Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 19:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe
-
Size
454KB
-
MD5
dc7cc407183f084c26292a5b110276a3
-
SHA1
21619b269ef5d7ea50a7e21b7a9e4150939bfd66
-
SHA256
b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef
-
SHA512
41eda05c2d050afcb235d61e8ecc828f3624e7a760b175971189b16160898519c69f4a21c6b7aa105cdfdbea9c39f46dbbf82b66aa283c89a19a355b9845696b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-93-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1804-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-167-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1432-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-277-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-468-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-489-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-599-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-614-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2764-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-720-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-970-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/292-977-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-1187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1444-1243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-1274-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1628 9xlfllx.exe 2388 5nhhhh.exe 2164 5lxflff.exe 2904 hbhbbh.exe 2748 vvjdj.exe 2156 3htthh.exe 3012 bntthn.exe 2684 lfrxxxf.exe 2668 bnhtbb.exe 1804 frrllxr.exe 2624 7hbttt.exe 1492 9nhnnh.exe 2744 xlxxlll.exe 1336 tnnbtb.exe 1792 3pvjd.exe 2968 jjvjp.exe 1220 thtnbb.exe 1644 5djpp.exe 2060 flxrrfl.exe 2416 nbbhhb.exe 1432 ppjdp.exe 1652 bbhnhn.exe 1140 9tnnhb.exe 1152 frflfrl.exe 672 tbnhbn.exe 1384 jvjjp.exe 2560 nhtbbn.exe 2496 lfrrxxl.exe 2564 llxlllr.exe 1672 ttthnb.exe 1280 dpvdj.exe 2004 3nnhnh.exe 1628 1bhbhb.exe 2924 vjvdj.exe 2784 flfxffr.exe 2912 tbbhbb.exe 2888 nhnbnt.exe 2800 vpvpj.exe 3036 lxrlxfr.exe 2936 htnnnb.exe 2872 btbhbh.exe 2632 7jvdp.exe 2708 5frfxlx.exe 2340 tbnbnt.exe 2244 nhthnt.exe 576 5pjvj.exe 1240 rlfrrxf.exe 1168 xrlrrxl.exe 2960 htthbh.exe 1148 pvdpv.exe 2860 5xrrxfr.exe 548 1lrfrxr.exe 332 hhbnht.exe 1356 9ppdp.exe 2124 jdvjp.exe 864 7lfxfxl.exe 2356 lfllxxr.exe 2196 hbnbnt.exe 2068 pvpjv.exe 1840 ppjjp.exe 2232 3xxfllr.exe 1708 thtthh.exe 404 3htbnb.exe 3060 dvjjp.exe -
resource yara_rule behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-660-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3008-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-932-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-1162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1187-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1324-1200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-1243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-1281-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1628 2612 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 30 PID 2612 wrote to memory of 1628 2612 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 30 PID 2612 wrote to memory of 1628 2612 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 30 PID 2612 wrote to memory of 1628 2612 b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe 30 PID 1628 wrote to memory of 2388 1628 9xlfllx.exe 31 PID 1628 wrote to memory of 2388 1628 9xlfllx.exe 31 PID 