Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe
-
Size
453KB
-
MD5
677b4d591e9cf494125b2ea79c284e80
-
SHA1
6d249e1f6573690574c37a8b7e6ef72e2bc18234
-
SHA256
62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8
-
SHA512
2645517ab7a3b1d5dbff29db278b89c16cb9ec0099151b76d25f6878f5dc206728f1cedc25e52eb7d786ef8d6ad5e0b359464ef65328fc482b28cdc61e71356f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbem:q7Tc2NYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/3012-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-51-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-77-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2644-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-157-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-239-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-326-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2752-330-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-380-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2172-394-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2336-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-516-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2284-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-531-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-560-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2776-654-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-736-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-743-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2892-750-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-753-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-806-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-813-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 3ddvj.exe 2368 jjddj.exe 3008 pvvjv.exe 2296 bbntbh.exe 2812 7jvjp.exe 2744 ffxfxxl.exe 2644 fflxlrl.exe 2776 fxlxrxl.exe 2628 llflflf.exe 2324 5tnntb.exe 484 lrrlflf.exe 2068 bbnbhn.exe 1796 ffrxrfx.exe 2596 dvjpd.exe 2344 rrxlrfr.exe 1560 bttttb.exe 1912 xxrxfrr.exe 2984 tbnbbb.exe 1260 ffrxffl.exe 2224 nhttnt.exe 1456 1rrxffr.exe 964 tnhnbh.exe 916 9lfrfrx.exe 1672 hhthnn.exe 1520 nthttt.exe 1532 nnthtb.exe 2128 1ttbnn.exe 2492 jjddp.exe 2536 bbnbhh.exe 884 jjddv.exe 2116 1bbnhh.exe 1584 dvppv.exe 2100 1nntnt.exe 2448 bthnth.exe 2752 vdpvj.exe 2820 lfxlrxl.exe 2296 tthnhn.exe 1592 7bbtnh.exe 2912 jdvjp.exe 2616 3xfxflr.exe 2748 llffrlf.exe 2784 htntbb.exe 2688 7vvdp.exe 2172 1xxxxlx.exe 2328 3hbhtb.exe 1116 tnhtbb.exe 2668 jjpvj.exe 776 vpvvp.exe 976 5xrrfrf.exe 2336 thttbt.exe 2596 7btbnt.exe 324 1dppp.exe 2896 llflrfr.exe 1148 hhnhbt.exe 2892 dvjpp.exe 576 vvpdj.exe 1304 1rffllr.exe 1156 bthhnh.exe 2588 jvjpd.exe 3036 xlffrxl.exe 1748 9xxxrrf.exe 1616 1tnbnt.exe 1080 jjvdp.exe 1660 rlflllx.exe -
resource yara_rule behavioral1/memory/3012-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-157-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1560-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-380-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2172-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-531-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2212-560-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2936-567-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2812-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-858-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-909-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2544 3012 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 30 PID 3012 wrote to memory of 2544 3012 