Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe
-
Size
453KB
-
MD5
ba378280d904c62c413b1ac2b556d513
-
SHA1
7db4943db0f761d760a43ed3dc5e19f3f9be596e
-
SHA256
805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d
-
SHA512
18142bdd0ca43219ce0bcf84c245eef3ec09294938175604c3993eafa1a6ea563c4be576d73ba1720e84a26b60a874fc937f3abff0cb5dae88a946bf1e7bbc21
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1948-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-85-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2512-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-137-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-157-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1728-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-224-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/336-235-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1908-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-273-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/756-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-294-0x00000000770E0000-0x00000000771DA000-memory.dmp family_blackmoon behavioral1/memory/756-293-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2064-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-433-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2288-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-473-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2724-480-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2944-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-815-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/576-890-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-960-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1256-985-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2372-1100-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2952-1156-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1244-1259-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1948 vvjjd.exe 2388 tnbbhn.exe 2128 dvdpd.exe 2168 5frrrrx.exe 576 hhtbhh.exe 2744 1frrrrf.exe 2612 bbnbnn.exe 2852 jpdpd.exe 2752 hbthnb.exe 2512 ddvvj.exe 2628 xrlrxxl.exe 2260 9tbthh.exe 1180 ppppd.exe 1360 fxllxll.exe 1664 ttbtbt.exe 2456 3jjpd.exe 2284 bthnth.exe 1728 7pdpp.exe 1036 xrlxfrl.exe 2824 3nbttn.exe 2944 3vdvj.exe 2020 rfrxllx.exe 2716 jdvdp.exe 336 lfllxxr.exe 1908 5bhhnh.exe 1208 ppjjp.exe 1456 hbtnbh.exe 2860 7ddpd.exe 3032 tbhnhn.exe 896 nnhthh.exe 756 fxrxlrf.exe 2984 ppddp.exe 2980 3xrxfrx.exe 2064 tnbbhh.exe 2428 1dddj.exe 2952 ffllllr.exe 2720 llxxrxl.exe 2696 nhbhbh.exe 2796 dvjjj.exe 3024 3vpvv.exe 2544 xrrxfrf.exe 2852 bhhtth.exe 2752 ntbnhn.exe 2560 3dpvv.exe 2552 5xxrrrr.exe 2332 3bhhhn.exe 2228 7nbbhn.exe 1096 1pdvv.exe 1140 9xxrfrx.exe 1668 hbntbb.exe 1300 7bthtb.exe 2288 3pdvv.exe 2312 rxrxrxr.exe 1892 rlfrlrx.exe 1196 9bbhth.exe 2816 vvpdj.exe 1720 ffffxxf.exe 2724 7xrxxff.exe 2944 tnhhtt.exe 380 7vjpv.exe 2488 lrlxlxx.exe 2164 lrflrxl.exe 2352 nbnnnn.exe 1616 jpdjv.exe -
resource yara_rule behavioral1/memory/1948-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-629-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2620-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-724-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-985-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1772-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 1948 2368 805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe 30 PID 2368 wrote to memory of 1948 2368 805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe 30 PID 2368 wrote to