Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe
-
Size
453KB
-
MD5
6770424f232e2326bc82e76ccb823670
-
SHA1
917cf1ec1263fec1eb87e6f3b8c924465f274104
-
SHA256
a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262
-
SHA512
ce16b1bdfb05598853c4aaae2df3795558a1fb5b7c4070447ccadc04ea87ce1bdb2b2a98d49afb38213fb0e0e93f37832b609dab80259067b039c6d61b80b5c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-263-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1968-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-439-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/332-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-469-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-682-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/708-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2376 5btthb.exe 2836 3dpvv.exe 2560 ttbnhh.exe 2764 ppdpj.exe 2720 ffrrllx.exe 2568 rrlxllx.exe 2240 9hnhbn.exe 1952 btnthb.exe 2904 pjjpj.exe 2592 5ntnhb.exe 2540 vdpdp.exe 2052 7ppdp.exe 1380 xxxxfff.exe 2072 vdpdj.exe 2876 fxrxllf.exe 1724 jpdjd.exe 1956 xxfxxlr.exe 2808 jppdd.exe 2248 lrxxrrr.exe 2096 bhbbnn.exe 448 9jvdj.exe 2360 hbtnbh.exe 2500 3ddpv.exe 1368 1dddv.exe 1720 5fxfrfr.exe 1196 jjjdp.exe 2412 1xrxflf.exe 1792 ppjpd.exe 2336 xflfrlf.exe 1968 pppdd.exe 2456 tttnbh.exe 2780 jpjdv.exe 2700 xrflxxx.exe 2708 hhtbnb.exe 2560 jvpjp.exe 2576 ffxrxfr.exe 2724 1tbtnn.exe 2692 djpdp.exe 2624 9lffrxr.exe 2604 5tttht.exe 1532 ddjdp.exe 1360 rrrlxxf.exe 2912 1fxlxfl.exe 2904 bthhtb.exe 2888 1pppp.exe 2352 tnhthh.exe 1632 jjvjp.exe 1244 1lfrfrl.exe 2620 xrflrrf.exe 2348 btnhbn.exe 2272 jpvpv.exe 660 1lrrffl.exe 332 hbthbh.exe 856 pjddp.exe 1364 pvjvj.exe 2036 lfrxlll.exe 2192 bbbbnb.exe 1932 jpjvv.exe 408 llxxffr.exe 1748 nhhtth.exe 1608 jjvdp.exe 776 fffrflf.exe 3012 3hbtnh.exe 3000 htnthn.exe -
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-285-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2708-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-728-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2448-735-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2376 2380 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 30 PID 2380 wrote to memory of 2376 2380 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 30 PID 2380 wrote to memory of 2376 2380 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 30 PID 2380 wrote to memory of 2376 2380 a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe 30 PID 2376 wrote to memory of 2836 2376 5btthb.exe 31 PID 2376 wrote to memory of 2836 2376 5btthb.exe 31 PID 2376 wrote to memory of 2836 2376 5btthb.exe 31 PID 2376 wrote to memory of 2836 2376 5btthb.exe 31 PID 2836 wrote to memory of 2560 2836 3dpvv.exe 32 PID 2836 wrote to memory of 2560 2836 3dpvv.exe 32 PID 2836 wrote to memory of 2560 2836 3dpvv.exe 32 PID 2836 wrote to memory of 2560 2836 3dpvv.exe 32 PID 2560 wrote to memory of 2764 2560 ttbnhh.exe 33 PID 2560 wrote to memory of 2764 2560 ttbnhh.exe 33 PID 2560 wrote to memory of 2764 2560 ttbnhh.exe 33 PID 2560 wrote to memory of 2764 2560 ttbnhh.exe 33 PID 2764 wrote to memory of 2720 2764 ppdpj.exe 34 PID 2764 wrote to memory of 2720 2764 ppdpj.exe 34 PID 2764 wrote to memory of 2720 2764 ppdpj.exe 