1628 wrote to memory of 2388 1628 9xlfllx.exe 31 PID 1628 wrote to memory of 2388 1628 9xlfllx.exe 31 PID 2388 wrote to memory of 2164 2388 5nhhhh.exe 32 PID 2388 wrote to memory of 2164 2388 5nhhhh.exe 32 PID 2388 wrote to memory of 2164 2388 5nhhhh.exe 32 PID 2388 wrote to memory of 2164 2388 5nhhhh.exe 32 PID 2164 wrote to memory of 2904 2164 5lxflff.exe 33 PID 2164 wrote to memory of 2904 2164 5lxflff.exe 33 PID 2164 wrote to memory of 2904 2164 5lxflff.exe 33 PID 2164 wrote to memory of 2904 2164 5lxflff.exe 33 PID 2904 wrote to memory of 2748 2904 hbhbbh.exe 34 PID 2904 wrote to memory of 2748 2904 hbhbbh.exe 34 PID 2904 wrote to memory of 2748 2904 hbhbbh.exe 34 PID 2904 wrote to memory of 2748 2904 hbhbbh.exe 34 PID 2748 wrote to memory of 2156 2748 vvjdj.exe 35 PID 2748 wrote to memory of 2156 2748 vvjdj.exe 35 PID 2748 wrote to memory of 2156 2748 vvjdj.exe 35 PID 2748 wrote to memory of 2156 2748 vvjdj.exe 35 PID 2156 wrote to memory of 3012 2156 3htthh.exe 36 PID 2156 wrote to memory of 3012 2156 3htthh.exe 36 PID 2156 wrote to memory of 3012 2156 3htthh.exe 36 PID 2156 wrote to memory of 3012 2156 3htthh.exe 36 PID 3012 wrote to memory of 2684 3012 bntthn.exe 37 PID 3012 wrote to memory of 2684 3012 bntthn.exe 37 PID 3012 wrote to memory of 2684 3012 bntthn.exe 37 PID 3012 wrote to memory of 2684 3012 bntthn.exe 37 PID 2684 wrote to memory of 2668 2684 lfrxxxf.exe 38 PID 2684 wrote to memory of 2668 2684 lfrxxxf.exe 38 PID 2684 wrote to memory of 2668 2684 lfrxxxf.exe 38 PID 2684 wrote to memory of 2668 2684 lfrxxxf.exe 38 PID 2668 wrote to memory of 1804 2668 bnhtbb.exe 39 PID 2668 wrote to memory of 1804 2668 bnhtbb.exe 39 PID 2668 wrote to memory of 1804 2668 bnhtbb.exe 39 PID 2668 wrote to memory of 1804 2668 bnhtbb.exe 39 PID 1804 wrote to memory of 2624 1804 frrllxr.exe 40 PID 1804 wrote to memory of 2624 1804 frrllxr.exe 40 PID 1804 wrote to memory of 2624 1804 frrllxr.exe 40 PID 1804 wrote to memory of 2624 1804 frrllxr.exe 40 PID 2624 wrote to memory of 1492 2624 7hbttt.exe 41 PID 2624 wrote to memory of 1492 2624 7hbttt.exe 41 PID 2624 wrote to memory of 1492 2624 7hbttt.exe 41 PID 2624 wrote to memory of 1492 2624 7hbttt.exe 41 PID 1492 wrote to memory of 2744 1492 9nhnnh.exe 42 PID 1492 wrote to memory of 2744 1492 9nhnnh.exe 42 PID 1492 wrote to memory of 2744 1492 9nhnnh.exe 42 PID 1492 wrote to memory of 2744 1492 9nhnnh.exe 42 PID 2744 wrote to memory of 1336 2744 xlxxlll.exe 43 PID 2744 wrote to memory of 1336 2744 xlxxlll.exe 43 PID 2744 wrote to memory of 1336 2744 xlxxlll.exe 43 PID 2744 wrote to memory of 1336 2744 xlxxlll.exe 43 PID 1336 wrote to memory of 1792 1336 tnnbtb.exe 44 PID 1336 wrote to memory of 1792 1336 tnnbtb.exe 44 PID 1336 wrote to memory of 1792 1336 tnnbtb.exe 44 PID 1336 wrote to memory of 1792 1336 tnnbtb.exe 44 PID 1792 wrote to memory of 2968 1792 3pvjd.exe 45 PID 1792 wrote to memory of 2968 1792 3pvjd.exe 45 PID 1792 wrote to memory of 2968 1792 3pvjd.exe 45 PID 1792 wrote to memory of 2968 1792 3pvjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe"C:\Users\Admin\AppData\Local\Temp\b30935357a1ebe055920dae1ed851252d463ecf5a2853867f9bedc179bdc25ef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\9xlfllx.exec:\9xlfllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\5nhhhh.exec:\5nhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\5lxflff.exec:\5lxflff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\hbhbbh.exec:\hbhbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vvjdj.exec:\vvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\3htthh.exec:\3htthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\bntthn.exec:\bntthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bnhtbb.exec:\bnhtbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\frrllxr.exec:\frrllxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\7hbttt.exec:\7hbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\9nhnnh.exec:\9nhnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\xlxxlll.exec:\xlxxlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\tnnbtb.exec:\tnnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\3pvjd.exec:\3pvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\jjvjp.exec:\jjvjp.exe17⤵
- Executes dropped EXE
PID:2968 -
\??\c:\thtnbb.exec:\thtnbb.exe18⤵
- Executes dropped EXE
PID:1220 -
\??\c:\5djpp.exec:\5djpp.exe19⤵
- Executes dropped EXE
PID:1644 -
\??\c:\flxrrfl.exec:\flxrrfl.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nbbhhb.exec:\nbbhhb.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppjdp.exec:\ppjdp.exe22⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bbhnhn.exec:\bbhnhn.exe23⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9tnnhb.exec:\9tnnhb.exe24⤵
- Executes dropped EXE
PID:1140 -
\??\c:\frflfrl.exec:\frflfrl.exe25⤵
- Executes dropped EXE
PID:1152 -
\??\c:\tbnhbn.exec:\tbnhbn.exe26⤵
- Executes dropped EXE
PID:672 -
\??\c:\jvjjp.exec:\jvjjp.exe27⤵
- Executes dropped EXE
PID:1384 -
\??\c:\nhtbbn.exec:\nhtbbn.exe28⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\llxlllr.exec:\llxlllr.exe30⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ttthnb.exec:\ttthnb.exe31⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dpvdj.exec:\dpvdj.exe32⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3nnhnh.exec:\3nnhnh.exe33⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1bhbhb.exec:\1bhbhb.exe34⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjvdj.exec:\vjvdj.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\flfxffr.exec:\flfxffr.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\tbbhbb.exec:\tbbhbb.exe37⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nhnbnt.exec:\nhnbnt.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vpvpj.exec:\vpvpj.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\lxrlxfr.exec:\lxrlxfr.exe40⤵
- Executes dropped EXE
PID:3036 -
\??\c:\htnnnb.exec:\htnnnb.exe41⤵
- Executes dropped EXE
PID:2936 -
\??\c:\btbhbh.exec:\btbhbh.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7jvdp.exec:\7jvdp.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5frfxlx.exec:\5frfxlx.exe44⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tbnbnt.exec:\tbnbnt.exe45⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhthnt.exec:\nhthnt.exe46⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5pjvj.exec:\5pjvj.exe47⤵
- Executes dropped EXE
PID:576 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe48⤵
- Executes dropped EXE
PID:1240 -
\??\c:\xrlrrxl.exec:\xrlrrxl.exe49⤵
- Executes dropped EXE
PID:1168 -
\??\c:\htthbh.exec:\htthbh.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pvdpv.exec:\pvdpv.exe51⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5xrrxfr.exec:\5xrrxfr.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1lrfrxr.exec:\1lrfrxr.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\hhbnht.exec:\hhbnht.exe54⤵
