Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe
-
Size
453KB
-
MD5
a22c5c169451666606e982783cc49800
-
SHA1
54abeaed1f7f2814f8f422e44a02ecbc1b127afe
-
SHA256
27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76
-
SHA512
9002653850b8728437b1ef89c6afd7f0b5b14a15f4a5241bf07c5f296be066a7a68202128926fafcfc98b9231019a238b1afdfb77a744c6917eda7fa030c4234
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2360-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-346-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1252-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/548-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1928-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-200-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1156-190-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2092-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-22-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/796-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-871-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2184-883-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2212-1241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 796 xrflxxf.exe 2488 ttbbhb.exe 2112 pdpvj.exe 2676 3xlllrx.exe 2832 bthntt.exe 2716 dvppv.exe 2732 fxlrfrl.exe 1708 lfxxflx.exe 2572 nhbbhb.exe 1512 pvjpd.exe 2616 rrflxfl.exe 820 9bbntt.exe 2956 vjvpp.exe 2800 fllrlrf.exe 2092 tnttbh.exe 2376 nhtttb.exe 2004 dpvjp.exe 1760 fxrfllf.exe 2952 lfxflrf.exe 1156 hhbntb.exe 2384 nhntbh.exe 408 bthbhb.exe 1928 5dpjj.exe 1860 dvjdp.exe 1636 xrffllx.exe 1052 rfxfrrf.exe 760 5jpjd.exe 1780 vvvdj.exe 568 frllxfl.exe 356 nhbbhh.exe 3040 htbhhh.exe 2268 jvppd.exe 2208 1frxxrx.exe 1692 3lxxxlr.exe 2416 hhhthh.exe 2112 vjvdp.exe 1152 rlxxllx.exe 2884 hbhhnn.exe 2120 1jppp.exe 2600 7djdd.exe 2744 1llllrr.exe 2584 3tnbhn.exe 2620 bntnbb.exe 1252 jdppd.exe 2840 5dppp.exe 548 9lfrxff.exe 820 1rrrxxf.exe 2816 tthntb.exe 536 5tbtnh.exe 1972 ppjpd.exe 1992 5frrrll.exe 2760 1lrrrrr.exe 2640 nhtthh.exe 2412 nhbhtt.exe 2536 vppjv.exe 2168 7vdpv.exe 2876 xrxxxxf.exe 2384 tnbhnh.exe 2968 hbhhtt.exe 316 pdppd.exe 1284 pjvjp.exe 2136 xflrrfl.exe 740 1tnnbb.exe 300 9dvdj.exe -
resource yara_rule behavioral1/memory/2360-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-871-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2184-883-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2896-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-1092-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-1198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-1241-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2360 wrote to memory of 796 2360 27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe 31 PID 2360 wrote to memory of 796 2360 27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe 31 PID 2360 wrote to memory of 796 2360 27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe 31 PID 2360 wrote to memory of 796 2360 27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe 31 PID 796 wrote to memory of 2488 796 xrflxxf.exe 32 PID 796 wrote to memory of 2488 796 xrflxxf.exe 32 PID 796 wrote to memory of 2488 796 xrflxxf.exe 32 PID 796 wrote to memory of 2488 796 xrflxxf.exe 32 PID 2488 wrote to memory of 2112 2488 ttbbhb.exe 33 PID 2488 wrote to memory of 2112 2488 ttbbhb.exe 33 PID 2488 wrote to memory of 2112 2488 ttbbhb.exe 33 PID 2488 wrote to