Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe
-
Size
455KB
-
MD5
c9ebf64fc48eba5d0588635df2f98d30
-
SHA1
98bb7df5d404306e70330dd164a3744d3c35db5b
-
SHA256
96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65
-
SHA512
39caaf215d25d5598360819572cc2139932831860a508658860f9c52045e1bc4ea1172789509e917a2ee808ff982036749af19c9308fc7be76e9227acfc72c7d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+Y:q7Tc2NYHUrAwfMp3CD+Y
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/3048-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-795-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-932-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-970-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2420-1009-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-1134-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1608-1191-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2232 vppvd.exe 2776 xfrfrxr.exe 2656 tnnnbh.exe 2808 bthtbb.exe 2572 rrlxlrl.exe 2784 bbtbnn.exe 2340 pjvdj.exe 2552 ddjjv.exe 1096 frfrxrx.exe 2640 jjvjd.exe 1700 rxlrxfx.exe 764 pjpjd.exe 1996 vvjvj.exe 932 rrfrxlf.exe 580 5vppp.exe 2368 btnbnb.exe 2932 vvvjd.exe 2156 llfrrll.exe 2532 bhtthn.exe 1036 lfrlffx.exe 2188 hhnthn.exe 1856 xrlxlxr.exe 868 bthtbh.exe 2460 ddvjj.exe 1672 9lfffll.exe 1716 ffxfxfx.exe 1660 xrrxflf.exe 2320 vvvpj.exe 2508 xxrflxf.exe 2632 9vpdp.exe 1120 7rllrrf.exe 1508 nhbnbh.exe 2168 9jvpd.exe 840 xxrlrxl.exe 2744 hbtbhh.exe 2768 jdvdp.exe 2816 lflfrxl.exe 2556 bhtbnn.exe 2860 hhnhbn.exe 2688 jvdjv.exe 2604 rrrxlrf.exe 2560 nntthn.exe 2784 nhhhtn.exe 2220 pjvvp.exe 1944 rrllffr.exe 2612 hnnbtb.exe 2788 5jddp.exe 2876 5ffrxfl.exe 2008 bnhhtt.exe 2000 nhhnbn.exe 1040 djdpj.exe 640 rlfrxrf.exe 380 btnntb.exe 320 ppjdp.exe 2396 5xxfrrf.exe 2488 rrlrlfx.exe 2356 bttntb.exe 2404 djdpp.exe 2528 frrrxfr.exe 2476 7htttt.exe 2468 nthttb.exe 964 pjdpj.exe 2400 ffxxrrx.exe 1312 9bnthh.exe -
resource yara_rule behavioral1/memory/3048-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-992-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2420-1009-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-1100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-1254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-1261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-1378-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rllxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2232 3048 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 30 PID 3048 wrote to memory of 2232 3048 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 30 PID 3048 wrote to memory of 2232 3048 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 30 PID 3048 wrote to memory of 2232 3048 96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe 30 PID 2232 wrote to memory of 2776 2232 vppvd.exe 31 PID 2232 wrote to memory of 2776 2232 vppvd.exe 31 PID 2232 wrote to memory of 2776 2232 vppvd.exe 31 PID 2232 wrote to memory of 2776 2232 vppvd.exe 31 PID 2776 wrote to memory of 2656 2776 xfrfrxr.exe 32 PID 2776 wrote to memory of 2656 2776 xfrfrxr.exe 32 PID 2776 wrote to memory of 2656 2776 xfrfrxr.exe 32 PID 2776 wrote to memory of 2656 2776 xfrfrxr.exe 32 PID 2656 wrote to memory of 2808 2656 tnnnbh.exe 33 PID 2656 wrote to memory of 2808 2656 tnnnbh.exe 33 PID 2656 wrote to memory