Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe
-
Size
454KB
-
MD5
777e2fb3d9406a28d986e5438055a9c6
-
SHA1
d8abf12cbb2d35e6565fa47fc39db2faf25bf18f
-
SHA256
c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48
-
SHA512
665f29c6292d287067f73eb813d97f4081b118e4cd69ab1e0ff7d10c707b37698b7bd49d6e5f873a3aac029017262f9bb5c6a1f6564800442a40fc661f693b89
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/3004-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1700-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-408-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2044-451-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/824-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-464-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2096-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-695-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/944-764-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-804-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2224-855-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-881-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 bhbnbn.exe 2740 bbthhn.exe 2780 ttnbhn.exe 2768 pppvj.exe 2820 5nbhbt.exe 2532 xfxlxll.exe 2040 ttnthn.exe 2504 lfxllrl.exe 2868 bbbnht.exe 2972 xrfxffx.exe 2156 tntnbh.exe 2244 9xlxfrx.exe 864 nhbhnt.exe 1700 fllrfll.exe 2636 bnhbtb.exe 1048 lllxlrl.exe 1532 tttntt.exe 624 fxxxlrf.exe 1320 hbntnh.exe 2096 ffxrlxr.exe 112 hhttnb.exe 1980 xrlxflx.exe 1000 hhbhth.exe 2060 lrlfxlr.exe 2136 lfxxfrx.exe 376 lfflrxf.exe 1276 3hhnbh.exe 2008 7ffrrfr.exe 980 tbthhh.exe 688 rlxrflr.exe 2164 pvvjj.exe 2176 3fxflfx.exe 2744 bbbttt.exe 2684 1pvvp.exe 2692 9rrxflx.exe 2660 bbtbhb.exe 2712 1tnbhn.exe 2784 vppvj.exe 2820 flrxrfx.exe 2992 hbtbhh.exe 340 9vdpj.exe 1312 xxffxlx.exe 2880 hbnbbh.exe 3008 1hthhh.exe 3024 jjdpv.exe 2488 9lfrflx.exe 2020 1tnnbb.exe 2328 hhhnnh.exe 1256 vvjvd.exe 320 3lxlxfl.exe 1700 hnhhnt.exe 2628 5pjjv.exe 540 lxllrxl.exe 2044 hbbbhn.exe 824 1vdjp.exe 2004 xxrrflr.exe 624 ffflxfl.exe 1616 bhbtnt.exe 2096 dvpvd.exe 1348 3lrfrrf.exe 752 hhbhth.exe 2392 jdvpj.exe 1816 ffxfxlf.exe 2500 xxrfffr.exe -
resource yara_rule behavioral1/memory/2224-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-543-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-695-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/2832-700-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-881-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2224 3004 c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe 31 PID 3004 wrote to memory of 2224 3004 c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe 31 PID 3004 wrote to memory of 2224 3004 c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe 31 PID 3004 wrote to memory of 2224 3004 c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe 31 PID 2224 wrote to memory of 2740 2224 bhbnbn.exe 32 PID 2224 wrote to memory of 2740 2224 bhbnbn.exe 32 PID 2224 wrote to memory of 2740 2224 bhbnbn.exe 32 PID 2224 wrote to memory of 2740 2224 bhbnbn.exe 32 PID 2740 wrote to memory of 2780 2740 bbthhn.exe 33 PID 2740 wrote to memory of 2780 2740 bbthhn.exe 33 PID 2740 wrote to memory of 2780 2740 bbthhn.exe 33 PID 2740 wrote to memory of 2780 2740 bbthhn.exe 33 PID 2780 wrote to memory of 2768 2780 ttnbhn.exe 34 PID 2780 wrote to memory of 2768 2780 