Analysis
-
max time kernel
120s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe
-
Size
453KB
-
MD5
372f6f8aaabb6dd679f8f98c60440050
-
SHA1
3230f4dcdd9ccf744f8da0d8a2026896d035fee9
-
SHA256
1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9
-
SHA512
6b55f80dc81e35fe0067fe75ba67ff6003b63d3c9f3c1d29062cef904c9294a5465e12335c942e6d21148e2c9335b35a886bdcd60a68c37a2a89e1f3451ce59f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeC:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 59 IoCs
resource yara_rule behavioral1/memory/2916-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-36-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/768-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-66-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2792-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-126-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/828-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-138-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1848-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-145-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1848-149-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/464-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-204-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/944-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1520-250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-257-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2228-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-352-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-360-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-452-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2620-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-502-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1464-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-508-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2460-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-537-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1532-562-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-679-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2456-761-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1124-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1228-781-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1476-851-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2792-905-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2632-944-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1160-958-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2416 xrxrxll.exe 2996 9lrlxfx.exe 2500 vvppv.exe 768 vpjpv.exe 2296 rlrrxxl.exe 2792 7llxrrx.exe 2708 5pjpd.exe 2872 ddvvp.exe 2720 jdppp.exe 2592 ddvvj.exe 3040 fxrfffr.exe 828 rlrxffr.exe 612 hbbhbh.exe 1848 rrlrffx.exe 352 bbtbtb.exe 464 7tbhnt.exe 2488 dvvjv.exe 2888 hbntnb.exe 2668 dvjdj.exe 904 3vvvd.exe 292 xxrrflf.exe 944 3dvpv.exe 1740 tbhhnn.exe 1732 pvjjv.exe 1520 xrlrfrx.exe 2228 dpdjp.exe 1612 rlflxfx.exe 2464 lfflrfr.exe 3044 llfrrxr.exe 864 lfxfrxr.exe 2132 xxxfrxx.exe 2976 dpjpv.exe 1556 flfrlxx.exe 2996 bthbbb.exe 2288 ppjpj.exe 1272 rlflxlf.exe 1128 tnhnhn.exe 1044 pjvdp.exe 2780 jdppv.exe 2924 lrlxllf.exe 2920 nnhnhh.exe 2616 pdppv.exe 2756 9lxxffr.exe 2600 btbhtt.exe 3004 thnhtt.exe 2344 1jppv.exe 1616 rlfrxxf.exe 2268 7httbn.exe 1388 jpdpv.exe 1528 dpjdp.exe 1512 llflrxr.exe 1884 ntthhb.exe 1712 vddpd.exe 1072 lfxxxfr.exe 1184 htbttb.exe 2620 vjjdd.exe 2864 3fxlrfr.exe 2540 fxrfrfl.exe 1444 bhbnhn.exe 1316 pppdv.exe 1632 rrrrxlf.exe 1464 7nhntb.exe 2460 pppdv.exe 1740 xxlxlrr.exe -
