Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe
-
Size
453KB
-
MD5
a059592eb9eb934bbab27d28b0c27340
-
SHA1
b0eb78387e42db6c998c38ce1198546d4069fede
-
SHA256
13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30
-
SHA512
52873f0398fbbc5fc8f6c273191f922fed4cedfe4df2bc4b4d880a90cde77360a069e429e9b60aecabb61098e86a877b3033367bdd2530495b0a154a252be4e0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1904-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-33-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2788-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-68-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2996-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-227-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2444-248-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2368-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/356-267-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/356-265-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1828-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-482-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1576-497-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1112-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-572-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-791-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2572-850-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-869-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2996-917-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2912-938-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-952-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3032-984-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2028-992-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2028-1012-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-1055-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1740 5vjdd.exe 1680 rfxlxfr.exe 2560 5nhbbb.exe 2072 tnbntn.exe 2828 nhbthn.exe 2788 1jdvp.exe 2888 nhhnbh.exe 2996 fxllxrl.exe 1468 ttbbhn.exe 2668 djdpd.exe 1932 rrffffr.exe 2956 ddpdv.exe 2952 hbthnb.exe 2936 vpjjv.exe 3048 3rrrffx.exe 3032 bhhhbt.exe 2032 llfxfrf.exe 2036 djdpd.exe 2428 xxrxrrf.exe 2108 vpdjv.exe 632 dpjvp.exe 772 1flxflx.exe 1244 7djjv.exe 832 5fxxxfl.exe 1752 jdjpv.exe 2092 fllrxxl.exe 2444 9tnntb.exe 2368 hbntbh.exe 356 bbtbhh.exe 1820 ddjjd.exe 1828 rrxlrlr.exe 2372 7pjpp.exe 2608 tnhhtt.exe 1680 vjppp.exe 1648 xrlrxfl.exe 316 bnbhtb.exe 2508 7nhntt.exe 2836 jdpdp.exe 2784 xlxlxrl.exe 2832 5btbbb.exe 2920 7nbhnh.exe 2916 9jppv.exe 3056 rfflxrf.exe 2640 frfrxxf.exe 2684 htttbn.exe 2200 1vppd.exe 1848 djjdp.exe 1568 xrxxxxf.exe 1408 bbtbnb.exe 2876 pdvdj.exe 2932 vpdjj.exe 3008 3ffflxl.exe 3032 hnnntt.exe 2024 dvjdv.exe 1464 vvpjp.exe 1744 lxllrrf.exe 2112 thhhnt.exe 1796 vjvvd.exe 620 dvvdd.exe 2448 rlxxflx.exe 1124 9tnnnt.exe 1576 vvvdj.exe 2268 9ddpd.exe 2824 9llrffr.exe -
resource yara_rule behavioral1/memory/1904-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-33-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2788-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-90-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1932-109-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2956-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-265-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1828-283-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2608-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-791-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/844-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-938-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2936-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-1169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-1266-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1788-1304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-1341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-1366-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1740 