Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe
-
Size
453KB
-
MD5
4acc2022623063c9e94a68ce0a853284
-
SHA1
08fca9da56af8208e83745322f24152eed9409a0
-
SHA256
e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008
-
SHA512
fbc9103af675cd9d22094b16a3ddd67e29f305e31db78420f997f4c506262408f810b9436c735f64483231e255b3ec4f6e051cf086dad16aaf56bd6ec829335a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6:q7Tc2NYHUrAwfMp3CD6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-152-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2372-163-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2388-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-217-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/872-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-292-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-468-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2396-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-590-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2024-661-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1820-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1376 nbbhhb.exe 2832 jjjvv.exe 2844 ttbtnh.exe 2772 pppjj.exe 1328 7flrxll.exe 2572 9lffrfr.exe 692 tbnhht.exe 1232 httnnb.exe 1432 xxrxlrx.exe 3024 3jjvp.exe 2936 5hnnbb.exe 2056 ntbbbt.exe 908 xxxlfrl.exe 1300 1rlxxfx.exe 536 hhttnn.exe 2372 rrrxlrf.exe 2388 nhbhbh.exe 2212 jpvjd.exe 1720 9xlrflr.exe 2784 ddddj.exe 1876 lrxrlxl.exe 1656 vjdpj.exe 872 lfrlrfx.exe 1516 dvppj.exe 1676 lfxfrfr.exe 2436 rrfrflx.exe 2192 fxrlrfr.exe 664 frxxflf.exe 1756 tbthth.exe 1748 jjddv.exe 1816 xrflxxl.exe 2712 vdpjj.exe 1688 rxxllrx.exe 2912 bbtnbt.exe 3004 ddddj.exe 2604 xffrxfl.exe 1804 hntnnh.exe 2688 vvjdp.exe 1328 xxrrxlf.exe 2080 tbbtnb.exe 2100 ppdpd.exe 1920 rlflxxl.exe 1296 nhbtnt.exe 1432 3pdjv.exe 2380 5vpvj.exe 2556 rrlflrx.exe 2248 7bbnbh.exe 1732 dvjdv.exe 2448 xxlxlrr.exe 1644 bhbtbh.exe 1284 jdvdp.exe 316 3vpdp.exe 1764 9xxfrfl.exe 2348 nhbhnn.exe 2240 jjjvp.exe 2052 xxrflrf.exe 2112 lfxxlfr.exe 808 tthtbh.exe 1356 ddjvj.exe 896 xllrxfr.exe 324 lfxrfrl.exe 2672 ntnnbh.exe 2396 jppdd.exe 2532 fxlllfl.exe -
resource yara_rule behavioral1/memory/2116-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1376-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-91-0x0000000001C80000-0x0000000001CAA000-memory.dmp upx behavioral1/memory/908-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-292-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3004-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-471-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2672-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-776-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 1376 2116 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 30 PID 2116 wrote to memory of 1376 2116 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 30 PID 2116 wrote to memory of 1376 2116 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 30 PID 2116 wrote to memory of 1376 2116 e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe 30 PID 1376 wrote to memory of 2832 1376 nbbhhb.exe 31 PID 1376 wrote to memory of 2832 1376 nbbhhb.exe 31 PID 1376 wrote to memory of 2832 1376 nbbhhb.exe 31 PID 1376 wrote to memory of 2832 1376 nbbhhb.exe 31 PID 2832 wrote to memory of 2844 2832 jjjvv.exe 32 PID 2832 wrote to