Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe
-
Size
454KB
-
MD5
e23b4a38adf721c8d05fecef8686fce4
-
SHA1
aed61ef3f172b4ec4f231622f76106c0322da3d5
-
SHA256
248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311
-
SHA512
8c43fffa403b659f3f56e3cb0450c9cbb440362c125b3e272daaa55711d0a7b31ff3df0d7d3526ce4b79d5f934d01f829225ef825187f1467fc74182cf13b2c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2572-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-128-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2820-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-354-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2676-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-926-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/480-972-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/936-1027-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/712-1283-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1536-1308-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1736-1353-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1948 xxrlrxl.exe 3044 lfflxfx.exe 2916 ddjvv.exe 2748 bnbbhh.exe 2880 ddpdp.exe 2872 7nnbnh.exe 2244 rfrxrfx.exe 2772 btttbb.exe 2620 jpvjp.exe 1820 7ffrfff.exe 2728 ppdjj.exe 1972 thbhbn.exe 2168 9vvdp.exe 2820 xrrfrxr.exe 2704 1pdjv.exe 2120 llfxlrf.exe 2124 jddpj.exe 576 1bnnbb.exe 764 jppjv.exe 1296 bbtbhn.exe 2508 vjddv.exe 1428 5nbbnt.exe 2088 jvddd.exe 620 hbnnhn.exe 1732 pjjvj.exe 908 xxlrlxf.exe 2564 vvdjp.exe 2528 5nhbbh.exe 1336 vvvjd.exe 2420 9bbbtb.exe 564 pjdvp.exe 2572 5tnntb.exe 3040 htntnt.exe 3028 jdvpj.exe 2332 lxlfxlr.exe 2284 9bbbhn.exe 2436 dvvdj.exe 2844 ddpdp.exe 2732 xrffxlr.exe 2576 1bbthb.exe 2800 nhtbbh.exe 1800 ppjvj.exe 2160 lfflrxx.exe 2676 5htbtn.exe 2624 3htbhh.exe 2216 9dvvj.exe 372 rfxxlfr.exe 1316 3nnntb.exe 2592 hbnnbh.exe 2924 9dpvv.exe 3036 lfrxllf.exe 532 9hthbb.exe 440 nnhtbt.exe 588 7djvp.exe 1868 rlrrflr.exe 812 1nhbtt.exe 2996 nhttnt.exe 2208 jjdjd.exe 2204 xfxfxfl.exe 3000 7xrxlll.exe 1616 5nthth.exe 880 pjdpd.exe 1356 1xrxllf.exe 1780 xrffllx.exe -
resource yara_rule behavioral1/memory/2572-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-128-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2820-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-265-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1336-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-744-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-941-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-1055-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-1351-0x0000000000230000-0x000000000025A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 1948 2572 248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe 30 PID 2572 wrote to memory of 1948 2572 248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe 30 PID 2572 wrote to memory of 1948 2572 248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe 30 PID 2572 wrote to memory of 1948 2572 248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe 30 PID 1948 wrote to memory of 3044 1948 xxrlrxl.exe 31 PID 1948 wrote to memory of 3044 1948 xxrlrxl.exe 31 PID 1948 wrote to memory of 3044 1948 xxrlrxl.exe 31 PID 1948 wrote to memory of 3044 1948 xxrlrxl.exe 31 PID 3044 wrote to memory of 2916 3044 lfflxfx.exe 32 PID 3044 wrote to memory of 2916 3044 lfflxfx.exe 32 PID 3044 