resource yara_rule behavioral1/memory/2916-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/464-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-250-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2228-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-679-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1856-705-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1412-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-925-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-938-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3000-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7httbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2416 2916 1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe 30 PID 2916 wrote to memory of 2416 2916 1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe 30 PID 2916 wrote to memory of 2416 2916 1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe 30 PID 2916 wrote to memory of 2416 2916 1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe 30 PID 2416 wrote to memory of 2996 2416 xrxrxll.exe 31 PID 2416 wrote to memory of 2996 2416 xrxrxll.exe 31 PID 2416 wrote to memory of 2996 2416 xrxrxll.exe 31 PID 2416 wrote to memory of 2996 2416 xrxrxll.exe 31 PID 2996 wrote to memory of 2500 2996 9lrlxfx.exe 32 PID 2996 wrote to memory of 2500 2996 9lrlxfx.exe 32 PID 2996 wrote to memory of 2500 2996 9lrlxfx.exe 32 PID 2996 wrote to memory of 2500 2996 9lrlxfx.exe 32 PID 2500 wrote to memory of 768 2500 vvppv.exe 33 PID 2500 wrote to memory of 768 2500 vvppv.exe 33 PID 2500 wrote to memory of 768 2500 vvppv.exe 33 PID 2500 wrote to memory of 768 2500 vvppv.exe 33 PID 768 wrote to memory of 2296 768 vpjpv.exe 34 PID 768 wrote to memory of 2296 768 vpjpv.exe 34 PID 768 wrote to memory of 2296 768 vpjpv.exe 34 PID 768 wrote to memory of 2296 768 vpjpv.exe 34 PID 2296 wrote to memory of 2792 2296 rlrrxxl.exe 35 PID 2296 wrote to memory of 2792 2296 rlrrxxl.exe 35 PID 2296 wrote to memory of 2792 2296 rlrrxxl.exe 35 PID 2296 wrote to memory of 2792 2296 rlrrxxl.exe 35 PID 2792 wrote to memory of 2708 2792 7llxrrx.exe 36 PID 2792 wrote to memory of 2708 2792 7llxrrx.exe 36 PID 2792 wrote to memory of 2708 2792 7llxrrx.exe 36 PID 2792 wrote to memory of 2708 2792 7llxrrx.exe 36 PID 2708 wrote to memory of 2872 2708 5pjpd.exe 37 PID 2708 wrote to memory of 2872 2708 5pjpd.exe 37 PID 2708 wrote to memory of 2872 2708 5pjpd.exe 37 PID 2708 wrote to memory of 2872 2708 5pjpd.exe 37 PID 2872 wrote to memory of 2720 2872 ddvvp.exe 38 PID 2872 wrote to memory of 2720 2872 ddvvp.exe 38 PID 2872 wrote to memory of 2720 2872 ddvvp.exe 38 PID 2872 wrote to memory of 2720 2872 ddvvp.exe 38 PID 2720 wrote to memory of 2592 2720 jdppp.exe 39 PID 2720 wrote to memory of 2592 2720 jdppp.exe 39 PID 2720 wrote to memory of 2592 2720 jdppp.exe 39 PID 2720 wrote to memory of 2592 2720 jdppp.exe 39 PID 2592 wrote to memory of 3040 2592 ddvvj.exe 40 PID 2592 wrote to memory of 3040 2592 ddvvj.exe 40 PID 2592 wrote to memory of 3040 2592 ddvvj.exe 40 PID 2592 wrote to memory of 3040 2592 ddvvj.exe 40 PID 3040 wrote to memory of 828 3040 fxrfffr.exe 41 PID 3040 wrote to memory of 828 3040 fxrfffr.exe 41 PID 3040 wrote to memory of 828 3040 fxrfffr.exe 41 PID 3040 wrote to memory of 828 3040 fxrfffr.exe 41 PID 828 wrote to memory of 612 828 rlrxffr.exe 42 PID 828 wrote to memory of 612 828 rlrxffr.exe 42 PID 828 wrote to memory of 612 828 rlrxffr.exe 42 PID 828 wrote to memory of 612 828 rlrxffr.exe 42 PID 612 wrote to memory of 1848 612 hbbhbh.exe 43 PID 612 wrote to memory of 1848 612 hbbhbh.exe 43 PID 612 wrote to memory of 1848 612 hbbhbh.exe 43 PID 612 wrote to memory of 1848 612 hbbhbh.exe 43 PID 1848 wrote to memory of 352 1848 rrlrffx.exe 44 PID 1848 wrote to memory of 352 1848 rrlrffx.exe 44 PID 1848 wrote to memory of 352 1848 rrlrffx.exe 44 PID 1848 wrote to memory of 352 1848 rrlrffx.exe 44 PID 352 wrote to memory of 464 352 bbtbtb.exe 45 PID 352 wrote to memory of 464 352 bbtbtb.exe 45 PID 352 wrote to memory of 464 352 bbtbtb.exe 45 PID 352 wrote to memory of 464 352 bbtbtb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe"C:\Users\Admin\AppData\Local\Temp\1ffae2f8410d0f94bc2eac7b303df23c89f37f942863371acebe333085e535b9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\xrxrxll.exec:\xrxrxll.