memory of 2844 2832 jjjvv.exe 32 PID 2832 wrote to memory of 2844 2832 jjjvv.exe 32 PID 2832 wrote to memory of 2844 2832 jjjvv.exe 32 PID 2844 wrote to memory of 2772 2844 ttbtnh.exe 33 PID 2844 wrote to memory of 2772 2844 ttbtnh.exe 33 PID 2844 wrote to memory of 2772 2844 ttbtnh.exe 33 PID 2844 wrote to memory of 2772 2844 ttbtnh.exe 33 PID 2772 wrote to memory of 1328 2772 pppjj.exe 34 PID 2772 wrote to memory of 1328 2772 pppjj.exe 34 PID 2772 wrote to memory of 1328 2772 pppjj.exe 34 PID 2772 wrote to memory of 1328 2772 pppjj.exe 34 PID 1328 wrote to memory of 2572 1328 7flrxll.exe 35 PID 1328 wrote to memory of 2572 1328 7flrxll.exe 35 PID 1328 wrote to memory of 2572 1328 7flrxll.exe 35 PID 1328 wrote to memory of 2572 1328 7flrxll.exe 35 PID 2572 wrote to memory of 692 2572 9lffrfr.exe 36 PID 2572 wrote to memory of 692 2572 9lffrfr.exe 36 PID 2572 wrote to memory of 692 2572 9lffrfr.exe 36 PID 2572 wrote to memory of 692 2572 9lffrfr.exe 36 PID 692 wrote to memory of 1232 692 tbnhht.exe 37 PID 692 wrote to memory of 1232 692 tbnhht.exe 37 PID 692 wrote to memory of 1232 692 tbnhht.exe 37 PID 692 wrote to memory of 1232 692 tbnhht.exe 37 PID 1232 wrote to memory of 1432 1232 httnnb.exe 38 PID 1232 wrote to memory of 1432 1232 httnnb.exe 38 PID 1232 wrote to memory of 1432 1232 httnnb.exe 38 PID 1232 wrote to memory of 1432 1232 httnnb.exe 38 PID 1432 wrote to memory of 3024 1432 xxrxlrx.exe 39 PID 1432 wrote to memory of 3024 1432 xxrxlrx.exe 39 PID 1432 wrote to memory of 3024 1432 xxrxlrx.exe 39 PID 1432 wrote to memory of 3024 1432 xxrxlrx.exe 39 PID 3024 wrote to memory of 2936 3024 3jjvp.exe 40 PID 3024 wrote to memory of 2936 3024 3jjvp.exe 40 PID 3024 wrote to memory of 2936 3024 3jjvp.exe 40 PID 3024 wrote to memory of 2936 3024 3jjvp.exe 40 PID 2936 wrote to memory of 2056 2936 5hnnbb.exe 41 PID 2936 wrote to memory of 2056 2936 5hnnbb.exe 41 PID 2936 wrote to memory of 2056 2936 5hnnbb.exe 41 PID 2936 wrote to memory of 2056 2936 5hnnbb.exe 41 PID 2056 wrote to memory of 908 2056 ntbbbt.exe 42 PID 2056 wrote to memory of 908 2056 ntbbbt.exe 42 PID 2056 wrote to memory of 908 2056 ntbbbt.exe 42 PID 2056 wrote to memory of 908 2056 ntbbbt.exe 42 PID 908 wrote to memory of 1300 908 xxxlfrl.exe 43 PID 908 wrote to memory of 1300 908 xxxlfrl.exe 43 PID 908 wrote to memory of 1300 908 xxxlfrl.exe 43 PID 908 wrote to memory of 1300 908 xxxlfrl.exe 43 PID 1300 wrote to memory of 536 1300 1rlxxfx.exe 44 PID 1300 wrote to memory of 536 1300 1rlxxfx.exe 44 PID 1300 wrote to memory of 536 1300 1rlxxfx.exe 44 PID 1300 wrote to memory of 536 1300 1rlxxfx.exe 44 PID 536 wrote to memory of 2372 536 hhttnn.exe 45 PID 536 wrote to memory of 2372 536 hhttnn.exe 45 PID 536 wrote to memory of 2372 536 hhttnn.exe 45 PID 536 wrote to memory of 2372 536 hhttnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe"C:\Users\Admin\AppData\Local\Temp\e40afca84df337bc64e2ee7fa0f769b5924b77c5882fd1a7726532752c885008.