Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe
-
Size
454KB
-
MD5
26840d2dd87bf7ca12964eb1529b71ab
-
SHA1
e7bc67db3b2970c83ab175b4185874dfb0adb3dc
-
SHA256
6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84
-
SHA512
e0e69348866bc3be7ee6b2e31cff3ffe5f313c526dcddc08a6f9ec32de1fa050f5973c4e7eaca2836a91f2c4b393d00052a453e86abbe018b064ca8fe3cd6da2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ:q7Tc2NYHUrAwfMp3CDJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2468-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-62-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-223-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2444-246-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2400-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-251-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1012-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-307-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2460-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-369-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3068-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-441-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1256-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-526-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2292-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-547-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2604-619-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2592-622-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2592-627-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-676-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/936-728-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/796-757-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2264-786-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/876-800-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 nbtnnn.exe 2864 1bnbbh.exe 2720 vddjd.exe 2452 3xrrxxr.exe 2840 bbttbb.exe 2588 7vjjp.exe 2664 7bbbbt.exe 2148 ddjvp.exe 2940 rlffrrx.exe 3060 jjjpv.exe 2448 fxllrrf.exe 1672 vpdjp.exe 652 lxrlllx.exe 1864 nhbbtn.exe 2028 rfrrffr.exe 1484 9thhnt.exe 2888 fxfxxxf.exe 820 rlffxrl.exe 2976 vjvpp.exe 2248 rrxxffr.exe 2260 3dddj.exe 1804 xrfflrx.exe 2444 llrxffr.exe 1756 btntbb.exe 1600 llxrrxl.exe 2400 5hnnth.exe 1628 ffxfllr.exe 3008 tbhnnt.exe 1012 7xfflrf.exe 2540 1htntt.exe 1708 3frrflr.exe 2316 fxrfrxr.exe 2816 ddvpd.exe 2460 rfxfxfx.exe 2868 tnhntt.exe 2748 nhhnhn.exe 2612 1jpvd.exe 2636 lxrrxxf.exe 2608 tnnnnh.exe 1948 jdddp.exe 2664 vpjjp.exe 3052 9fxxflf.exe 2920 hthhnn.exe 2200 tnhbnn.exe 3068 dvjjp.exe 2884 xlflrlr.exe 1716 5thhhn.exe 1856 9hhthh.exe 2848 ppjjp.exe 824 lxffllx.exe 936 bnntbh.exe 2004 vdvdj.exe 1484 jddvj.exe 1256 3rrrrxl.exe 1448 7hhhnt.exe 1972 vvjjj.exe 1992 rfffllx.exe 2268 tnhttn.exe 600 hhbhhh.exe 1084 vjddj.exe 2164 frffllr.exe 2188 tnbbbt.exe 1540 ttntbh.exe 1784 9dddj.exe -
resource yara_rule behavioral1/memory/2468-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-307-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2460-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-441-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1256-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-526-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2292-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-718-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2768-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-772-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/876-800-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2080 