Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe
-
Size
454KB
-
MD5
15b80259b921f6f991deaee3c731a7a0
-
SHA1
3d30eb348acaef645185cdc3e4013e5b6f1f6512
-
SHA256
e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729
-
SHA512
1dafa72c338af2a360b7c172d93aebdf86664ae05cfdcf1a148cf7daab71d7c3d167b4aeb95b9a3f8190eddae29a264cd67076af84b96b103ddce238b29395f4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe5:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-92-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2876-90-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2112-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-181-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2496-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-254-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/284-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-306-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2568-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-410-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1332-418-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-458-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2148-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-485-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-494-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/340-507-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-548-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2588-554-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2572-587-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2572-606-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1420-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-722-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-797-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-835-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-1094-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-1122-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2448 frfxxxl.exe 2320 llxflfr.exe 2340 tnhntt.exe 2100 3djjv.exe 892 rlxfllf.exe 2912 5dvpj.exe 2880 7rfxxlx.exe 2888 5dddp.exe 2876 7rfxrxr.exe 2632 xfxfrxf.exe 1420 9pddv.exe 2112 nhnthh.exe 2028 3jdjd.exe 3020 xxflrxr.exe 1776 hhnbhh.exe 2720 hhbbtb.exe 2996 thbnhn.exe 1880 jjdpd.exe 2716 nhbnbn.exe 2152 hhthtb.exe 2496 xxlxflr.exe 3064 3xrrxfr.exe 1516 nnbnbh.exe 380 9pppv.exe 1956 vvjpv.exe 236 7hbbhn.exe 1564 vvpdj.exe 1468 rrfflrf.exe 1524 nthtnn.exe 284 3lflxfr.exe 1892 7btbtt.exe 880 1bntbh.exe 2292 ddvpd.exe 2448 pjdvv.exe 2568 vvdjj.exe 1740 xrrxlrf.exe 2392 3tnbhn.exe 2280 hhnnnn.exe 2560 jjdjj.exe 2580 ffxxrxl.exe 2728 xxrrlrx.exe 2628 hbntbh.exe 2736 jdvvp.exe 2976 3vjpp.exe 2796 rxllxxf.exe 2612 nnhtnt.exe 2636 pjpvd.exe 2304 ppjpv.exe 2324 5rllrrx.exe 2940 hbbbtn.exe 1332 vpjpd.exe 3008 7xrxrrf.exe 1640 rrlxfrx.exe 1988 nnnntb.exe 2988 vvpvj.exe 3016 ddpdj.exe 2172 xlfxflr.exe 2380 lfxfrrx.exe 2368 bthntt.exe 2148 jpjpv.exe 340 llflxxf.exe 2600 fffxrfx.exe 856 ttntbh.exe 1516 ddvdj.exe -
resource yara_rule behavioral1/memory/2512-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-126-0x0000000000350000-0x000000000037A000-memory.dmp upx behavioral1/memory/2720-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-159-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1880-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-254-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1524-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-548-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2588-554-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/284-562-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1628-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-960-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-986-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-999-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-1094-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-1119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-1122-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1692-1127-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2448 