Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe
-
Size
454KB
-
MD5
fff8174ac6791aff7f1d0060ab0e9b80
-
SHA1
7810919cd2910614e9e5192a9d0f75f9c9e9b8a1
-
SHA256
771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6
-
SHA512
69b7f0bf2ea99749a93bfcf44d15ce15ed118f34d920ff418c357ad69e6b09bbcc1b48455fb31f68557c3a78f3a9007a8812dcd3de69f1565686d224a85e6348
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-63-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2672-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-120-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/772-110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2024-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-168-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-195-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1968-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-360-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2624-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-418-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-483-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-482-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-503-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-693-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2500-756-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-778-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1256-813-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-981-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-1016-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1956-1029-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2232-1094-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2752-1162-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 1lrrrxx.exe 2092 btntbb.exe 2124 pjjvp.exe 2784 1hhhtt.exe 2860 hthbbt.exe 2788 jdppv.exe 2944 frxflrx.exe 2672 1vddp.exe 1996 5pddp.exe 2252 lflrxfl.exe 772 bthbhh.exe 1412 9lllrxf.exe 2040 fxlrfxx.exe 2024 vvppp.exe 1916 xlrlxxf.exe 1612 thtbhh.exe 2728 7vjpd.exe 1988 xxxllfx.exe 3028 7fllxrf.exe 1944 9vjjj.exe 2224 9dvdd.exe 1544 lfxxllx.exe 1968 bbnnbb.exe 1512 dpjpv.exe 1728 9xrrllr.exe 1604 vpvpv.exe 2344 rlllrrx.exe 820 bbtbnt.exe 584 pjvjp.exe 2032 tthbhh.exe 2564 nbnnbn.exe 2400 1dppv.exe 2412 rflrflr.exe 1536 xrllxlx.exe 2536 hbhntt.exe 2736 hbtnnt.exe 2380 pjvjp.exe 2972 xlfffxx.exe 2780 xlxxrlr.exe 2888 htnthb.exe 1448 jvdvd.exe 2624 pjvpd.exe 2672 frflffl.exe 2676 xrllrrx.exe 2600 3htttt.exe 2252 9dpvd.exe 624 pdpvd.exe 2516 xxlrflx.exe 2836 5tbtbb.exe 1736 tbhnhh.exe 1992 1dppj.exe 2504 fxxrffl.exe 2840 rfrxlrf.exe 380 btnhth.exe 1208 vjvvd.exe 2916 jvpvv.exe 1584 frxxfff.exe 1956 tnbbhb.exe 2604 bnhbhb.exe 2200 9jppv.exe 1852 5lrllfr.exe 2996 nhtbhn.exe 1628 9hnntb.exe 2308 djpjj.exe -
resource yara_rule behavioral1/memory/2404-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-83-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2944-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-418-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2504-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-957-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-1017-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-1029-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2280-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-1068-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-1075-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-1175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2544 2404 771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe 30 PID 2404 wrote to memory of 2544 2404 771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe 30 PID 2404 wrote to memory of 2544 2404 771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe 30 PID 2404 wrote to memory of 2544 2404 771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe 30 PID 2544 wrote to memory of 2092 2544 1lrrrxx.exe 31 PID 2544 wrote to memory of 2092 2544 1lrrrxx.exe 31 PID 2544 wrote to memory of 2092 2544 1lrrrxx.exe 31 PID 2544 wrote to memory of 2092 2544 1lrrrxx.exe 31 PID 2092 wrote to memory of 2124 2092 btntbb.exe 32 PID 2092 wrote to memory of 2124 2092 btntbb.exe 32 PID 2092 wrote to memory of 2124 2092 btntbb.exe 32 PID 2092 wrote to memory of 2124 2092 btntbb.exe 32 PID 2124 wrote to memory of 2784 2124 pjjvp.exe 33 PID 2124 wrote to memory of 2784 2124 pjjvp.exe 33 PID 2124 wrote to memory of 2784 2124 pjjvp.exe 33 PID 2124 wrote to memory of 2784 2124 pjjvp.exe 33 PID 2784 wrote to memory of 2860 2784 1hhhtt.exe 34 PID 2784 wrote to memory of 2860 2784 1hhhtt.exe 34 PID 2784 wrote to memory of 2860 2784 1hhhtt.exe 34 PID 2784 wrote to memory of 2860 2784 1hhhtt.exe 34 PID 2860 wrote to memory of 2788 2860 hthbbt.exe 35 PID 2860 wrote to memory of 2788 2860 hthbbt.exe 35 PID 2860 wrote to memory of 2788 2860 hthbbt.exe 35 PID 2860 wrote to memory of 2788 2860 hthbbt.exe 35 PID 2788 wrote to memory of 2944 2788 jdppv.exe 36 PID 2788 wrote to memory of 2944 2788 jdppv.exe 36 PID 2788 wrote to memory of 2944 2788 jdppv.exe 36 PID 2788 wrote to memory of 2944 2788 jdppv.exe 36 PID 2944 wrote to memory of 2672 2944 frxflrx.exe 37 PID 2944 wrote to memory of 2672 2944 frxflrx.exe 37 PID 2944 wrote to memory of 2672 2944 frxflrx.exe 37 PID 2944 wrote to memory of 2672 2944 frxflrx.exe 37 PID 2672 wrote to memory of 1996 2672 1vddp.exe 38 PID 2672 wrote to memory of 1996 2672 1vddp.exe 38 PID 2672 wrote to memory of 1996 2672 1vddp.exe 38 PID 2672 wrote to memory of 1996 2672 1vddp.exe 38 PID 1996 wrote to memory of 2252 1996 5pddp.exe 39 PID 1996 wrote to memory of 2252 1996 5pddp.exe 39 PID 1996 wrote to memory of 2252 1996 5pddp.exe 39 PID 1996 wrote to memory of 2252 1996 5pddp.exe 39 PID 2252 wrote to memory of 772 2252 lflrxfl.exe 40 PID 2252 wrote to memory of 772 2252 lflrxfl.exe 40 PID 2252 wrote to memory of 772 2252 lflrxfl.exe 40 PID 2252 wrote to memory of 772 2252 lflrxfl.exe 40 PID 772 wrote to memory of 1412 772 bthbhh.exe 41 PID 772 wrote to memory of 1412 772 bthbhh.exe 41 PID 772 wrote to memory of 1412 772 bthbhh.exe 41 PID 772 wrote to memory of 1412 772 bthbhh.exe 41 PID 1412 wrote to memory of 2040 1412 9lllrxf.exe 42 PID 1412 wrote to memory of 2040 1412 9lllrxf.exe 42 PID 1412 wrote to memory of 2040 1412 9lllrxf.exe 42 PID 1412 wrote to memory of 2040 1412 9lllrxf.exe 42 PID 2040 wrote to memory of 2024 2040 fxlrfxx.exe 43 PID 2040 wrote to memory of 2024 2040 fxlrfxx.exe 43 PID 2040 wrote to memory of 2024 2040 fxlrfxx.exe 43 PID 2040 wrote to memory of 2024 2040 fxlrfxx.exe 43 PID 2024 wrote to memory of 1916 2024 vvppp.exe 44 PID 2024 wrote to memory of 1916 2024 vvppp.exe 44 PID 2024 wrote to memory of 1916 2024 vvppp.exe 44 PID 2024 wrote to memory of 1916 2024 vvppp.exe 44 PID 1916 wrote to memory of 1612 1916 xlrlxxf.exe 45 PID 1916 wrote to memory of 1612 1916 xlrlxxf.exe 45 PID 1916 wrote to memory of 1612 1916 xlrlxxf.exe 45 PID 1916 wrote to memory of 1612 1916 xlrlxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe"C:\Users\Admin\AppData\Local\Temp\771bbed5bc02a626fda50b0882a51ad808022524168fe48a8cd6223fb8c10ff6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\btntbb.exec:\btntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\pjjvp.exec:\pjjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\1hhhtt.exec:\1hhhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\hthbbt.exec:\hthbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jdppv.exec:\jdppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\frxflrx.exec:\frxflrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\1vddp.exec:\1vddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\5pddp.exec:\5pddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\lflrxfl.exec:\lflrxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\bthbhh.exec:\bthbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\9lllrxf.exec:\9lllrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\fxlrfxx.exec:\fxlrfxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\vvppp.exec:\vvppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xlrlxxf.exec:\xlrlxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\thtbhh.exec:\thtbhh.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\7vjpd.exec:\7vjpd.exe18⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xxxllfx.exec:\xxxllfx.exe19⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7fllxrf.exec:\7fllxrf.exe20⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9vjjj.exec:\9vjjj.exe21⤵
- Executes dropped EXE
PID:1944 -
\??\c:\9dvdd.exec:\9dvdd.exe22⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lfxxllx.exec:\lfxxllx.exe23⤵
- Executes dropped EXE
PID:1544 -
\??\c:\bbnnbb.exec:\bbnnbb.exe24⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dpjpv.exec:\dpjpv.exe25⤵
- Executes dropped EXE
PID:1512 -
\??\c:\9xrrllr.exec:\9xrrllr.exe26⤵
- Executes dropped EXE
PID:1728 -
\??\c:\vpvpv.exec:\vpvpv.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rlllrrx.exec:\rlllrrx.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbtbnt.exec:\bbtbnt.exe29⤵
- Executes dropped EXE
PID:820 -
\??\c:\pjvjp.exec:\pjvjp.exe30⤵
- Executes dropped EXE
PID:584 -
\??\c:\tthbhh.exec:\tthbhh.exe31⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nbnnbn.exec:\nbnnbn.exe32⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1dppv.exec:\1dppv.exe33⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rflrflr.exec:\rflrflr.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xrllxlx.exec:\xrllxlx.exe35⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbhntt.exec:\hbhntt.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\hbtnnt.exec:\hbtnnt.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pjvjp.exec:\pjvjp.exe38⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xlfffxx.exec:\xlfffxx.exe39⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xlxxrlr.exec:\xlxxrlr.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\htnthb.exec:\htnthb.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jvdvd.exec:\jvdvd.exe42⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pjvpd.exec:\pjvpd.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\frflffl.exec:\frflffl.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\xrllrrx.exec:\xrllrrx.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3htttt.exec:\3htttt.exe46⤵
- Executes dropped EXE
PID:2600 -
\??\c:\9dpvd.exec:\9dpvd.exe47⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pdpvd.exec:\pdpvd.exe48⤵
- Executes dropped EXE
PID:624 -
\??\c:\xxlrflx.exec:\xxlrflx.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5tbtbb.exec:\5tbtbb.exe50⤵
- Executes dropped EXE
PID:2836 -
