Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe
-
Size
453KB
-
MD5
4acc2022623063c9e94a68ce0a853284
-
SHA1
08fca9da56af8208e83745322f24152eed9409a0
-
SHA256
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008
-
SHA512
fbc9103af675cd9d22094b16a3ddd67e29f305e31db78420f997f4c506262408f810b9436c735f64483231e255b3ec4f6e051cf086dad16aaf56bd6ec829335a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6:q7Tc2NYHUrAwfMp3CD6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-139-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1652-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1364-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-231-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/864-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-229-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1464-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-444-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/844-461-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/444-470-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1952-484-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1548-521-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-551-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2588-571-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2836-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-614-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-647-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-673-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 lxrxfxf.exe 2920 nbnnnt.exe 2568 vjppv.exe 2836 rlrrfxf.exe 2716 1thhhb.exe 2608 frffllx.exe 3024 btbbtt.exe 1120 dpvdd.exe 2900 lxlflrx.exe 1432 xlrlrlr.exe 2044 9pjpv.exe 2348 xrfxflr.exe 2252 bnttnn.exe 1732 hbbbbb.exe 2792 5fxrxff.exe 1652 1bnnnh.exe 2936 1vpvv.exe 1380 hthnnn.exe 1900 9pvdv.exe 1604 9bhbbb.exe 1364 vvvdd.exe 1304 9tnnnn.exe 2488 bnbbhh.exe 864 vvvvd.exe 1464 rlxfxrf.exe 2284 bnbhtt.exe 3044 xlrrlll.exe 1680 pdjjj.exe 2112 5vvjd.exe 2928 xlxffxl.exe 2652 9bnnnh.exe 2560 9xfffxf.exe 2816 hnbtbh.exe 2696 3vjdv.exe 2716 lfrxxxf.exe 3028 9bnhtt.exe 2576 7tbtnn.exe 1052 9pppd.exe 1120 rfxfrlr.exe 2760 bhhhbb.exe 2376 9thbbb.exe 2796 5dpvv.exe 536 3rfrrrx.exe 2052 frffffl.exe 1660 httttt.exe 712 5dvjj.exe 1732 vjvvv.exe 1784 thtbhh.exe 1420 thtttt.exe 2940 jvjdd.exe 1688 7xfxffl.exe 2396 1thhbt.exe 1888 tthnhh.exe 844 vjvpv.exe 444 xxllllr.exe 408 bnbbbt.exe 1952 7jjdd.exe 2592 pjvdj.exe 2488 1rffxrx.exe 1548 hthhhh.exe 580 7bthhn.exe 1464 5pdjv.exe 2444 fxllxxl.exe 904 nhhnbb.exe -
resource yara_rule behavioral1/memory/2748-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-444-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/844-461-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/408-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-660-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnntb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2748 2664 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 31 PID 2664 wrote to memory of 2748 2664 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 31 PID 2664 wrote to memory of 2748 2664 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 31 PID 2664 wrote to memory of 2748 2664 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 31 PID 2748 wrote to memory of 2920 2748 lxrxfxf.exe 32 PID 2748 