2512 e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe 30 PID 2512 wrote to memory of 2448 2512 e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe 30 PID 2512 wrote to memory of 2448 2512 e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe 30 PID 2512 wrote to memory of 2448 2512 e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe 30 PID 2448 wrote to memory of 2320 2448 frfxxxl.exe 31 PID 2448 wrote to memory of 2320 2448 frfxxxl.exe 31 PID 2448 wrote to memory of 2320 2448 frfxxxl.exe 31 PID 2448 wrote to memory of 2320 2448 frfxxxl.exe 31 PID 2320 wrote to memory of 2340 2320 llxflfr.exe 32 PID 2320 wrote to memory of 2340 2320 llxflfr.exe 32 PID 2320 wrote to memory of 2340 2320 llxflfr.exe 32 PID 2320 wrote to memory of 2340 2320 llxflfr.exe 32 PID 2340 wrote to memory of 2100 2340 tnhntt.exe 33 PID 2340 wrote to memory of 2100 2340 tnhntt.exe 33 PID 2340 wrote to memory of 2100 2340 tnhntt.exe 33 PID 2340 wrote to memory of 2100 2340 tnhntt.exe 33 PID 2100 wrote to memory of 892 2100 3djjv.exe 34 PID 2100 wrote to memory of 892 2100 3djjv.exe 34 PID 2100 wrote to memory of 892 2100 3djjv.exe 34 PID 2100 wrote to memory of 892 2100 3djjv.exe 34 PID 892 wrote to memory of 2912 892 rlxfllf.exe 35 PID 892 wrote to memory of 2912 892 rlxfllf.exe 35 PID 892 wrote to memory of 2912 892 rlxfllf.exe 35 PID 892 wrote to memory of 2912 892 rlxfllf.exe 35 PID 2912 wrote to memory of 2880 2912 5dvpj.exe 36 PID 2912 wrote to memory of 2880 2912 5dvpj.exe 36 PID 2912 wrote to memory of 2880 2912 5dvpj.exe 36 PID 2912 wrote to memory of 2880 2912 5dvpj.exe 36 PID 2880 wrote to memory of 2888 2880 7rfxxlx.exe 37 PID 2880 wrote to memory of 2888 2880 7rfxxlx.exe 37 PID 2880 wrote to memory of 2888 2880 7rfxxlx.exe 37 PID 2880 wrote to memory of 2888 2880 7rfxxlx.exe 37 PID 2888 wrote to memory of 2876 2888 5dddp.exe 38 PID 2888 wrote to memory of 2876 2888 5dddp.exe 38 PID 2888 wrote to memory of 2876 2888 5dddp.exe 38 PID 2888 wrote to memory of 2876 2888 5dddp.exe 38 PID 2876 wrote to memory of 2632 2876 7rfxrxr.exe 39 PID 2876 wrote to memory of 2632 2876 7rfxrxr.exe 39 PID 2876 wrote to memory of 2632 2876 7rfxrxr.exe 39 PID 2876 wrote to memory of 2632 2876 7rfxrxr.exe 39 PID 2632 wrote to memory of 1420 2632 xfxfrxf.exe 40 PID 2632 wrote to memory of 1420 2632 xfxfrxf.exe 40 PID 2632 wrote to memory of 1420 2632 xfxfrxf.exe 40 PID 2632 wrote to memory of 1420 2632 xfxfrxf.exe 40 PID 1420 wrote to memory of 2112 1420 9pddv.exe 41 PID 1420 wrote to memory of 2112 1420 9pddv.exe 41 PID 1420 wrote to memory of 2112 1420 9pddv.exe 41 PID 1420 wrote to memory of 2112 1420 9pddv.exe 41 PID 2112 wrote to memory of 2028 2112 nhnthh.exe 42 PID 2112 wrote to memory of 2028 2112 nhnthh.exe 42 PID 2112 wrote to memory of 2028 2112 nhnthh.exe 42 PID 2112 wrote to memory of 2028 2112 nhnthh.exe 42 PID 2028 wrote to memory of 3020 2028 3jdjd.exe 43 PID 2028 wrote to memory of 3020 2028 3jdjd.exe 43 PID 2028 wrote to memory of 3020 2028 3jdjd.exe 43 PID 2028 wrote to memory of 3020 2028 3jdjd.exe 43 PID 3020 wrote to memory of 1776 3020 xxflrxr.exe 44 PID 3020 wrote to memory of 1776 3020 xxflrxr.exe 44 PID 3020 wrote to memory of 1776 3020 xxflrxr.exe 44 PID 3020 wrote to memory of 1776 3020 xxflrxr.exe 44 PID 1776 wrote to memory of 2720 1776 hhnbhh.exe 45 PID 1776 wrote to memory of 2720 1776 hhnbhh.exe 45 PID 1776 wrote to memory of 2720 1776 hhnbhh.exe 45 PID 1776 wrote to memory of 2720 1776 hhnbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe"C:\Users\Admin\AppData\Local\Temp\e9ebfa573fac0249d10e3af589a28ff0e52eb2df4eb1b2669369a2f4b4ad0729N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\frfxxxl.exec:\frfxxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\llxflfr.exec:\llxflfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\tnhntt.exec:\tnhntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\3djjv.exec:\3djjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rlxfllf.exec:\rlxfllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\5dvpj.exec:\5dvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\7rfxxlx.exec:\7rfxxlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\5dddp.exec:\5dddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7rfxrxr.exec:\7rfxrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xfxfrxf.exec:\xfxfrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\9pddv.exec:\9pddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\nhnthh.exec:\nhnthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\3jdjd.exec:\3jdjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\xxflrxr.exec:\xxflrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\hhnbhh.exec:\hhnbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\hhbbtb.exec:\hhbbtb.exe17⤵
- Executes dropped EXE
PID:2720 -
\??\c:\thbnhn.exec:\thbnhn.exe18⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjdpd.exec:\jjdpd.exe19⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nhbnbn.exec:\nhbnbn.exe20⤵
- Executes dropped EXE
PID:2716 -
\??\c:\hhthtb.exec:\hhthtb.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xxlxflr.exec:\xxlxflr.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3xrrxfr.exec:\3xrrxfr.exe23⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nnbnbh.exec:\nnbnbh.exe24⤵
- Executes dropped EXE
PID:1516 -
\??\c:\9pppv.exec:\9pppv.exe25⤵
- Executes dropped EXE
PID:380 -
\??\c:\vvjpv.exec:\vvjpv.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7hbbhn.exec:\7hbbhn.exe27⤵
- Executes dropped EXE
PID:236 -
\??\c:\vvpdj.exec:\vvpdj.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\rrfflrf.exec:\rrfflrf.exe29⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nthtnn.exec:\nthtnn.exe30⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3lflxfr.exec:\3lflxfr.exe31⤵
- Executes dropped EXE
PID:284 -
\??\c:\7btbtt.exec:\7btbtt.exe32⤵
- Executes dropped EXE
PID:1892 -
\??\c:\1bntbh.exec:\1bntbh.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\ddvpd.exec:\ddvpd.exe34⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pjdvv.exec:\pjdvv.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vvdjj.exec:\vvdjj.exe36⤵
- Executes dropped EXE
PID:2568 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe37⤵
- Executes dropped EXE
PID:1740 -
\??\c:\3tnbhn.exec:\3tnbhn.exe38⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hhnnnn.exec:\hhnnnn.exe39⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jjdjj.exec:\jjdjj.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ffxxrxl.exec:\ffxxrxl.exe41⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xxrrlrx.exec:\xxrrlrx.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\hbntbh.exec:\hbntbh.exe43⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jdvvp.exec:\jdvvp.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3vjpp.exec:\3vjpp.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rxllxxf.exec:\rxllxxf.exe46⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nnhtnt.exec:\nnhtnt.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\pjpvd.exec:\pjpvd.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ppjpv.exec:\ppjpv.exe49⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5rllrrx.exec:\5rllrrx.exe50⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hbbbtn.exec:\hbbbtn.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vpjpd.exec:\vpjpd.exe52⤵