ttnbhn.exe 34 PID 2780 wrote to memory of 2768 2780 ttnbhn.exe 34 PID 2780 wrote to memory of 2768 2780 ttnbhn.exe 34 PID 2768 wrote to memory of 2820 2768 pppvj.exe 35 PID 2768 wrote to memory of 2820 2768 pppvj.exe 35 PID 2768 wrote to memory of 2820 2768 pppvj.exe 35 PID 2768 wrote to memory of 2820 2768 pppvj.exe 35 PID 2820 wrote to memory of 2532 2820 5nbhbt.exe 36 PID 2820 wrote to memory of 2532 2820 5nbhbt.exe 36 PID 2820 wrote to memory of 2532 2820 5nbhbt.exe 36 PID 2820 wrote to memory of 2532 2820 5nbhbt.exe 36 PID 2532 wrote to memory of 2040 2532 xfxlxll.exe 37 PID 2532 wrote to memory of 2040 2532 xfxlxll.exe 37 PID 2532 wrote to memory of 2040 2532 xfxlxll.exe 37 PID 2532 wrote to memory of 2040 2532 xfxlxll.exe 37 PID 2040 wrote to memory of 2504 2040 ttnthn.exe 38 PID 2040 wrote to memory of 2504 2040 ttnthn.exe 38 PID 2040 wrote to memory of 2504 2040 ttnthn.exe 38 PID 2040 wrote to memory of 2504 2040 ttnthn.exe 38 PID 2504 wrote to memory of 2868 2504 lfxllrl.exe 39 PID 2504 wrote to memory of 2868 2504 lfxllrl.exe 39 PID 2504 wrote to memory of 2868 2504 lfxllrl.exe 39 PID 2504 wrote to memory of 2868 2504 lfxllrl.exe 39 PID 2868 wrote to memory of 2972 2868 bbbnht.exe 40 PID 2868 wrote to memory of 2972 2868 bbbnht.exe 40 PID 2868 wrote to memory of 2972 2868 bbbnht.exe 40 PID 2868 wrote to memory of 2972 2868 bbbnht.exe 40 PID 2972 wrote to memory of 2156 2972 xrfxffx.exe 41 PID 2972 wrote to memory of 2156 2972 xrfxffx.exe 41 PID 2972 wrote to memory of 2156 2972 xrfxffx.exe 41 PID 2972 wrote to memory of 2156 2972 xrfxffx.exe 41 PID 2156 wrote to memory of 2244 2156 tntnbh.exe 42 PID 2156 wrote to memory of 2244 2156 tntnbh.exe 42 PID 2156 wrote to memory of 2244 2156 tntnbh.exe 42 PID 2156 wrote to memory of 2244 2156 tntnbh.exe 42 PID 2244 wrote to memory of 864 2244 9xlxfrx.exe 43 PID 2244 wrote to memory of 864 2244 9xlxfrx.exe 43 PID 2244 wrote to memory of 864 2244 9xlxfrx.exe 43 PID 2244 wrote to memory of 864 2244 9xlxfrx.exe 43 PID 864 wrote to memory of 1700 864 nhbhnt.exe 44 PID 864 wrote to memory of 1700 864 nhbhnt.exe 44 PID 864 wrote to memory of 1700 864 nhbhnt.exe 44 PID 864 wrote to memory of 1700 864 nhbhnt.exe 44 PID 1700 wrote to memory of 2636 1700 fllrfll.exe 45 PID 1700 wrote to memory of 2636 1700 fllrfll.exe 45 PID 1700 wrote to memory of 2636 1700 fllrfll.exe 45 PID 1700 wrote to memory of 2636 1700 fllrfll.exe 45 PID 2636 wrote to memory of 1048 2636 bnhbtb.exe 46 PID 2636 wrote to memory of 1048 2636 bnhbtb.exe 46 PID 2636 wrote to memory of 1048 2636 bnhbtb.exe 46 PID 2636 wrote to memory of 1048 2636 bnhbtb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe"C:\Users\Admin\AppData\Local\Temp\c5b8f7028f12b6e34bb206528e08643cbf502556c33f5c5be34b15f31b96dd48.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\bhbnbn.exec:\bhbnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\bbthhn.exec:\bbthhn.