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 30 PID 3012 wrote to memory of 2544 3012 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 30 PID 3012 wrote to memory of 2544 3012 62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe 30 PID 2544 wrote to memory of 2368 2544 3ddvj.exe 31 PID 2544 wrote to memory of 2368 2544 3ddvj.exe 31 PID 2544 wrote to memory of 2368 2544 3ddvj.exe 31 PID 2544 wrote to memory of 2368 2544 3ddvj.exe 31 PID 2368 wrote to memory of 3008 2368 jjddj.exe 32 PID 2368 wrote to memory of 3008 2368 jjddj.exe 32 PID 2368 wrote to memory of 3008 2368 jjddj.exe 32 PID 2368 wrote to memory of 3008 2368 jjddj.exe 32 PID 3008 wrote to memory of 2296 3008 pvvjv.exe 33 PID 3008 wrote to memory of 2296 3008 pvvjv.exe 33 PID 3008 wrote to memory of 2296 3008 pvvjv.exe 33 PID 3008 wrote to memory of 2296 3008 pvvjv.exe 33 PID 2296 wrote to memory of 2812 2296 bbntbh.exe 34 PID 2296 wrote to memory of 2812 2296 bbntbh.exe 34 PID 2296 wrote to memory of 2812 2296 bbntbh.exe 34 PID 2296 wrote to memory of 2812 2296 bbntbh.exe 34 PID 2812 wrote to memory of 2744 2812 7jvjp.exe 35 PID 2812 wrote to memory of 2744 2812 7jvjp.exe 35 PID 2812 wrote to memory of 2744 2812 7jvjp.exe 35 PID 2812 wrote to memory of 2744 2812 7jvjp.exe 35 PID 2744 wrote to memory of 2644 2744 ffxfxxl.exe 36 PID 2744 wrote to memory of 2644 2744 ffxfxxl.exe 36 PID 2744 wrote to memory of 2644 2744 ffxfxxl.exe 36 PID 2744 wrote to memory of 2644 2744 ffxfxxl.exe 36 PID 2644 wrote to memory of 2776 2644 fflxlrl.exe 37 PID 2644 wrote to memory of 2776 2644 fflxlrl.exe 37 PID 2644 wrote to memory of 2776 2644 fflxlrl.exe 37 PID 2644 wrote to memory of 2776 2644 fflxlrl.exe 37 PID 2776 wrote to memory of 2628 2776 fxlxrxl.exe 38 PID 2776 wrote to memory of 2628 2776 fxlxrxl.exe 38 PID 2776 wrote to memory of 2628 2776 fxlxrxl.exe 38 PID 2776 wrote to memory of 2628 2776 fxlxrxl.exe 38 PID 2628 wrote to memory of 2324 2628 llflflf.exe 39 PID 2628 wrote to memory of 2324 2628 llflflf.exe 39 PID 2628 wrote to memory of 2324 2628 llflflf.exe 39 PID 2628 wrote to memory of 2324 2628 llflflf.exe 39 PID 2324 wrote to memory of 484 2324 5tnntb.exe 40 PID 2324 wrote to memory of 484 2324 5tnntb.exe 40 PID 2324 wrote to memory of 484 2324 5tnntb.exe 40 PID 2324 wrote to memory of 484 2324 5tnntb.exe 40 PID 484 wrote to memory of 2068 484 lrrlflf.exe 41 PID 484 wrote to memory of 2068 484 lrrlflf.exe 41 PID 484 wrote to memory of 2068 484 lrrlflf.exe 41 PID 484 wrote to memory of 2068 484 lrrlflf.exe 41 PID 2068 wrote to memory of 1796 2068 bbnbhn.exe 42 PID 2068 wrote to memory of 1796 2068 bbnbhn.exe 42 PID 2068 wrote to memory of 1796 2068 bbnbhn.exe 42 PID 2068 wrote to memory of 1796 2068 bbnbhn.exe 42 PID 1796 wrote to memory of 2596 1796 ffrxrfx.exe 43 PID 1796 wrote to memory of 2596 1796 ffrxrfx.exe 43 PID 1796 wrote to memory of 2596 1796 ffrxrfx.exe 43 PID 1796 wrote to memory of 2596 1796 ffrxrfx.exe 43 PID 2596 wrote to memory of 2344 2596 dvjpd.exe 44 PID 2596 wrote to memory of 2344 2596 dvjpd.exe 44 PID 2596 wrote to memory of 2344 2596 dvjpd.exe 44 PID 2596 wrote to memory of 2344 2596 dvjpd.exe 44 PID 2344 wrote to memory of 1560 2344 rrxlrfr.exe 45 PID 2344 wrote to memory of 1560 2344 rrxlrfr.exe 45 PID 2344 wrote to memory of 1560 2344 rrxlrfr.exe 45 PID 2344 wrote to memory of 1560 2344 