Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe
-
Size
453KB
-
MD5
5371c3a06b6d83729c37424b9e530779
-
SHA1
20437b26ae33536fa4a6ed40a3fde9daedf11d4a
-
SHA256
8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051
-
SHA512
9ce002f23ee512d45eac1003c9fddffef9cf1471771985248d9bc88556099de427362e4e23bbe0d358624570d438384e85229f42bc82417dc86516a4a4b08972
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/3056-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1864-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1488-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1408-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-170-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2152-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-290-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3044-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3044-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-380-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1948-387-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1084-393-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2808-432-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2412-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-563-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2344-605-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-692-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2896-705-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2696-719-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1356-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-980-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2768-1166-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1796-1235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 9rllxfr.exe 1972 3pppj.exe 2172 llrxfxr.exe 2736 9ttthh.exe 2860 pjvdp.exe 2740 lxrxllr.exe 2640 dvjdj.exe 2772 dpddp.exe 2624 lrrlrfx.exe 1688 1nhhtn.exe 1864 ffxlxfl.exe 876 lxfflfr.exe 2812 lfrrrrf.exe 1488 btthbb.exe 1408 5rlfllx.exe 1844 1frrrxx.exe 2936 jdjpv.exe 2444 lxxflll.exe 2152 btntbn.exe 1384 dvjpp.exe 2192 htbtth.exe 1332 lfxfllf.exe 2644 5ttthn.exe 2960 rrlrflx.exe 2320 bthnbh.exe 920 dvvdp.exe 2268 lfrrfxl.exe 1156 5bnnbb.exe 700 jddjv.exe 1676 3bntbh.exe 1648 3vvvd.exe 3044 tthntb.exe 2008 7pjpj.exe 2340 xlfflxl.exe 1968 tnhnbh.exe 2752 vvjvd.exe 2756 rflfllr.exe 2884 3ntthn.exe 1932 1hntht.exe 2992 dvpvp.exe 2628 xxlfffr.exe 2660 5lfxxfr.exe 2656 7hhbbb.exe 2600 1jddd.exe 1948 1xlxxxr.exe 1084 7hhhbb.exe 1632 tnhhnt.exe 572 pdpvd.exe 1908 rxrxxfl.exe 768 hbhbtt.exe 1488 bnhnbh.exe 2808 ddjpv.exe 1820 xxflrfr.exe 1584 hthbbb.exe 2432 jdpjp.exe 2412 dvvvd.exe 2704 xrllxrr.exe 3052 tnbntt.exe 444 pjdjv.exe 2044 pjddp.exe 1088 fxrrlrf.exe 956 3tbbnb.exe 1872 jjdjv.exe 1784 1jdjv.exe -
resource yara_rule behavioral1/memory/3056-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-290-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/3044-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-899-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-980-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/916-1069-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1796-1235-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2060 3056 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 3056 wrote to memory of 2060 3056 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 3056 wrote to memory of 2060 3056 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 3056 wrote to memory of 2060 3056 