Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe
-
Size
454KB
-
MD5
e9779298fd1bd3f965a6e8ea11323700
-
SHA1
a4d7b3b48ae468042b2af2aa2c0c0951620e606a
-
SHA256
11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725
-
SHA512
90a1d5891e71d342ea719584cd4a650dd49e26a4c94ef66590a1d7f47d8682f732e20d96dab3dc23dfd18364b0062aec8e09ada8ffc9ec1b581a674c0747e89b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-34-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-117-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1028-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-137-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2972-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-152-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-270-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/992-283-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1588-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-401-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1668-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-538-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-568-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1724-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-578-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-648-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1668-704-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/644-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-877-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-915-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2476-961-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-991-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2816-1041-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1068-1048-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-1180-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2628-1195-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2304-1219-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 xrllllr.exe 2328 bbhntn.exe 2340 nhnthn.exe 2808 xlxxfxl.exe 1896 5tbthn.exe 2920 vpdvd.exe 2968 lrlxffr.exe 2656 7vppd.exe 2788 llxflxf.exe 2640 3jvpd.exe 2324 1hbbnt.exe 1028 9jdvd.exe 1108 xrlrxxf.exe 2972 vjppv.exe 2840 llfrflr.exe 2824 1vddj.exe 2132 rfxrrrx.exe 2180 hhbntt.exe 2344 jdvdj.exe 2148 pjvvv.exe 1460 btntbb.exe 2428 dvjpv.exe 1300 1rflrrr.exe 2024 5jvvp.exe 1552 vpddj.exe 1528 hbthnn.exe 1468 1dddd.exe 2072 nhhhnn.exe 2064 vpdjv.exe 992 tththn.exe 880 ddpvv.exe 2440 ttnthn.exe 2336 jvpvj.exe 1588 xxxfxfl.exe 1700 tnbhtn.exe 3028 ttnntb.exe 2392 7ddjj.exe 2780 flxxffr.exe 2904 5fllrrl.exe 3044 nhbbhh.exe 1048 3jdjp.exe 2628 ppjjj.exe 1396 3lxffxx.exe 2420 nhtbbb.exe 2796 5bnhtn.exe 2652 1dvjp.exe 2112 7jdpp.exe 840 9frrrrx.exe 560 thtbhb.exe 1668 btnntt.exe 1640 dvjjj.exe 2820 rrxrffl.exe 2836 3rlflll.exe 2312 hhttbt.exe 2260 pddvd.exe 2520 5lrllll.exe 2268 lxrxlfr.exe 2200 nhtthn.exe 1888 pdjjj.exe 448 5jddd.exe 3068 lfrlrxf.exe 1920 thbhnt.exe 2272 9htnnn.exe 1144 pjvjv.exe -
resource yara_rule behavioral1/memory/2440-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-401-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1668-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-909-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-961-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-1041-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1636-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-1116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-1128-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2392-1154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-1187-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rflllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 