memory of 2112 2488 ttbbhb.exe 33 PID 2112 wrote to memory of 2676 2112 pdpvj.exe 34 PID 2112 wrote to memory of 2676 2112 pdpvj.exe 34 PID 2112 wrote to memory of 2676 2112 pdpvj.exe 34 PID 2112 wrote to memory of 2676 2112 pdpvj.exe 34 PID 2676 wrote to memory of 2832 2676 3xlllrx.exe 35 PID 2676 wrote to memory of 2832 2676 3xlllrx.exe 35 PID 2676 wrote to memory of 2832 2676 3xlllrx.exe 35 PID 2676 wrote to memory of 2832 2676 3xlllrx.exe 35 PID 2832 wrote to memory of 2716 2832 bthntt.exe 36 PID 2832 wrote to memory of 2716 2832 bthntt.exe 36 PID 2832 wrote to memory of 2716 2832 bthntt.exe 36 PID 2832 wrote to memory of 2716 2832 bthntt.exe 36 PID 2716 wrote to memory of 2732 2716 dvppv.exe 37 PID 2716 wrote to memory of 2732 2716 dvppv.exe 37 PID 2716 wrote to memory of 2732 2716 dvppv.exe 37 PID 2716 wrote to memory of 2732 2716 dvppv.exe 37 PID 2732 wrote to memory of 1708 2732 fxlrfrl.exe 38 PID 2732 wrote to memory of 1708 2732 fxlrfrl.exe 38 PID 2732 wrote to memory of 1708 2732 fxlrfrl.exe 38 PID 2732 wrote to memory of 1708 2732 fxlrfrl.exe 38 PID 1708 wrote to memory of 2572 1708 lfxxflx.exe 39 PID 1708 wrote to memory of 2572 1708 lfxxflx.exe 39 PID 1708 wrote to memory of 2572 1708 lfxxflx.exe 39 PID 1708 wrote to memory of 2572 1708 lfxxflx.exe 39 PID 2572 wrote to memory of 1512 2572 nhbbhb.exe 40 PID 2572 wrote to memory of 1512 2572 nhbbhb.exe 40 PID 2572 wrote to memory of 1512 2572 nhbbhb.exe 40 PID 2572 wrote to memory of 1512 2572 nhbbhb.exe 40 PID 1512 wrote to memory of 2616 1512 pvjpd.exe 41 PID 1512 wrote to memory of 2616 1512 pvjpd.exe 41 PID 1512 wrote to memory of 2616 1512 pvjpd.exe 41 PID 1512 wrote to memory of 2616 1512 pvjpd.exe 41 PID 2616 wrote to memory of 820 2616 rrflxfl.exe 42 PID 2616 wrote to memory of 820 2616 rrflxfl.exe 42 PID 2616 wrote to memory of 820 2616 rrflxfl.exe 42 PID 2616 wrote to memory of 820 2616 rrflxfl.exe 42 PID 820 wrote to memory of 2956 820 9bbntt.exe 43 PID 820 wrote to memory of 2956 820 9bbntt.exe 43 PID 820 wrote to memory of 2956 820 9bbntt.exe 43 PID 820 wrote to memory of 2956 820 9bbntt.exe 43 PID 2956 wrote to memory of 2800 2956 vjvpp.exe 44 PID 2956 wrote to memory of 2800 2956 vjvpp.exe 44 PID 2956 wrote to memory of 2800 2956 vjvpp.exe 44 PID 2956 wrote to memory of 2800 2956 vjvpp.exe 44 PID 2800 wrote to memory of 2092 2800 fllrlrf.exe 45 PID 2800 wrote to memory of 2092 2800 fllrlrf.exe 45 PID 2800 wrote to memory of 2092 2800 fllrlrf.exe 45 PID 2800 wrote to memory of 2092 2800 fllrlrf.exe 45 PID 2092 wrote to memory of 2376 2092 tnttbh.exe 46 PID 2092 wrote to memory of 2376 2092 tnttbh.exe 46 PID 2092 wrote to memory of 2376 2092 tnttbh.exe 46 PID 2092 wrote to memory of 2376 2092 tnttbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe"C:\Users\Admin\AppData\Local\Temp\27f73525473d5452f49f3a83f9f5cc40807e2698fb2b10874102d50a2418df76N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\xrflxxf.exec:\xrflxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\ttbbhb.exec:\ttbbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\pdpvj.exec:\pdpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\3xlllrx.exec:\3xlllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\bthntt.exec:\bthntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\dvppv.exec:\dvppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\fxlrfrl.exec:\fxlrfrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