34 PID 2764 wrote to memory of 2720 2764 ppdpj.exe 34 PID 2720 wrote to memory of 2568 2720 ffrrllx.exe 35 PID 2720 wrote to memory of 2568 2720 ffrrllx.exe 35 PID 2720 wrote to memory of 2568 2720 ffrrllx.exe 35 PID 2720 wrote to memory of 2568 2720 ffrrllx.exe 35 PID 2568 wrote to memory of 2240 2568 rrlxllx.exe 36 PID 2568 wrote to memory of 2240 2568 rrlxllx.exe 36 PID 2568 wrote to memory of 2240 2568 rrlxllx.exe 36 PID 2568 wrote to memory of 2240 2568 rrlxllx.exe 36 PID 2240 wrote to memory of 1952 2240 9hnhbn.exe 37 PID 2240 wrote to memory of 1952 2240 9hnhbn.exe 37 PID 2240 wrote to memory of 1952 2240 9hnhbn.exe 37 PID 2240 wrote to memory of 1952 2240 9hnhbn.exe 37 PID 1952 wrote to memory of 2904 1952 btnthb.exe 38 PID 1952 wrote to memory of 2904 1952 btnthb.exe 38 PID 1952 wrote to memory of 2904 1952 btnthb.exe 38 PID 1952 wrote to memory of 2904 1952 btnthb.exe 38 PID 2904 wrote to memory of 2592 2904 pjjpj.exe 39 PID 2904 wrote to memory of 2592 2904 pjjpj.exe 39 PID 2904 wrote to memory of 2592 2904 pjjpj.exe 39 PID 2904 wrote to memory of 2592 2904 pjjpj.exe 39 PID 2592 wrote to memory of 2540 2592 5ntnhb.exe 40 PID 2592 wrote to memory of 2540 2592 5ntnhb.exe 40 PID 2592 wrote to memory of 2540 2592 5ntnhb.exe 40 PID 2592 wrote to memory of 2540 2592 5ntnhb.exe 40 PID 2540 wrote to memory of 2052 2540 vdpdp.exe 41 PID 2540 wrote to memory of 2052 2540 vdpdp.exe 41 PID 2540 wrote to memory of 2052 2540 vdpdp.exe 41 PID 2540 wrote to memory of 2052 2540 vdpdp.exe 41 PID 2052 wrote to memory of 1380 2052 7ppdp.exe 42 PID 2052 wrote to memory of 1380 2052 7ppdp.exe 42 PID 2052 wrote to memory of 1380 2052 7ppdp.exe 42 PID 2052 wrote to memory of 1380 2052 7ppdp.exe 42 PID 1380 wrote to memory of 2072 1380 xxxxfff.exe 43 PID 1380 wrote to memory of 2072 1380 xxxxfff.exe 43 PID 1380 wrote to memory of 2072 1380 xxxxfff.exe 43 PID 1380 wrote to memory of 2072 1380 xxxxfff.exe 43 PID 2072 wrote to memory of 2876 2072 vdpdj.exe 44 PID 2072 wrote to memory of 2876 2072 vdpdj.exe 44 PID 2072 wrote to memory of 2876 2072 vdpdj.exe 44 PID 2072 wrote to memory of 2876 2072 vdpdj.exe 44 PID 2876 wrote to memory of 1724 2876 fxrxllf.exe 45 PID 2876 wrote to memory of 1724 2876 fxrxllf.exe 45 PID 2876 wrote to memory of 1724 2876 fxrxllf.exe 45 PID 2876 wrote to memory of 1724 2876 fxrxllf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe"C:\Users\Admin\AppData\Local\Temp\a7a4b86d5b866a895674a9f701cc1eeb4602ca8484c60926a3e13977b0f04262N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\5btthb.exec:\5btthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3dpvv.exec:\3dpvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ttbnhh.exec:\ttbnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ppdpj.exec:\ppdpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\ffrrllx.exec:\ffrrllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\rrlxllx.exec:\rrlxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9hnhbn.exec:\9hnhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\btnthb.exec:\btnthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\pjjpj.exec:\pjjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\5ntnhb.exec:\5ntnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\vdpdp.exec:\vdpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\7ppdp.exec:\7ppdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\xxxxfff.exec:\xxxxfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\vdpdj.exec:\vdpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\fxrxllf.exec:\fxrxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\jpdjd.exec:\jpdjd.exe17⤵