1904 13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe 30 PID 1904 wrote to memory of 1740 1904 13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe 30 PID 1904 wrote to memory of 1740 1904 13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe 30 PID 1904 wrote to memory of 1740 1904 13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe 30 PID 1740 wrote to memory of 1680 1740 5vjdd.exe 31 PID 1740 wrote to memory of 1680 1740 5vjdd.exe 31 PID 1740 wrote to memory of 1680 1740 5vjdd.exe 31 PID 1740 wrote to memory of 1680 1740 5vjdd.exe 31 PID 1680 wrote to memory of 2560 1680 rfxlxfr.exe 32 PID 1680 wrote to memory of 2560 1680 rfxlxfr.exe 32 PID 1680 wrote to memory of 2560 1680 rfxlxfr.exe 32 PID 1680 wrote to memory of 2560 1680 rfxlxfr.exe 32 PID 2560 wrote to memory of 2072 2560 5nhbbb.exe 33 PID 2560 wrote to memory of 2072 2560 5nhbbb.exe 33 PID 2560 wrote to memory of 2072 2560 5nhbbb.exe 33 PID 2560 wrote to memory of 2072 2560 5nhbbb.exe 33 PID 2072 wrote to memory of 2828 2072 tnbntn.exe 34 PID 2072 wrote to memory of 2828 2072 tnbntn.exe 34 PID 2072 wrote to memory of 2828 2072 tnbntn.exe 34 PID 2072 wrote to memory of 2828 2072 tnbntn.exe 34 PID 2828 wrote to memory of 2788 2828 nhbthn.exe 35 PID 2828 wrote to memory of 2788 2828 nhbthn.exe 35 PID 2828 wrote to memory of 2788 2828 nhbthn.exe 35 PID 2828 wrote to memory of 2788 2828 nhbthn.exe 35 PID 2788 wrote to memory of 2888 2788 1jdvp.exe 36 PID 2788 wrote to memory of 2888 2788 1jdvp.exe 36 PID 2788 wrote to memory of 2888 2788 1jdvp.exe 36 PID 2788 wrote to memory of 2888 2788 1jdvp.exe 36 PID 2888 wrote to memory of 2996 2888 nhhnbh.exe 37 PID 2888 wrote to memory of 2996 2888 nhhnbh.exe 37 PID 2888 wrote to memory of 2996 2888 nhhnbh.exe 37 PID 2888 wrote to memory of 2996 2888 nhhnbh.exe 37 PID 2996 wrote to memory of 1468 2996 fxllxrl.exe 38 PID 2996 wrote to memory of 1468 2996 fxllxrl.exe 38 PID 2996 wrote to memory of 1468 2996 fxllxrl.exe 38 PID 2996 wrote to memory of 1468 2996 fxllxrl.exe 38 PID 1468 wrote to memory of 2668 1468 ttbbhn.exe 39 PID 1468 wrote to memory of 2668 1468 ttbbhn.exe 39 PID 1468 wrote to memory of 2668 1468 ttbbhn.exe 39 PID 1468 wrote to memory of 2668 1468 ttbbhn.exe 39 PID 2668 wrote to memory of 1932 2668 djdpd.exe 40 PID 2668 wrote to memory of 1932 2668 djdpd.exe 40 PID 2668 wrote to memory of 1932 2668 djdpd.exe 40 PID 2668 wrote to memory of 1932 2668 djdpd.exe 40 PID 1932 wrote to memory of 2956 1932 rrffffr.exe 41 PID 1932 wrote to memory of 2956 1932 rrffffr.exe 41 PID 1932 wrote to memory of 2956 1932 rrffffr.exe 41 PID 1932 wrote to memory of 2956 1932 rrffffr.exe 41 PID 2956 wrote to memory of 2952 2956 ddpdv.exe 42 PID 2956 wrote to memory of 2952 2956 ddpdv.exe 42 PID 2956 wrote to memory of 2952 2956 ddpdv.exe 42 PID 2956 wrote to memory of 2952 2956 ddpdv.exe 42 PID 2952 wrote to memory of 2936 2952 hbthnb.exe 43 PID 2952 wrote to memory of 2936 2952 hbthnb.exe 43 PID 2952 wrote to memory of 2936 2952 hbthnb.exe 43 PID 2952 wrote to memory of 2936 2952 hbthnb.exe 43 PID 2936 wrote to memory of 3048 2936 vpjjv.exe 44 PID 2936 wrote to memory of 3048 2936 vpjjv.exe 44 PID 2936 wrote to memory of 3048 2936 vpjjv.exe 44 PID 2936 wrote to memory of 3048 2936 vpjjv.exe 44 PID 3048 wrote to memory of 3032 3048 3rrrffx.exe 45 PID 3048 wrote to memory of 3032 3048 3rrrffx.exe 45 PID 3048 wrote to memory of 3032 3048 3rrrffx.exe 45 PID 3048 wrote to memory