- Executes dropped EXE
PID:332 -
\??\c:\9ppdp.exec:\9ppdp.exe55⤵
- Executes dropped EXE
PID:1356 -
\??\c:\jdvjp.exec:\jdvjp.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7lfxfxl.exec:\7lfxfxl.exe57⤵
- Executes dropped EXE
PID:864 -
\??\c:\lfllxxr.exec:\lfllxxr.exe58⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbnbnt.exec:\hbnbnt.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pvpjv.exec:\pvpjv.exe60⤵
- Executes dropped EXE
PID:2068 -
\??\c:\ppjjp.exec:\ppjjp.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\3xxfllr.exec:\3xxfllr.exe62⤵
- Executes dropped EXE
PID:2232 -
\??\c:\thtthh.exec:\thtthh.exe63⤵
- Executes dropped EXE
PID:1708 -
\??\c:\3htbnb.exec:\3htbnb.exe64⤵
- Executes dropped EXE
PID:404 -
\??\c:\dvjjp.exec:\dvjjp.exe65⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rfrxfxx.exec:\rfrxfxx.exe66⤵PID:1372
-
\??\c:\7btbbh.exec:\7btbbh.exe67⤵PID:1724
-
\??\c:\pjvjj.exec:\pjvjj.exe68⤵
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\5xfxrrx.exec:\5xfxrrx.exe69⤵PID:2168
-
\??\c:\rrlrlfl.exec:\rrlrlfl.exe70⤵PID:572
-
\??\c:\hhnbtt.exec:\hhnbtt.exe71⤵PID:1856
-
\??\c:\vppvj.exec:\vppvj.exe72⤵PID:2444
-
\??\c:\3xrxfff.exec:\3xrxfff.exe73⤵PID:1656
-
\??\c:\ntbhtt.exec:\ntbhtt.exe74⤵PID:2552
-
\??\c:\vpvvd.exec:\vpvvd.exe75⤵PID:1624
-
\??\c:\jvddp.exec:\jvddp.exe76⤵PID:2080
-
\??\c:\llflxxl.exec:\llflxxl.exe77⤵PID:2464
-
\??\c:\nhtnbt.exec:\nhtnbt.exe78⤵PID:2924
-
\??\c:\thbhnt.exec:\thbhnt.exe79⤵PID:2784
-
\??\c:\1pddj.exec:\1pddj.exe80⤵PID:3044
-
\??\c:\9rrrxxl.exec:\9rrrxxl.exe81⤵PID:2888
-
\??\c:\hhhntb.exec:\hhhntb.exe82⤵PID:2776
-
\??\c:\5pddj.exec:\5pddj.exe83⤵PID:2676
-
\??\c:\vjpvj.exec:\vjpvj.exe84⤵PID:2756
-
\??\c:\frfxffl.exec:\frfxffl.exe85⤵PID:2688
-
\??\c:\nbnnnn.exec:\nbnnnn.exe86⤵PID:2764
-
\??\c:\btnthh.exec:\btnthh.exe87⤵PID:2376
-
\??\c:\7jvpj.exec:\7jvpj.exe88⤵PID:1412
-
\??\c:\xxrflrr.exec:\xxrflrr.exe89⤵PID:1236
-
\??\c:\lrfllrr.exec:\lrfllrr.exe90⤵PID:1092
-
\??\c:\5htbnn.exec:\5htbnn.exe91⤵PID:696
-
\??\c:\vdjvj.exec:\vdjvj.exe92⤵PID:3008
-
\??\c:\lfrxxff.exec:\lfrxxff.exe93⤵PID:632
-
\??\c:\frlrffl.exec:\frlrffl.exe94⤵PID:1664
-
\??\c:\bthhnh.exec:\bthhnh.exe95⤵PID:888
-
\??\c:\hbtnnt.exec:\hbtnnt.exe96⤵PID:2968
-
\??\c:\pvvjd.exec:\pvvjd.exe97⤵PID:1948
-
\??\c:\fxxlrxf.exec:\fxxlrxf.exe98⤵PID:2148
-
\??\c:\7llxrfx.exec:\7llxrfx.exe99⤵PID:1300
-
\??\c:\nnthbb.exec:\nnthbb.exe100⤵PID:2128
-
\??\c:\jpvvp.exec:\jpvvp.exe101⤵PID:2072
-
\??\c:\jjdjp.exec:\jjdjp.exe102⤵PID:1864
-
\??\c:\nhhbht.exec:\nhhbht.exe103⤵PID:2432
-
\??\c:\9hnnnb.exec:\9hnnnb.exe104⤵PID:1652
-
\??\c:\vpjpd.exec:\vpjpd.exe105⤵PID:2288
-
\??\c:\rrxlllx.exec:\rrxlllx.exe106⤵PID:1944
-
\??\c:\5llfrrf.exec:\5llfrrf.exe107⤵PID:1364
-
\??\c:\bbbbhn.exec:\bbbbhn.exe108⤵PID:2144
-
\??\c:\pjddd.exec:\pjddd.exe109⤵PID:2132
-
\??\c:\rxxffll.exec:\rxxffll.exe110⤵PID:1724
-
\??\c:\1lrrxxf.exec:\1lrrxxf.exe111⤵PID:3052
-
\??\c:\9bnnbh.exec:\9bnnbh.exe112⤵PID:2168
-
\??\c:\djpjd.exec:\djpjd.exe113⤵PID:872
-
\??\c:\jddjv.exec:\jddjv.exe114⤵PID:2532
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe115⤵PID:3068
-
\??\c:\1tbtbb.exec:\1tbtbb.exe116⤵PID:1672
-
\??\c:\bhbnht.exec:\bhbnht.exe117⤵PID:2316
-
\??\c:\jdpdj.exec:\jdpdj.exe118⤵PID:2828
-
\??\c:\9rrllrf.exec:\9rrllrf.exe119⤵PID:1620
-
\??\c:\xrlrflx.exec:\xrlrflx.exe120⤵PID:2480
-
\??\c:\tbnbhh.exec:\tbnbhh.exe121⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-