8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe 30 PID 2060 wrote to memory of 1972 2060 9rllxfr.exe 31 PID 2060 wrote to memory of 1972 2060 9rllxfr.exe 31 PID 2060 wrote to memory of 1972 2060 9rllxfr.exe 31 PID 2060 wrote to memory of 1972 2060 9rllxfr.exe 31 PID 1972 wrote to memory of 2172 1972 3pppj.exe 32 PID 1972 wrote to memory of 2172 1972 3pppj.exe 32 PID 1972 wrote to memory of 2172 1972 3pppj.exe 32 PID 1972 wrote to memory of 2172 1972 3pppj.exe 32 PID 2172 wrote to memory of 2736 2172 llrxfxr.exe 33 PID 2172 wrote to memory of 2736 2172 llrxfxr.exe 33 PID 2172 wrote to memory of 2736 2172 llrxfxr.exe 33 PID 2172 wrote to memory of 2736 2172 llrxfxr.exe 33 PID 2736 wrote to memory of 2860 2736 9ttthh.exe 34 PID 2736 wrote to memory of 2860 2736 9ttthh.exe 34 PID 2736 wrote to memory of 2860 2736 9ttthh.exe 34 PID 2736 wrote to memory of 2860 2736 9ttthh.exe 34 PID 2860 wrote to memory of 2740 2860 pjvdp.exe 35 PID 2860 wrote to memory of 2740 2860 pjvdp.exe 35 PID 2860 wrote to memory of 2740 2860 pjvdp.exe 35 PID 2860 wrote to memory of 2740 2860 pjvdp.exe 35 PID 2740 wrote to memory of 2640 2740 lxrxllr.exe 36 PID 2740 wrote to memory of 2640 2740 lxrxllr.exe 36 PID 2740 wrote to memory of 2640 2740 lxrxllr.exe 36 PID 2740 wrote to memory of 2640 2740 lxrxllr.exe 36 PID 2640 wrote to memory of 2772 2640 dvjdj.exe 37 PID 2640 wrote to memory of 2772 2640 dvjdj.exe 37 PID 2640 wrote to memory of 2772 2640 dvjdj.exe 37 PID 2640 wrote to memory of 2772 2640 dvjdj.exe 37 PID 2772 wrote to memory of 2624 2772 dpddp.exe 38 PID 2772 wrote to memory of 2624 2772 dpddp.exe 38 PID 2772 wrote to memory of 2624 2772 dpddp.exe 38 PID 2772 wrote to memory of 2624 2772 dpddp.exe 38 PID 2624 wrote to memory of 1688 2624 lrrlrfx.exe 39 PID 2624 wrote to memory of 1688 2624 lrrlrfx.exe 39 PID 2624 wrote to memory of 1688 2624 lrrlrfx.exe 39 PID 2624 wrote to memory of 1688 2624 lrrlrfx.exe 39 PID 1688 wrote to memory of 1864 1688 1nhhtn.exe 40 PID 1688 wrote to memory of 1864 1688 1nhhtn.exe 40 PID 1688 wrote to memory of 1864 1688 1nhhtn.exe 40 PID 1688 wrote to memory of 1864 1688 1nhhtn.exe 40 PID 1864 wrote to memory of 876 1864 ffxlxfl.exe 41 PID 1864 wrote to memory of 876 1864 ffxlxfl.exe 41 PID 1864 wrote to memory of 876 1864 ffxlxfl.exe 41 PID 1864 wrote to memory of 876 1864 ffxlxfl.exe 41 PID 876 wrote to memory of 2812 876 lxfflfr.exe 42 PID 876 wrote to memory of 2812 876 lxfflfr.exe 42 PID 876 wrote to memory of 2812 876 lxfflfr.exe 42 PID 876 wrote to memory of 2812 876 lxfflfr.exe 42 PID 2812 wrote to memory of 1488 2812 lfrrrrf.exe 43 PID 2812 wrote to memory of 1488 2812 lfrrrrf.exe 43 PID 2812 wrote to memory of 1488 2812 lfrrrrf.exe 43 PID 2812 wrote to memory of 1488 2812 lfrrrrf.exe 43 PID 1488 wrote to memory of 1408 1488 btthbb.exe 44 PID 1488 wrote to memory of 1408 1488 btthbb.exe 44 PID 1488 wrote to memory of 1408 1488 btthbb.exe 44 PID 1488 wrote to memory of 1408 1488 btthbb.exe 44 PID 1408 wrote to memory of 1844 1408 5rlfllx.exe 45 PID 1408 wrote to memory of 1844 1408 5rlfllx.exe 45 PID 1408 wrote to memory of 1844 1408 5rlfllx.exe 45 PID 1408 wrote to memory of 1844 1408 5rlfllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe"C:\Users\Admin\AppData\Local\Temp\8d0f96ceddd83aa15ce76fe63c4905bb9fd2382089c3764539a136fe56a3d051.