2468 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 30 PID 2468 wrote to memory of 2080 2468 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 30 PID 2468 wrote to memory of 2080 2468 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 30 PID 2468 wrote to memory of 2080 2468 6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe 30 PID 2080 wrote to memory of 2864 2080 nbtnnn.exe 31 PID 2080 wrote to memory of 2864 2080 nbtnnn.exe 31 PID 2080 wrote to memory of 2864 2080 nbtnnn.exe 31 PID 2080 wrote to memory of 2864 2080 nbtnnn.exe 31 PID 2864 wrote to memory of 2720 2864 1bnbbh.exe 32 PID 2864 wrote to memory of 2720 2864 1bnbbh.exe 32 PID 2864 wrote to memory of 2720 2864 1bnbbh.exe 32 PID 2864 wrote to memory of 2720 2864 1bnbbh.exe 32 PID 2720 wrote to memory of 2452 2720 vddjd.exe 33 PID 2720 wrote to memory of 2452 2720 vddjd.exe 33 PID 2720 wrote to memory of 2452 2720 vddjd.exe 33 PID 2720 wrote to memory of 2452 2720 vddjd.exe 33 PID 2452 wrote to memory of 2840 2452 3xrrxxr.exe 34 PID 2452 wrote to memory of 2840 2452 3xrrxxr.exe 34 PID 2452 wrote to memory of 2840 2452 3xrrxxr.exe 34 PID 2452 wrote to memory of 2840 2452 3xrrxxr.exe 34 PID 2840 wrote to memory of 2588 2840 bbttbb.exe 35 PID 2840 wrote to memory of 2588 2840 bbttbb.exe 35 PID 2840 wrote to memory of 2588 2840 bbttbb.exe 35 PID 2840 wrote to memory of 2588 2840 bbttbb.exe 35 PID 2588 wrote to memory of 2664 2588 7vjjp.exe 36 PID 2588 wrote to memory of 2664 2588 7vjjp.exe 36 PID 2588 wrote to memory of 2664 2588 7vjjp.exe 36 PID 2588 wrote to memory of 2664 2588 7vjjp.exe 36 PID 2664 wrote to memory of 2148 2664 7bbbbt.exe 37 PID 2664 wrote to memory of 2148 2664 7bbbbt.exe 37 PID 2664 wrote to memory of 2148 2664 7bbbbt.exe 37 PID 2664 wrote to memory of 2148 2664 7bbbbt.exe 37 PID 2148 wrote to memory of 2940 2148 ddjvp.exe 38 PID 2148 wrote to memory of 2940 2148 ddjvp.exe 38 PID 2148 wrote to memory of 2940 2148 ddjvp.exe 38 PID 2148 wrote to memory of 2940 2148 ddjvp.exe 38 PID 2940 wrote to memory of 3060 2940 rlffrrx.exe 39 PID 2940 wrote to memory of 3060 2940 rlffrrx.exe 39 PID 2940 wrote to memory of 3060 2940 rlffrrx.exe 39 PID 2940 wrote to memory of 3060 2940 rlffrrx.exe 39 PID 3060 wrote to memory of 2448 3060 jjjpv.exe 40 PID 3060 wrote to memory of 2448 3060 jjjpv.exe 40 PID 3060 wrote to memory of 2448 3060 jjjpv.exe 40 PID 3060 wrote to memory of 2448 3060 jjjpv.exe 40 PID 2448 wrote to memory of 1672 2448 fxllrrf.exe 41 PID 2448 wrote to memory of 1672 2448 fxllrrf.exe 41 PID 2448 wrote to memory of 1672 2448 fxllrrf.exe 41 PID 2448 wrote to memory of 1672 2448 fxllrrf.exe 41 PID 1672 wrote to memory of 652 1672 vpdjp.exe 42 PID 1672 wrote to memory of 652 1672 vpdjp.exe 42 PID 1672 wrote to memory of 652 1672 vpdjp.exe 42 PID 1672 wrote to memory of 652 1672 vpdjp.exe 42 PID 652 wrote to memory of 1864 652 lxrlllx.exe 43 PID 652 wrote to memory of 1864 652 lxrlllx.exe 43 PID 652 wrote to memory of 1864 652 lxrlllx.exe 43 PID 652 wrote to memory of 1864 652 lxrlllx.exe 43 PID 1864 wrote to memory of 2028 1864 nhbbtn.exe 44 PID 1864 wrote to memory of 2028 1864 nhbbtn.exe 44 PID 1864 wrote to memory of 2028 1864 nhbbtn.exe 44 PID 1864 wrote to memory of 2028 1864 nhbbtn.exe 44 PID 2028 wrote to memory of 1484 2028 rfrrffr.exe 45 PID 2028 wrote to memory of 1484 2028 rfrrffr.exe 45 PID 2028 wrote to memory of 1484 2028 rfrrffr.exe 45 PID 2028 wrote to memory of 1484 2028 rfrrffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe"C:\Users\Admin\AppData\Local\Temp\6d42dc2836814294a65b53b56ab86fbb5eec5dc02b938e95cc035bf3b686ae84.