lfxxflx.exec:\lfxxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\nhbbhb.exec:\nhbbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pvjpd.exec:\pvjpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\rrflxfl.exec:\rrflxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\9bbntt.exec:\9bbntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\vjvpp.exec:\vjvpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\fllrlrf.exec:\fllrlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tnttbh.exec:\tnttbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\nhtttb.exec:\nhtttb.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\dpvjp.exec:\dpvjp.exe18⤵
- Executes dropped EXE
PID:2004 -
\??\c:\fxrfllf.exec:\fxrfllf.exe19⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfxflrf.exec:\lfxflrf.exe20⤵
- Executes dropped EXE
PID:2952 -
\??\c:\hhbntb.exec:\hhbntb.exe21⤵
- Executes dropped EXE
PID:1156 -
\??\c:\nhntbh.exec:\nhntbh.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2384 -
\??\c:\bthbhb.exec:\bthbhb.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\5dpjj.exec:\5dpjj.exe24⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvjdp.exec:\dvjdp.exe25⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xrffllx.exec:\xrffllx.exe26⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rfxfrrf.exec:\rfxfrrf.exe27⤵
- Executes dropped EXE
PID:1052 -
\??\c:\5jpjd.exec:\5jpjd.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\vvvdj.exec:\vvvdj.exe29⤵
- Executes dropped EXE
PID:1780 -
\??\c:\frllxfl.exec:\frllxfl.exe30⤵
- Executes dropped EXE
PID:568 -
\??\c:\nhbbhh.exec:\nhbbhh.exe31⤵
- Executes dropped EXE
PID:356 -
\??\c:\htbhhh.exec:\htbhhh.exe32⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jvppd.exec:\jvppd.exe33⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1frxxrx.exec:\1frxxrx.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3lxxxlr.exec:\3lxxxlr.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hhhthh.exec:\hhhthh.exe36⤵
- Executes dropped EXE
PID:2416 -
\??\c:\vjvdp.exec:\vjvdp.exe37⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlxxllx.exec:\rlxxllx.exe38⤵
- Executes dropped EXE
PID:1152 -
\??\c:\hbhhnn.exec:\hbhhnn.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1jppp.exec:\1jppp.exe40⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7djdd.exec:\7djdd.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\1llllrr.exec:\1llllrr.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3tnbhn.exec:\3tnbhn.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bntnbb.exec:\bntnbb.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jdppd.exec:\jdppd.exe45⤵
- Executes dropped EXE
PID:1252 -
\??\c:\5dppp.exec:\5dppp.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\9lfrxff.exec:\9lfrxff.exe47⤵
- Executes dropped EXE
PID:548 -
\??\c:\1rrrxxf.exec:\1rrrxxf.exe48⤵
- Executes dropped EXE
PID:820 -
\??\c:\tthntb.exec:\tthntb.exe49⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5tbtnh.exec:\5tbtnh.exe50⤵
- Executes dropped EXE
PID:536 -
\??\c:\ppjpd.exec:\ppjpd.exe51⤵
- Executes dropped EXE
PID:1972 -
\??\c:\5frrrll.exec:\5frrrll.exe52⤵
- Executes dropped EXE
PID:1992 -
\??\c:\1lrrrrr.exec:\1lrrrrr.exe53⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nhtthh.exec:\nhtthh.exe54⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nhbhtt.exec:\nhbhtt.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vppjv.exec:\vppjv.exe56⤵