wrote to memory of 2916 3044 lfflxfx.exe 32 PID 3044 wrote to memory of 2916 3044 lfflxfx.exe 32 PID 2916 wrote to memory of 2748 2916 ddjvv.exe 33 PID 2916 wrote to memory of 2748 2916 ddjvv.exe 33 PID 2916 wrote to memory of 2748 2916 ddjvv.exe 33 PID 2916 wrote to memory of 2748 2916 ddjvv.exe 33 PID 2748 wrote to memory of 2880 2748 bnbbhh.exe 34 PID 2748 wrote to memory of 2880 2748 bnbbhh.exe 34 PID 2748 wrote to memory of 2880 2748 bnbbhh.exe 34 PID 2748 wrote to memory of 2880 2748 bnbbhh.exe 34 PID 2880 wrote to memory of 2872 2880 ddpdp.exe 35 PID 2880 wrote to memory of 2872 2880 ddpdp.exe 35 PID 2880 wrote to memory of 2872 2880 ddpdp.exe 35 PID 2880 wrote to memory of 2872 2880 ddpdp.exe 35 PID 2872 wrote to memory of 2244 2872 7nnbnh.exe 36 PID 2872 wrote to memory of 2244 2872 7nnbnh.exe 36 PID 2872 wrote to memory of 2244 2872 7nnbnh.exe 36 PID 2872 wrote to memory of 2244 2872 7nnbnh.exe 36 PID 2244 wrote to memory of 2772 2244 rfrxrfx.exe 37 PID 2244 wrote to memory of 2772 2244 rfrxrfx.exe 37 PID 2244 wrote to memory of 2772 2244 rfrxrfx.exe 37 PID 2244 wrote to memory of 2772 2244 rfrxrfx.exe 37 PID 2772 wrote to memory of 2620 2772 btttbb.exe 38 PID 2772 wrote to memory of 2620 2772 btttbb.exe 38 PID 2772 wrote to memory of 2620 2772 btttbb.exe 38 PID 2772 wrote to memory of 2620 2772 btttbb.exe 38 PID 2620 wrote to memory of 1820 2620 jpvjp.exe 39 PID 2620 wrote to memory of 1820 2620 jpvjp.exe 39 PID 2620 wrote to memory of 1820 2620 jpvjp.exe 39 PID 2620 wrote to memory of 1820 2620 jpvjp.exe 39 PID 1820 wrote to memory of 2728 1820 7ffrfff.exe 40 PID 1820 wrote to memory of 2728 1820 7ffrfff.exe 40 PID 1820 wrote to memory of 2728 1820 7ffrfff.exe 40 PID 1820 wrote to memory of 2728 1820 7ffrfff.exe 40 PID 2728 wrote to memory of 1972 2728 ppdjj.exe 41 PID 2728 wrote to memory of 1972 2728 ppdjj.exe 41 PID 2728 wrote to memory of 1972 2728 ppdjj.exe 41 PID 2728 wrote to memory of 1972 2728 ppdjj.exe 41 PID 1972 wrote to memory of 2168 1972 thbhbn.exe 42 PID 1972 wrote to memory of 2168 1972 thbhbn.exe 42 PID 1972 wrote to memory of 2168 1972 thbhbn.exe 42 PID 1972 wrote to memory of 2168 1972 thbhbn.exe 42 PID 2168 wrote to memory of 2820 2168 9vvdp.exe 43 PID 2168 wrote to memory of 2820 2168 9vvdp.exe 43 PID 2168 wrote to memory of 2820 2168 9vvdp.exe 43 PID 2168 wrote to memory of 2820 2168 9vvdp.exe 43 PID 2820 wrote to memory of 2704 2820 xrrfrxr.exe 44 PID 2820 wrote to memory of 2704 2820 xrrfrxr.exe 44 PID 2820 wrote to memory of 2704 2820 xrrfrxr.exe 44 PID 2820 wrote to memory of 2704 2820 xrrfrxr.exe 44 PID 2704 wrote to memory of 2120 2704 1pdjv.exe 45 PID 2704 wrote to memory of 2120 2704 1pdjv.exe 45 PID 2704 wrote to memory of 2120 2704 1pdjv.exe 45 PID 2704 wrote to memory of 2120 2704 1pdjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe"C:\Users\Admin\AppData\Local\Temp\248967d4c21b02530a6102efac901c8a8ad2c618ff47470393573e358e7cf311.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\lfflxfx.exec:\lfflxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\ddjvv.exec:\ddjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\bnbbhh.exec:\bnbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\ddpdp.exec:\ddpdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\7nnbnh.exec:\7nnbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rfrxrfx.exec:\rfrxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\btttbb.exec:\btttbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jpvjp.exec:\jpvjp.