Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe
-
Size
453KB
-
MD5
81df8aae425888d6e823b90176cf2bb0
-
SHA1
b6d170b1393b7f30baa3ae63424e4fd92c1e3dc0
-
SHA256
f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10
-
SHA512
bfce54334d39b4450f9e1e07c0e1042a312a74c35c00185ed3162d98f10439a0f2a42fcf8560d0760dafd6f5caef1c840750336143724a0ce2693249fcdefe2b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2156-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-26-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2436-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-100-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2984-111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-120-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/896-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-129-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2308-139-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1980-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-214-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/892-250-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/396-268-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2200-273-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2872-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-305-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1608-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-366-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2544-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-572-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-578-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2236-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-601-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3020-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-657-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1928-685-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1364-712-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-719-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1016-834-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 9fffxxl.exe 2804 7nttbb.exe 2436 3xrlxfl.exe 2604 9nnthn.exe 2652 7bnntt.exe 2888 lfrrrrf.exe 2880 lfrfllr.exe 2540 hbntnn.exe 2776 fxrxflr.exe 2532 nhnntt.exe 2984 pppdv.exe 672 pjvvj.exe 896 bnhhnn.exe 2308 5htbnt.exe 1980 rfrxfxl.exe 1316 nhntbb.exe 1860 1hbnth.exe 1864 rfffrxr.exe 1032 9nhnhh.exe 2860 vvjjv.exe 2764 tbhbbb.exe 2580 pppvp.exe 3068 9hbhbh.exe 2192 btntnt.exe 692 1xrfflr.exe 892 hbhhnt.exe 1476 7pjpv.exe 396 5bnbbb.exe 2200 vddjp.exe 2872 3dvvp.exe 1836 bnhnhh.exe 1632 pppvp.exe 1608 5fxfflr.exe 2460 dvpvj.exe 1532 jdpvd.exe 2868 rrlxrxf.exe 2384 hhtbhn.exe 2644 tnhhhn.exe 2888 dvjdp.exe 2736 fxrxxxl.exe 2184 3nbbnt.exe 2624 3nhhbb.exe 2776 3vjpp.exe 2544 3frlffl.exe 2980 lrxrxfr.exe 2988 bbnntb.exe 1548 jdvvv.exe 1992 lfrrfxl.exe 2320 rrflxxx.exe 664 bthnbb.exe 1948 5jvvj.exe 2444 dpvvd.exe 1884 5lxfllr.exe 1892 bttbhb.exe 2256 3djjj.exe 2844 3dppp.exe 2828 7rrxfxf.exe 2860 bnttbb.exe 2148 nntbbb.exe 916 7pddj.exe 1744 7fffxxf.exe 1412 9ttbhh.exe 2608 3ttttt.exe 1292 dvpjd.exe -
resource yara_rule behavioral1/memory/2156-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-267-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2872-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-657-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2684-678-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2308-692-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1476-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-909-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-948-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-1034-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-1047-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-1060-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-1073-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2120 