wrote to memory of 2920 2748 lxrxfxf.exe 32 PID 2748 wrote to memory of 2920 2748 lxrxfxf.exe 32 PID 2748 wrote to memory of 2920 2748 lxrxfxf.exe 32 PID 2920 wrote to memory of 2568 2920 nbnnnt.exe 33 PID 2920 wrote to memory of 2568 2920 nbnnnt.exe 33 PID 2920 wrote to memory of 2568 2920 nbnnnt.exe 33 PID 2920 wrote to memory of 2568 2920 nbnnnt.exe 33 PID 2568 wrote to memory of 2836 2568 vjppv.exe 34 PID 2568 wrote to memory of 2836 2568 vjppv.exe 34 PID 2568 wrote to memory of 2836 2568 vjppv.exe 34 PID 2568 wrote to memory of 2836 2568 vjppv.exe 34 PID 2836 wrote to memory of 2716 2836 rlrrfxf.exe 35 PID 2836 wrote to memory of 2716 2836 rlrrfxf.exe 35 PID 2836 wrote to memory of 2716 2836 rlrrfxf.exe 35 PID 2836 wrote to memory of 2716 2836 rlrrfxf.exe 35 PID 2716 wrote to memory of 2608 2716 1thhhb.exe 36 PID 2716 wrote to memory of 2608 2716 1thhhb.exe 36 PID 2716 wrote to memory of 2608 2716 1thhhb.exe 36 PID 2716 wrote to memory of 2608 2716 1thhhb.exe 36 PID 2608 wrote to memory of 3024 2608 frffllx.exe 37 PID 2608 wrote to memory of 3024 2608 frffllx.exe 37 PID 2608 wrote to memory of 3024 2608 frffllx.exe 37 PID 2608 wrote to memory of 3024 2608 frffllx.exe 37 PID 3024 wrote to memory of 1120 3024 btbbtt.exe 38 PID 3024 wrote to memory of 1120 3024 btbbtt.exe 38 PID 3024 wrote to memory of 1120 3024 btbbtt.exe 38 PID 3024 wrote to memory of 1120 3024 btbbtt.exe 38 PID 1120 wrote to memory of 2900 1120 dpvdd.exe 39 PID 1120 wrote to memory of 2900 1120 dpvdd.exe 39 PID 1120 wrote to memory of 2900 1120 dpvdd.exe 39 PID 1120 wrote to memory of 2900 1120 dpvdd.exe 39 PID 2900 wrote to memory of 1432 2900 lxlflrx.exe 40 PID 2900 wrote to memory of 1432 2900 lxlflrx.exe 40 PID 2900 wrote to memory of 1432 2900 lxlflrx.exe 40 PID 2900 wrote to memory of 1432 2900 lxlflrx.exe 40 PID 1432 wrote to memory of 2044 1432 xlrlrlr.exe 41 PID 1432 wrote to memory of 2044 1432 xlrlrlr.exe 41 PID 1432 wrote to memory of 2044 1432 xlrlrlr.exe 41 PID 1432 wrote to memory of 2044 1432 xlrlrlr.exe 41 PID 2044 wrote to memory of 2348 2044 9pjpv.exe 42 PID 2044 wrote to memory of 2348 2044 9pjpv.exe 42 PID 2044 wrote to memory of 2348 2044 9pjpv.exe 42 PID 2044 wrote to memory of 2348 2044 9pjpv.exe 42 PID 2348 wrote to memory of 2252 2348 xrfxflr.exe 43 PID 2348 wrote to memory of 2252 2348 xrfxflr.exe 43 PID 2348 wrote to memory of 2252 2348 xrfxflr.exe 43 PID 2348 wrote to memory of 2252 2348 xrfxflr.exe 43 PID 2252 wrote to memory of 1732 2252 bnttnn.exe 44 PID 2252 wrote to memory of 1732 2252 bnttnn.exe 44 PID 2252 wrote to memory of 1732 2252 bnttnn.exe 44 PID 2252 wrote to memory of 1732 2252 bnttnn.exe 44 PID 1732 wrote to memory of 2792 1732 hbbbbb.exe 45 PID 1732 wrote to memory of 2792 1732 hbbbbb.exe 45 PID 1732 wrote to memory of 2792 1732 hbbbbb.exe 45 PID 1732 wrote to memory of 2792 1732 hbbbbb.exe 45 PID 2792 wrote to memory of 1652 2792 5fxrxff.exe 46 PID 2792 wrote to memory of 1652 2792 5fxrxff.exe 46 PID 2792 wrote to memory of 1652 2792 5fxrxff.exe 46 PID 2792 wrote to memory of 1652 2792 5fxrxff.