Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 21:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe
-
Size
453KB
-
MD5
c8fd1fdc14b394376b7dede634435d90
-
SHA1
a743a4fb0c3e5a14c8a510230ba23d57b1eba5e9
-
SHA256
43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fd
-
SHA512
97e653392318e20b4c4e1a3c575d8c5d3374fa4146e20687fe8e75f90a65e3b44f52beccd81139edce7f3cc1463fd4fd182a80cf3d348d104604a75841e8c967
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2676-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1280-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-110-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2916-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1220-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-355-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1208-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-1188-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1232 hbttbt.exe 2768 xlfflrl.exe 2804 jjpvd.exe 2808 ffrxflf.exe 2844 btthbh.exe 2640 ttthnn.exe 1716 nnhhbh.exe 980 vpdjp.exe 2200 nhnttt.exe 1280 lxflxfr.exe 1676 5bhtnn.exe 2916 3btttn.exe 2964 lfrxllx.exe 2928 rlxfllx.exe 2452 7rrfrlf.exe 2860 3vjdv.exe 2320 xrlxrxr.exe 2060 vpjpv.exe 2104 xrxfflx.exe 1140 pjvpv.exe 2472 rrflllf.exe 1612 5vpjj.exe 1476 3fllflr.exe 860 bnbhnn.exe 1392 7lxxfrl.exe 1780 5btthn.exe 1028 ppppp.exe 2892 1nbhnt.exe 2032 hnhntb.exe 1828 hnhhtt.exe 1220 ttnthb.exe 316 fxrrxrx.exe 2784 nhnnbb.exe 1600 vvvvj.exe 2704 fxlrxxx.exe 2720 hnttbb.exe 2888 hhnthn.exe 2712 jdppv.exe 2568 fxfxrrx.exe 2632 1bbhhh.exe 2644 9djpp.exe 2612 rlllllx.exe 1716 xfxlxxx.exe 2016 btnbbh.exe 2168 dvpvd.exe 2664 xllfxrr.exe 2988 rrfxlrl.exe 2000 tnbhtt.exe 2960 9pjjd.exe 2744 rlxrxxl.exe 3020 lfrfllf.exe 2848 tnhntt.exe 324 vjpjv.exe 2452 7llrflr.exe 476 ffrrlfr.exe 1816 nbnnbh.exe 2164 pjjpp.exe 1148 dvjjd.exe 624 flllllx.exe 1692 3nhnnt.exe 1680 jdppv.exe 2984 dpvdj.exe 900 5lfxrxr.exe 1740 btnnbh.exe -
resource yara_rule behavioral1/memory/2676-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1220-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-1261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-1274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-1287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-1367-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2676 wrote to memory of 1232 2676 43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe 31 PID 2676 wrote to memory of 1232 2676 43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe 31 PID 2676 wrote to memory of 1232 2676 43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe 31 PID 2676 wrote to memory of 1232 2676 43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe 31 PID 1232 wrote to memory of 2768 1232 hbttbt.exe 32 PID 1232 wrote to memory of 2768 1232 hbttbt.exe 32 PID 1232 wrote to memory of 2768 1232 hbttbt.exe 32 PID 1232 wrote to memory of 2768 1232 hbttbt.exe 32 PID 2768 wrote to memory of 2804 2768 xlfflrl.exe 33 PID 2768 wrote to memory of 2804 2768 xlfflrl.exe 33 PID 2768 wrote to memory of 2804 2768 xlfflrl.exe 33 PID 2768 wrote to memory of 2804 2768 xlfflrl.exe 33 PID 2804 wrote to memory of 2808 2804 jjpvd.exe 34 PID 2804 wrote to memory of 2808 2804 jjpvd.exe 34 PID 2804 wrote to memory of 2808 2804 jjpvd.exe 34 PID 2804 wrote to memory of 2808 