbtb.exe 2160 3vpvv.exe 1204 3fffxlx.exe -
resource yara_rule behavioral1/memory/2316-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-451-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/680-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-528-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2592-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-656-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-678-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1764-734-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1760-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-813-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2064 2316 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 30 PID 2316 wrote to memory of 2064 2316 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 30 PID 2316 wrote to memory of 2064 2316 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 30 PID 2316 wrote to memory of 2064 2316 d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe 30 PID 2064 wrote to memory of 2876 2064 9llrflf.exe 31 PID 2064 wrote to memory of 2876 2064 9llrflf.exe 31 PID 2064 wrote to memory of 2876 2064 9llrflf.exe 31 PID 2064 wrote to memory of 2876 2064 9llrflf.exe 31 PID 2876 wrote to memory of 2712 2876 bthtbh.exe 32 PID 2876 wrote to memory of 2712 2876 bthtbh.exe 32 PID 2876 wrote to memory of 2712 2876 bthtbh.exe 32 PID 2876 wrote to memory of 2712 2876 bthtbh.exe 32 PID 2712 wrote to memory of 2612 2712 vvdpp.exe 33 PID 2712 wrote to memory of 2612 2712 vvdpp.exe 33 PID 2712 wrote to memory of 2612 2712 vvdpp.exe 33 PID 2712 wrote to memory of 2612 2712 vvdpp.exe 33 PID 2612 wrote to memory of 2716 2612 flrxrxx.exe 34 PID 2612 wrote to memory of 2716 2612 flrxrxx.exe 34 PID 2612 wrote to memory of 2716 2612 flrxrxx.exe 34 PID 2612 wrote to memory of 2716 2612 flrxrxx.exe 34 PID 2716 wrote to memory of 2572 2716 vjdjj.exe 35 PID 2716 wrote to memory of 2572 2716 vjdjj.exe 35 PID 2716 wrote to memory of 2572 2716 vjdjj.exe 35 PID 2716 wrote to memory of 2572 2716 vjdjj.exe 35 PID 2572 wrote to memory of 1976 2572 9rfffff.exe 36 PID 2572 wrote to memory of 1976 2572 9rfffff.exe 36 PID 2572 wrote to memory of 1976 2572 9rfffff.exe 36 PID 2572 wrote to memory of 1976 2572 9rfffff.exe 36 PID 1976 wrote to memory of 1988 1976 5ppdv.exe 37 PID 1976 wrote to memory of 1988 1976 5ppdv.exe 37 PID 1976 wrote to memory of 1988 1976 5ppdv.exe 37 PID 1976 wrote to memory of 1988 1976 5ppdv.exe 37 PID 1988 wrote to memory of 2068 1988 xffxxxx.exe 38 PID 1988 wrote to memory of 2068 1988 xffxxxx.exe 38 PID 1988 wrote to memory of 2068 1988 xffxxxx.exe 38 PID 1988 wrote to memory of 2068 1988 xffxxxx.exe 38 PID 2068 wrote to memory of 2184 2068 1jdpv.exe 39 PID 2068 wrote to memory of 2184 2068 1jdpv.exe 39 PID 2068 wrote to memory of 2184 2068 1jdpv.exe 39 PID 2068 wrote to memory of 2184 2068 1jdpv.exe 39 PID 2184 wrote to memory of 2224 2184 fxrlrlr.exe 40 PID 2184 wrote to memory of 2224 2184 fxrlrlr.exe 40 PID 2184 wrote to memory of 2224 2184 fxrlrlr.exe 40 PID 2184 wrote to memory of 2224 2184 fxrlrlr.exe 40 PID 2224 wrote to memory of 2648 2224 pppjd.exe 41 PID 2224 wrote to memory of 2648 2224 pppjd.exe 41 PID 2224 wrote to memory of 2648 2224 pppjd.exe 41 PID 2224 wrote to memory of 2648 2224 pppjd.exe 41 PID 2648 wrote to memory of 2776 2648 xflxlxl.exe 42 PID 2648 wrote to memory of 2776 2648 xflxlxl.exe 42 PID 2648 wrote to memory of 2776 2648 xflxlxl.exe 42 PID 2648 wrote to memory of 2776 2648 xflxlxl.exe 42 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 43 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 43 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 43 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 43 PID 2636 wrote to memory of 2304 2636 bhbnbn.exe 44 PID 2636 wrote to memory of 2304 2636 bhbnbn.exe 44 PID 2636 