of 3032 3048 3rrrffx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe"C:\Users\Admin\AppData\Local\Temp\13deab242096f3c84a87add89e062ffd44e2a07076b38b4efcd3ce8b51b0fa30N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\5vjdd.exec:\5vjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\rfxlxfr.exec:\rfxlxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\5nhbbb.exec:\5nhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\tnbntn.exec:\tnbntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nhbthn.exec:\nhbthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1jdvp.exec:\1jdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nhhnbh.exec:\nhhnbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxllxrl.exec:\fxllxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\ttbbhn.exec:\ttbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\djdpd.exec:\djdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rrffffr.exec:\rrffffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\ddpdv.exec:\ddpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\hbthnb.exec:\hbthnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\vpjjv.exec:\vpjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\3rrrffx.exec:\3rrrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\bhhhbt.exec:\bhhhbt.exe17⤵
- Executes dropped EXE
PID:3032 -
\??\c:\llfxfrf.exec:\llfxfrf.exe18⤵
- Executes dropped EXE
PID:2032 -
\??\c:\djdpd.exec:\djdpd.exe19⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xxrxrrf.exec:\xxrxrrf.exe20⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vpdjv.exec:\vpdjv.exe21⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dpjvp.exec:\dpjvp.exe22⤵
- Executes dropped EXE
PID:632 -
\??\c:\1flxflx.exec:\1flxflx.exe23⤵
- Executes dropped EXE
PID:772 -
\??\c:\7djjv.exec:\7djjv.exe24⤵
- Executes dropped EXE
PID:1244 -
\??\c:\5fxxxfl.exec:\5fxxxfl.exe25⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdjpv.exec:\jdjpv.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\fllrxxl.exec:\fllrxxl.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9tnntb.exec:\9tnntb.exe28⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hbntbh.exec:\hbntbh.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bbtbhh.exec:\bbtbhh.exe30⤵
- Executes dropped EXE
PID:356 -
\??\c:\ddjjd.exec:\ddjjd.exe31⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rrxlrlr.exec:\rrxlrlr.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7pjpp.exec:\7pjpp.exe33⤵
- Executes dropped EXE
PID:2372 -
\??\c:\tnhhtt.exec:\tnhhtt.exe34⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vjppp.exec:\vjppp.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe36⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bnbhtb.exec:\bnbhtb.exe37⤵
- Executes dropped EXE
PID:316 -
\??\c:\7nhntt.exec:\7nhntt.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jdpdp.exec:\jdpdp.exe39⤵
- Executes dropped EXE
PID:2836 -
\??\c:\xlxlxrl.exec:\xlxlxrl.exe40⤵
- Executes dropped EXE
PID:2784 -
\??\c:\5btbbb.exec:\5btbbb.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832 -
\??\c:\7nbhnh.exec:\7nbhnh.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\9jppv.exec:\9jppv.exe43⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rfflxrf.exec:\rfflxrf.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\frfrxxf.exec:\frfrxxf.exe45⤵
- Executes dropped EXE
PID:2640 -
\??\c:\htttbn.exec:\htttbn.exe46⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1vppd.exec:\1vppd.exe47⤵
- Executes dropped EXE
PID:2200 -
\??\c:\djjdp.exec:\djjdp.exe48⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe49⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bbtbnb.exec:\bbtbnb.exe50⤵
- Executes dropped EXE
PID:1408 -