- Executes dropped EXE
PID:1332 -
\??\c:\7xrxrrf.exec:\7xrxrrf.exe53⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rrlxfrx.exec:\rrlxfrx.exe54⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nnnntb.exec:\nnnntb.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vvpvj.exec:\vvpvj.exe56⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ddpdj.exec:\ddpdj.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xlfxflr.exec:\xlfxflr.exe58⤵
- Executes dropped EXE
PID:2172 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe59⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bthntt.exec:\bthntt.exe60⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jpjpv.exec:\jpjpv.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\llflxxf.exec:\llflxxf.exe62⤵
- Executes dropped EXE
PID:340 -
\??\c:\fffxrfx.exec:\fffxrfx.exe63⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ttntbh.exec:\ttntbh.exe64⤵
- Executes dropped EXE
PID:856 -
\??\c:\ddvdj.exec:\ddvdj.exe65⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xrxxfff.exec:\xrxxfff.exe66⤵PID:296
-
\??\c:\xxlrllx.exec:\xxlrllx.exe67⤵PID:276
-
\??\c:\nnnbtb.exec:\nnnbtb.exe68⤵PID:1680
-
\??\c:\ddppd.exec:\ddppd.exe69⤵PID:3048
-
\??\c:\7vvvv.exec:\7vvvv.exe70⤵PID:2376
-
\??\c:\xrlxflx.exec:\xrlxflx.exe71⤵PID:352
-
\??\c:\hbhnbn.exec:\hbhnbn.exe72⤵PID:2588
-
\??\c:\btntht.exec:\btntht.exe73⤵PID:284
-
\??\c:\vppdv.exec:\vppdv.exe74⤵PID:1616
-
\??\c:\rrlxrrf.exec:\rrlxrrf.exe75⤵PID:2440
-
\??\c:\lfxxlrr.exec:\lfxxlrr.exe76⤵PID:1692
-
\??\c:\9bbnhn.exec:\9bbnhn.exe77⤵PID:2572
-
\??\c:\dvjjp.exec:\dvjjp.exe78⤵PID:1548
-
\??\c:\vpjpd.exec:\vpjpd.exe79⤵PID:2808
-
\??\c:\xrrrffx.exec:\xrrrffx.exe80⤵PID:2484
-
\??\c:\hhbhtb.exec:\hhbhtb.exe81⤵PID:1628
-
\??\c:\tnhtbh.exec:\tnhtbh.exe82⤵PID:1124
-
\??\c:\pdddj.exec:\pdddj.exe83⤵PID:1748
-
\??\c:\lxrrfxf.exec:\lxrrfxf.exe84⤵PID:2956
-
\??\c:\xrrrfxf.exec:\xrrrfxf.exe85⤵PID:2728
-
\??\c:\hhbtnb.exec:\hhbtnb.exe86⤵PID:2784
-
\??\c:\vpjjp.exec:\vpjjp.exe87⤵PID:2656
-
\??\c:\7ppvd.exec:\7ppvd.exe88⤵PID:2732
-
\??\c:\1rlxflx.exec:\1rlxflx.exe89⤵PID:2796
-
\??\c:\nhbttb.exec:\nhbttb.exe90⤵PID:2116
-
\??\c:\bthhnn.exec:\bthhnn.exe91⤵PID:2636
-
\??\c:\ppvdp.exec:\ppvdp.exe92⤵PID:560
-
\??\c:\xxxlrxf.exec:\xxxlrxf.exe93⤵PID:1420
-
\??\c:\lrffrfx.exec:\lrffrfx.exe94⤵PID:1464
-
\??\c:\bhbhtb.exec:\bhbhtb.exe95⤵PID:2848
-
\??\c:\dvvdv.exec:\dvvdv.exe96⤵PID:1992
-
\??\c:\jvppv.exec:\jvppv.exe97⤵PID:2824
-
\??\c:\fffflfl.exec:\fffflfl.exe98⤵PID:1776
-
\??\c:\bhbbht.exec:\bhbbht.exe99⤵PID:2832
-
\??\c:\nnntth.exec:\nnntth.exe100⤵PID:2212
-
\??\c:\9dvvd.exec:\9dvvd.exe101⤵
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\xrllrfl.exec:\xrllrfl.exe102⤵
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\7xrrxxf.exec:\7xrrxxf.exe103⤵PID:1916
-
\??\c:\tnnbnt.exec:\tnnbnt.exe104⤵PID:2144
-
\??\c:\djjpv.exec:\djjpv.exe105⤵PID:2596
-
\??\c:\jpjdj.exec:\jpjdj.exe106⤵PID:1224
-
\??\c:\rfxxxfl.exec:\rfxxxfl.exe107⤵PID:304
-
\??\c:\7ntnnt.exec:\7ntnnt.exe108⤵PID:856
-
\??\c:\htbnhn.exec:\htbnhn.exe109⤵PID:2156
-
\??\c:\dpdjd.exec:\dpdjd.exe110⤵PID:316
-
\??\c:\rlffllx.exec:\rlffllx.exe111⤵PID:236
-
\??\c:\1xflrxx.exec:\1xflrxx.exe112⤵PID:1528
-
\??\c:\5thhnn.exec:\5thhnn.exe113⤵PID:616
-
\??\c:\ppjpv.exec:\ppjpv.exe114⤵PID:2076
-
\??\c:\7vppv.exec:\7vppv.exe115⤵
- System Location Discovery: System Language Discovery
PID:1156 -
\??\c:\lfrlxff.exec:\lfrlxff.exe116⤵PID:2536
-
\??\c:\rlllxlx.exec:\rlllxlx.exe117⤵PID:1732
-
\??\c:\9hhttt.exec:\9hhttt.exe118⤵PID:2540
-
\??\c:\vvjpd.exec:\vvjpd.exe119⤵PID:2556
-
\??\c:\dvpvd.exec:\dvpvd.exe120⤵PID:2320
-
\??\c:\3flxfll.exec:\3flxfll.exe121⤵PID:2552
-
\??\c:\bbtbbh.exec:\bbtbbh.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-