wrote to memory of 2304 2636 bhbnbn.exe 44 PID 2636 wrote to memory of 2304 2636 bhbnbn.exe 44 PID 2304 wrote to memory of 1612 2304 rrxlxfx.exe 45 PID 2304 wrote to memory of 1612 2304 rrxlxfx.exe 45 PID 2304 wrote to memory of 1612 2304 rrxlxfx.exe 45 PID 2304 wrote to memory of 1612 2304 rrxlxfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe"C:\Users\Admin\AppData\Local\Temp\d97ba7dcdb821382b953f55b6c3290c2ececc65313c7fc8281b48a23520e8789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\9llrflf.exec:\9llrflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\bthtbh.exec:\bthtbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\vvdpp.exec:\vvdpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\flrxrxx.exec:\flrxrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vjdjj.exec:\vjdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\9rfffff.exec:\9rfffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5ppdv.exec:\5ppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\xffxxxx.exec:\xffxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\1jdpv.exec:\1jdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\fxrlrlr.exec:\fxrlrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pppjd.exec:\pppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xflxlxl.exec:\xflxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jvjpd.exec:\jvjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\bhbnbn.exec:\bhbnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rrxlxfx.exec:\rrxlxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\3xlxrxf.exec:\3xlxrxf.exe17⤵
- Executes dropped EXE
PID:1612 -
\??\c:\pvpvv.exec:\pvpvv.exe18⤵
- Executes dropped EXE
PID:1524 -
\??\c:\lfrrxlf.exec:\lfrrxlf.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vppdj.exec:\vppdj.exe20⤵
- Executes dropped EXE
PID:1480 -
\??\c:\hhbhbh.exec:\hhbhbh.exe21⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1dvdj.exec:\1dvdj.exe22⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lflrrrf.exec:\lflrrrf.exe23⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ddvdp.exec:\ddvdp.exe24⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ddvdp.exec:\ddvdp.exe26⤵
- Executes dropped EXE
PID:2260 -
\??\c:\thbbbt.exec:\thbbbt.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\vpjpj.exec:\vpjpj.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe29⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dpvvd.exec:\dpvvd.exe30⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rlfrflr.exec:\rlfrflr.exe31⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7ntntt.exec:\7ntntt.exe32⤵
- Executes dropped EXE
PID:2660 -
\??\c:\pjddd.exec:\pjddd.exe33⤵
- Executes dropped EXE
PID:1724 -
\??\c:\btntbh.exec:\btntbh.exe34⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jjdjv.exec:\jjdjv.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fxrflrf.exec:\fxrflrf.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7tnnnt.exec:\7tnnnt.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5bthnt.exec:\5bthnt.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9pvdv.exec:\9pvdv.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fxrxflx.exec:\fxrxflx.exe40⤵
- Executes dropped EXE
PID:2112 -
\??\c:\nhbhnh.exec:\nhbhnh.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vpdvd.exec:\vpdvd.exe42⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1pddp.exec:\1pddp.exe43⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe44⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nnhbnt.exec:\nnhbnt.exe45⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5jjjp.exec:\5jjjp.exe46⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1ffrlfr.exec:\1ffrlfr.exe47⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrxffrr.exec:\xrxffrr.exe48⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbnnbh.exec:\hbnnbh.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\jvpvj.exec:\jvpvj.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\rfrfxxl.exec:\rfrfxxl.exe51⤵