2804 jjpvd.exe 34 PID 2808 wrote to memory of 2844 2808 ffrxflf.exe 35 PID 2808 wrote to memory of 2844 2808 ffrxflf.exe 35 PID 2808 wrote to memory of 2844 2808 ffrxflf.exe 35 PID 2808 wrote to memory of 2844 2808 ffrxflf.exe 35 PID 2844 wrote to memory of 2640 2844 btthbh.exe 36 PID 2844 wrote to memory of 2640 2844 btthbh.exe 36 PID 2844 wrote to memory of 2640 2844 btthbh.exe 36 PID 2844 wrote to memory of 2640 2844 btthbh.exe 36 PID 2640 wrote to memory of 1716 2640 ttthnn.exe 37 PID 2640 wrote to memory of 1716 2640 ttthnn.exe 37 PID 2640 wrote to memory of 1716 2640 ttthnn.exe 37 PID 2640 wrote to memory of 1716 2640 ttthnn.exe 37 PID 1716 wrote to memory of 980 1716 nnhhbh.exe 38 PID 1716 wrote to memory of 980 1716 nnhhbh.exe 38 PID 1716 wrote to memory of 980 1716 nnhhbh.exe 38 PID 1716 wrote to memory of 980 1716 nnhhbh.exe 38 PID 980 wrote to memory of 2200 980 vpdjp.exe 39 PID 980 wrote to memory of 2200 980 vpdjp.exe 39 PID 980 wrote to memory of 2200 980 vpdjp.exe 39 PID 980 wrote to memory of 2200 980 vpdjp.exe 39 PID 2200 wrote to memory of 1280 2200 nhnttt.exe 40 PID 2200 wrote to memory of 1280 2200 nhnttt.exe 40 PID 2200 wrote to memory of 1280 2200 nhnttt.exe 40 PID 2200 wrote to memory of 1280 2200 nhnttt.exe 40 PID 1280 wrote to memory of 1676 1280 lxflxfr.exe 41 PID 1280 wrote to memory of 1676 1280 lxflxfr.exe 41 PID 1280 wrote to memory of 1676 1280 lxflxfr.exe 41 PID 1280 wrote to memory of 1676 1280 lxflxfr.exe 41 PID 1676 wrote to memory of 2916 1676 5bhtnn.exe 42 PID 1676 wrote to memory of 2916 1676 5bhtnn.exe 42 PID 1676 wrote to memory of 2916 1676 5bhtnn.exe 42 PID 1676 wrote to memory of 2916 1676 5bhtnn.exe 42 PID 2916 wrote to memory of 2964 2916 3btttn.exe 43 PID 2916 wrote to memory of 2964 2916 3btttn.exe 43 PID 2916 wrote to memory of 2964 2916 3btttn.exe 43 PID 2916 wrote to memory of 2964 2916 3btttn.exe 43 PID 2964 wrote to memory of 2928 2964 lfrxllx.exe 44 PID 2964 wrote to memory of 2928 2964 lfrxllx.exe 44 PID 2964 wrote to memory of 2928 2964 lfrxllx.exe 44 PID 2964 wrote to memory of 2928 2964 lfrxllx.exe 44 PID 2928 wrote to memory of 2452 2928 rlxfllx.exe 45 PID 2928 wrote to memory of 2452 2928 rlxfllx.exe 45 PID 2928 wrote to memory of 2452 2928 rlxfllx.exe 45 PID 2928 wrote to memory of 2452 2928 rlxfllx.exe 45 PID 2452 wrote to memory of 2860 2452 7rrfrlf.exe 46 PID 2452 wrote to memory of 2860 2452 7rrfrlf.exe 46 PID 2452 wrote to memory of 2860 2452 7rrfrlf.exe 46 PID 2452 wrote to memory of 2860 2452 7rrfrlf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe"C:\Users\Admin\AppData\Local\Temp\43489aadc91538ac011704eeb48fd2d4a6afd93ec09e3d7eff424cdfaba752fdN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hbttbt.exec:\hbttbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\xlfflrl.exec:\xlfflrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jjpvd.exec:\jjpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\ffrxflf.exec:\ffrxflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\btthbh.exec:\btthbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\ttthnn.exec:\ttthnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nnhhbh.exec:\nnhhbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\vpdjp.exec:\vpdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\nhnttt.exec:\nhnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