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nbbhhb.exec:\nbbhhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\jjjvv.exec:\jjjvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ttbtnh.exec:\ttbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pppjj.exec:\pppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\7flrxll.exec:\7flrxll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\9lffrfr.exec:\9lffrfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\tbnhht.exec:\tbnhht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\httnnb.exec:\httnnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\3jjvp.exec:\3jjvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\5hnnbb.exec:\5hnnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ntbbbt.exec:\ntbbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\1rlxxfx.exec:\1rlxxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\hhttnn.exec:\hhttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe17⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhbhbh.exec:\nhbhbh.exe18⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jpvjd.exec:\jpvjd.exe19⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9xlrflr.exec:\9xlrflr.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\ddddj.exec:\ddddj.exe21⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lrxrlxl.exec:\lrxrlxl.exe22⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vjdpj.exec:\vjdpj.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lfrlrfx.exec:\lfrlrfx.exe24⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvppj.exec:\dvppj.exe25⤵
- Executes dropped EXE
PID:1516 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe26⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rrfrflx.exec:\rrfrflx.exe27⤵
- Executes dropped EXE
PID:2436 -
\??\c:\fxrlrfr.exec:\fxrlrfr.exe28⤵
- Executes dropped EXE
PID:2192 -
\??\c:\frxxflf.exec:\frxxflf.exe29⤵
- Executes dropped EXE
PID:664 -
\??\c:\tbthth.exec:\tbthth.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jjddv.exec:\jjddv.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\xrflxxl.exec:\xrflxxl.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\vdpjj.exec:\vdpjj.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rxxllrx.exec:\rxxllrx.exe34⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bbtnbt.exec:\bbtnbt.exe35⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ddddj.exec:\ddddj.exe36⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xffrxfl.exec:\xffrxfl.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hntnnh.exec:\hntnnh.exe38⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vvjdp.exec:\vvjdp.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xxrrxlf.exec:\xxrrxlf.exe40⤵
- Executes dropped EXE
PID:1328 -
\??\c:\tbbtnb.exec:\tbbtnb.exe41⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ppdpd.exec:\ppdpd.exe42⤵
- Executes dropped EXE
PID:2100 -
\??\c:\rlflxxl.exec:\rlflxxl.exe43⤵
- Executes dropped EXE
PID:1920 -
\??\c:\nhbtnt.exec:\nhbtnt.exe44⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3pdjv.exec:\3pdjv.exe45⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5vpvj.exec:\5vpvj.exe46⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rrlflrx.exec:\rrlflrx.exe47⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7bbnbh.exec:\7bbnbh.exe48⤵
- Executes dropped EXE
PID:2248 -
\??\c:\dvjdv.exec:\dvjdv.exe49⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xxlxlrr.exec:\xxlxlrr.exe50⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bhbtbh.exec:\bhbtbh.exe51⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdvdp.exec:\jdvdp.exe52⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3vpdp.exec:\3vpdp.exe53⤵
- Executes dropped EXE
PID:316 -