\??\c:\pdvdj.exec:\pdvdj.exe51⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vpdjj.exec:\vpdjj.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3ffflxl.exec:\3ffflxl.exe53⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hnnntt.exec:\hnnntt.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dvjdv.exec:\dvjdv.exe55⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vvpjp.exec:\vvpjp.exe56⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lxllrrf.exec:\lxllrrf.exe57⤵
- Executes dropped EXE
PID:1744 -
\??\c:\thhhnt.exec:\thhhnt.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vjvvd.exec:\vjvvd.exe59⤵
- Executes dropped EXE
PID:1796 -
\??\c:\dvvdd.exec:\dvvdd.exe60⤵
- Executes dropped EXE
PID:620 -
\??\c:\rlxxflx.exec:\rlxxflx.exe61⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9tnnnt.exec:\9tnnnt.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vvvdj.exec:\vvvdj.exe63⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9ddpd.exec:\9ddpd.exe64⤵
- Executes dropped EXE
PID:2268 -
\??\c:\9llrffr.exec:\9llrffr.exe65⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ttntnn.exec:\ttntnn.exe66⤵PID:900
-
\??\c:\7pjjp.exec:\7pjjp.exe67⤵PID:2480
-
\??\c:\jjjdj.exec:\jjjdj.exe68⤵PID:2304
-
\??\c:\5xxrfrf.exec:\5xxrfrf.exe69⤵PID:2308
-
\??\c:\3nnnnh.exec:\3nnnnh.exe70⤵PID:568
-
\??\c:\thhnth.exec:\thhnth.exe71⤵PID:2600
-
\??\c:\jjvvv.exec:\jjvvv.exe72⤵PID:1112
-
\??\c:\ppvvp.exec:\ppvvp.exe73⤵PID:1600
-
\??\c:\llrllrx.exec:\llrllrx.exe74⤵PID:2296
-
\??\c:\btnbhn.exec:\btnbhn.exe75⤵PID:352
-
\??\c:\jpdjp.exec:\jpdjp.exe76⤵PID:1216
-
\??\c:\7vpjp.exec:\7vpjp.exe77⤵PID:1148
-
\??\c:\7lfxllx.exec:\7lfxllx.exe78⤵PID:1532
-
\??\c:\7httbh.exec:\7httbh.exe79⤵PID:1648
-
\??\c:\bbtthn.exec:\bbtthn.exe80⤵PID:2552
-
\??\c:\jjvjd.exec:\jjvjd.exe81⤵PID:2148
-
\??\c:\llfxlxl.exec:\llfxlxl.exe82⤵PID:2864
-
\??\c:\lxflxxl.exec:\lxflxxl.exe83⤵PID:2772
-
\??\c:\tnhhtn.exec:\tnhhtn.exe84⤵PID:2752
-
\??\c:\jjjjv.exec:\jjjjv.exe85⤵PID:2360
-
\??\c:\xxrxllx.exec:\xxrxllx.exe86⤵PID:2776
-
\??\c:\ffflrrx.exec:\ffflrrx.exe87⤵PID:2908
-
\??\c:\nbtntb.exec:\nbtntb.exe88⤵PID:2652
-
\??\c:\vddpp.exec:\vddpp.exe89⤵PID:2668
-
\??\c:\1ddjv.exec:\1ddjv.exe90⤵PID:2536
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe91⤵PID:668
-
\??\c:\xlflrxf.exec:\xlflrxf.exe92⤵PID:1908
-
\??\c:\btnthh.exec:\btnthh.exe93⤵PID:3044
-
\??\c:\pppdp.exec:\pppdp.exe94⤵PID:2964
-
\??\c:\pvdvv.exec:\pvdvv.exe95⤵PID:2936
-
\??\c:\rxrfxfl.exec:\rxrfxfl.exe96⤵PID:2968
-
\??\c:\tnhntn.exec:\tnhntn.exe97⤵PID:3000
-
\??\c:\bbnbnt.exec:\bbnbnt.exe98⤵PID:2016
-
\??\c:\jvpvj.exec:\jvpvj.exe99⤵PID:2704
-
\??\c:\frfflrx.exec:\frfflrx.exe100⤵PID:1452
-
\??\c:\xrrfxfx.exec:\xrrfxfx.exe101⤵
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\hnnnnt.exec:\hnnnnt.exe102⤵PID:808
-
\??\c:\jvpvv.exec:\jvpvv.exe103⤵PID:696
-
\??\c:\jdvvj.exec:\jdvvj.exe104⤵PID:332
-
\??\c:\fxfffrf.exec:\fxfffrf.exe105⤵PID:264
-
\??\c:\9tnhnn.exec:\9tnhnn.exe106⤵PID:2448
-
\??\c:\nbttbb.exec:\nbttbb.exe107⤵PID:1516
-
\??\c:\1pppv.exec:\1pppv.exe108⤵PID:832
-
\??\c:\3rxrrrx.exec:\3rxrrrx.exe109⤵PID:348
-
\??\c:\lfrxffr.exec:\lfrxffr.exe110⤵PID:1856
-
\??\c:\nnbhnn.exec:\nnbhnn.exe111⤵PID:1276
-
\??\c:\dpdvv.exec:\dpdvv.exe112⤵
- System Location Discovery: System Language Discovery
PID:2056 -
\??\c:\jjdpd.exec:\jjdpd.exe113⤵PID:2288
-
\??\c:\5rlfllr.exec:\5rlfllr.exe114⤵PID:280
-
\??\c:\bnbbnh.exec:\bnbbnh.exe115⤵PID:2152
-
\??\c:\nnhnbh.exec:\nnhnbh.exe116⤵PID:2472
-
\??\c:\9ddjj.exec:\9ddjj.exe117⤵PID:844
-
\??\c:\9fxffll.exec:\9fxffll.exe118⤵PID:2400
-
\??\c:\3rrffxx.exec:\3rrffxx.exe119⤵PID:1952
-
\??\c:\nnhhtt.exec:\nnhhtt.exe120⤵PID:1556
-
\??\c:\dvpvp.exec:\dvpvp.exe121⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-