\lxflxfr.exec:\lxflxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\5bhtnn.exec:\5bhtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3btttn.exec:\3btttn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\lfrxllx.exec:\lfrxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rlxfllx.exec:\rlxfllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\7rrfrlf.exec:\7rrfrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\3vjdv.exec:\3vjdv.exe17⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xrlxrxr.exec:\xrlxrxr.exe18⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vpjpv.exec:\vpjpv.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xrxfflx.exec:\xrxfflx.exe20⤵
- Executes dropped EXE
PID:2104 -
\??\c:\pjvpv.exec:\pjvpv.exe21⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rrflllf.exec:\rrflllf.exe22⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5vpjj.exec:\5vpjj.exe23⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3fllflr.exec:\3fllflr.exe24⤵
- Executes dropped EXE
PID:1476 -
\??\c:\bnbhnn.exec:\bnbhnn.exe25⤵
- Executes dropped EXE
PID:860 -
\??\c:\7lxxfrl.exec:\7lxxfrl.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\5btthn.exec:\5btthn.exe27⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ppppp.exec:\ppppp.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\1nbhnt.exec:\1nbhnt.exe29⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hnhntb.exec:\hnhntb.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hnhhtt.exec:\hnhhtt.exe31⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ttnthb.exec:\ttnthb.exe32⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe33⤵
- Executes dropped EXE
PID:316 -
\??\c:\nhnnbb.exec:\nhnnbb.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vvvvj.exec:\vvvvj.exe35⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hnttbb.exec:\hnttbb.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hhnthn.exec:\hhnthn.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdppv.exec:\jdppv.exe39⤵
- Executes dropped EXE
PID:2712 -
\??\c:\fxfxrrx.exec:\fxfxrrx.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\1bbhhh.exec:\1bbhhh.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9djpp.exec:\9djpp.exe42⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rlllllx.exec:\rlllllx.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xfxlxxx.exec:\xfxlxxx.exe44⤵
- Executes dropped EXE
PID:1716 -
\??\c:\btnbbh.exec:\btnbbh.exe45⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dvpvd.exec:\dvpvd.exe46⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xllfxrr.exec:\xllfxrr.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrfxlrl.exec:\rrfxlrl.exe48⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnbhtt.exec:\tnbhtt.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9pjjd.exec:\9pjjd.exe50⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe51⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lfrfllf.exec:\lfrfllf.exe52⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnhntt.exec:\tnhntt.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vjpjv.exec:\vjpjv.exe54⤵
- Executes dropped EXE
PID:324 -
\??\c:\7llrflr.exec:\7llrflr.exe55⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ffrrlfr.exec:\ffrrlfr.exe56⤵
- Executes dropped EXE
PID:476 -