\??\c:\9xxfrfl.exec:\9xxfrfl.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nhbhnn.exec:\nhbhnn.exe55⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjjvp.exec:\jjjvp.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xxrflrf.exec:\xxrflrf.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lfxxlfr.exec:\lfxxlfr.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tthtbh.exec:\tthtbh.exe59⤵
- Executes dropped EXE
PID:808 -
\??\c:\ddjvj.exec:\ddjvj.exe60⤵
- Executes dropped EXE
PID:1356 -
\??\c:\xllrxfr.exec:\xllrxfr.exe61⤵
- Executes dropped EXE
PID:896 -
\??\c:\lfxrfrl.exec:\lfxrfrl.exe62⤵
- Executes dropped EXE
PID:324 -
\??\c:\ntnnbh.exec:\ntnnbh.exe63⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jppdd.exec:\jppdd.exe64⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxlllfl.exec:\fxlllfl.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\ntbhhn.exec:\ntbhhn.exe66⤵PID:2812
-
\??\c:\jvjjj.exec:\jvjjj.exe67⤵PID:1848
-
\??\c:\xxxfrrf.exec:\xxxfrrf.exe68⤵PID:3040
-
\??\c:\xxrfrrf.exec:\xxrfrrf.exe69⤵PID:1988
-
\??\c:\ttnthn.exec:\ttnthn.exe70⤵PID:1984
-
\??\c:\jvpdd.exec:\jvpdd.exe71⤵PID:2104
-
\??\c:\5rflxff.exec:\5rflxff.exe72⤵PID:700
-
\??\c:\7ttbbh.exec:\7ttbbh.exe73⤵PID:2416
-
\??\c:\hnhhtb.exec:\hnhhtb.exe74⤵PID:2004
-
\??\c:\ppjdv.exec:\ppjdv.exe75⤵PID:2252
-
\??\c:\xffxrfx.exec:\xffxrfx.exe76⤵PID:2676
-
\??\c:\nttnnb.exec:\nttnnb.exe77⤵PID:2848
-
\??\c:\vvjvj.exec:\vvjvj.exe78⤵PID:1688
-
\??\c:\fflffrl.exec:\fflffrl.exe79⤵PID:2576
-
\??\c:\fffxllx.exec:\fffxllx.exe80⤵PID:2724
-
\??\c:\bhhhhn.exec:\bhhhhn.exe81⤵PID:2604
-
\??\c:\dpjvj.exec:\dpjvj.exe82⤵PID:2244
-
\??\c:\7xxfffx.exec:\7xxfffx.exe83⤵PID:2764
-
\??\c:\7nnbnt.exec:\7nnbnt.exe84⤵PID:2644
-
\??\c:\vdvjj.exec:\vdvjj.exe85⤵PID:2692
-
\??\c:\vppvp.exec:\vppvp.exe86⤵PID:2024
-
\??\c:\lllflxr.exec:\lllflxr.exe87⤵PID:1476
-
\??\c:\hhbtnb.exec:\hhbtnb.exe88⤵PID:3028
-
\??\c:\ppjvj.exec:\ppjvj.exe89⤵PID:2400
-
\??\c:\pvddj.exec:\pvddj.exe90⤵PID:1820
-
\??\c:\rxrfrxx.exec:\rxrfrxx.exe91⤵PID:1692
-
\??\c:\nntbtb.exec:\nntbtb.exe92⤵PID:2900
-
\??\c:\pjjvj.exec:\pjjvj.exe93⤵PID:1048
-
\??\c:\lllrlxx.exec:\lllrlxx.exe94⤵PID:1320
-
\??\c:\1tbnht.exec:\1tbnht.exe95⤵PID:2344
-
\??\c:\nttnht.exec:\nttnht.exe96⤵PID:320
-
\??\c:\pdppd.exec:\pdppd.exe97⤵PID:2780
-
\??\c:\xflfxll.exec:\xflfxll.exe98⤵PID:2392
-
\??\c:\9nthbn.exec:\9nthbn.exe99⤵PID:2372
-
\??\c:\pvvpd.exec:\pvvpd.exe100⤵PID:2496
-
\??\c:\9ddjd.exec:\9ddjd.exe101⤵PID:2148
-
\??\c:\ffrlxxx.exec:\ffrlxxx.exe102⤵PID:1928
-
\??\c:\ppvjd.exec:\ppvjd.exe103⤵PID:1388
-
\??\c:\fllrrlf.exec:\fllrrlf.exe104⤵PID:2792
-
\??\c:\bhbnhn.exec:\bhbnhn.exe105⤵PID:928
-
\??\c:\hnhtnt.exec:\hnhtnt.exe106⤵PID:944
-
\??\c:\pppvp.exec:\pppvp.exe107⤵PID:1784
-
\??\c:\frflxlf.exec:\frflxlf.exe108⤵PID:1712
-
\??\c:\tbbnhb.exec:\tbbnhb.exe109⤵PID:1704
-
\??\c:\ttntht.exec:\ttntht.exe110⤵PID:2304
-
\??\c:\jppvp.exec:\jppvp.exe111⤵PID:1604
-
\??\c:\lllffxx.exec:\lllffxx.exe112⤵PID:2544
-
\??\c:\fxxrrfx.exec:\fxxrrfx.exe113⤵PID:2192
-
\??\c:\3thtnt.exec:\3thtnt.exe114⤵PID:2268
-
\??\c:\9djdp.exec:\9djdp.exe115⤵PID:2440
-
\??\c:\pdddp.exec:\pdddp.exe116⤵PID:992
-
\??\c:\flxxlfl.exec:\flxxlfl.exe117⤵PID:352
-
\??\c:\bbnbtb.exec:\bbnbtb.exe118⤵PID:2664
-
\??\c:\vdjvp.exec:\vdjvp.exe119⤵PID:2852
-
\??\c:\djdjv.exec:\djdjv.exe120⤵PID:2412
-
\??\c:\lllfxfr.exec:\lllfxfr.exe121⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-