Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 15:29
Behavioral task
behavioral1
Sample
f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe
-
Size
130KB
-
MD5
52039e11a38cbca607d22dbc06785fc7
-
SHA1
1beb567a22d519b6530301280644df6375f390bf
-
SHA256
f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33
-
SHA512
76fab7b3065e222b48efc4b51faed6f647a09b1e8d5f42d7cb4d78e3c4760619c5e13aa782fa288c1bbed0e00f5c2aacbc0434ed4456129d8f74a4933aecac3c
-
SSDEEP
3072:0hOmTsF93UYfwC6GIoutX8Kikz9qI+fPl/d:0cm4FmowdHoSH5L+Zd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/236-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1640-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-34-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2728-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-101-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2664-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2960-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2024-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-202-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1612-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-222-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/844-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-261-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2368-274-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/236-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2064-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1788-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-450-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1744-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-513-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/524-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/872-570-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2640-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2232-719-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/820-762-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1440-775-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2792-857-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2800-885-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2688-904-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1248-948-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2032-967-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1348-979-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2348-1174-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1240-1339-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1640 dvjpd.exe 2572 1lxlllr.exe 2264 rrfrrxl.exe 2804 tnhnbb.exe 2768 ffxrxlx.exe 2728 lxrxflr.exe 2852 rlrlflx.exe 2724 ppjvd.exe 2676 xrrfrxl.exe 2664 nnhthn.exe 2672 dvjdj.exe 1712 9fxfllr.exe 3048 ntbntt.exe 2712 hbtbtb.exe 2960 vjjpv.exe 3052 9lxflrx.exe 1900 1flrrfx.exe 1036 7nhthb.exe 2056 ddvjp.exe 2024 flfxxlr.exe 1612 rflfxfl.exe 1548 nnntht.exe 2288 dvdjp.exe 2332 xrlrxxf.exe 112 thbbhh.exe 844 9nbtbh.exe 1624 9dddv.exe 2128 jdpjp.exe 2368 lffxflf.exe 316 vvpvj.exe 236 vpdjp.exe 1648 lfxfrxf.exe 2064 lfxfllr.exe 1716 nhbbhn.exe 2792 1vvpd.exe 2820 7ddjj.exe 2832 fffrxfx.exe 2736 5lrrflx.exe 2772 ththtt.exe 1788 jdvdd.exe 2784 ppvdj.exe 476 xrllrxl.exe 2040 lflrxlx.exe 1508 7thbhh.exe 1224 tnbhhn.exe 2012 ddvdp.exe 2924 xrffllf.exe 2904 xrflxlr.exe 2956 nnbtnn.exe 2788 btnhtt.exe 2700 1jdjv.exe 2972 vpdjp.exe 1008 1fxxxfr.exe 2868 xrflrlx.exe 1344 thnbhh.exe 2148 bbnttt.exe 2388 7jvvv.exe 2056 jvddj.exe 1868 rfxrxxl.exe 2796 3frrxlr.exe 2400 1tbttt.exe 2508 tnbhbt.exe 1016 vpvpd.exe 1744 vpjpd.exe -