2168 2440 11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe 30 PID 2440 wrote to memory of 2168 2440 11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe 30 PID 2440 wrote to memory of 2168 2440 11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe 30 PID 2440 wrote to memory of 2168 2440 11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe 30 PID 2168 wrote to memory of 2328 2168 xrllllr.exe 31 PID 2168 wrote to memory of 2328 2168 xrllllr.exe 31 PID 2168 wrote to memory of 2328 2168 xrllllr.exe 31 PID 2168 wrote to memory of 2328 2168 xrllllr.exe 31 PID 2328 wrote to memory of 2340 2328 bbhntn.exe 32 PID 2328 wrote to memory of 2340 2328 bbhntn.exe 32 PID 2328 wrote to memory of 2340 2328 bbhntn.exe 32 PID 2328 wrote to memory of 2340 2328 bbhntn.exe 32 PID 2340 wrote to memory of 2808 2340 nhnthn.exe 33 PID 2340 wrote to memory of 2808 2340 nhnthn.exe 33 PID 2340 wrote to memory of 2808 2340 nhnthn.exe 33 PID 2340 wrote to memory of 2808 2340 nhnthn.exe 33 PID 2808 wrote to memory of 1896 2808 xlxxfxl.exe 34 PID 2808 wrote to memory of 1896 2808 xlxxfxl.exe 34 PID 2808 wrote to memory of 1896 2808 xlxxfxl.exe 34 PID 2808 wrote to memory of 1896 2808 xlxxfxl.exe 34 PID 1896 wrote to memory of 2920 1896 5tbthn.exe 35 PID 1896 wrote to memory of 2920 1896 5tbthn.exe 35 PID 1896 wrote to memory of 2920 1896 5tbthn.exe 35 PID 1896 wrote to memory of 2920 1896 5tbthn.exe 35 PID 2920 wrote to memory of 2968 2920 vpdvd.exe 36 PID 2920 wrote to memory of 2968 2920 vpdvd.exe 36 PID 2920 wrote to memory of 2968 2920 vpdvd.exe 36 PID 2920 wrote to memory of 2968 2920 vpdvd.exe 36 PID 2968 wrote to memory of 2656 2968 lrlxffr.exe 37 PID 2968 wrote to memory of 2656 2968 lrlxffr.exe 37 PID 2968 wrote to memory of 2656 2968 lrlxffr.exe 37 PID 2968 wrote to memory of 2656 2968 lrlxffr.exe 37 PID 2656 wrote to memory of 2788 2656 7vppd.exe 38 PID 2656 wrote to memory of 2788 2656 7vppd.exe 38 PID 2656 wrote to memory of 2788 2656 7vppd.exe 38 PID 2656 wrote to memory of 2788 2656 7vppd.exe 38 PID 2788 wrote to memory of 2640 2788 llxflxf.exe 39 PID 2788 wrote to memory of 2640 2788 llxflxf.exe 39 PID 2788 wrote to memory of 2640 2788 llxflxf.exe 39 PID 2788 wrote to memory of 2640 2788 llxflxf.exe 39 PID 2640 wrote to memory of 2324 2640 3jvpd.exe 40 PID 2640 wrote to memory of 2324 2640 3jvpd.exe 40 PID 2640 wrote to memory of 2324 2640 3jvpd.exe 40 PID 2640 wrote to memory of 2324 2640 3jvpd.exe 40 PID 2324 wrote to memory of 1028 2324 1hbbnt.exe 41 PID 2324 wrote to memory of 1028 2324 1hbbnt.exe 41 PID 2324 wrote to memory of 1028 2324 1hbbnt.exe 41 PID 2324 wrote to memory of 1028 2324 1hbbnt.exe 41 PID 1028 wrote to memory of 1108 1028 9jdvd.exe 42 PID 1028 wrote to memory of 1108 1028 9jdvd.exe 42 PID 1028 wrote to memory of 1108 1028 9jdvd.exe 42 PID 1028 wrote to memory of 1108 1028 9jdvd.exe 42 PID 1108 wrote to memory of 2972 1108 xrlrxxf.exe 43 PID 1108 wrote to memory of 2972 1108 xrlrxxf.exe 43 PID 1108 wrote to memory of 2972 1108 xrlrxxf.exe 43 PID 1108 wrote to memory of 2972 1108 xrlrxxf.exe 43 PID 2972 wrote to memory of 2840 2972 vjppv.exe 44 PID 2972 wrote to memory of 2840 2972 vjppv.exe 44 PID 2972 wrote to memory of 2840 2972 vjppv.exe 44 PID 2972 wrote to memory of 2840 2972 vjppv.exe 44 PID 2840 wrote to memory of 2824 2840 llfrflr.exe 45 PID 2840 wrote to memory of 2824 2840 llfrflr.exe 45 PID 2840 wrote to memory of 2824 2840 llfrflr.exe 45 PID 2840 wrote to memory of 2824 2840 llfrflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe"C:\Users\Admin\AppData\Local\Temp\11422d8f13424b8644b2d8a97c1d4a8aef4d2c3d65a51a1b23aaaf2080c04725N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xrllllr.exec:\xrllllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\bbhntn.exec:\bbhntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nhnthn.exec:\nhnthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\5tbthn.exec:\5tbthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\vpdvd.exec:\vpdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\lrlxffr.exec:\lrlxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\7vppd.exec:\7vppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\llxflxf.exec:\llxflxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\3jvpd.exec:\3jvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\1hbbnt.exec:\1hbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\9jdvd.exec:\9jdvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\vjppv.exec:\vjppv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\llfrflr.exec:\llfrflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1vddj.exec:\1vddj.exe17⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rfxrrrx.exec:\rfxrrrx.exe18⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hhbntt.exec:\hhbntt.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jdvdj.exec:\jdvdj.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjvvv.exec:\pjvvv.exe21⤵
- Executes dropped EXE
PID:2148 -
\??\c:\btntbb.exec:\btntbb.exe22⤵
- Executes dropped EXE
PID:1460 -
\??\c:\dvjpv.exec:\dvjpv.exe23⤵
- Executes dropped EXE
PID:2428 -
\??\c:\1rflrrr.exec:\1rflrrr.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5jvvp.exec:\5jvvp.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vpddj.exec:\vpddj.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\hbthnn.exec:\hbthnn.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\1dddd.exec:\1dddd.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nhhhnn.exec:\nhhhnn.exe29⤵
- Executes dropped EXE
PID:2072 -
\??\c:\vpdjv.exec:\vpdjv.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tththn.exec:\tththn.exe31⤵
- Executes dropped EXE
PID:992 -
\??\c:\ddpvv.exec:\ddpvv.exe32⤵
- Executes dropped EXE
PID:880 -
\??\c:\ttnthn.exec:\ttnthn.exe33⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jvpvj.exec:\jvpvj.exe34⤵
- Executes dropped EXE
PID:2336 -
\??\c:\xxxfxfl.exec:\xxxfxfl.exe35⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tnbhtn.exec:\tnbhtn.exe36⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ttnntb.exec:\ttnntb.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7ddjj.exec:\7ddjj.exe38⤵
- Executes dropped EXE
PID:2392 -
\??\c:\flxxffr.exec:\flxxffr.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\5fllrrl.exec:\5fllrrl.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nhbbhh.exec:\nhbbhh.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3jdjp.exec:\3jdjp.exe42⤵
- Executes dropped EXE
PID:1048 -
\??\c:\ppjjj.exec:\ppjjj.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\3lxffxx.exec:\3lxffxx.exe44⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nhtbbb.exec:\nhtbbb.exe45⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5bnhtn.exec:\5bnhtn.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1dvjp.exec:\1dvjp.exe47⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7jdpp.exec:\7jdpp.exe48⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9frrrrx.exec:\9frrrrx.exe49⤵
- Executes dropped EXE
PID:840 -
\??\c:\thtbhb.exec:\thtbhb.exe50⤵
- Executes dropped EXE
PID:560 -