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\9lrlxfx.exec:\9lrlxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vvppv.exec:\vvppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\vpjpv.exec:\vpjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\7llxrrx.exec:\7llxrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\5pjpd.exec:\5pjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ddvvp.exec:\ddvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\jdppp.exec:\jdppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\ddvvj.exec:\ddvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\fxrfffr.exec:\fxrfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\rlrxffr.exec:\rlrxffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\hbbhbh.exec:\hbbhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\rrlrffx.exec:\rrlrffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\bbtbtb.exec:\bbtbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\7tbhnt.exec:\7tbhnt.exe17⤵
- Executes dropped EXE
PID:464 -
\??\c:\dvvjv.exec:\dvvjv.exe18⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbntnb.exec:\hbntnb.exe19⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvjdj.exec:\dvjdj.exe20⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3vvvd.exec:\3vvvd.exe21⤵
- Executes dropped EXE
PID:904 -
\??\c:\xxrrflf.exec:\xxrrflf.exe22⤵
- Executes dropped EXE
PID:292 -
\??\c:\3dvpv.exec:\3dvpv.exe23⤵
- Executes dropped EXE
PID:944 -
\??\c:\tbhhnn.exec:\tbhhnn.exe24⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pvjjv.exec:\pvjjv.exe25⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xrlrfrx.exec:\xrlrfrx.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dpdjp.exec:\dpdjp.exe27⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rlflxfx.exec:\rlflxfx.exe28⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lfflrfr.exec:\lfflrfr.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\llfrrxr.exec:\llfrrxr.exe30⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\xxxfrxx.exec:\xxxfrxx.exe32⤵
- Executes dropped EXE
PID:2132 -
\??\c:\dpjpv.exec:\dpjpv.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\flfrlxx.exec:\flfrlxx.exe34⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bthbbb.exec:\bthbbb.exe35⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ppjpj.exec:\ppjpj.exe36⤵
- Executes dropped EXE
PID:2288 -
\??\c:\rlflxlf.exec:\rlflxlf.exe37⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tnhnhn.exec:\tnhnhn.exe38⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pjvdp.exec:\pjvdp.exe39⤵
- Executes dropped EXE
PID:1044 -
\??\c:\jdppv.exec:\jdppv.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lrlxllf.exec:\lrlxllf.exe41⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nnhnhh.exec:\nnhnhh.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdppv.exec:\pdppv.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\9lxxffr.exec:\9lxxffr.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\btbhtt.exec:\btbhtt.exe45⤵
- Executes dropped EXE
PID:2600 -
\??\c:\thnhtt.exec:\thnhtt.exe46⤵
- Executes dropped EXE
PID:3004 -
\??\c:\1jppv.exec:\1jppv.exe47⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe48⤵
- Executes dropped EXE
PID:1616 -
\??\c:\7httbn.exec:\7httbn.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2268 -
\??\c:\jpdpv.exec:\jpdpv.exe50⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dpjdp.exec:\dpjdp.exe51⤵