resource yara_rule behavioral1/memory/236-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000012117-5.dat upx behavioral1/memory/236-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c3a-18.dat upx behavioral1/files/0x0007000000016c4a-26.dat upx behavioral1/memory/2264-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2572-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1640-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016c51-36.dat upx behavioral1/memory/2804-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cc8-45.dat upx behavioral1/files/0x0007000000016d06-64.dat upx behavioral1/memory/2728-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016cec-56.dat upx behavioral1/memory/2728-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d0e-75.dat upx behavioral1/memory/2724-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016d18-83.dat upx behavioral1/memory/2724-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000173a9-91.dat upx behavioral1/memory/2664-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2676-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017488-103.dat upx behavioral1/memory/2664-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017492-111.dat upx behavioral1/memory/1712-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174cc-119.dat upx behavioral1/files/0x000d000000018676-129.dat upx behavioral1/memory/2712-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018683-139.dat upx behavioral1/files/0x00050000000186e4-147.dat upx behavioral1/memory/3052-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2960-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186ea-156.dat upx behavioral1/files/0x00050000000186ee-166.dat upx behavioral1/memory/1900-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1036-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000186fd-175.dat upx behavioral1/files/0x0005000000018728-184.dat upx behavioral1/memory/2024-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001873d-194.dat upx behavioral1/memory/2024-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018784-206.dat upx behavioral1/memory/1548-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1612-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001878f-214.dat upx behavioral1/memory/1548-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000187a5-224.dat upx behavioral1/files/0x0006000000019023-232.dat upx behavioral1/files/0x000500000001925e-240.dat upx behavioral1/memory/844-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019261-249.dat upx behavioral1/memory/1624-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019282-258.dat upx behavioral1/files/0x0005000000019334-266.dat upx behavioral1/files/0x00090000000165c2-276.dat upx behavioral1/files/0x0005000000019350-283.dat upx behavioral1/files/0x00050000000193b4-293.dat upx behavioral1/memory/236-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2064-306-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 236 wrote to memory of 1640 236 f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe 30 PID 236 wrote to memory of 1640 236 f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe 30 PID 236 wrote to memory of 1640 236 f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe 30 PID 236 wrote to memory of 1640 236 f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe 30 PID 1640 wrote to memory of 2572 1640 dvjpd.exe 31 PID 1640 wrote to memory of 2572 1640 dvjpd.exe 31 PID 1640 wrote to memory of 2572 1640 dvjpd.exe 31 PID 1640 wrote to memory of 2572 1640 dvjpd.exe 31 PID 2572 wrote to memory of 2264 2572 1lxlllr.exe 32 PID 2572 wrote to memory of 2264 2572 1lxlllr.exe 32 PID 2572 wrote to memory of 2264 2572 1lxlllr.exe 32 PID 2572 wrote to memory of 2264 2572 1lxlllr.exe 32 PID 2264 wrote to memory of 2804 2264 rrfrrxl.exe 33 PID 2264 wrote to memory of 2804 2264 rrfrrxl.exe 33 PID 2264 wrote to memory of 2804 2264 rrfrrxl.exe 33 PID 2264 wrote to memory of 2804 2264 rrfrrxl.exe 33 PID 2804 wrote to memory of 2768 2804 tnhnbb.exe 34 PID 2804 wrote to memory of 2768 2804 tnhnbb.exe 34 PID 2804 wrote to memory of 2768 2804 tnhnbb.exe 34 PID 2804 wrote to memory of 2768 2804 tnhnbb.exe 34 PID 2768 wrote to memory of 2728 2768 ffxrxlx.exe 35 PID 2768 wrote to memory of 2728 2768 ffxrxlx.exe 35 PID 2768 wrote to memory of 2728 2768 ffxrxlx.exe 35 PID 2768 wrote to memory of 2728 2768 ffxrxlx.exe 35 PID 2728 wrote to memory of 2852 2728 lxrxflr.exe 36 PID 2728 wrote to memory of 2852 2728 lxrxflr.exe 36 PID 2728 wrote to memory of 2852 2728 lxrxflr.exe 36 PID 2728 wrote to memory of 2852 2728 lxrxflr.exe 36 PID 2852 wrote to memory of 2724 2852 rlrlflx.exe 37 PID 2852 wrote to memory of 2724 2852 rlrlflx.exe 37 PID 2852 wrote to memory of 2724 2852 rlrlflx.exe 37 PID 2852 wrote to memory of 2724 2852 rlrlflx.exe 37 PID 2724 wrote to memory of 2676 2724 ppjvd.exe 38 PID 2724 wrote to memory of 2676 2724 ppjvd.exe 38 PID 2724 wrote to memory of 2676 2724 ppjvd.exe 38 PID 2724 wrote to memory of 2676 2724 ppjvd.exe 38 PID 2676 wrote to memory of 2664 2676 xrrfrxl.exe 39 PID 2676 wrote to memory of 2664 2676 xrrfrxl.exe 39 PID 2676 wrote to memory of 2664 2676 xrrfrxl.exe 39 PID 2676 wrote to memory of 2664 2676 xrrfrxl.exe 39 PID 2664 wrote to memory of 2672 2664 nnhthn.exe 40 PID 2664 wrote to memory of 2672 2664 nnhthn.exe 40 PID 2664 wrote to memory of 2672 2664 nnhthn.exe 40 PID 2664 wrote to memory of 2672 2664 nnhthn.exe 40 PID 2672 wrote to memory of 1712 2672 dvjdj.exe 41 PID 2672 wrote to memory of 1712 2672 dvjdj.exe 41 PID 2672 wrote to memory of 1712 2672 dvjdj.exe 41 PID 2672 wrote to memory of 1712 2672 dvjdj.exe 41 PID 1712 wrote to memory of 3048 1712 9fxfllr.exe 42 PID 1712 wrote to memory of 3048 1712 9fxfllr.exe 42 PID 1712 wrote to memory of 3048 1712 9fxfllr.exe 42 PID 1712 wrote to memory of 3048 1712 9fxfllr.exe 42 PID 3048 wrote to memory of 2712 3048 ntbntt.exe 43 PID 3048 wrote to memory of 2712 3048 ntbntt.exe 43 PID 3048 wrote to memory of 2712 3048 ntbntt.exe 43 PID 3048 wrote to memory of 2712 3048 ntbntt.exe 43 PID 2712 wrote to memory of 2960 2712 hbtbtb.exe 44 PID 2712 wrote to memory of 2960 2712 hbtbtb.exe 44 PID 2712 wrote to memory of 2960 2712 hbtbtb.exe 44 PID 2712 wrote to memory of 2960 2712 hbtbtb.exe 44 PID 2960 wrote to memory of 3052 2960 vjjpv.exe 45 PID 2960 wrote to memory of 3052 2960 vjjpv.exe 45 PID 2960 wrote to memory of 3052 2960 vjjpv.exe 45 PID 2960 wrote to memory of 3052 2960 vjjpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe"C:\Users\Admin\AppData\Local\Temp\f1df4ffcb0603ce5f490a95be7bbd4ca24c6530daca2b364236ca17b4e9bde33.