rrxlrfr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe"C:\Users\Admin\AppData\Local\Temp\62e180700bcc672252e5461d231ff0173cfec2b41ed72d02fba23bafa57d9ba8N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\3ddvj.exec:\3ddvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jjddj.exec:\jjddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pvvjv.exec:\pvvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bbntbh.exec:\bbntbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\7jvjp.exec:\7jvjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\ffxfxxl.exec:\ffxfxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\fflxlrl.exec:\fflxlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\fxlxrxl.exec:\fxlxrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\llflflf.exec:\llflflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\5tnntb.exec:\5tnntb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\lrrlflf.exec:\lrrlflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\bbnbhn.exec:\bbnbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ffrxrfx.exec:\ffrxrfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\dvjpd.exec:\dvjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\rrxlrfr.exec:\rrxlrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bttttb.exec:\bttttb.exe17⤵
- Executes dropped EXE
PID:1560 -
\??\c:\xxrxfrr.exec:\xxrxfrr.exe18⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tbnbbb.exec:\tbnbbb.exe19⤵
- Executes dropped EXE
PID:2984 -
\??\c:\ffrxffl.exec:\ffrxffl.exe20⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nhttnt.exec:\nhttnt.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\1rrxffr.exec:\1rrxffr.exe22⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnhnbh.exec:\tnhnbh.exe23⤵
- Executes dropped EXE
PID:964 -
\??\c:\9lfrfrx.exec:\9lfrfrx.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\hhthnn.exec:\hhthnn.exe25⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nthttt.exec:\nthttt.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\nnthtb.exec:\nnthtb.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1ttbnn.exec:\1ttbnn.exe28⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jjddp.exec:\jjddp.exe29⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbnbhh.exec:\bbnbhh.exe30⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jjddv.exec:\jjddv.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\1bbnhh.exec:\1bbnhh.exe32⤵
- Executes dropped EXE
PID:2116 -
\??\c:\dvppv.exec:\dvppv.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1nntnt.exec:\1nntnt.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bthnth.exec:\bthnth.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vdpvj.exec:\vdpvj.exe36⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\tthnhn.exec:\tthnhn.exe38⤵
- Executes dropped EXE
PID:2296 -
\??\c:\7bbtnh.exec:\7bbtnh.exe39⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jdvjp.exec:\jdvjp.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3xfxflr.exec:\3xfxflr.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\llffrlf.exec:\llffrlf.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\htntbb.exec:\htntbb.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7vvdp.exec:\7vvdp.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\1xxxxlx.exec:\1xxxxlx.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3hbhtb.exec:\3hbhtb.exe46⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tnhtbb.exec:\tnhtbb.exe47⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jjpvj.exec:\jjpvj.exe48⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vpvvp.exec:\vpvvp.exe49⤵
- Executes dropped EXE
PID:776 -
\??\c:\5xrrfrf.exec:\5xrrfrf.exe50⤵
- Executes dropped EXE
PID:976 -
\??\c:\thttbt.exec:\thttbt.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7btbnt.exec:\7btbnt.exe52⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1dppp.exec:\1dppp.exe53⤵