- Executes dropped EXE
PID:1724 -
\??\c:\xxfxxlr.exec:\xxfxxlr.exe18⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jppdd.exec:\jppdd.exe19⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe20⤵
- Executes dropped EXE
PID:2248 -
\??\c:\bhbbnn.exec:\bhbbnn.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\9jvdj.exec:\9jvdj.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbtnbh.exec:\hbtnbh.exe23⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3ddpv.exec:\3ddpv.exe24⤵
- Executes dropped EXE
PID:2500 -
\??\c:\1dddv.exec:\1dddv.exe25⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5fxfrfr.exec:\5fxfrfr.exe26⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjjdp.exec:\jjjdp.exe27⤵
- Executes dropped EXE
PID:1196 -
\??\c:\1xrxflf.exec:\1xrxflf.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ppjpd.exec:\ppjpd.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xflfrlf.exec:\xflfrlf.exe30⤵
- Executes dropped EXE
PID:2336 -
\??\c:\pppdd.exec:\pppdd.exe31⤵
- Executes dropped EXE
PID:1968 -
\??\c:\tttnbh.exec:\tttnbh.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jpjdv.exec:\jpjdv.exe33⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrflxxx.exec:\xrflxxx.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hhtbnb.exec:\hhtbnb.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jvpjp.exec:\jvpjp.exe36⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ffxrxfr.exec:\ffxrxfr.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1tbtnn.exec:\1tbtnn.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djpdp.exec:\djpdp.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9lffrxr.exec:\9lffrxr.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5tttht.exec:\5tttht.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ddjdp.exec:\ddjdp.exe42⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrrlxxf.exec:\rrrlxxf.exe43⤵
- Executes dropped EXE
PID:1360 -
\??\c:\1fxlxfl.exec:\1fxlxfl.exe44⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bthhtb.exec:\bthhtb.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\1pppp.exec:\1pppp.exe46⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnhthh.exec:\tnhthh.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jjvjp.exec:\jjvjp.exe48⤵
- Executes dropped EXE
PID:1632 -
\??\c:\1lfrfrl.exec:\1lfrfrl.exe49⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xrflrrf.exec:\xrflrrf.exe50⤵
- Executes dropped EXE
PID:2620 -
\??\c:\btnhbn.exec:\btnhbn.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jpvpv.exec:\jpvpv.exe52⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1lrrffl.exec:\1lrrffl.exe53⤵
- Executes dropped EXE
PID:660 -
\??\c:\hbthbh.exec:\hbthbh.exe54⤵
- Executes dropped EXE
PID:332 -
\??\c:\pjddp.exec:\pjddp.exe55⤵
- Executes dropped EXE
PID:856 -
\??\c:\pvjvj.exec:\pvjvj.exe56⤵
- Executes dropped EXE
PID:1364 -