2156 f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe 30 PID 2156 wrote to memory of 2120 2156 f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe 30 PID 2156 wrote to memory of 2120 2156 f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe 30 PID 2156 wrote to memory of 2120 2156 f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe 30 PID 2120 wrote to memory of 2804 2120 9fffxxl.exe 31 PID 2120 wrote to memory of 2804 2120 9fffxxl.exe 31 PID 2120 wrote to memory of 2804 2120 9fffxxl.exe 31 PID 2120 wrote to memory of 2804 2120 9fffxxl.exe 31 PID 2804 wrote to memory of 2436 2804 7nttbb.exe 32 PID 2804 wrote to memory of 2436 2804 7nttbb.exe 32 PID 2804 wrote to memory of 2436 2804 7nttbb.exe 32 PID 2804 wrote to memory of 2436 2804 7nttbb.exe 32 PID 2436 wrote to memory of 2604 2436 3xrlxfl.exe 33 PID 2436 wrote to memory of 2604 2436 3xrlxfl.exe 33 PID 2436 wrote to memory of 2604 2436 3xrlxfl.exe 33 PID 2436 wrote to memory of 2604 2436 3xrlxfl.exe 33 PID 2604 wrote to memory of 2652 2604 9nnthn.exe 34 PID 2604 wrote to memory of 2652 2604 9nnthn.exe 34 PID 2604 wrote to memory of 2652 2604 9nnthn.exe 34 PID 2604 wrote to memory of 2652 2604 9nnthn.exe 34 PID 2652 wrote to memory of 2888 2652 7bnntt.exe 35 PID 2652 wrote to memory of 2888 2652 7bnntt.exe 35 PID 2652 wrote to memory of 2888 2652 7bnntt.exe 35 PID 2652 wrote to memory of 2888 2652 7bnntt.exe 35 PID 2888 wrote to memory of 2880 2888 lfrrrrf.exe 36 PID 2888 wrote to memory of 2880 2888 lfrrrrf.exe 36 PID 2888 wrote to memory of 2880 2888 lfrrrrf.exe 36 PID 2888 wrote to memory of 2880 2888 lfrrrrf.exe 36 PID 2880 wrote to memory of 2540 2880 lfrfllr.exe 37 PID 2880 wrote to memory of 2540 2880 lfrfllr.exe 37 PID 2880 wrote to memory of 2540 2880 lfrfllr.exe 37 PID 2880 wrote to memory of 2540 2880 lfrfllr.exe 37 PID 2540 wrote to memory of 2776 2540 hbntnn.exe 38 PID 2540 wrote to memory of 2776 2540 hbntnn.exe 38 PID 2540 wrote to memory of 2776 2540 hbntnn.exe 38 PID 2540 wrote to memory of 2776 2540 hbntnn.exe 38 PID 2776 wrote to memory of 2532 2776 fxrxflr.exe 39 PID 2776 wrote to memory of 2532 2776 fxrxflr.exe 39 PID 2776 wrote to memory of 2532 2776 fxrxflr.exe 39 PID 2776 wrote to memory of 2532 2776 fxrxflr.exe 39 PID 2532 wrote to memory of 2984 2532 nhnntt.exe 40 PID 2532 wrote to memory of 2984 2532 nhnntt.exe 40 PID 2532 wrote to memory of 2984 2532 nhnntt.exe 40 PID 2532 wrote to memory of 2984 2532 nhnntt.exe 40 PID 2984 wrote to memory of 672 2984 pppdv.exe 41 PID 2984 wrote to memory of 672 2984 pppdv.exe 41 PID 2984 wrote to memory of 672 2984 pppdv.exe 41 PID 2984 wrote to memory of 672 2984 pppdv.exe 41 PID 672 wrote to memory of 896 672 pjvvj.exe 42 PID 672 wrote to memory of 896 672 pjvvj.exe 42 PID 672 wrote to memory of 896 672 pjvvj.exe 42 PID 672 wrote to memory of 896 672 pjvvj.exe 42 PID 896 wrote to memory of 2308 896 bnhhnn.exe 43 PID 896 wrote to memory of 2308 896 bnhhnn.exe 43 PID 896 wrote to memory of 2308 896 bnhhnn.exe 43 PID 896 wrote to memory of 2308 896 bnhhnn.exe 43 PID 2308 wrote to memory of 1980 2308 5htbnt.exe 44 PID 2308 wrote to memory of 1980 2308 5htbnt.exe 44 PID 2308 wrote to memory of 1980 2308 5htbnt.exe 44 PID 2308 wrote to memory of 1980 2308 5htbnt.exe 44 PID 1980 wrote to memory of 1316 1980 rfrxfxl.exe 45 PID 1980 wrote to memory of 1316 1980 rfrxfxl.exe 45 PID 1980 wrote to memory of 1316 1980 rfrxfxl.exe 45 PID 1980 wrote to memory of 1316 1980 rfrxfxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe"C:\Users\Admin\AppData\Local\Temp\f5591fc74457178e0d6e66d0172058eb25380bfa49d908c03ef343545583ac10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\9fffxxl.exec:\9fffxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\7nttbb.exec:\7nttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\3xrlxfl.exec:\3xrlxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9nnthn.exec:\9nnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7bnntt.exec:\7bnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lfrfllr.exec:\lfrfllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hbntnn.exec:\hbntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\fxrxflr.exec:\fxrxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\nhnntt.exec:\nhnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\pppdv.exec:\pppdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pjvvj.exec:\pjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\bnhhnn.exec:\bnhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\5htbnt.exec:\5htbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rfrxfxl.exec:\rfrxfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\nhntbb.exec:\nhntbb.exe17⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1hbnth.exec:\1hbnth.exe18⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rfffrxr.exec:\rfffrxr.exe19⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9nhnhh.exec:\9nhnhh.exe20⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vvjjv.exec:\vvjjv.exe21⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tbhbbb.exec:\tbhbbb.exe22⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pppvp.exec:\pppvp.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\9hbhbh.exec:\9hbhbh.exe24⤵
- Executes dropped EXE
PID:3068 -
\??\c:\btntnt.exec:\btntnt.exe25⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1xrfflr.exec:\1xrfflr.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbhhnt.exec:\hbhhnt.exe27⤵
- Executes dropped EXE
PID:892 -
\??\c:\7pjpv.exec:\7pjpv.exe28⤵
- Executes dropped EXE
PID:1476 -
\??\c:\5bnbbb.exec:\5bnbbb.exe29⤵
- Executes dropped EXE
PID:396 -
\??\c:\vddjp.exec:\vddjp.exe30⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3dvvp.exec:\3dvvp.exe31⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bnhnhh.exec:\bnhnhh.exe32⤵
- Executes dropped EXE
PID:1836 -
\??\c:\pppvp.exec:\pppvp.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5fxfflr.exec:\5fxfflr.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\dvpvj.exec:\dvpvj.exe35⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jdpvd.exec:\jdpvd.exe36⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrlxrxf.exec:\rrlxrxf.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hhtbhn.exec:\hhtbhn.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tnhhhn.exec:\tnhhhn.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\dvjdp.exec:\dvjdp.exe40⤵
- Executes dropped EXE
PID:2888 -
\??\c:\fxrxxxl.exec:\fxrxxxl.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3nbbnt.exec:\3nbbnt.exe42⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3nhhbb.exec:\3nhhbb.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3vjpp.exec:\3vjpp.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\3frlffl.exec:\3frlffl.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lrxrxfr.exec:\lrxrxfr.exe46⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bbnntb.exec:\bbnntb.exe47⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jdvvv.exec:\jdvvv.exe48⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe49⤵
- Executes dropped EXE
PID:1992 -
\??\c:\rrflxxx.exec:\rrflxxx.exe50⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bthnbb.exec:\bthnbb.exe51⤵