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ttnbhn.exec:\ttnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\pppvj.exec:\pppvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\5nbhbt.exec:\5nbhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\xfxlxll.exec:\xfxlxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ttnthn.exec:\ttnthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\lfxllrl.exec:\lfxllrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bbbnht.exec:\bbbnht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xrfxffx.exec:\xrfxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tntnbh.exec:\tntnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\9xlxfrx.exec:\9xlxfrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\nhbhnt.exec:\nhbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\fllrfll.exec:\fllrfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bnhbtb.exec:\bnhbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lllxlrl.exec:\lllxlrl.exe17⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tttntt.exec:\tttntt.exe18⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fxxxlrf.exec:\fxxxlrf.exe19⤵
- Executes dropped EXE
PID:624 -
\??\c:\hbntnh.exec:\hbntnh.exe20⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ffxrlxr.exec:\ffxrlxr.exe21⤵
- Executes dropped EXE
PID:2096 -
\??\c:\hhttnb.exec:\hhttnb.exe22⤵
- Executes dropped EXE
PID:112 -
\??\c:\xrlxflx.exec:\xrlxflx.exe23⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hhbhth.exec:\hhbhth.exe24⤵
- Executes dropped EXE
PID:1000 -
\??\c:\lrlfxlr.exec:\lrlfxlr.exe25⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lfxxfrx.exec:\lfxxfrx.exe26⤵
- Executes dropped EXE
PID:2136 -
\??\c:\lfflrxf.exec:\lfflrxf.exe27⤵
- Executes dropped EXE
PID:376 -
\??\c:\3hhnbh.exec:\3hhnbh.exe28⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7ffrrfr.exec:\7ffrrfr.exe29⤵
- Executes dropped EXE
PID:2008 -
\??\c:\tbthhh.exec:\tbthhh.exe30⤵
- Executes dropped EXE
PID:980 -
\??\c:\rlxrflr.exec:\rlxrflr.exe31⤵
- Executes dropped EXE
PID:688 -
\??\c:\pvvjj.exec:\pvvjj.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3fxflfx.exec:\3fxflfx.exe33⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bbbttt.exec:\bbbttt.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1pvvp.exec:\1pvvp.exe35⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9rrxflx.exec:\9rrxflx.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bbtbhb.exec:\bbtbhb.exe37⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1tnbhn.exec:\1tnbhn.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vppvj.exec:\vppvj.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\flrxrfx.exec:\flrxrfx.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hbtbhh.exec:\hbtbhh.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\9vdpj.exec:\9vdpj.exe42⤵
- Executes dropped EXE
PID:340 -
\??\c:\xxffxlx.exec:\xxffxlx.exe43⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hbnbbh.exec:\hbnbbh.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1hthhh.exec:\1hthhh.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jjdpv.exec:\jjdpv.exe46⤵
- Executes dropped EXE
PID:3024 -
\??\c:\9lfrflx.exec:\9lfrflx.exe47⤵
- Executes dropped EXE
PID:2488 -
\??\c:\1tnnbb.exec:\1tnnbb.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhhnnh.exec:\hhhnnh.exe49⤵
- Executes dropped EXE
PID:2328 -
\??\c:\vvjvd.exec:\vvjvd.exe50⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3lxlxfl.exec:\3lxlxfl.exe51⤵
- Executes dropped EXE
PID:320 -
\??\c:\hnhhnt.exec:\hnhhnt.exe52⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5pjjv.exec:\5pjjv.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\lxllrxl.exec:\lxllrxl.exe54⤵
- Executes dropped EXE
PID:540 -