- Executes dropped EXE
PID:324 -
\??\c:\llflrfr.exec:\llflrfr.exe54⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hhnhbt.exec:\hhnhbt.exe55⤵
- Executes dropped EXE
PID:1148 -
\??\c:\dvjpp.exec:\dvjpp.exe56⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvpdj.exec:\vvpdj.exe57⤵
- Executes dropped EXE
PID:576 -
\??\c:\1rffllr.exec:\1rffllr.exe58⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bthhnh.exec:\bthhnh.exe59⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jvjpd.exec:\jvjpd.exe60⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xlffrxl.exec:\xlffrxl.exe61⤵
- Executes dropped EXE
PID:3036 -
\??\c:\9xxxrrf.exec:\9xxxrrf.exe62⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1tnbnt.exec:\1tnbnt.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\jjvdp.exec:\jjvdp.exe64⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rlflllx.exec:\rlflllx.exe65⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lfrlrlf.exec:\lfrlrlf.exe66⤵PID:2284
-
\??\c:\5ntbhh.exec:\5ntbhh.exe67⤵PID:2560
-
\??\c:\vjpdj.exec:\vjpdj.exe68⤵PID:2936
-
\??\c:\5rllfll.exec:\5rllfll.exe69⤵PID:380
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe70⤵PID:2212
-
\??\c:\7nbhnn.exec:\7nbhnn.exe71⤵PID:616
-
\??\c:\dvjpv.exec:\dvjpv.exe72⤵PID:2300
-
\??\c:\9xffxxx.exec:\9xffxxx.exe73⤵PID:1924
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe74⤵PID:2116
-
\??\c:\bnbtnn.exec:\bnbtnn.exe75⤵PID:1576
-
\??\c:\dvjpd.exec:\dvjpd.exe76⤵PID:2076
-
\??\c:\vvjpp.exec:\vvjpp.exe77⤵PID:2276
-
\??\c:\flfxflx.exec:\flfxflx.exe78⤵PID:2448
-
\??\c:\bhhbnn.exec:\bhhbnn.exe79⤵PID:2752
-
\??\c:\nbtbhh.exec:\nbtbhh.exe80⤵PID:2156
-
\??\c:\vpjjp.exec:\vpjjp.exe81⤵PID:2736
-
\??\c:\xxxxllx.exec:\xxxxllx.exe82⤵PID:2812
-
\??\c:\bnthtb.exec:\bnthtb.exe83⤵PID:2728
-
\??\c:\3nhntb.exec:\3nhntb.exe84⤵PID:2744
-
\??\c:\9dpdv.exec:\9dpdv.exe85⤵PID:2724
-
\??\c:\5xlflrx.exec:\5xlflrx.exe86⤵PID:2776
-
\??\c:\lfllxrf.exec:\lfllxrf.exe87⤵PID:2672
-
\??\c:\5bnhnh.exec:\5bnhnh.exe88⤵PID:2456
-
\??\c:\7ddjj.exec:\7ddjj.exe89⤵PID:1140
-
\??\c:\dvpvj.exec:\dvpvj.exe90⤵PID:1484
-
\??\c:\1rlxffl.exec:\1rlxffl.exe91⤵PID:2880
-
\??\c:\bnhthn.exec:\bnhthn.exe92⤵PID:556
-
\??\c:\3djdd.exec:\3djdd.exe93⤵PID:2860
-
\??\c:\jdjjp.exec:\jdjjp.exe94⤵PID:1724
-
\??\c:\3fllrlr.exec:\3fllrlr.exe95⤵PID:376
-
\??\c:\1htbnt.exec:\1htbnt.exe96⤵PID:2596
-
\??\c:\ttnbnn.exec:\ttnbnn.exe97⤵PID:1256
-
\??\c:\jdpvd.exec:\jdpvd.exe98⤵PID:1912
-
\??\c:\flflxfx.exec:\flflxfx.exe99⤵PID:2940
-
\??\c:\5nbbhn.exec:\5nbbhn.exe100⤵PID:2892
-
\??\c:\5tbttn.exec:\5tbttn.exe101⤵PID:448
-
\??\c:\9pjdd.exec:\9pjdd.exe102⤵PID:3040
-
\??\c:\frfflrx.exec:\frfflrx.exe103⤵PID:1156
-
\??\c:\lrrxflr.exec:\lrrxflr.exe104⤵PID:1516
-
\??\c:\bntttn.exec:\bntttn.exe105⤵PID:1456
-
\??\c:\dpjpj.exec:\dpjpj.exe106⤵PID:1320
-
\??\c:\pvjvp.exec:\pvjvp.exe107⤵PID:1372
-
\??\c:\xrlrfll.exec:\xrlrfll.exe108⤵PID:916
-
\??\c:\5httnn.exec:\5httnn.exe109⤵PID:2080
-
\??\c:\ppvdp.exec:\ppvdp.exe110⤵PID:2436
-
\??\c:\ppddv.exec:\ppddv.exe111⤵PID:2144
-
\??\c:\ffxxflx.exec:\ffxxflx.exe112⤵PID:568
-
\??\c:\bnbbnh.exec:\bnbbnh.exe113⤵PID:1800
-
\??\c:\pvppj.exec:\pvppj.exe114⤵PID:2196
-
\??\c:\1frlrxx.exec:\1frlrxx.exe115⤵PID:1740
-
\??\c:\9bbhtb.exec:\9bbhtb.exe116⤵PID:3068
-
\??\c:\5jjjv.exec:\5jjjv.exe117⤵PID:2524
-
\??\c:\xlfflrf.exec:\xlfflrf.exe118⤵PID:2500
-
\??\c:\btnnhn.exec:\btnnhn.exe119⤵PID:1584
-
\??\c:\jdddj.exec:\jdddj.exe120⤵PID:2692
-
\??\c:\5pdjd.exec:\5pdjd.exe121⤵PID:2808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-