\??\c:\lfrxlll.exec:\lfrxlll.exe57⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bbbbnb.exec:\bbbbnb.exe58⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jpjvv.exec:\jpjvv.exe59⤵
- Executes dropped EXE
PID:1932 -
\??\c:\llxxffr.exec:\llxxffr.exe60⤵
- Executes dropped EXE
PID:408 -
\??\c:\nhhtth.exec:\nhhtth.exe61⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjvdp.exec:\jjvdp.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fffrflf.exec:\fffrflf.exe63⤵
- Executes dropped EXE
PID:776 -
\??\c:\3hbtnh.exec:\3hbtnh.exe64⤵
- Executes dropped EXE
PID:3012 -
\??\c:\htnthn.exec:\htnthn.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7jvjp.exec:\7jvjp.exe66⤵PID:2324
-
\??\c:\rlrrxrr.exec:\rlrrxrr.exe67⤵PID:2468
-
\??\c:\3hbhhn.exec:\3hbhhn.exe68⤵PID:3068
-
\??\c:\ddjvp.exec:\ddjvp.exe69⤵PID:2104
-
\??\c:\3vvdv.exec:\3vvdv.exe70⤵PID:1964
-
\??\c:\1rxlflx.exec:\1rxlflx.exe71⤵PID:2864
-
\??\c:\nhbtht.exec:\nhbtht.exe72⤵PID:1448
-
\??\c:\ddpdv.exec:\ddpdv.exe73⤵PID:1592
-
\??\c:\lflrxfx.exec:\lflrxfx.exe74⤵PID:2804
-
\??\c:\tnntnt.exec:\tnntnt.exe75⤵PID:1572
-
\??\c:\nnhntb.exec:\nnhntb.exe76⤵PID:2748
-
\??\c:\7jpjp.exec:\7jpjp.exe77⤵PID:2948
-
\??\c:\rxfxfxx.exec:\rxfxfxx.exe78⤵PID:2728
-
\??\c:\tttbnt.exec:\tttbnt.exe79⤵PID:2548
-
\??\c:\jjdvp.exec:\jjdvp.exe80⤵PID:812
-
\??\c:\ddpdd.exec:\ddpdd.exe81⤵PID:3024
-
\??\c:\7fxxllr.exec:\7fxxllr.exe82⤵PID:3028
-
\??\c:\nnnbtb.exec:\nnnbtb.exe83⤵PID:1532
-
\??\c:\dvpvj.exec:\dvpvj.exe84⤵PID:1360
-
\??\c:\ffrlxlr.exec:\ffrlxlr.exe85⤵PID:2912
-
\??\c:\rxlrlxr.exec:\rxlrlxr.exe86⤵PID:1168
-
\??\c:\tbntnn.exec:\tbntnn.exe87⤵PID:1408
-
\??\c:\pdjvv.exec:\pdjvv.exe88⤵PID:2280
-
\??\c:\fllffrr.exec:\fllffrr.exe89⤵PID:1164
-
\??\c:\frlrfxr.exec:\frlrfxr.exe90⤵PID:1700
-
\??\c:\1tnthn.exec:\1tnthn.exe91⤵PID:2652
-
\??\c:\jdjdd.exec:\jdjdd.exe92⤵PID:2348
-
\??\c:\7lflrxf.exec:\7lflrxf.exe93⤵PID:536
-
\??\c:\hnnntb.exec:\hnnntb.exe94⤵PID:708
-
\??\c:\tnhbhn.exec:\tnhbhn.exe95⤵PID:2964
-
\??\c:\5jdjp.exec:\5jdjp.exe96⤵PID:2736
-
\??\c:\xxllrxl.exec:\xxllrxl.exe97⤵PID:2448
-
\??\c:\9nhhtt.exec:\9nhhtt.exe98⤵PID:2236
-
\??\c:\btnnbb.exec:\btnnbb.exe99⤵PID:1084
-
\??\c:\vddjj.exec:\vddjj.exe100⤵PID:2124
-
\??\c:\fxlrffr.exec:\fxlrffr.exe101⤵PID:1452
-
\??\c:\nnhhth.exec:\nnhhth.exe102⤵PID:2020
-
\??\c:\5tnthn.exec:\5tnthn.exe103⤵PID:1776
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe104⤵PID:1544
-
\??\c:\tbtbbb.exec:\tbtbbb.exe105⤵PID:1920
-
\??\c:\hbntbh.exec:\hbntbh.exe106⤵PID:2140
-
\??\c:\ddpvd.exec:\ddpvd.exe107⤵PID:1196
-
\??\c:\rffrfrf.exec:\rffrfrf.exe108⤵PID:1000
-
\??\c:\nhthnt.exec:\nhthnt.exe109⤵PID:2468
-
\??\c:\djvvj.exec:\djvvj.exe110⤵PID:2472
-
\??\c:\5rfxrfx.exec:\5rfxrfx.exe111⤵PID:2992
-
\??\c:\1hthtb.exec:\1hthtb.exe112⤵PID:2056
-
\??\c:\7pjvd.exec:\7pjvd.exe113⤵
- System Location Discovery: System Language Discovery
PID:2752 -
\??\c:\flxfxfr.exec:\flxfxfr.exe114⤵PID:1564
-
\??\c:\7nntbb.exec:\7nntbb.exe115⤵PID:2784
-
\??\c:\ntbtbn.exec:\ntbtbn.exe116⤵PID:2684
-
\??\c:\jjdjd.exec:\jjdjd.exe117⤵PID:2836
-
\??\c:\xxrfrxf.exec:\xxrfrxf.exe118⤵PID:2580
-
\??\c:\nnntbn.exec:\nnntbn.exe119⤵PID:2668
-
\??\c:\nhbhbh.exec:\nhbhbh.exe120⤵PID:2724
-
\??\c:\9jjjp.exec:\9jjjp.exe121⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-