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7ffrfff.exec:\7ffrfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\ppdjj.exec:\ppdjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\thbhbn.exec:\thbhbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\9vvdp.exec:\9vvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\xrrfrxr.exec:\xrrfrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\1pdjv.exec:\1pdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\llfxlrf.exec:\llfxlrf.exe17⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jddpj.exec:\jddpj.exe18⤵
- Executes dropped EXE
PID:2124 -
\??\c:\1bnnbb.exec:\1bnnbb.exe19⤵
- Executes dropped EXE
PID:576 -
\??\c:\jppjv.exec:\jppjv.exe20⤵
- Executes dropped EXE
PID:764 -
\??\c:\bbtbhn.exec:\bbtbhn.exe21⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vjddv.exec:\vjddv.exe22⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5nbbnt.exec:\5nbbnt.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jvddd.exec:\jvddd.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hbnnhn.exec:\hbnnhn.exe25⤵
- Executes dropped EXE
PID:620 -
\??\c:\pjjvj.exec:\pjjvj.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xxlrlxf.exec:\xxlrlxf.exe27⤵
- Executes dropped EXE
PID:908 -
\??\c:\vvdjp.exec:\vvdjp.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\5nhbbh.exec:\5nhbbh.exe29⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vvvjd.exec:\vvvjd.exe30⤵
- Executes dropped EXE
PID:1336 -
\??\c:\9bbbtb.exec:\9bbbtb.exe31⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjdvp.exec:\pjdvp.exe32⤵
- Executes dropped EXE
PID:564 -
\??\c:\5tnntb.exec:\5tnntb.exe33⤵
- Executes dropped EXE
PID:2572 -
\??\c:\htntnt.exec:\htntnt.exe34⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdvpj.exec:\jdvpj.exe35⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxlfxlr.exec:\lxlfxlr.exe36⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9bbbhn.exec:\9bbbhn.exe37⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvvdj.exec:\dvvdj.exe38⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ddpdp.exec:\ddpdp.exe39⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xrffxlr.exec:\xrffxlr.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\1bbthb.exec:\1bbthb.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nhtbbh.exec:\nhtbbh.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\ppjvj.exec:\ppjvj.exe43⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfflrxx.exec:\lfflrxx.exe44⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5htbtn.exec:\5htbtn.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3htbhh.exec:\3htbhh.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9dvvj.exec:\9dvvj.exe47⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rfxxlfr.exec:\rfxxlfr.exe48⤵
- Executes dropped EXE
PID:372 -
\??\c:\3nnntb.exec:\3nnntb.exe49⤵
- Executes dropped EXE
PID:1316 -
\??\c:\hbnnbh.exec:\hbnnbh.exe50⤵
- Executes dropped EXE
PID:2592 -
\??\c:\9dpvv.exec:\9dpvv.exe51⤵
- Executes dropped EXE
PID:2924 -
\??\c:\lfrxllf.exec:\lfrxllf.exe52⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9hthbb.exec:\9hthbb.exe53⤵
- Executes dropped EXE
PID:532 -
\??\c:\nnhtbt.exec:\nnhtbt.exe54⤵
- Executes dropped EXE
PID:440 -