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nbtnnn.exec:\nbtnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1bnbbh.exec:\1bnbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vddjd.exec:\vddjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3xrrxxr.exec:\3xrrxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\bbttbb.exec:\bbttbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\7vjjp.exec:\7vjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\7bbbbt.exec:\7bbbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\ddjvp.exec:\ddjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rlffrrx.exec:\rlffrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jjjpv.exec:\jjjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\fxllrrf.exec:\fxllrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vpdjp.exec:\vpdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\lxrlllx.exec:\lxrlllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\nhbbtn.exec:\nhbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\rfrrffr.exec:\rfrrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\9thhnt.exec:\9thhnt.exe17⤵
- Executes dropped EXE
PID:1484 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe18⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rlffxrl.exec:\rlffxrl.exe19⤵
- Executes dropped EXE
PID:820 -
\??\c:\vjvpp.exec:\vjvpp.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rrxxffr.exec:\rrxxffr.exe21⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3dddj.exec:\3dddj.exe22⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xrfflrx.exec:\xrfflrx.exe23⤵
- Executes dropped EXE
PID:1804 -
\??\c:\llrxffr.exec:\llrxffr.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\btntbb.exec:\btntbb.exe25⤵
- Executes dropped EXE
PID:1756 -
\??\c:\llxrrxl.exec:\llxrrxl.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\5hnnth.exec:\5hnnth.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ffxfllr.exec:\ffxfllr.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\tbhnnt.exec:\tbhnnt.exe29⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7xfflrf.exec:\7xfflrf.exe30⤵
- Executes dropped EXE
PID:1012 -
\??\c:\1htntt.exec:\1htntt.exe31⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3frrflr.exec:\3frrflr.exe32⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxrfrxr.exec:\fxrfrxr.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ddvpd.exec:\ddvpd.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rfxfxfx.exec:\rfxfxfx.exe35⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tnhntt.exec:\tnhntt.exe36⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhhnhn.exec:\nhhnhn.exe37⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1jpvd.exec:\1jpvd.exe38⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tnnnnh.exec:\tnnnnh.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jdddp.exec:\jdddp.exe41⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpjjp.exec:\vpjjp.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9fxxflf.exec:\9fxxflf.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hthhnn.exec:\hthhnn.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\tnhbnn.exec:\tnhbnn.exe45⤵
- Executes dropped EXE
PID:2200 -
\??\c:\dvjjp.exec:\dvjjp.exe46⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xlflrlr.exec:\xlflrlr.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5thhhn.exec:\5thhhn.exe48⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9hhthh.exec:\9hhthh.exe49⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppjjp.exec:\ppjjp.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lxffllx.exec:\lxffllx.exe51⤵