memory of 1948 2368 805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe 30 PID 2368 wrote to memory of 1948 2368 805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe 30 PID 1948 wrote to memory of 2388 1948 vvjjd.exe 31 PID 1948 wrote to memory of 2388 1948 vvjjd.exe 31 PID 1948 wrote to memory of 2388 1948 vvjjd.exe 31 PID 1948 wrote to memory of 2388 1948 vvjjd.exe 31 PID 2388 wrote to memory of 2128 2388 tnbbhn.exe 32 PID 2388 wrote to memory of 2128 2388 tnbbhn.exe 32 PID 2388 wrote to memory of 2128 2388 tnbbhn.exe 32 PID 2388 wrote to memory of 2128 2388 tnbbhn.exe 32 PID 2128 wrote to memory of 2168 2128 dvdpd.exe 33 PID 2128 wrote to memory of 2168 2128 dvdpd.exe 33 PID 2128 wrote to memory of 2168 2128 dvdpd.exe 33 PID 2128 wrote to memory of 2168 2128 dvdpd.exe 33 PID 2168 wrote to memory of 576 2168 5frrrrx.exe 34 PID 2168 wrote to memory of 576 2168 5frrrrx.exe 34 PID 2168 wrote to memory of 576 2168 5frrrrx.exe 34 PID 2168 wrote to memory of 576 2168 5frrrrx.exe 34 PID 576 wrote to memory of 2744 576 hhtbhh.exe 35 PID 576 wrote to memory of 2744 576 hhtbhh.exe 35 PID 576 wrote to memory of 2744 576 hhtbhh.exe 35 PID 576 wrote to memory of 2744 576 hhtbhh.exe 35 PID 2744 wrote to memory of 2612 2744 1frrrrf.exe 36 PID 2744 wrote to memory of 2612 2744 1frrrrf.exe 36 PID 2744 wrote to memory of 2612 2744 1frrrrf.exe 36 PID 2744 wrote to memory of 2612 2744 1frrrrf.exe 36 PID 2612 wrote to memory of 2852 2612 bbnbnn.exe 37 PID 2612 wrote to memory of 2852 2612 bbnbnn.exe 37 PID 2612 wrote to memory of 2852 2612 bbnbnn.exe 37 PID 2612 wrote to memory of 2852 2612 bbnbnn.exe 37 PID 2852 wrote to memory of 2752 2852 jpdpd.exe 38 PID 2852 wrote to memory of 2752 2852 jpdpd.exe 38 PID 2852 wrote to memory of 2752 2852 jpdpd.exe 38 PID 2852 wrote to memory of 2752 2852 jpdpd.exe 38 PID 2752 wrote to memory of 2512 2752 hbthnb.exe 39 PID 2752 wrote to memory of 2512 2752 hbthnb.exe 39 PID 2752 wrote to memory of 2512 2752 hbthnb.exe 39 PID 2752 wrote to memory of 2512 2752 hbthnb.exe 39 PID 2512 wrote to memory of 2628 2512 ddvvj.exe 40 PID 2512 wrote to memory of 2628 2512 ddvvj.exe 40 PID 2512 wrote to memory of 2628 2512 ddvvj.exe 40 PID 2512 wrote to memory of 2628 2512 ddvvj.exe 40 PID 2628 wrote to memory of 2260 2628 xrlrxxl.exe 41 PID 2628 wrote to memory of 2260 2628 xrlrxxl.exe 41 PID 2628 wrote to memory of 2260 2628 xrlrxxl.exe 41 PID 2628 wrote to memory of 2260 2628 xrlrxxl.exe 41 PID 2260 wrote to memory of 1180 2260 9tbthh.exe 42 PID 2260 wrote to memory of 1180 2260 9tbthh.exe 42 PID 2260 wrote to memory of 1180 2260 9tbthh.exe 42 PID 2260 wrote to memory of 1180 2260 9tbthh.exe 42 PID 1180 wrote to memory of 1360 1180 ppppd.exe 43 PID 1180 wrote to memory of 1360 1180 ppppd.exe 43 PID 1180 wrote to memory of 1360 1180 ppppd.exe 43 PID 1180 wrote to memory of 1360 1180 ppppd.exe 43 PID 1360 wrote to memory of 1664 1360 fxllxll.exe 44 PID 1360 wrote to memory of 1664 1360 fxllxll.exe 44 PID 1360 wrote to memory of 1664 1360 fxllxll.exe 44 PID 1360 wrote to memory of 1664 1360 fxllxll.exe 44 PID 1664 wrote to memory of 2456 1664 ttbtbt.exe 45 PID 1664 wrote to memory of 2456 1664 ttbtbt.exe 45 PID 1664 wrote to memory of 2456 1664 ttbtbt.exe 45 PID 1664 wrote to memory of 2456 1664 ttbtbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe"C:\Users\Admin\AppData\Local\Temp\805f18e19464015ea5b53754323ffb0c29223bf207f3baab3cfa6d550262539d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vvjjd.exec:\vvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\tnbbhn.exec:\tnbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvdpd.exec:\dvdpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\5frrrrx.exec:\5frrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hhtbhh.exec:\hhtbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\1frrrrf.exec:\1frrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\bbnbnn.exec:\bbnbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jpdpd.exec:\jpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\hbthnb.exec:\hbthnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ddvvj.exec:\ddvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xrlrxxl.exec:\xrlrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\9tbthh.exec:\9tbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\ppppd.exec:\ppppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\fxllxll.exec:\fxllxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\ttbtbt.exec:\ttbtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\3jjpd.exec:\3jjpd.exe17⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bthnth.exec:\bthnth.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7pdpp.exec:\7pdpp.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrlxfrl.exec:\xrlxfrl.exe20⤵
- Executes dropped EXE
PID:1036 -
\??\c:\3nbttn.exec:\3nbttn.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3vdvj.exec:\3vdvj.exe22⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rfrxllx.exec:\rfrxllx.exe23⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jdvdp.exec:\jdvdp.exe24⤵
- Executes dropped EXE
PID:2716 -
\??\c:\lfllxxr.exec:\lfllxxr.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\5bhhnh.exec:\5bhhnh.exe26⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ppjjp.exec:\ppjjp.exe27⤵
- Executes dropped EXE
PID:1208 -
\??\c:\hbtnbh.exec:\hbtnbh.exe28⤵
- Executes dropped EXE
PID:1456 -
\??\c:\7ddpd.exec:\7ddpd.exe29⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tbhnhn.exec:\tbhnhn.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nnhthh.exec:\nnhthh.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe32⤵
- Executes dropped EXE
PID:756 -
\??\c:\3bntnb.exec:\3bntnb.exe33⤵PID:1516
-
\??\c:\ppddp.exec:\ppddp.exe34⤵
- Executes dropped EXE
PID:2984 -
\??\c:\3xrxfrx.exec:\3xrxfrx.exe35⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tnbbhh.exec:\tnbbhh.exe36⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1dddj.exec:\1dddj.exe37⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ffllllr.exec:\ffllllr.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\llxxrxl.exec:\llxxrxl.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nhbhbh.exec:\nhbhbh.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dvjjj.exec:\dvjjj.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3vpvv.exec:\3vpvv.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\xrrxfrf.exec:\xrrxfrf.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bhhtth.exec:\bhhtth.exe44⤵
- Executes dropped EXE
PID:2852 -
\??\c:\ntbnhn.exec:\ntbnhn.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3dpvv.exec:\3dpvv.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560 -
\??\c:\5xxrrrr.exec:\5xxrrrr.exe47⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3bhhhn.exec:\3bhhhn.exe48⤵
- Executes dropped EXE
PID:2332 -
\??\c:\7nbbhn.exec:\7nbbhn.exe49⤵
- Executes dropped EXE
PID:2228 -
\??\c:\1pdvv.exec:\1pdvv.exe50⤵
- Executes dropped EXE
PID:1096 -
\??\c:\9xxrfrx.exec:\9xxrfrx.exe51⤵
- Executes dropped EXE
PID:1140 -
\??\c:\hbntbb.exec:\hbntbb.exe52⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7bthtb.exec:\7bthtb.exe53⤵
- Executes dropped EXE