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\9rllxfr.exec:\9rllxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\3pppj.exec:\3pppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\llrxfxr.exec:\llrxfxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\9ttthh.exec:\9ttthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\pjvdp.exec:\pjvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\lxrxllr.exec:\lxrxllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dvjdj.exec:\dvjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\dpddp.exec:\dpddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\lrrlrfx.exec:\lrrlrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\1nhhtn.exec:\1nhhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\ffxlxfl.exec:\ffxlxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\lxfflfr.exec:\lxfflfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\lfrrrrf.exec:\lfrrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\btthbb.exec:\btthbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\5rlfllx.exec:\5rlfllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\1frrrxx.exec:\1frrrxx.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jdjpv.exec:\jdjpv.exe18⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lxxflll.exec:\lxxflll.exe19⤵
- Executes dropped EXE
PID:2444 -
\??\c:\btntbn.exec:\btntbn.exe20⤵
- Executes dropped EXE
PID:2152 -
\??\c:\dvjpp.exec:\dvjpp.exe21⤵
- Executes dropped EXE
PID:1384 -
\??\c:\htbtth.exec:\htbtth.exe22⤵
- Executes dropped EXE
PID:2192 -
\??\c:\lfxfllf.exec:\lfxfllf.exe23⤵
- Executes dropped EXE
PID:1332 -
\??\c:\5ttthn.exec:\5ttthn.exe24⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rrlrflx.exec:\rrlrflx.exe25⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bthnbh.exec:\bthnbh.exe26⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvvdp.exec:\dvvdp.exe27⤵
- Executes dropped EXE
PID:920 -
\??\c:\lfrrfxl.exec:\lfrrfxl.exe28⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5bnnbb.exec:\5bnnbb.exe29⤵
- Executes dropped EXE
PID:1156 -
\??\c:\jddjv.exec:\jddjv.exe30⤵
- Executes dropped EXE
PID:700 -
\??\c:\3bntbh.exec:\3bntbh.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\3vvvd.exec:\3vvvd.exe32⤵
- Executes dropped EXE
PID:1648 -
\??\c:\tthntb.exec:\tthntb.exe33⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7pjpj.exec:\7pjpj.exe34⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xlfflxl.exec:\xlfflxl.exe35⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnhnbh.exec:\tnhnbh.exe36⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vvjvd.exec:\vvjvd.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rflfllr.exec:\rflfllr.exe38⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3ntthn.exec:\3ntthn.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1hntht.exec:\1hntht.exe40⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dvpvp.exec:\dvpvp.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\xxlfffr.exec:\xxlfffr.exe42⤵
- Executes dropped EXE
PID:2628 -
\??\c:\5lfxxfr.exec:\5lfxxfr.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\7hhbbb.exec:\7hhbbb.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1jddd.exec:\1jddd.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1xlxxxr.exec:\1xlxxxr.exe46⤵
- Executes dropped EXE
PID:1948 -
\??\c:\7hhhbb.exec:\7hhhbb.exe47⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tnhhnt.exec:\tnhhnt.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pdpvd.exec:\pdpvd.exe49⤵
- Executes dropped EXE
PID:572 -
\??\c:\rxrxxfl.exec:\rxrxxfl.exe50⤵
- Executes dropped EXE
PID:1908 -
\??\c:\hbhbtt.exec:\hbhbtt.exe51⤵
- Executes dropped EXE
PID:768 -
\??\c:\bnhnbh.exec:\bnhnbh.exe52⤵