- Executes dropped EXE
PID:824 -
\??\c:\bnntbh.exec:\bnntbh.exe52⤵
- Executes dropped EXE
PID:936 -
\??\c:\vdvdj.exec:\vdvdj.exe53⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jddvj.exec:\jddvj.exe54⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3rrrrxl.exec:\3rrrrxl.exe55⤵
- Executes dropped EXE
PID:1256 -
\??\c:\7hhhnt.exec:\7hhhnt.exe56⤵
- Executes dropped EXE
PID:1448 -
\??\c:\vvjjj.exec:\vvjjj.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\rfffllx.exec:\rfffllx.exe58⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tnhttn.exec:\tnhttn.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\hhbhhh.exec:\hhbhhh.exe60⤵
- Executes dropped EXE
PID:600 -
\??\c:\vjddj.exec:\vjddj.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\frffllr.exec:\frffllr.exe62⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tnbbbt.exec:\tnbbbt.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ttntbh.exec:\ttntbh.exe64⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9dddj.exec:\9dddj.exe65⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xlfxffx.exec:\xlfxffx.exe66⤵PID:2376
-
\??\c:\rfxxfll.exec:\rfxxfll.exe67⤵PID:844
-
\??\c:\9nnhnn.exec:\9nnhnn.exe68⤵PID:2292
-
\??\c:\dvjpv.exec:\dvjpv.exe69⤵PID:2532
-
\??\c:\rrlrxrx.exec:\rrlrxrx.exe70⤵PID:3008
-
\??\c:\ffffllx.exec:\ffffllx.exe71⤵PID:1340
-
\??\c:\hnhhhh.exec:\hnhhhh.exe72⤵PID:872
-
\??\c:\pjjpd.exec:\pjjpd.exe73⤵PID:1228
-
\??\c:\lxrlrxl.exec:\lxrlrxl.exe74⤵PID:1608
-
\??\c:\3lrxxrx.exec:\3lrxxrx.exe75⤵PID:2316
-
\??\c:\nnnntt.exec:\nnnntt.exe76⤵PID:2740
-
\??\c:\dpppv.exec:\dpppv.exe77⤵PID:2080
-
\??\c:\jjvpv.exec:\jjvpv.exe78⤵PID:2872
-
\??\c:\lfxfrrx.exec:\lfxfrrx.exe79⤵PID:2676
-
\??\c:\tthbhh.exec:\tthbhh.exe80⤵PID:2752
-
\??\c:\3nbhtt.exec:\3nbhtt.exe81⤵PID:2604
-
\??\c:\jdpjp.exec:\jdpjp.exe82⤵PID:2592
-
\??\c:\rxrlxxl.exec:\rxrlxxl.exe83⤵PID:2708
-
\??\c:\tnhnnt.exec:\tnhnnt.exe84⤵PID:1956
-
\??\c:\tnhntb.exec:\tnhntb.exe85⤵PID:3052
-
\??\c:\1dpjp.exec:\1dpjp.exe86⤵PID:1932
-
\??\c:\rlflffl.exec:\rlflffl.exe87⤵PID:2200
-
\??\c:\3tnthh.exec:\3tnthh.exe88⤵PID:576
-
\??\c:\jvjdj.exec:\jvjdj.exe89⤵PID:2340
-
\??\c:\jddpp.exec:\jddpp.exe90⤵PID:1904
-
\??\c:\lfffllx.exec:\lfffllx.exe91⤵PID:2040
-
\??\c:\3nhttt.exec:\3nhttt.exe92⤵PID:1864
-
\??\c:\9nbnbh.exec:\9nbnbh.exe93⤵PID:712
-
\??\c:\ppdjd.exec:\ppdjd.exe94⤵PID:936
-
\??\c:\1rlrflr.exec:\1rlrflr.exe95⤵PID:1684
-
\??\c:\bnbtbb.exec:\bnbtbb.exe96⤵PID:1288
-
\??\c:\htttbh.exec:\htttbh.exe97⤵PID:2404
-
\??\c:\vppvj.exec:\vppvj.exe98⤵PID:2768
-
\??\c:\xlllrxf.exec:\xlllrxf.exe99⤵PID:2220
-
\??\c:\lxrxfxf.exec:\lxrxfxf.exe100⤵PID:2352
-
\??\c:\tnbttt.exec:\tnbttt.exe101⤵PID:796
-
\??\c:\vdppp.exec:\vdppp.exe102⤵PID:2264
-
\??\c:\7jddj.exec:\7jddj.exe103⤵PID:980
-
\??\c:\9fxxxrr.exec:\9fxxxrr.exe104⤵PID:1888
-
\??\c:\tbnhnn.exec:\tbnhnn.exe105⤵PID:940
-
\??\c:\pdjjj.exec:\pdjjj.exe106⤵PID:1600
-
\??\c:\5vpvd.exec:\5vpvd.exe107⤵PID:2236
-
\??\c:\frfrrrr.exec:\frfrrrr.exe108⤵PID:876
-
\??\c:\nbnnnn.exec:\nbnnnn.exe109⤵PID:1628
-
\??\c:\1vdvd.exec:\1vdvd.exe110⤵PID:1336
-
\??\c:\vpjpv.exec:\vpjpv.exe111⤵PID:2096
-
\??\c:\xrlflrx.exec:\xrlflrx.exe112⤵PID:2996
-
\??\c:\bnbbbb.exec:\bnbbbb.exe113⤵PID:2728
-
\??\c:\tnntnh.exec:\tnntnh.exe114⤵PID:1572
-
\??\c:\pjdjj.exec:\pjdjj.exe115⤵PID:2828
-
\??\c:\fxrflrf.exec:\fxrflrf.exe116⤵PID:2820
-
\??\c:\frxxffl.exec:\frxxffl.exe117⤵PID:2744
-
\??\c:\nnhtbh.exec:\nnhtbh.exe118⤵PID:2460
-
\??\c:\jdvvv.exec:\jdvvv.exe119⤵PID:2864
-
\??\c:\1rlfrlr.exec:\1rlfrlr.exe120⤵PID:2676
-
\??\c:\bthntb.exec:\bthntb.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-