\??\c:\hbbbhn.exec:\hbbbhn.exe55⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1vdjp.exec:\1vdjp.exe56⤵
- Executes dropped EXE
PID:824 -
\??\c:\xxrrflr.exec:\xxrrflr.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\ffflxfl.exec:\ffflxfl.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\bhbtnt.exec:\bhbtnt.exe59⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dvpvd.exec:\dvpvd.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\3lrfrrf.exec:\3lrfrrf.exe61⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hhbhth.exec:\hhbhth.exe62⤵
- Executes dropped EXE
PID:752 -
\??\c:\jdvpj.exec:\jdvpj.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\ffxfxlf.exec:\ffxfxlf.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xxrfffr.exec:\xxrfffr.exe65⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9tnnbh.exec:\9tnnbh.exe66⤵PID:1620
-
\??\c:\ddvvv.exec:\ddvvv.exe67⤵PID:608
-
\??\c:\xlffllr.exec:\xlffllr.exe68⤵PID:2616
-
\??\c:\bbtbth.exec:\bbtbth.exe69⤵PID:2116
-
\??\c:\nnthbh.exec:\nnthbh.exe70⤵PID:1988
-
\??\c:\7frrffl.exec:\7frrffl.exe71⤵PID:1804
-
\??\c:\lxrrxxl.exec:\lxrrxxl.exe72⤵PID:872
-
\??\c:\hbnnbb.exec:\hbnnbb.exe73⤵PID:2952
-
\??\c:\ddvdp.exec:\ddvdp.exe74⤵PID:2236
-
\??\c:\pddjv.exec:\pddjv.exe75⤵PID:1580
-
\??\c:\xxxfllx.exec:\xxxfllx.exe76⤵PID:2788
-
\??\c:\1hnhhn.exec:\1hnhhn.exe77⤵PID:2900
-
\??\c:\pjvpv.exec:\pjvpv.exe78⤵PID:2568
-
\??\c:\vpddj.exec:\vpddj.exe79⤵PID:2844
-
\??\c:\5lrxlxx.exec:\5lrxlxx.exe80⤵PID:2340
-
\??\c:\nnbbhb.exec:\nnbbhb.exe81⤵PID:2708
-
\??\c:\hbttbh.exec:\hbttbh.exe82⤵PID:2608
-
\??\c:\dvpvj.exec:\dvpvj.exe83⤵PID:2536
-
\??\c:\rrllxfr.exec:\rrllxfr.exe84⤵PID:588
-
\??\c:\5hhnbb.exec:\5hhnbb.exe85⤵PID:2864
-
\??\c:\ttthtb.exec:\ttthtb.exe86⤵PID:2968
-
\??\c:\5pjvv.exec:\5pjvv.exe87⤵PID:3012
-
\??\c:\fflflfx.exec:\fflflfx.exe88⤵PID:2624
-
\??\c:\bbnntb.exec:\bbnntb.exe89⤵PID:1324
-
\??\c:\3nnbnt.exec:\3nnbnt.exe90⤵PID:2156
-
\??\c:\dvvvj.exec:\dvvvj.exe91⤵PID:780
-
\??\c:\rrfrflx.exec:\rrfrflx.exe92⤵PID:1796
-
\??\c:\bbhhth.exec:\bbhhth.exe93⤵PID:2824
-
\??\c:\vpddj.exec:\vpddj.exe94⤵PID:2832
-
\??\c:\xrrxxfr.exec:\xrrxxfr.exe95⤵PID:1060
-
\??\c:\rlflrxl.exec:\rlflrxl.exe96⤵PID:1912
-
\??\c:\bbbnbh.exec:\bbbnbh.exe97⤵PID:900
-
\??\c:\pddjj.exec:\pddjj.exe98⤵PID:2756
-
\??\c:\ffffxlx.exec:\ffffxlx.exe99⤵PID:824
-
\??\c:\7xrxfxf.exec:\7xrxfxf.exe100⤵PID:1932
-
\??\c:\nhbbhh.exec:\nhbbhh.exe101⤵PID:2220
-
\??\c:\9dvjp.exec:\9dvjp.exe102⤵PID:2104
-
\??\c:\ffflflx.exec:\ffflflx.exe103⤵PID:944
-
\??\c:\nnnbtb.exec:\nnnbtb.exe104⤵PID:892
-
\??\c:\7vvpp.exec:\7vvpp.exe105⤵PID:828
-
\??\c:\ppdjj.exec:\ppdjj.exe106⤵PID:1000
-
\??\c:\xxfrflr.exec:\xxfrflr.exe107⤵PID:1696
-
\??\c:\hthnhn.exec:\hthnhn.exe108⤵PID:1712
-
\??\c:\lllllrf.exec:\lllllrf.exe109⤵PID:1716
-
\??\c:\nhttbb.exec:\nhttbb.exe110⤵PID:608
-
\??\c:\9nnthn.exec:\9nnthn.exe111⤵PID:284
-
\??\c:\dvdvd.exec:\dvdvd.exe112⤵PID:1276
-
\??\c:\rrlxxlx.exec:\rrlxxlx.exe113⤵PID:992
-
\??\c:\1thhtt.exec:\1thhtt.exe114⤵PID:1804
-
\??\c:\djdpj.exec:\djdpj.exe115⤵
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\rfrxffx.exec:\rfrxffx.exe116⤵PID:880
-
\??\c:\5thhbb.exec:\5thhbb.exe117⤵PID:2224
-
\??\c:\pdjdp.exec:\pdjdp.exe118⤵PID:2760
-
\??\c:\fllxlrl.exec:\fllxlrl.exe119⤵PID:2748
-
\??\c:\3nhhnn.exec:\3nhhnn.exe120⤵PID:2896
-
\??\c:\nnhnbt.exec:\nnhnbt.exe121⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-