\??\c:\tbhnhh.exec:\tbhnhh.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\1dppj.exec:\1dppj.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fxxrffl.exec:\fxxrffl.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe54⤵
- Executes dropped EXE
PID:2840 -
\??\c:\btnhth.exec:\btnhth.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\vjvvd.exec:\vjvvd.exe56⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jvpvv.exec:\jvpvv.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\frxxfff.exec:\frxxfff.exe58⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tnbbhb.exec:\tnbbhb.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bnhbhb.exec:\bnhbhb.exe60⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9jppv.exec:\9jppv.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\5lrllfr.exec:\5lrllfr.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nhtbhn.exec:\nhtbhn.exe63⤵
- Executes dropped EXE
PID:2996 -
\??\c:\9hnntb.exec:\9hnntb.exe64⤵
- Executes dropped EXE
PID:1628 -
\??\c:\djpjj.exec:\djpjj.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xlrlrrx.exec:\xlrlrrx.exe66⤵PID:840
-
\??\c:\frllrlr.exec:\frllrlr.exe67⤵PID:1868
-
\??\c:\ntbntt.exec:\ntbntt.exe68⤵PID:2188
-
\??\c:\bnbbhh.exec:\bnbbhh.exe69⤵PID:988
-
\??\c:\vjvvj.exec:\vjvvj.exe70⤵PID:3008
-
\??\c:\rlxfffl.exec:\rlxfffl.exe71⤵PID:1152
-
\??\c:\frrlxxx.exec:\frrlxxx.exe72⤵PID:2256
-
\??\c:\7htbbb.exec:\7htbbb.exe73⤵PID:2392
-
\??\c:\3jvvv.exec:\3jvvv.exe74⤵PID:532
-
\??\c:\5jvvj.exec:\5jvvj.exe75⤵PID:2572
-
\??\c:\rlrxlff.exec:\rlrxlff.exe76⤵PID:2404
-
\??\c:\nbnnhh.exec:\nbnnhh.exe77⤵PID:1532
-
\??\c:\dpdvd.exec:\dpdvd.exe78⤵PID:1540
-
\??\c:\pjvvv.exec:\pjvvv.exe79⤵PID:2092
-
\??\c:\3xllfff.exec:\3xllfff.exe80⤵PID:2084
-
\??\c:\tnbhtt.exec:\tnbhtt.exe81⤵PID:2756
-
\??\c:\nbhbhh.exec:\nbhbhh.exe82⤵PID:2512
-
\??\c:\vpdjj.exec:\vpdjj.exe83⤵PID:2900
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe84⤵PID:2652
-
\??\c:\9rfrrff.exec:\9rfrrff.exe85⤵PID:2952
-
\??\c:\thntbt.exec:\thntbt.exe86⤵PID:2832
-
\??\c:\dvjjj.exec:\dvjjj.exe87⤵PID:3056
-
\??\c:\pjvvd.exec:\pjvvd.exe88⤵PID:2684
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe89⤵PID:776
-
\??\c:\tnnthh.exec:\tnnthh.exe90⤵PID:3064
-
\??\c:\tnbhnt.exec:\tnbhnt.exe91⤵PID:1444
-
\??\c:\dvvvd.exec:\dvvvd.exe92⤵PID:1412
-
\??\c:\lrxxlfr.exec:\lrxxlfr.exe93⤵PID:2040
-
\??\c:\nbnthb.exec:\nbnthb.exe94⤵PID:1104
-
\??\c:\nbhhhh.exec:\nbhhhh.exe95⤵PID:1924
-
\??\c:\7pjpj.exec:\7pjpj.exe96⤵PID:2716
-
\??\c:\5xlfffx.exec:\5xlfffx.exe97⤵PID:1660
-
\??\c:\xlxxfxl.exec:\xlxxfxl.exe98⤵PID:2844
-
\??\c:\nhnhtt.exec:\nhnhtt.exe99⤵PID:1368
-
\??\c:\hthnnn.exec:\hthnnn.exe100⤵PID:2116
-
\??\c:\vjvvv.exec:\vjvvv.exe101⤵PID:3028
-
\??\c:\xlrxllr.exec:\xlrxllr.exe102⤵PID:2484
-
\??\c:\xlrrxrx.exec:\xlrrxrx.exe103⤵PID:2500
-
\??\c:\nbhbhb.exec:\nbhbhb.exe104⤵PID:2200
-
\??\c:\pjjpd.exec:\pjjpd.exe105⤵PID:2276
-
\??\c:\rrfllrx.exec:\rrfllrx.exe106⤵PID:2000
-
\??\c:\xxrfflr.exec:\xxrfflr.exe107⤵PID:1968
-
\??\c:\bnbtnt.exec:\bnbtnt.exe108⤵PID:2988
-
\??\c:\jpjdd.exec:\jpjdd.exe109⤵PID:1964
-
\??\c:\ppvdd.exec:\ppvdd.exe110⤵PID:1280
-
\??\c:\rflxfff.exec:\rflxfff.exe111⤵PID:2556
-
\??\c:\nhhhtn.exec:\nhhhtn.exe112⤵PID:1256
-
\??\c:\1nbbbh.exec:\1nbbbh.exe113⤵PID:2312
-
\??\c:\vjvdj.exec:\vjvdj.exe114⤵PID:632
-
\??\c:\xrxrxll.exec:\xrxrxll.exe115⤵PID:1440
-
\??\c:\1lrlrxf.exec:\1lrlrxf.exe116⤵PID:2320
-
\??\c:\btbhbt.exec:\btbhbt.exe117⤵PID:3016
-
\??\c:\bttttt.exec:\bttttt.exe118⤵PID:2368
-
\??\c:\dvddv.exec:\dvddv.exe119⤵PID:1528
-
\??\c:\rlrrrll.exec:\rlrrrll.exe120⤵PID:2560
-
\??\c:\7tbnnh.exec:\7tbnnh.exe121⤵PID:1532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-