- Executes dropped EXE
PID:1528 -
\??\c:\llflrxr.exec:\llflrxr.exe52⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ntthhb.exec:\ntthhb.exe53⤵
- Executes dropped EXE
PID:1884 -
\??\c:\vddpd.exec:\vddpd.exe54⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lfxxxfr.exec:\lfxxxfr.exe55⤵
- Executes dropped EXE
PID:1072 -
\??\c:\htbttb.exec:\htbttb.exe56⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vjjdd.exec:\vjjdd.exe57⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3fxlrfr.exec:\3fxlrfr.exe58⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxrfrfl.exec:\fxrfrfl.exe59⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bhbnhn.exec:\bhbnhn.exe60⤵
- Executes dropped EXE
PID:1444 -
\??\c:\pppdv.exec:\pppdv.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rrrrxlf.exec:\rrrrxlf.exe62⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7nhntb.exec:\7nhntb.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pppdv.exec:\pppdv.exe64⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xxlxlrr.exec:\xxlxlrr.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\tbthtb.exec:\tbthtb.exe66⤵PID:1396
-
\??\c:\7vvvj.exec:\7vvvj.exe67⤵PID:552
-
\??\c:\xxrfffr.exec:\xxrfffr.exe68⤵PID:284
-
\??\c:\hbhhtt.exec:\hbhhtt.exe69⤵PID:2440
-
\??\c:\nntnbh.exec:\nntnbh.exe70⤵PID:3048
-
\??\c:\djjvp.exec:\djjvp.exe71⤵PID:1532
-
\??\c:\xllxlrr.exec:\xllxlrr.exe72⤵PID:2036
-
\??\c:\hhhnnb.exec:\hhhnnb.exe73⤵PID:2184
-
\??\c:\tbnnht.exec:\tbnnht.exe74⤵PID:2260
-
\??\c:\ppjjd.exec:\ppjjd.exe75⤵PID:1504
-
\??\c:\1ffxlxl.exec:\1ffxlxl.exe76⤵PID:2988
-
\??\c:\hbthnb.exec:\hbthnb.exe77⤵PID:1704
-
\??\c:\pddjv.exec:\pddjv.exe78⤵PID:2168
-
\??\c:\7pjpv.exec:\7pjpv.exe79⤵PID:472
-
\??\c:\rrxlllx.exec:\rrxlllx.exe80⤵PID:2500
-
\??\c:\3htbth.exec:\3htbth.exe81⤵PID:2688
-
\??\c:\1dppp.exec:\1dppp.exe82⤵PID:2744
-
\??\c:\ppjvd.exec:\ppjvd.exe83⤵PID:2780
-
\??\c:\rlflrxl.exec:\rlflrxl.exe84⤵PID:2772
-
\??\c:\btbhnb.exec:\btbhnb.exe85⤵PID:2884
-
\??\c:\vdpvv.exec:\vdpvv.exe86⤵
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\lxrxlfx.exec:\lxrxlfx.exe87⤵PID:2328
-
\??\c:\5fxxrxf.exec:\5fxxrxf.exe88⤵PID:2704
-
\??\c:\bbbtth.exec:\bbbtth.exe89⤵PID:2992
-
\??\c:\vpjjp.exec:\vpjjp.exe90⤵PID:3012
-
\??\c:\lllxrrr.exec:\lllxrrr.exe91⤵PID:1472
-
\??\c:\bbnntb.exec:\bbnntb.exe92⤵PID:1944
-
\??\c:\jjdjv.exec:\jjdjv.exe93⤵PID:2140
-
\??\c:\7vvvd.exec:\7vvvd.exe94⤵PID:1856
-
\??\c:\fflxlrl.exec:\fflxlrl.exe95⤵PID:2396
-
\??\c:\btnbnh.exec:\btnbnh.exe96⤵PID:1884
-
\??\c:\jddvp.exec:\jddvp.exe97⤵PID:2384
-
\??\c:\3lfrflx.exec:\3lfrflx.exe98⤵PID:2368
-
\??\c:\pppdp.exec:\pppdp.exe99⤵PID:1412
-
\??\c:\3rxfrfr.exec:\3rxfrfr.exe100⤵PID:2424
-
\??\c:\xrfrfrr.exec:\xrfrfrr.exe101⤵PID:1816
-
\??\c:\bhhnbn.exec:\bhhnbn.exe102⤵PID:444
-
\??\c:\vdvpj.exec:\vdvpj.exe103⤵PID:2456
-
\??\c:\xxrxflx.exec:\xxrxflx.exe104⤵PID:1124
-
\??\c:\rxxrflx.exec:\rxxrflx.exe105⤵PID:292
-
\??\c:\hhbnbn.exec:\hhbnbn.exe106⤵PID:1228
-
\??\c:\djjpj.exec:\djjpj.exe107⤵PID:1724
-
\??\c:\ffffrfr.exec:\ffffrfr.exe108⤵PID:680
-
\??\c:\1bbnbh.exec:\1bbnbh.exe109⤵
- System Location Discovery: System Language Discovery
PID:620 -
\??\c:\1dvjd.exec:\1dvjd.exe110⤵PID:2224
-
\??\c:\xlflflf.exec:\xlflflf.exe111⤵PID:936
-
\??\c:\nnhnnt.exec:\nnhnnt.exe112⤵PID:1888
-
\??\c:\1nnbbh.exec:\1nnbbh.exe113⤵PID:2340
-
\??\c:\dpddd.exec:\dpddd.exe114⤵PID:1476
-
\??\c:\xffrfxr.exec:\xffrfxr.exe115⤵PID:1748
-
\??\c:\bbhtbb.exec:\bbhtbb.exe116⤵PID:2916
-
\??\c:\7vpdp.exec:\7vpdp.exe117⤵PID:2128
-
\??\c:\lllxrlx.exec:\lllxrlx.exe118⤵PID:3016
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe119⤵PID:1580
-
\??\c:\ttntnt.exec:\ttntnt.exe120⤵PID:1588
-
\??\c:\jjpvd.exec:\jjpvd.exe121⤵PID:2180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-