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\dvjpd.exec:\dvjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\1lxlllr.exec:\1lxlllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rrfrrxl.exec:\rrfrrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\tnhnbb.exec:\tnhnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ffxrxlx.exec:\ffxrxlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lxrxflr.exec:\lxrxflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rlrlflx.exec:\rlrlflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ppjvd.exec:\ppjvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\nnhthn.exec:\nnhthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\dvjdj.exec:\dvjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\9fxfllr.exec:\9fxfllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\ntbntt.exec:\ntbntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\hbtbtb.exec:\hbtbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\vjjpv.exec:\vjjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\9lxflrx.exec:\9lxflrx.exe17⤵
- Executes dropped EXE
PID:3052 -
\??\c:\1flrrfx.exec:\1flrrfx.exe18⤵
- Executes dropped EXE
PID:1900 -
\??\c:\7nhthb.exec:\7nhthb.exe19⤵
- Executes dropped EXE
PID:1036 -
\??\c:\ddvjp.exec:\ddvjp.exe20⤵
- Executes dropped EXE
PID:2056 -
\??\c:\flfxxlr.exec:\flfxxlr.exe21⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rflfxfl.exec:\rflfxfl.exe22⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnntht.exec:\nnntht.exe23⤵
- Executes dropped EXE
PID:1548 -
\??\c:\dvdjp.exec:\dvdjp.exe24⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe25⤵
- Executes dropped EXE
PID:2332 -
\??\c:\thbbhh.exec:\thbbhh.exe26⤵
- Executes dropped EXE
PID:112 -
\??\c:\9nbtbh.exec:\9nbtbh.exe27⤵
- Executes dropped EXE
PID:844 -
\??\c:\9dddv.exec:\9dddv.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jdpjp.exec:\jdpjp.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lffxflf.exec:\lffxflf.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vvpvj.exec:\vvpvj.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpdjp.exec:\vpdjp.exe32⤵
- Executes dropped EXE
PID:236 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe33⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lfxfllr.exec:\lfxfllr.exe34⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhbbhn.exec:\nhbbhn.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\1vvpd.exec:\1vvpd.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7ddjj.exec:\7ddjj.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fffrxfx.exec:\fffrxfx.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\5lrrflx.exec:\5lrrflx.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\ththtt.exec:\ththtt.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jdvdd.exec:\jdvdd.exe41⤵
- Executes dropped EXE
PID:1788 -
\??\c:\ppvdj.exec:\ppvdj.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xrllrxl.exec:\xrllrxl.exe43⤵
- Executes dropped EXE
PID:476 -
\??\c:\lflrxlx.exec:\lflrxlx.exe44⤵
- Executes dropped EXE
PID:2040 -
\??\c:\7thbhh.exec:\7thbhh.exe45⤵
- Executes dropped EXE
PID:1508 -
\??\c:\tnbhhn.exec:\tnbhhn.exe46⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ddvdp.exec:\ddvdp.exe47⤵
- Executes dropped EXE
PID:2012 -
\??\c:\xrffllf.exec:\xrffllf.exe48⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xrflxlr.exec:\xrflxlr.exe49⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnbtnn.exec:\nnbtnn.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\btnhtt.exec:\btnhtt.exe51⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1jdjv.exec:\1jdjv.exe52⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpdjp.exec:\vpdjp.exe53⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1fxxxfr.exec:\1fxxxfr.exe54⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xrflrlx.exec:\xrflrlx.exe55⤵