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe"C:\Users\Admin\AppData\Local\Temp\e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nbnnnt.exec:\nbnnnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vjppv.exec:\vjppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1thhhb.exec:\1thhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\frffllx.exec:\frffllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\btbbtt.exec:\btbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\dpvdd.exec:\dpvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\lxlflrx.exec:\lxlflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\9pjpv.exec:\9pjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\xrfxflr.exec:\xrfxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\bnttnn.exec:\bnttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\hbbbbb.exec:\hbbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\5fxrxff.exec:\5fxrxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1bnnnh.exec:\1bnnnh.exe17⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1vpvv.exec:\1vpvv.exe18⤵
- Executes dropped EXE
PID:2936 -
\??\c:\hthnnn.exec:\hthnnn.exe19⤵
- Executes dropped EXE
PID:1380 -
\??\c:\9pvdv.exec:\9pvdv.exe20⤵
- Executes dropped EXE
PID:1900 -
\??\c:\9bhbbb.exec:\9bhbbb.exe21⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvvdd.exec:\vvvdd.exe22⤵
- Executes dropped EXE
PID:1364 -
\??\c:\9tnnnn.exec:\9tnnnn.exe23⤵
- Executes dropped EXE
PID:1304 -
\??\c:\bnbbhh.exec:\bnbbhh.exe24⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vvvvd.exec:\vvvvd.exe25⤵
- Executes dropped EXE
PID:864 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe26⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bnbhtt.exec:\bnbhtt.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284 -
\??\c:\xlrrlll.exec:\xlrrlll.exe28⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pdjjj.exec:\pdjjj.exe29⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5vvjd.exec:\5vvjd.exe30⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlxffxl.exec:\xlxffxl.exe31⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9bnnnh.exec:\9bnnnh.exe32⤵
- Executes dropped EXE
PID:2652 -
\??\c:\9xfffxf.exec:\9xfffxf.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\hnbtbh.exec:\hnbtbh.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3vjdv.exec:\3vjdv.exe35⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9bnhtt.exec:\9bnhtt.exe37⤵
- Executes dropped EXE
PID:3028 -
\??\c:\7tbtnn.exec:\7tbtnn.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9pppd.exec:\9pppd.exe39⤵
- Executes dropped EXE
PID:1052 -
\??\c:\rfxfrlr.exec:\rfxfrlr.exe40⤵
- Executes dropped EXE
PID:1120 -
\??\c:\bhhhbb.exec:\bhhhbb.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9thbbb.exec:\9thbbb.exe42⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5dpvv.exec:\5dpvv.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\3rfrrrx.exec:\3rfrrrx.exe44⤵
- Executes dropped EXE
PID:536 -
\??\c:\frffffl.exec:\frffffl.exe45⤵
- Executes dropped EXE
PID:2052 -
\??\c:\httttt.exec:\httttt.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\5dvjj.exec:\5dvjj.exe47⤵
- Executes dropped EXE
PID:712 -
\??\c:\vjvvv.exec:\vjvvv.exe48⤵
- Executes dropped EXE
PID:1732 -
\??\c:\thtbhh.exec:\thtbhh.exe49⤵
- Executes dropped EXE
PID:1784 -
\??\c:\thtttt.exec:\thtttt.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jvjdd.exec:\jvjdd.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\7xfxffl.exec:\7xfxffl.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1thhbt.exec:\1thhbt.exe53⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tthnhh.exec:\tthnhh.exe54⤵