of 2808 2656 tnnnbh.exe 33 PID 2656 wrote to memory of 2808 2656 tnnnbh.exe 33 PID 2808 wrote to memory of 2572 2808 bthtbb.exe 34 PID 2808 wrote to memory of 2572 2808 bthtbb.exe 34 PID 2808 wrote to memory of 2572 2808 bthtbb.exe 34 PID 2808 wrote to memory of 2572 2808 bthtbb.exe 34 PID 2572 wrote to memory of 2784 2572 rrlxlrl.exe 35 PID 2572 wrote to memory of 2784 2572 rrlxlrl.exe 35 PID 2572 wrote to memory of 2784 2572 rrlxlrl.exe 35 PID 2572 wrote to memory of 2784 2572 rrlxlrl.exe 35 PID 2784 wrote to memory of 2340 2784 bbtbnn.exe 36 PID 2784 wrote to memory of 2340 2784 bbtbnn.exe 36 PID 2784 wrote to memory of 2340 2784 bbtbnn.exe 36 PID 2784 wrote to memory of 2340 2784 bbtbnn.exe 36 PID 2340 wrote to memory of 2552 2340 pjvdj.exe 37 PID 2340 wrote to memory of 2552 2340 pjvdj.exe 37 PID 2340 wrote to memory of 2552 2340 pjvdj.exe 37 PID 2340 wrote to memory of 2552 2340 pjvdj.exe 37 PID 2552 wrote to memory of 1096 2552 ddjjv.exe 38 PID 2552 wrote to memory of 1096 2552 ddjjv.exe 38 PID 2552 wrote to memory of 1096 2552 ddjjv.exe 38 PID 2552 wrote to memory of 1096 2552 ddjjv.exe 38 PID 1096 wrote to memory of 2640 1096 frfrxrx.exe 39 PID 1096 wrote to memory of 2640 1096 frfrxrx.exe 39 PID 1096 wrote to memory of 2640 1096 frfrxrx.exe 39 PID 1096 wrote to memory of 2640 1096 frfrxrx.exe 39 PID 2640 wrote to memory of 1700 2640 jjvjd.exe 40 PID 2640 wrote to memory of 1700 2640 jjvjd.exe 40 PID 2640 wrote to memory of 1700 2640 jjvjd.exe 40 PID 2640 wrote to memory of 1700 2640 jjvjd.exe 40 PID 1700 wrote to memory of 764 1700 rxlrxfx.exe 41 PID 1700 wrote to memory of 764 1700 rxlrxfx.exe 41 PID 1700 wrote to memory of 764 1700 rxlrxfx.exe 41 PID 1700 wrote to memory of 764 1700 rxlrxfx.exe 41 PID 764 wrote to memory of 1996 764 pjpjd.exe 42 PID 764 wrote to memory of 1996 764 pjpjd.exe 42 PID 764 wrote to memory of 1996 764 pjpjd.exe 42 PID 764 wrote to memory of 1996 764 pjpjd.exe 42 PID 1996 wrote to memory of 932 1996 vvjvj.exe 43 PID 1996 wrote to memory of 932 1996 vvjvj.exe 43 PID 1996 wrote to memory of 932 1996 vvjvj.exe 43 PID 1996 wrote to memory of 932 1996 vvjvj.exe 43 PID 932 wrote to memory of 580 932 rrfrxlf.exe 44 PID 932 wrote to memory of 580 932 rrfrxlf.exe 44 PID 932 wrote to memory of 580 932 rrfrxlf.exe 44 PID 932 wrote to memory of 580 932 rrfrxlf.exe 44 PID 580 wrote to memory of 2368 580 5vppp.exe 45 PID 580 wrote to memory of 2368 580 5vppp.exe 45 PID 580 wrote to memory of 2368 580 5vppp.exe 45 PID 580 wrote to memory of 2368 580 5vppp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe"C:\Users\Admin\AppData\Local\Temp\96c8dbfcf4811b5f5bfbe4e63afbe4b80f752239f254c587ed39fd82c4eb1e65N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vppvd.exec:\vppvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\xfrfrxr.exec:\xfrfrxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\tnnnbh.exec:\tnnnbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\bthtbb.exec:\bthtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\rrlxlrl.exec:\rrlxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bbtbnn.exec:\bbtbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjvdj.exec:\pjvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ddjjv.exec:\ddjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\frfrxrx.exec:\frfrxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\jjvjd.exec:\jjvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rxlrxfx.exec:\rxlrxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\pjpjd.exec:\pjpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vvjvj.exec:\vvjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\rrfrxlf.exec:\rrfrxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\5vppp.exec:\5vppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\btnbnb.exec:\btnbnb.exe17⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vvvjd.exec:\vvvjd.exe18⤵
- Executes dropped EXE
PID:2932 -
\??\c:\llfrrll.exec:\llfrrll.exe19⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bhtthn.exec:\bhtthn.exe20⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfrlffx.exec:\lfrlffx.exe21⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hhnthn.exec:\hhnthn.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xrlxlxr.exec:\xrlxlxr.exe23⤵
- Executes dropped EXE
PID:1856 -
\??\c:\bthtbh.exec:\bthtbh.exe24⤵
- Executes dropped EXE
PID:868 -
\??\c:\ddvjj.exec:\ddvjj.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\9lfffll.exec:\9lfffll.exe26⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ffxfxfx.exec:\ffxfxfx.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xrrxflf.exec:\xrrxflf.exe28⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vvvpj.exec:\vvvpj.exe29⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xxrflxf.exec:\xxrflxf.exe30⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9vpdp.exec:\9vpdp.exe31⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7rllrrf.exec:\7rllrrf.exe32⤵
- Executes dropped EXE
PID:1120 -
\??\c:\nhbnbh.exec:\nhbnbh.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\9jvpd.exec:\9jvpd.exe34⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xxrlrxl.exec:\xxrlrxl.exe35⤵
- Executes dropped EXE
PID:840 -
\??\c:\hbtbhh.exec:\hbtbhh.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2744 -
\??\c:\jdvdp.exec:\jdvdp.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lflfrxl.exec:\lflfrxl.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bhtbnn.exec:\bhtbnn.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hhnhbn.exec:\hhnhbn.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\jvdjv.exec:\jvdjv.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nntthn.exec:\nntthn.exe43⤵
- Executes dropped EXE
PID:2560 -
\??\c:\nhhhtn.exec:\nhhhtn.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjvvp.exec:\pjvvp.exe45⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrllffr.exec:\rrllffr.exe46⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnnbtb.exec:\hnnbtb.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\5jddp.exec:\5jddp.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5ffrxfl.exec:\5ffrxfl.exe49⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bnhhtt.exec:\bnhhtt.exe50⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nhhnbn.exec:\nhhnbn.exe51⤵
- Executes dropped EXE
PID:2000 -
\??\c:\djdpj.exec:\djdpj.exe52⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rlfrxrf.exec:\rlfrxrf.exe53⤵
- Executes dropped EXE
PID:640 -
\??\c:\btnntb.exec:\btnntb.exe54⤵
- Executes dropped EXE
PID:380 -
\??\c:\ppjdp.exec:\ppjdp.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\5xxfrrf.exec:\5xxfrrf.exe56⤵