\??\c:\nbnnbh.exec:\nbnnbh.exe57⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pjjpp.exec:\pjjpp.exe58⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dvjjd.exec:\dvjjd.exe59⤵
- Executes dropped EXE
PID:1148 -
\??\c:\flllllx.exec:\flllllx.exe60⤵
- Executes dropped EXE
PID:624 -
\??\c:\3nhnnt.exec:\3nhnnt.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jdppv.exec:\jdppv.exe62⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dpvdj.exec:\dpvdj.exe63⤵
- Executes dropped EXE
PID:2984 -
\??\c:\5lfxrxr.exec:\5lfxrxr.exe64⤵
- Executes dropped EXE
PID:900 -
\??\c:\btnnbh.exec:\btnnbh.exe65⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9btbtt.exec:\9btbtt.exe66⤵PID:2980
-
\??\c:\jjddj.exec:\jjddj.exe67⤵PID:1100
-
\??\c:\lfflfxl.exec:\lfflfxl.exe68⤵PID:2020
-
\??\c:\bbnnnh.exec:\bbnnnh.exe69⤵PID:2116
-
\??\c:\pjvdd.exec:\pjvdd.exe70⤵PID:1372
-
\??\c:\vpppv.exec:\vpppv.exe71⤵PID:1208
-
\??\c:\xxrxrxx.exec:\xxrxrxx.exe72⤵PID:2504
-
\??\c:\bhbbhn.exec:\bhbbhn.exe73⤵
- System Location Discovery: System Language Discovery
PID:3064 -
\??\c:\dpvvd.exec:\dpvvd.exe74⤵PID:1040
-
\??\c:\lfxrrrf.exec:\lfxrrrf.exe75⤵PID:2296
-
\??\c:\5rffllr.exec:\5rffllr.exe76⤵PID:1592
-
\??\c:\nhnbnh.exec:\nhnbnh.exe77⤵PID:2780
-
\??\c:\djvjp.exec:\djvjp.exe78⤵PID:1600
-
\??\c:\ppdjp.exec:\ppdjp.exe79⤵PID:2128
-
\??\c:\xlllrxf.exec:\xlllrxf.exe80⤵PID:2720
-
\??\c:\bhtbnn.exec:\bhtbnn.exe81⤵PID:2888
-
\??\c:\9jvvj.exec:\9jvvj.exe82⤵
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\dpjpj.exec:\dpjpj.exe83⤵PID:2788
-
\??\c:\frlllfl.exec:\frlllfl.exe84⤵PID:2632
-
\??\c:\tnbnhh.exec:\tnbnhh.exe85⤵PID:1656
-
\??\c:\nnbbhb.exec:\nnbbhb.exe86⤵PID:2256
-
\??\c:\vvjpd.exec:\vvjpd.exe87⤵PID:2324
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe88⤵PID:2284
-
\??\c:\nbtbnh.exec:\nbtbnh.exe89⤵PID:2220
-
\??\c:\nnbbtt.exec:\nnbbtt.exe90⤵PID:2428
-
\??\c:\jdvdj.exec:\jdvdj.exe91⤵PID:2932
-
\??\c:\1xlxxrr.exec:\1xlxxrr.exe92⤵PID:1096
-
\??\c:\rrxlflr.exec:\rrxlflr.exe93⤵PID:3012
-
\??\c:\tnhhnh.exec:\tnhhnh.exe94⤵PID:3016
-
\??\c:\pjpvd.exec:\pjpvd.exe95⤵PID:2796
-
\??\c:\lxrrllx.exec:\lxrrllx.exe96⤵PID:2292
-
\??\c:\7rffxfr.exec:\7rffxfr.exe97⤵PID:2708
-
\??\c:\tnhhnn.exec:\tnhhnn.exe98⤵PID:988
-
\??\c:\dpjpd.exec:\dpjpd.exe99⤵PID:2308
-
\??\c:\jdpvd.exec:\jdpvd.exe100⤵PID:668
-
\??\c:\1xrlllr.exec:\1xrlllr.exe101⤵PID:2184
-
\??\c:\nbnthb.exec:\nbnthb.exe102⤵PID:2064
-
\??\c:\7vjjv.exec:\7vjjv.exe103⤵PID:2432
-
\??\c:\jjvvp.exec:\jjvvp.exe104⤵PID:624
-
\??\c:\fxrxffr.exec:\fxrxffr.exe105⤵PID:604
-
\??\c:\5ttbnb.exec:\5ttbnb.exe106⤵PID:1612
-
\??\c:\jppjj.exec:\jppjj.exe107⤵PID:1672
-
\??\c:\vjdjd.exec:\vjdjd.exe108⤵PID:1388
-
\??\c:\3llrxfl.exec:\3llrxfl.exe109⤵PID:1736
-
\??\c:\5hhntn.exec:\5hhntn.exe110⤵PID:1724
-
\??\c:\bthhtt.exec:\bthhtt.exe111⤵PID:1780
-
\??\c:\5vvdd.exec:\5vvdd.exe112⤵PID:2312
-
\??\c:\llxxrrx.exec:\llxxrrx.exe113⤵PID:2236
-
\??\c:\bthnbb.exec:\bthnbb.exe114⤵PID:1516
-
\??\c:\5tnnbb.exec:\5tnnbb.exe115⤵PID:612
-
\??\c:\vjddj.exec:\vjddj.exe116⤵PID:1812
-
\??\c:\xlffffl.exec:\xlffffl.exe117⤵PID:3056
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe118⤵PID:880
-
\??\c:\tnbbhn.exec:\tnbbhn.exe119⤵PID:1496
-
\??\c:\vpdjp.exec:\vpdjp.exe120⤵PID:2676
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe121⤵PID:2120
-
\??\c:\5bnnbb.exec:\5bnnbb.exe122⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-