- Executes dropped EXE
PID:2776 -
\??\c:\htbntt.exec:\htbntt.exe52⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bbbhnt.exec:\bbbhnt.exe53⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ddvdv.exec:\ddvdv.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\llxxllx.exec:\llxxllx.exe55⤵
- Executes dropped EXE
PID:680 -
\??\c:\tbtnth.exec:\tbtnth.exe56⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dppvp.exec:\dppvp.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\lxxlrxf.exec:\lxxlrxf.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xxxflrl.exec:\xxxflrl.exe59⤵
- Executes dropped EXE
PID:1480 -
\??\c:\nnhnbb.exec:\nnhnbb.exe60⤵
- Executes dropped EXE
PID:1704 -
\??\c:\1vjjp.exec:\1vjjp.exe61⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lrlxrxf.exec:\lrlxrxf.exe62⤵
- Executes dropped EXE
PID:948 -
\??\c:\5nnbtb.exec:\5nnbtb.exe63⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3vpvv.exec:\3vpvv.exe64⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3fffxlx.exec:\3fffxlx.exe65⤵
- Executes dropped EXE
PID:1204 -
\??\c:\xrfrflf.exec:\xrfrflf.exe66⤵PID:1080
-
\??\c:\7btbhn.exec:\7btbhn.exe67⤵PID:556
-
\??\c:\jjdvj.exec:\jjdvj.exe68⤵PID:2484
-
\??\c:\lfxflrf.exec:\lfxflrf.exe69⤵PID:2324
-
\??\c:\1hhtnn.exec:\1hhtnn.exe70⤵PID:1804
-
\??\c:\9nbhnn.exec:\9nbhnn.exe71⤵PID:1044
-
\??\c:\jjjjj.exec:\jjjjj.exe72⤵PID:872
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe73⤵PID:2672
-
\??\c:\hnhnnh.exec:\hnhnnh.exe74⤵PID:2724
-
\??\c:\9pjpj.exec:\9pjpj.exe75⤵PID:2804
-
\??\c:\lfflrrl.exec:\lfflrrl.exe76⤵PID:1716
-
\??\c:\ttnthh.exec:\ttnthh.exe77⤵PID:2148
-
\??\c:\hbnhnt.exec:\hbnhnt.exe78⤵PID:2732
-
\??\c:\jjjdv.exec:\jjjdv.exe79⤵PID:2876
-
\??\c:\lxlrxfl.exec:\lxlrxfl.exe80⤵PID:2680
-
\??\c:\5xxlrfr.exec:\5xxlrfr.exe81⤵PID:2592
-
\??\c:\bnhnhn.exec:\bnhnhn.exe82⤵PID:2632
-
\??\c:\5jdjp.exec:\5jdjp.exe83⤵
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe84⤵PID:2196
-
\??\c:\llxrxxf.exec:\llxrxxf.exe85⤵PID:776
-
\??\c:\tnhhth.exec:\tnhhth.exe86⤵PID:2200
-
\??\c:\dddpp.exec:\dddpp.exe87⤵PID:2052
-
\??\c:\vvpjv.exec:\vvpjv.exe88⤵PID:660
-
\??\c:\1flrffl.exec:\1flrffl.exe89⤵PID:484
-
\??\c:\9bbhhh.exec:\9bbhhh.exe90⤵PID:2788
-
\??\c:\5nnbnt.exec:\5nnbnt.exe91⤵PID:2648
-
\??\c:\3dvdp.exec:\3dvdp.exe92⤵PID:468
-
\??\c:\lllrxlf.exec:\lllrxlf.exe93⤵PID:1856
-
\??\c:\7nhnth.exec:\7nhnth.exe94⤵PID:2100
-
\??\c:\hhhthn.exec:\hhhthn.exe95⤵PID:2972
-
\??\c:\pjdjp.exec:\pjdjp.exe96⤵PID:1756
-
\??\c:\xxlrxrf.exec:\xxlrxrf.exe97⤵PID:1764
-
\??\c:\fxllxxf.exec:\fxllxxf.exe98⤵PID:944
-
\??\c:\bnnnnh.exec:\bnnnnh.exe99⤵PID:2560
-
\??\c:\3vvdj.exec:\3vvdj.exe100⤵PID:1760
-
\??\c:\xrfrflx.exec:\xrfrflx.exe101⤵PID:1048
-
\??\c:\bhnhnh.exec:\bhnhnh.exe102⤵PID:1484
-
\??\c:\9btbhn.exec:\9btbhn.exe103⤵PID:2004
-
\??\c:\vjdvj.exec:\vjdvj.exe104⤵PID:2552
-
\??\c:\xrfxfrl.exec:\xrfxfrl.exe105⤵PID:344
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe106⤵PID:1376
-
\??\c:\5hhhnb.exec:\5hhhnb.exe107⤵PID:2160
-
\??\c:\dvpdd.exec:\dvpdd.exe108⤵PID:892
-
\??\c:\rlxflrl.exec:\rlxflrl.exe109⤵PID:1080
-
\??\c:\9rlrxxl.exec:\9rlrxxl.exe110⤵PID:556
-
\??\c:\jpddp.exec:\jpddp.exe111⤵PID:2484
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe112⤵PID:2140
-
\??\c:\hhbtnt.exec:\hhbtnt.exe113⤵PID:1848
-
\??\c:\7pdpd.exec:\7pdpd.exe114⤵PID:1044
-
\??\c:\7lfflrx.exec:\7lfflrx.exe115⤵PID:2336
-
\??\c:\tbhthn.exec:\tbhthn.exe116⤵PID:2492
-
\??\c:\pjvdp.exec:\pjvdp.exe117⤵PID:2300
-
\??\c:\vpdpj.exec:\vpdpj.exe118⤵PID:3008
-
\??\c:\ffxfxrr.exec:\ffxfxrr.exe119⤵PID:1572
-
\??\c:\7httbh.exec:\7httbh.exe120⤵PID:3000
-
\??\c:\vvdjv.exec:\vvdjv.exe121⤵PID:2828
-
\??\c:\fffrflx.exec:\fffrflx.exe122⤵PID:1992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-