- Executes dropped EXE
PID:2536 -
\??\c:\7vdpv.exec:\7vdpv.exe57⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrxxxxf.exec:\xrxxxxf.exe58⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tnbhnh.exec:\tnbhnh.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hbhhtt.exec:\hbhhtt.exe60⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pdppd.exec:\pdppd.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:316 -
\??\c:\pjvjp.exec:\pjvjp.exe62⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xflrrfl.exec:\xflrrfl.exe63⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1tnnbb.exec:\1tnnbb.exe64⤵
- Executes dropped EXE
PID:740 -
\??\c:\9dvdj.exec:\9dvdj.exe65⤵
- Executes dropped EXE
PID:300 -
\??\c:\pjvjp.exec:\pjvjp.exe66⤵PID:2236
-
\??\c:\5xrrrfl.exec:\5xrrrfl.exe67⤵PID:696
-
\??\c:\hhhthb.exec:\hhhthb.exe68⤵PID:1712
-
\??\c:\5nbbhn.exec:\5nbbhn.exe69⤵PID:916
-
\??\c:\9jpvd.exec:\9jpvd.exe70⤵PID:764
-
\??\c:\pjdjp.exec:\pjdjp.exe71⤵PID:3040
-
\??\c:\rrllxxx.exec:\rrllxxx.exe72⤵PID:2320
-
\??\c:\xllxlrf.exec:\xllxlrf.exe73⤵PID:2652
-
\??\c:\htbntt.exec:\htbntt.exe74⤵PID:2888
-
\??\c:\hbntbh.exec:\hbntbh.exe75⤵PID:2700
-
\??\c:\3pvpp.exec:\3pvpp.exe76⤵PID:2992
-
\??\c:\dpvvd.exec:\dpvvd.exe77⤵PID:2112
-
\??\c:\lrxflxl.exec:\lrxflxl.exe78⤵PID:2388
-
\??\c:\5tntnt.exec:\5tntnt.exe79⤵PID:2364
-
\??\c:\5hnntn.exec:\5hnntn.exe80⤵PID:2716
-
\??\c:\jvpvv.exec:\jvpvv.exe81⤵PID:2608
-
\??\c:\pdjdd.exec:\pdjdd.exe82⤵PID:1708
-
\??\c:\flrllfr.exec:\flrllfr.exe83⤵PID:2744
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe84⤵PID:2584
-
\??\c:\frxxfxx.exec:\frxxfxx.exe85⤵PID:2284
-
\??\c:\htnnhh.exec:\htnnhh.exe86⤵PID:1852
-
\??\c:\jpddj.exec:\jpddj.exe87⤵PID:468
-
\??\c:\pdpjp.exec:\pdpjp.exe88⤵PID:2560
-
\??\c:\dvjdp.exec:\dvjdp.exe89⤵PID:2688
-
\??\c:\lrxxfrx.exec:\lrxxfrx.exe90⤵PID:2916
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe91⤵PID:1696
-
\??\c:\thtnbb.exec:\thtnbb.exe92⤵PID:2000
-
\??\c:\htbbnh.exec:\htbbnh.exe93⤵PID:1316
-
\??\c:\7pjdd.exec:\7pjdd.exe94⤵PID:1992
-
\??\c:\jdjjd.exec:\jdjjd.exe95⤵PID:2612
-
\??\c:\lfllllx.exec:\lfllllx.exe96⤵PID:2668
-
\??\c:\rffrrll.exec:\rffrrll.exe97⤵PID:1620
-
\??\c:\thtbbt.exec:\thtbbt.exe98⤵PID:2344
-
\??\c:\bntttt.exec:\bntttt.exe99⤵PID:1156
-
\??\c:\pdvvv.exec:\pdvvv.exe100⤵PID:1892
-
\??\c:\7djpj.exec:\7djpj.exe101⤵PID:1500
-
\??\c:\llrxfff.exec:\llrxfff.exe102⤵PID:2036
-
\??\c:\7xxxxrx.exec:\7xxxxrx.exe103⤵PID:1928
-
\??\c:\btbhnh.exec:\btbhnh.exe104⤵PID:1860
-
\??\c:\5bhhtb.exec:\5bhhtb.exe105⤵PID:2276
-
\??\c:\vjvvv.exec:\vjvvv.exe106⤵PID:2940
-
\??\c:\1vjdj.exec:\1vjdj.exe107⤵PID:1080
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe108⤵PID:1788
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe109⤵PID:300
-
\??\c:\tnnhhb.exec:\tnnhhb.exe110⤵PID:1628
-
\??\c:\9nnnhb.exec:\9nnnhb.exe111⤵PID:696
-
\??\c:\3jpjj.exec:\3jpjj.exe112⤵PID:1712
-
\??\c:\7djpj.exec:\7djpj.exe113⤵PID:1532
-
\??\c:\flrrxrx.exec:\flrrxrx.exe114⤵PID:3044
-
\??\c:\9lrrlfl.exec:\9lrrlfl.exe115⤵PID:1676
-
\??\c:\nhnhhh.exec:\nhnhhh.exe116⤵PID:2492
-
\??\c:\thhhnh.exec:\thhhnh.exe117⤵PID:2328
-
\??\c:\jdjvp.exec:\jdjvp.exe118⤵PID:956
-
\??\c:\xlrlxlx.exec:\xlrlxlx.exe119⤵PID:2828
-
\??\c:\nbhhhh.exec:\nbhhhh.exe120⤵PID:2860
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe121⤵PID:2148
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-