\??\c:\7djvp.exec:\7djvp.exe55⤵
- Executes dropped EXE
PID:588 -
\??\c:\rlrrflr.exec:\rlrrflr.exe56⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1nhbtt.exec:\1nhbtt.exe57⤵
- Executes dropped EXE
PID:812 -
\??\c:\nhttnt.exec:\nhttnt.exe58⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjdjd.exec:\jjdjd.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xfxfxfl.exec:\xfxfxfl.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7xrxlll.exec:\7xrxlll.exe61⤵
- Executes dropped EXE
PID:3000 -
\??\c:\5nthth.exec:\5nthth.exe62⤵
- Executes dropped EXE
PID:1616 -
\??\c:\pjdpd.exec:\pjdpd.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\1xrxllf.exec:\1xrxllf.exe64⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xrffllx.exec:\xrffllx.exe65⤵
- Executes dropped EXE
PID:1780 -
\??\c:\nnttbh.exec:\nnttbh.exe66⤵PID:2000
-
\??\c:\ppdpd.exec:\ppdpd.exe67⤵PID:1732
-
\??\c:\xffllxf.exec:\xffllxf.exe68⤵PID:908
-
\??\c:\lfflflx.exec:\lfflflx.exe69⤵PID:2320
-
\??\c:\7bhntt.exec:\7bhntt.exe70⤵PID:2156
-
\??\c:\vvppd.exec:\vvppd.exe71⤵PID:1648
-
\??\c:\7jpdp.exec:\7jpdp.exe72⤵PID:1336
-
\??\c:\5flxrlf.exec:\5flxrlf.exe73⤵PID:2420
-
\??\c:\bbbhnn.exec:\bbbhnn.exe74⤵PID:1760
-
\??\c:\pvjjj.exec:\pvjjj.exe75⤵PID:868
-
\??\c:\pjddp.exec:\pjddp.exe76⤵PID:1576
-
\??\c:\ffffxll.exec:\ffffxll.exe77⤵PID:2220
-
\??\c:\hbthnn.exec:\hbthnn.exe78⤵PID:3032
-
\??\c:\bbnbhn.exec:\bbnbhn.exe79⤵PID:2460
-
\??\c:\pdvdp.exec:\pdvdp.exe80⤵PID:308
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe81⤵PID:2748
-
\??\c:\hhthnt.exec:\hhthnt.exe82⤵PID:2892
-
\??\c:\hhbnth.exec:\hhbnth.exe83⤵PID:2768
-
\??\c:\jjddd.exec:\jjddd.exe84⤵PID:2904
-
\??\c:\7llrrrx.exec:\7llrrrx.exe85⤵PID:2816
-
\??\c:\tnhthn.exec:\tnhthn.exe86⤵PID:2888
-
\??\c:\httbnn.exec:\httbnn.exe87⤵PID:2616
-
\??\c:\1vppd.exec:\1vppd.exe88⤵PID:2600
-
\??\c:\fxlrrxl.exec:\fxlrrxl.exe89⤵PID:2648
-
\??\c:\rfxrffl.exec:\rfxrffl.exe90⤵PID:2188
-
\??\c:\nhhhtt.exec:\nhhhtt.exe91⤵PID:2216
-
\??\c:\5vppj.exec:\5vppj.exe92⤵PID:2728
-
\??\c:\7fxxlrf.exec:\7fxxlrf.exe93⤵PID:1972
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe94⤵PID:2168
-
\??\c:\9btbtb.exec:\9btbtb.exe95⤵PID:2820
-
\??\c:\pjjpj.exec:\pjjpj.exe96⤵PID:2116
-
\??\c:\dvpvj.exec:\dvpvj.exe97⤵PID:316
-
\??\c:\rxrxrxx.exec:\rxrxrxx.exe98⤵PID:2212
-
\??\c:\nnhnbh.exec:\nnhnbh.exe99⤵PID:568
-
\??\c:\ddjpp.exec:\ddjpp.exe100⤵PID:2084
-
\??\c:\pjjpd.exec:\pjjpd.exe101⤵PID:1812
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe102⤵PID:2100
-
\??\c:\flflflx.exec:\flflflx.exe103⤵PID:920
-
\??\c:\nnbthn.exec:\nnbthn.exe104⤵PID:2504
-
\??\c:\pjvdd.exec:\pjvdd.exe105⤵PID:2700
-
\??\c:\vpdjp.exec:\vpdjp.exe106⤵PID:1880
-
\??\c:\xrfrxxr.exec:\xrfrxxr.exe107⤵PID:836
-
\??\c:\9nhhtb.exec:\9nhhtb.exe108⤵PID:1556
-
\??\c:\9hhnbh.exec:\9hhnbh.exe109⤵PID:2588
-
\??\c:\jjppd.exec:\jjppd.exe110⤵PID:916
-
\??\c:\lfllflr.exec:\lfllflr.exe111⤵PID:2444
-
\??\c:\lfflffr.exec:\lfflffr.exe112⤵PID:2392
-
\??\c:\bbbnhn.exec:\bbbnhn.exe113⤵PID:988
-
\??\c:\dvjvp.exec:\dvjvp.exe114⤵PID:2524
-
\??\c:\vpppd.exec:\vpppd.exe115⤵PID:3064
-
\??\c:\frrfrxf.exec:\frrfrxf.exe116⤵PID:888
-
\??\c:\bthnbh.exec:\bthnbh.exe117⤵PID:1960
-
\??\c:\hnhhbh.exec:\hnhhbh.exe118⤵PID:2416
-
\??\c:\vdvjv.exec:\vdvjv.exe119⤵PID:1596
-
\??\c:\lllxrxl.exec:\lllxrxl.exe120⤵PID:1948
-
\??\c:\btnnhh.exec:\btnnhh.exe121⤵PID:236
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-