\??\c:\btnntt.exec:\btnntt.exe51⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dvjjj.exec:\dvjjj.exe52⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rrxrffl.exec:\rrxrffl.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3rlflll.exec:\3rlflll.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hhttbt.exec:\hhttbt.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\pddvd.exec:\pddvd.exe56⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5lrllll.exec:\5lrllll.exe57⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lxrxlfr.exec:\lxrxlfr.exe58⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nhtthn.exec:\nhtthn.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pdjjj.exec:\pdjjj.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5jddd.exec:\5jddd.exe61⤵
- Executes dropped EXE
PID:448 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\thbhnt.exec:\thbhnt.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9htnnn.exec:\9htnnn.exe64⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pjvjv.exec:\pjvjv.exe65⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7xfxxxr.exec:\7xfxxxr.exe66⤵PID:1660
-
\??\c:\bnhhnt.exec:\bnhhnt.exe67⤵PID:916
-
\??\c:\bnbbhh.exec:\bnbbhh.exe68⤵PID:952
-
\??\c:\dvjjp.exec:\dvjjp.exe69⤵PID:2276
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe70⤵PID:2964
-
\??\c:\btnbhn.exec:\btnbhn.exe71⤵PID:2060
-
\??\c:\hbnhnn.exec:\hbnhnn.exe72⤵PID:2072
-
\??\c:\9pdjd.exec:\9pdjd.exe73⤵PID:772
-
\??\c:\pjpjv.exec:\pjpjv.exe74⤵PID:1724
-
\??\c:\lfrlrxx.exec:\lfrlrxx.exe75⤵PID:2292
-
\??\c:\1httbb.exec:\1httbb.exe76⤵PID:2448
-
\??\c:\jdvvj.exec:\jdvvj.exe77⤵PID:2168
-
\??\c:\jjvjp.exec:\jjvjp.exe78⤵PID:1628
-
\??\c:\lfxlxrx.exec:\lfxlxrx.exe79⤵PID:1588
-
\??\c:\7bnhhh.exec:\7bnhhh.exe80⤵PID:2712
-
\??\c:\3tntbb.exec:\3tntbb.exe81⤵PID:2580
-
\??\c:\vjddv.exec:\vjddv.exe82⤵PID:2892
-
\??\c:\frxxrrx.exec:\frxxrrx.exe83⤵PID:1896
-
\??\c:\9frllll.exec:\9frllll.exe84⤵PID:2920
-
\??\c:\httthb.exec:\httthb.exe85⤵PID:2784
-
\??\c:\1djdj.exec:\1djdj.exe86⤵PID:2984
-
\??\c:\5dvvd.exec:\5dvvd.exe87⤵PID:2656
-
\??\c:\5lfffff.exec:\5lfffff.exe88⤵PID:2668
-
\??\c:\9flfxrx.exec:\9flfxrx.exe89⤵PID:2692
-
\??\c:\nhnnnh.exec:\nhnnnh.exe90⤵PID:2796
-
\??\c:\7jdjp.exec:\7jdjp.exe91⤵PID:2624
-
\??\c:\3vvjp.exec:\3vvjp.exe92⤵PID:2940
-
\??\c:\llxrrlx.exec:\llxrrlx.exe93⤵PID:1332
-
\??\c:\7hbbhb.exec:\7hbbhb.exe94⤵PID:1028
-
\??\c:\nhbhnn.exec:\nhbhnn.exe95⤵PID:1668
-
\??\c:\pdddd.exec:\pdddd.exe96⤵PID:2688
-
\??\c:\xxfrrrx.exec:\xxfrrrx.exe97⤵PID:2848
-
\??\c:\1xfrrll.exec:\1xfrrll.exe98⤵PID:2944
-
\??\c:\tnbhtt.exec:\tnbhtt.exe99⤵PID:1764
-
\??\c:\5pvpj.exec:\5pvpj.exe100⤵PID:2260
-
\??\c:\5jddd.exec:\5jddd.exe101⤵PID:1936
-
\??\c:\rlffrxx.exec:\rlffrxx.exe102⤵PID:2356
-
\??\c:\rrlrlfr.exec:\rrlrlfr.exe103⤵PID:340
-
\??\c:\hhnbtt.exec:\hhnbtt.exe104⤵PID:996
-
\??\c:\1dppp.exec:\1dppp.exe105⤵PID:3064
-
\??\c:\vvvdp.exec:\vvvdp.exe106⤵PID:1136
-
\??\c:\lfrrflx.exec:\lfrrflx.exe107⤵PID:956
-
\??\c:\5bbbnh.exec:\5bbbnh.exe108⤵PID:2128
-
\??\c:\3pvdd.exec:\3pvdd.exe109⤵PID:296
-
\??\c:\pddjp.exec:\pddjp.exe110⤵PID:2364
-
\??\c:\ffxlxxf.exec:\ffxlxxf.exe111⤵PID:1552
-
\??\c:\btbhhh.exec:\btbhhh.exe112⤵PID:2232
-
\??\c:\nhnntn.exec:\nhnntn.exe113⤵PID:2084
-
\??\c:\pjvvj.exec:\pjvvj.exe114⤵PID:3060
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe115⤵PID:2032
-
\??\c:\lfxxrrx.exec:\lfxxrrx.exe116⤵PID:2056
-
\??\c:\hbhnbb.exec:\hbhnbb.exe117⤵PID:804
-
\??\c:\vpdvd.exec:\vpdvd.exe118⤵PID:2540
-
\??\c:\7jvpp.exec:\7jvpp.exe119⤵PID:644
-
\??\c:\9rflllr.exec:\9rflllr.exe120⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\htbhnn.exec:\htbhnn.exe121⤵PID:2440
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-