PID:1300 -
\??\c:\3pdvv.exec:\3pdvv.exe54⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rxrxrxr.exec:\rxrxrxr.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\rlfrlrx.exec:\rlfrlrx.exe56⤵
- Executes dropped EXE
PID:1892 -
\??\c:\9bbhth.exec:\9bbhth.exe57⤵
- Executes dropped EXE
PID:1196 -
\??\c:\vvpdj.exec:\vvpdj.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ffffxxf.exec:\ffffxxf.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7xrxxff.exec:\7xrxxff.exe60⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tnhhtt.exec:\tnhhtt.exe61⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7vjpv.exec:\7vjpv.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\lrlxlxx.exec:\lrlxlxx.exe63⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lrflrxl.exec:\lrflrxl.exe64⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nbnnnn.exec:\nbnnnn.exe65⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jpdjv.exec:\jpdjv.exe66⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjvvp.exec:\jjvvp.exe67⤵PID:2480
-
\??\c:\rrrrffr.exec:\rrrrffr.exe68⤵PID:1208
-
\??\c:\ttthnb.exec:\ttthnb.exe69⤵PID:2200
-
\??\c:\thtbnn.exec:\thtbnn.exe70⤵PID:2208
-
\??\c:\jddpj.exec:\jddpj.exe71⤵PID:2308
-
\??\c:\lxxfrxf.exec:\lxxfrxf.exe72⤵PID:1408
-
\??\c:\bthhnt.exec:\bthhnt.exe73⤵PID:2432
-
\??\c:\5djjv.exec:\5djjv.exe74⤵PID:2436
-
\??\c:\rlflxfr.exec:\rlflxfr.exe75⤵PID:2920
-
\??\c:\htbnbh.exec:\htbnbh.exe76⤵PID:2376
-
\??\c:\tthnbb.exec:\tthnbb.exe77⤵PID:1848
-
\??\c:\7jdjp.exec:\7jdjp.exe78⤵PID:1780
-
\??\c:\rrflllr.exec:\rrflllr.exe79⤵PID:2064
-
\??\c:\nnhtnt.exec:\nnhtnt.exe80⤵PID:2792
-
\??\c:\btthnt.exec:\btthnt.exe81⤵PID:2468
-
\??\c:\dvvdp.exec:\dvvdp.exe82⤵PID:3068
-
\??\c:\lflfxxl.exec:\lflfxxl.exe83⤵PID:2756
-
\??\c:\xlffrxl.exec:\xlffrxl.exe84⤵PID:2196
-
\??\c:\7hbhnt.exec:\7hbhnt.exe85⤵PID:2740
-
\??\c:\vpdpv.exec:\vpdpv.exe86⤵PID:2644
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe87⤵PID:2620
-
\??\c:\ffxlxxx.exec:\ffxlxxx.exe88⤵PID:3016
-
\??\c:\tnthbn.exec:\tnthbn.exe89⤵PID:2472
-
\??\c:\pppvj.exec:\pppvj.exe90⤵PID:2552
-
\??\c:\pvvjd.exec:\pvvjd.exe91⤵PID:2260
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe92⤵PID:2228
-
\??\c:\bbbnbn.exec:\bbbnbn.exe93⤵PID:316
-
\??\c:\nnhthn.exec:\nnhthn.exe94⤵PID:1180
-
\??\c:\7dvvd.exec:\7dvvd.exe95⤵PID:1336
-
\??\c:\lfxflrf.exec:\lfxflrf.exe96⤵PID:2420
-
\??\c:\frrrflr.exec:\frrrflr.exe97⤵PID:1432
-
\??\c:\tnntbh.exec:\tnntbh.exe98⤵PID:1844
-
\??\c:\bhhbht.exec:\bhhbht.exe99⤵PID:1032
-
\??\c:\jvjpd.exec:\jvjpd.exe100⤵PID:1680
-
\??\c:\fxfxlxl.exec:\fxfxlxl.exe101⤵PID:1344
-
\??\c:\rlxlxlx.exec:\rlxlxlx.exe102⤵PID:2608
-
\??\c:\nhbhtb.exec:\nhbhtb.exe103⤵PID:2728
-
\??\c:\1btbbb.exec:\1btbbb.exe104⤵PID:1772
-
\??\c:\3jvdv.exec:\3jvdv.exe105⤵PID:2872
-
\??\c:\9xrrrrf.exec:\9xrrrrf.exe106⤵PID:2380
-
\??\c:\7xxflxl.exec:\7xxflxl.exe107⤵PID:1716
-
\??\c:\5btbnb.exec:\5btbnb.exe108⤵PID:2164
-
\??\c:\pppdj.exec:\pppdj.exe109⤵PID:1472
-
\??\c:\9jjpj.exec:\9jjpj.exe110⤵PID:1176
-
\??\c:\lrfrlxl.exec:\lrfrlxl.exe111⤵PID:608
-
\??\c:\tnhbbn.exec:\tnhbbn.exe112⤵PID:684
-
\??\c:\bbhbnb.exec:\bbhbnb.exe113⤵PID:2268
-
\??\c:\5jjvj.exec:\5jjvj.exe114⤵PID:3032
-
\??\c:\flrlxlx.exec:\flrlxlx.exe115⤵PID:992
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe116⤵PID:1512
-
\??\c:\nhhthb.exec:\nhhthb.exe117⤵PID:2336
-
\??\c:\bttbhb.exec:\bttbhb.exe118⤵PID:1948
-
\??\c:\pvvdj.exec:\pvvdj.exe119⤵
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\3fllrrx.exec:\3fllrrx.exe120⤵PID:2980
-
\??\c:\rrxlrfl.exec:\rrxlrfl.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-