- Executes dropped EXE
PID:1488 -
\??\c:\ddjpv.exec:\ddjpv.exe53⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xxflrfr.exec:\xxflrfr.exe54⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hthbbb.exec:\hthbbb.exe55⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jdpjp.exec:\jdpjp.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dvvvd.exec:\dvvvd.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrllxrr.exec:\xrllxrr.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\tnbntt.exec:\tnbntt.exe59⤵
- Executes dropped EXE
PID:3052 -
\??\c:\pjdjv.exec:\pjdjv.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjddp.exec:\pjddp.exe61⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxrrlrf.exec:\fxrrlrf.exe62⤵
- Executes dropped EXE
PID:1088 -
\??\c:\3tbbnb.exec:\3tbbnb.exe63⤵
- Executes dropped EXE
PID:956 -
\??\c:\jjdjv.exec:\jjdjv.exe64⤵
- Executes dropped EXE
PID:1872 -
\??\c:\1jdjv.exec:\1jdjv.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrllxxl.exec:\xrllxxl.exe66⤵PID:1328
-
\??\c:\nhbbhb.exec:\nhbbhb.exe67⤵PID:908
-
\??\c:\vjvvd.exec:\vjvvd.exe68⤵PID:2492
-
\??\c:\vjddp.exec:\vjddp.exe69⤵PID:2496
-
\??\c:\3llllxf.exec:\3llllxf.exe70⤵PID:2104
-
\??\c:\hbbtnn.exec:\hbbtnn.exe71⤵PID:2224
-
\??\c:\1dppv.exec:\1dppv.exe72⤵PID:1352
-
\??\c:\vpjvv.exec:\vpjvv.exe73⤵PID:848
-
\??\c:\7lxxxfl.exec:\7lxxxfl.exe74⤵PID:2336
-
\??\c:\tnhntb.exec:\tnhntb.exe75⤵PID:2324
-
\??\c:\jdvjv.exec:\jdvjv.exe76⤵PID:3044
-
\??\c:\pvjpd.exec:\pvjpd.exe77⤵PID:2348
-
\??\c:\xlffrxl.exec:\xlffrxl.exe78⤵PID:2008
-
\??\c:\5nhhnt.exec:\5nhhnt.exe79⤵PID:2340
-
\??\c:\1jdvd.exec:\1jdvd.exe80⤵PID:1968
-
\??\c:\jvdvd.exec:\jvdvd.exe81⤵PID:2344
-
\??\c:\9xrrflx.exec:\9xrrflx.exe82⤵PID:2736
-
\??\c:\nhnhnn.exec:\nhnhnn.exe83⤵PID:2884
-
\??\c:\9jvvd.exec:\9jvvd.exe84⤵PID:2900
-
\??\c:\3jpvd.exec:\3jpvd.exe85⤵PID:2632
-
\??\c:\rrxxlrx.exec:\rrxxlrx.exe86⤵PID:2776
-
\??\c:\5htnnb.exec:\5htnnb.exe87⤵PID:2728
-
\??\c:\3tttbb.exec:\3tttbb.exe88⤵PID:2604
-
\??\c:\pjpvd.exec:\pjpvd.exe89⤵PID:2500
-
\??\c:\fxrrffx.exec:\fxrrffx.exe90⤵PID:988
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe91⤵PID:2672
-
\??\c:\bnhnbt.exec:\bnhnbt.exe92⤵PID:796
-
\??\c:\jvddd.exec:\jvddd.exe93⤵PID:584
-
\??\c:\lfxflrx.exec:\lfxflrx.exe94⤵PID:1032
-
\??\c:\xfflrxf.exec:\xfflrxf.exe95⤵PID:2824
-
\??\c:\nnhtbh.exec:\nnhtbh.exe96⤵PID:532
-
\??\c:\pjvjv.exec:\pjvjv.exe97⤵PID:2896
-
\??\c:\rxrxllr.exec:\rxrxllr.exe98⤵PID:1636
-
\??\c:\xlfxlrl.exec:\xlfxlrl.exe99⤵PID:2696
-
\??\c:\btnttb.exec:\btnttb.exe100⤵PID:2936
-
\??\c:\vvjpd.exec:\vvjpd.exe101⤵PID:2220
-
\??\c:\5dppd.exec:\5dppd.exe102⤵PID:2256
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe103⤵PID:3064
-
\??\c:\bththt.exec:\bththt.exe104⤵PID:3008
-
\??\c:\1dpvv.exec:\1dpvv.exe105⤵PID:1812
-
\??\c:\3djpd.exec:\3djpd.exe106⤵PID:1356
-
\??\c:\xlrrfxf.exec:\xlrrfxf.exe107⤵PID:2156
-
\??\c:\7ntthb.exec:\7ntthb.exe108⤵PID:1828
-
\??\c:\tnbhhh.exec:\tnbhhh.exe109⤵PID:1284
-
\??\c:\1jppv.exec:\1jppv.exe110⤵PID:1236
-
\??\c:\3lxflxx.exec:\3lxflxx.exe111⤵PID:2468
-
\??\c:\3fxxfrr.exec:\3fxxfrr.exe112⤵PID:1760
-
\??\c:\btnhtt.exec:\btnhtt.exe113⤵PID:2012
-
\??\c:\vjvpv.exec:\vjvpv.exe114⤵PID:2180
-
\??\c:\vpvvv.exec:\vpvvv.exe115⤵PID:2108
-
\??\c:\1frlxxf.exec:\1frlxxf.exe116⤵PID:1680
-
\??\c:\5bntbb.exec:\5bntbb.exe117⤵PID:848
-
\??\c:\pdppd.exec:\pdppd.exe118⤵PID:1412
-
\??\c:\3lllxlr.exec:\3lllxlr.exe119⤵PID:2528
-
\??\c:\fxrfrxr.exec:\fxrfrxr.exe120⤵PID:1280
-
\??\c:\btntbb.exec:\btntbb.exe121⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-