- Executes dropped EXE
PID:1888 -
\??\c:\vjvpv.exec:\vjvpv.exe55⤵
- Executes dropped EXE
PID:844 -
\??\c:\xxllllr.exec:\xxllllr.exe56⤵
- Executes dropped EXE
PID:444 -
\??\c:\bnbbbt.exec:\bnbbbt.exe57⤵
- Executes dropped EXE
PID:408 -
\??\c:\7jjdd.exec:\7jjdd.exe58⤵
- Executes dropped EXE
PID:1952 -
\??\c:\pjvdj.exec:\pjvdj.exe59⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1rffxrx.exec:\1rffxrx.exe60⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hthhhh.exec:\hthhhh.exe61⤵
- Executes dropped EXE
PID:1548 -
\??\c:\7bthhn.exec:\7bthhn.exe62⤵
- Executes dropped EXE
PID:580 -
\??\c:\5pdjv.exec:\5pdjv.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\fxllxxl.exec:\fxllxxl.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nhhnbb.exec:\nhhnbb.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\nnbbhh.exec:\nnbbhh.exe66⤵PID:2012
-
\??\c:\jpjdp.exec:\jpjdp.exe67⤵PID:2744
-
\??\c:\xxxxllr.exec:\xxxxllr.exe68⤵PID:2664
-
\??\c:\9nbbnn.exec:\9nbbnn.exe69⤵PID:2752
-
\??\c:\hbnttt.exec:\hbnttt.exe70⤵PID:2868
-
\??\c:\vjddj.exec:\vjddj.exe71⤵PID:2588
-
\??\c:\fxrfllr.exec:\fxrfllr.exe72⤵PID:2836
-
\??\c:\9xfxflx.exec:\9xfxflx.exe73⤵PID:2552
-
\??\c:\btnnbb.exec:\btnnbb.exe74⤵PID:2712
-
\??\c:\dvjpp.exec:\dvjpp.exe75⤵PID:2656
-
\??\c:\ddddj.exec:\ddddj.exe76⤵PID:2372
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe77⤵PID:2584
-
\??\c:\btnthh.exec:\btnthh.exe78⤵PID:2420
-
\??\c:\7bntbb.exec:\7bntbb.exe79⤵PID:1120
-
\??\c:\dvpvj.exec:\dvpvj.exe80⤵PID:2632
-
\??\c:\xxrfxxl.exec:\xxrfxxl.exe81⤵PID:2376
-
\??\c:\rxlfrrx.exec:\rxlfrrx.exe82⤵PID:1064
-
\??\c:\5thntb.exec:\5thntb.exe83⤵PID:1448
-
\??\c:\7pvvd.exec:\7pvvd.exe84⤵PID:2252
-
\??\c:\9rlrrxl.exec:\9rlrrxl.exe85⤵PID:2772
-
\??\c:\rrfrflx.exec:\rrfrflx.exe86⤵PID:1636
-
\??\c:\nbnttb.exec:\nbnttb.exe87⤵PID:2872
-
\??\c:\jvjjp.exec:\jvjjp.exe88⤵PID:1656
-
\??\c:\dvjjp.exec:\dvjjp.exe89⤵PID:988
-
\??\c:\1rrrxfl.exec:\1rrrxfl.exe90⤵PID:2940
-
\??\c:\3bhbtb.exec:\3bhbtb.exe91⤵PID:2944
-
\??\c:\bttbtt.exec:\bttbtt.exe92⤵PID:2164
-
\??\c:\7pjpp.exec:\7pjpp.exe93⤵PID:924
-
\??\c:\ddvdp.exec:\ddvdp.exe94⤵PID:1468
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe95⤵PID:1620
-
\??\c:\hhbhnn.exec:\hhbhnn.exe96⤵PID:2120
-
\??\c:\9dvvd.exec:\9dvvd.exe97⤵PID:1304
-
\??\c:\1vvpp.exec:\1vvpp.exe98⤵PID:560
-
\??\c:\rfxxlfx.exec:\rfxxlfx.exe99⤵PID:1608
-
\??\c:\rlflxxf.exec:\rlflxxf.exe100⤵PID:2216
-
\??\c:\tntbbb.exec:\tntbbb.exe101⤵PID:1612
-
\??\c:\pjpvj.exec:\pjpvj.exe102⤵PID:2336
-
\??\c:\9dvvv.exec:\9dvvv.exe103⤵PID:1464
-
\??\c:\1xlfrxf.exec:\1xlfrxf.exe104⤵PID:2952
-
\??\c:\xrffrrl.exec:\xrffrrl.exe105⤵PID:904
-
\??\c:\hbnntb.exec:\hbnntb.exe106⤵PID:2012
-
\??\c:\7dpvd.exec:\7dpvd.exe107⤵PID:2756
-
\??\c:\ddvjv.exec:\ddvjv.exe108⤵PID:2928
-
\??\c:\1rxxflr.exec:\1rxxflr.exe109⤵PID:2652
-
\??\c:\7nbbbh.exec:\7nbbbh.exe110⤵PID:2868
-
\??\c:\9btbbh.exec:\9btbbh.exe111⤵PID:2588
-
\??\c:\vpjpd.exec:\vpjpd.exe112⤵PID:2528
-
\??\c:\lllrlrf.exec:\lllrlrf.exe113⤵PID:2696
-
\??\c:\7lfllrl.exec:\7lfllrl.exe114⤵PID:2848
-
\??\c:\tnhhnt.exec:\tnhhnt.exe115⤵PID:3016
-
\??\c:\7dvdj.exec:\7dvdj.exe116⤵PID:2576
-
\??\c:\dvpvv.exec:\dvpvv.exe117⤵PID:1416
-
\??\c:\xrllrxf.exec:\xrllrxf.exe118⤵PID:2000
-
\??\c:\lfxfxlf.exec:\lfxfxlf.exe119⤵PID:2104
-
\??\c:\nhbhtb.exec:\nhbhtb.exe120⤵PID:2976
-
\??\c:\jdppj.exec:\jdppj.exe121⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-