- Executes dropped EXE
PID:2868 -
\??\c:\thnbhh.exec:\thnbhh.exe56⤵
- Executes dropped EXE
PID:1344 -
\??\c:\bbnttt.exec:\bbnttt.exe57⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7jvvv.exec:\7jvvv.exe58⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvddj.exec:\jvddj.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rfxrxxl.exec:\rfxrxxl.exe60⤵
- Executes dropped EXE
PID:1868 -
\??\c:\3frrxlr.exec:\3frrxlr.exe61⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1tbttt.exec:\1tbttt.exe62⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tnbhbt.exec:\tnbhbt.exe63⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpvpd.exec:\vpvpd.exe64⤵
- Executes dropped EXE
PID:1016 -
\??\c:\vpjpd.exec:\vpjpd.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xrxfxff.exec:\xrxfxff.exe66⤵PID:280
-
\??\c:\xrrrxff.exec:\xrrrxff.exe67⤵PID:1924
-
\??\c:\3bnnnb.exec:\3bnnnb.exe68⤵PID:2592
-
\??\c:\vpddp.exec:\vpddp.exe69⤵PID:764
-
\??\c:\7dpjj.exec:\7dpjj.exe70⤵PID:1624
-
\??\c:\jddjd.exec:\jddjd.exe71⤵PID:524
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe72⤵PID:1580
-
\??\c:\nhttbb.exec:\nhttbb.exe73⤵PID:872
-
\??\c:\nhnntt.exec:\nhnntt.exe74⤵PID:1740
-
\??\c:\vvjvj.exec:\vvjvj.exe75⤵PID:2572
-
\??\c:\vpjdd.exec:\vpjdd.exe76⤵PID:1648
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe77⤵PID:2532
-
\??\c:\1lfxlxf.exec:\1lfxlxf.exe78⤵PID:2068
-
\??\c:\1tthhh.exec:\1tthhh.exe79⤵PID:2716
-
\??\c:\9nbhtt.exec:\9nbhtt.exe80⤵PID:2888
-
\??\c:\jdpvd.exec:\jdpvd.exe81⤵PID:2744
-
\??\c:\ddpvd.exec:\ddpvd.exe82⤵PID:3068
-
\??\c:\9fxfrrf.exec:\9fxfrrf.exe83⤵PID:2640
-
\??\c:\xflxxfx.exec:\xflxxfx.exe84⤵PID:2844
-
\??\c:\1nhntb.exec:\1nhntb.exe85⤵PID:2616
-
\??\c:\5nhtbb.exec:\5nhtbb.exe86⤵PID:2688
-
\??\c:\5ppvv.exec:\5ppvv.exe87⤵PID:2364
-
\??\c:\pjjpv.exec:\pjjpv.exe88⤵PID:2676
-
\??\c:\ffxxlfr.exec:\ffxxlfr.exe89⤵PID:1568
-
\??\c:\lxrlxxx.exec:\lxrlxxx.exe90⤵PID:1396
-
\??\c:\1fxrflr.exec:\1fxrflr.exe91⤵PID:3004
-
\??\c:\hbnhhn.exec:\hbnhhn.exe92⤵PID:2936
-
\??\c:\hbhhtt.exec:\hbhhtt.exe93⤵PID:568
-
\??\c:\jjvjp.exec:\jjvjp.exe94⤵PID:2712
-
\??\c:\pjjpp.exec:\pjjpp.exe95⤵PID:2920
-
\??\c:\lflxlrf.exec:\lflxlrf.exe96⤵PID:2960
-
\??\c:\7rrlrrr.exec:\7rrlrrr.exe97⤵PID:3052
-
\??\c:\5bttth.exec:\5bttth.exe98⤵PID:1904
-
\??\c:\bthhnn.exec:\bthhnn.exe99⤵PID:1900
-
\??\c:\jdpvd.exec:\jdpvd.exe100⤵PID:2232
-
\??\c:\pjvvd.exec:\pjvvd.exe101⤵PID:2164
-
\??\c:\rlfflff.exec:\rlfflff.exe102⤵PID:2024
-
\??\c:\xrffrxf.exec:\xrffrxf.exe103⤵PID:2112
-
\??\c:\nnhnth.exec:\nnhnth.exe104⤵PID:1316
-
\??\c:\9bthtt.exec:\9bthtt.exe105⤵PID:1548
-
\??\c:\vpvvv.exec:\vpvvv.exe106⤵PID:408
-
\??\c:\vpvvd.exec:\vpvvd.exe107⤵PID:820
-
\??\c:\xxffrxf.exec:\xxffrxf.exe108⤵PID:1732
-
\??\c:\xlflxff.exec:\xlflxff.exe109⤵PID:1440
-
\??\c:\bbhbtb.exec:\bbhbtb.exe110⤵PID:3032
-
\??\c:\ddvdv.exec:\ddvdv.exe111⤵PID:2584
-
\??\c:\pjpjj.exec:\pjpjj.exe112⤵PID:604
-
\??\c:\rfxxllx.exec:\rfxxllx.exe113⤵PID:344
-
\??\c:\xrrxrfl.exec:\xrrxrfl.exe114⤵PID:1428
-
\??\c:\nnhnhh.exec:\nnhnhh.exe115⤵PID:524
-
\??\c:\dvjpv.exec:\dvjpv.exe116⤵PID:1908
-
\??\c:\vvdvv.exec:\vvdvv.exe117⤵PID:1256
-
\??\c:\fxlxrrf.exec:\fxlxrrf.exe118⤵PID:2544
-
\??\c:\lllxfrl.exec:\lllxfrl.exe119⤵PID:2536
-
\??\c:\nnbhbb.exec:\nnbhbb.exe120⤵PID:1520
-
\??\c:\bnbhnt.exec:\bnbhnt.exe121⤵PID:2532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-