- Executes dropped EXE
PID:664 -
\??\c:\5jvvj.exec:\5jvvj.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948 -
\??\c:\dpvvd.exec:\dpvvd.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\5lxfllr.exec:\5lxfllr.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\bttbhb.exec:\bttbhb.exe55⤵
- Executes dropped EXE
PID:1892 -
\??\c:\3djjj.exec:\3djjj.exe56⤵
- Executes dropped EXE
PID:2256 -
\??\c:\3dppp.exec:\3dppp.exe57⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7rrxfxf.exec:\7rrxfxf.exe58⤵
- Executes dropped EXE
PID:2828 -
\??\c:\bnttbb.exec:\bnttbb.exe59⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nntbbb.exec:\nntbbb.exe60⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7pddj.exec:\7pddj.exe61⤵
- Executes dropped EXE
PID:916 -
\??\c:\7fffxxf.exec:\7fffxxf.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9ttbhh.exec:\9ttbhh.exe63⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3ttttt.exec:\3ttttt.exe64⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvpjd.exec:\dvpjd.exe65⤵
- Executes dropped EXE
PID:1292 -
\??\c:\xlfxlxr.exec:\xlfxlxr.exe66⤵PID:1140
-
\??\c:\nhhnhh.exec:\nhhnhh.exe67⤵PID:2876
-
\??\c:\hbnbhn.exec:\hbnbhn.exe68⤵PID:1584
-
\??\c:\7pvdp.exec:\7pvdp.exe69⤵PID:1544
-
\??\c:\9llxrrr.exec:\9llxrrr.exe70⤵PID:1424
-
\??\c:\lfrxllx.exec:\lfrxllx.exe71⤵PID:1780
-
\??\c:\hhttnn.exec:\hhttnn.exe72⤵PID:1788
-
\??\c:\tntttt.exec:\tntttt.exe73⤵PID:2232
-
\??\c:\vdvdj.exec:\vdvdj.exe74⤵PID:1520
-
\??\c:\7fxxllr.exec:\7fxxllr.exe75⤵PID:2120
-
\??\c:\hhthtt.exec:\hhthtt.exe76⤵PID:2088
-
\??\c:\btnbhn.exec:\btnbhn.exe77⤵PID:3060
-
\??\c:\3dpvj.exec:\3dpvj.exe78⤵PID:2236
-
\??\c:\7fxlxfr.exec:\7fxlxfr.exe79⤵PID:2640
-
\??\c:\llfxxrf.exec:\llfxxrf.exe80⤵PID:2604
-
\??\c:\nhbntb.exec:\nhbntb.exe81⤵PID:2740
-
\??\c:\3jdjj.exec:\3jdjj.exe82⤵PID:2628
-
\??\c:\1dvvj.exec:\1dvvj.exe83⤵PID:2520
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe84⤵PID:2832
-
\??\c:\frxfrxf.exec:\frxfrxf.exe85⤵PID:2528
-
\??\c:\7bnttb.exec:\7bnttb.exe86⤵PID:3020
-
\??\c:\vvpvj.exec:\vvpvj.exe87⤵PID:2564
-
\??\c:\dvpdj.exec:\dvpdj.exe88⤵PID:2984
-
\??\c:\5frrxff.exec:\5frrxff.exe89⤵PID:672
-
\??\c:\bntbhn.exec:\bntbhn.exe90⤵PID:2684
-
\??\c:\vpdjv.exec:\vpdjv.exe91⤵PID:1928
-
\??\c:\dvpdp.exec:\dvpdp.exe92⤵PID:2308
-
\??\c:\1rrxflf.exec:\1rrxflf.exe93⤵PID:1236
-
\??\c:\nhbhtb.exec:\nhbhtb.exe94⤵PID:1956
-
\??\c:\vdjjp.exec:\vdjjp.exe95⤵PID:1364
-
\??\c:\pvjpd.exec:\pvjpd.exe96⤵PID:2572
-
\??\c:\xxlrxff.exec:\xxlrxff.exe97⤵PID:1740
-
\??\c:\bhtthh.exec:\bhtthh.exe98⤵PID:1032
-
\??\c:\hhtthn.exec:\hhtthn.exe99⤵PID:2820
-
\??\c:\dvddp.exec:\dvddp.exe100⤵PID:2960
-
\??\c:\xrrflxl.exec:\xrrflxl.exe101⤵PID:2500
-
\??\c:\3lxxlrf.exec:\3lxxlrf.exe102⤵PID:1400
-
\??\c:\3nhntt.exec:\3nhntt.exe103⤵PID:2912
-
\??\c:\vdvvv.exec:\vdvvv.exe104⤵PID:1300
-
\??\c:\dvdjj.exec:\dvdjj.exe105⤵PID:2284
-
\??\c:\rlfflrx.exec:\rlfflrx.exe106⤵PID:2340
-
\??\c:\hhtnnn.exec:\hhtnnn.exe107⤵PID:1648
-
\??\c:\nhhntt.exec:\nhhntt.exe108⤵PID:1600
-
\??\c:\jppvd.exec:\jppvd.exe109⤵PID:1560
-
\??\c:\fxfflfl.exec:\fxfflfl.exe110⤵PID:1476
-
\??\c:\5xlxffl.exec:\5xlxffl.exe111⤵PID:2948
-
\??\c:\bbnhhn.exec:\bbnhhn.exe112⤵PID:2168
-
\??\c:\7nbhnb.exec:\7nbhnb.exe113⤵PID:2552
-
\??\c:\pvvjj.exec:\pvvjj.exe114⤵PID:876
-
\??\c:\9xxxfff.exec:\9xxxfff.exe115⤵PID:1016
-
\??\c:\lflrrxf.exec:\lflrrxf.exe116⤵PID:2232
-
\??\c:\ttnthn.exec:\ttnthn.exe117⤵PID:2260
-
\??\c:\5vvdv.exec:\5vvdv.exe118⤵PID:1608
-
\??\c:\djvvj.exec:\djvvj.exe119⤵
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\xllrffl.exec:\xllrffl.exe120⤵PID:2448
-
\??\c:\9hbttb.exec:\9hbttb.exe121⤵PID:2868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-