- Executes dropped EXE
PID:2396 -
\??\c:\rrlrlfx.exec:\rrlrlfx.exe57⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bttntb.exec:\bttntb.exe58⤵
- Executes dropped EXE
PID:2356 -
\??\c:\djdpp.exec:\djdpp.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\frrrxfr.exec:\frrrxfr.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528 -
\??\c:\7htttt.exec:\7htttt.exe61⤵
- Executes dropped EXE
PID:2476 -
\??\c:\nthttb.exec:\nthttb.exe62⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pjdpj.exec:\pjdpj.exe63⤵
- Executes dropped EXE
PID:964 -
\??\c:\ffxxrrx.exec:\ffxxrrx.exe64⤵
- Executes dropped EXE
PID:2400 -
\??\c:\9bnthh.exec:\9bnthh.exe65⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ttnnbn.exec:\ttnnbn.exe66⤵PID:904
-
\??\c:\jjddj.exec:\jjddj.exe67⤵PID:1340
-
\??\c:\llffxfx.exec:\llffxfx.exe68⤵PID:2364
-
\??\c:\hhhbhn.exec:\hhhbhn.exe69⤵PID:1728
-
\??\c:\hhbnht.exec:\hhbnht.exe70⤵PID:768
-
\??\c:\dvddj.exec:\dvddj.exe71⤵
- System Location Discovery: System Language Discovery
PID:2956 -
\??\c:\llflflx.exec:\llflflx.exe72⤵PID:1804
-
\??\c:\nhbbht.exec:\nhbbht.exe73⤵PID:2068
-
\??\c:\djjvp.exec:\djjvp.exe74⤵PID:2916
-
\??\c:\jjvdj.exec:\jjvdj.exe75⤵PID:2336
-
\??\c:\7rrxffl.exec:\7rrxffl.exe76⤵PID:888
-
\??\c:\nbtbtt.exec:\nbtbtt.exe77⤵PID:1120
-
\??\c:\tththh.exec:\tththh.exe78⤵PID:1280
-
\??\c:\pvpvp.exec:\pvpvp.exe79⤵PID:2700
-
\??\c:\lfxfllx.exec:\lfxfllx.exe80⤵PID:2736
-
\??\c:\hhbhnb.exec:\hhbhnb.exe81⤵PID:1608
-
\??\c:\nthbtt.exec:\nthbtt.exe82⤵PID:2752
-
\??\c:\3dppd.exec:\3dppd.exe83⤵PID:2748
-
\??\c:\rfxlrrf.exec:\rfxlrrf.exe84⤵PID:2908
-
\??\c:\fxxrlrf.exec:\fxxrlrf.exe85⤵PID:2904
-
\??\c:\bbttnb.exec:\bbttnb.exe86⤵PID:2588
-
\??\c:\7dpjp.exec:\7dpjp.exe87⤵PID:2564
-
\??\c:\xlflrfx.exec:\xlflrfx.exe88⤵PID:2672
-
\??\c:\3xrxrxf.exec:\3xrxrxf.exe89⤵PID:2348
-
\??\c:\nhtbnn.exec:\nhtbnn.exe90⤵PID:1744
-
\??\c:\vvvdv.exec:\vvvdv.exe91⤵PID:880
-
\??\c:\jdvdv.exec:\jdvdv.exe92⤵PID:2800
-
\??\c:\rllrxxr.exec:\rllrxxr.exe93⤵PID:2880
-
\??\c:\3hhtht.exec:\3hhtht.exe94⤵PID:2640
-
\??\c:\ddpvj.exec:\ddpvj.exe95⤵PID:664
-
\??\c:\pdvdv.exec:\pdvdv.exe96⤵PID:1752
-
\??\c:\xrlxxlx.exec:\xrlxxlx.exe97⤵PID:1936
-
\??\c:\bthntb.exec:\bthntb.exe98⤵PID:2020
-
\??\c:\pvvvp.exec:\pvvvp.exe99⤵PID:932
-
\??\c:\pjjjv.exec:\pjjjv.exe100⤵PID:1756
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe101⤵PID:2124
-
\??\c:\hbthtb.exec:\hbthtb.exe102⤵PID:2368
-
\??\c:\9nhnnb.exec:\9nhnnb.exe103⤵PID:2772
-
\??\c:\1jjpp.exec:\1jjpp.exe104⤵PID:2432
-
\??\c:\fxlrlxf.exec:\fxlrlxf.exe105⤵PID:912
-
\??\c:\bntnnh.exec:\bntnnh.exe106⤵PID:2532
-
\??\c:\tttbnn.exec:\tttbnn.exe107⤵PID:2236
-
\??\c:\3jvjv.exec:\3jvjv.exe108⤵PID:1616
-
\??\c:\rrlrlxl.exec:\rrlrlxl.exe109⤵PID:1648
-
\??\c:\xfrxllr.exec:\xfrxllr.exe110⤵PID:800
-
\??\c:\btnbnn.exec:\btnbnn.exe111⤵PID:2484
-
\??\c:\jpjpd.exec:\jpjpd.exe112⤵PID:1540
-
\??\c:\vvjjv.exec:\vvjjv.exe113⤵PID:2104
-
\??\c:\rxfxllx.exec:\rxfxllx.exe114⤵PID:1720
-
\??\c:\ntnhth.exec:\ntnhth.exe115⤵PID:1328
-
\??\c:\bbttbn.exec:\bbttbn.exe116⤵PID:2636
-
\??\c:\7vppj.exec:\7vppj.exe117⤵PID:2040
-
\??\c:\fflrflf.exec:\fflrflf.exe118⤵PID:1152
-
\??\c:\vvdpp.exec:\vvdpp.exe119⤵PID:2508
-
\??\c:\vjpdv.exec:\vjpdv.exe120⤵
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\flrffrf.exec:\flrffrf.exe121⤵PID:2044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-