Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe
-
Size
453KB
-
MD5
1f54838389ed2fdd0e65b05cfb433a40
-
SHA1
38556cd647d84d1bfba8be65fd2075c0aaf3072b
-
SHA256
238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543ed
-
SHA512
906abcb164d0f91713a6038bf986ae9f6f8a8534501626db67e33ca6e10d7309902fcd0a00993235841163b862be4e7b9de579fabe503c4a6db43ed49e353f7d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2880-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-249-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2296-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-399-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-479-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-526-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2940-548-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/2212-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-615-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2732-650-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-676-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-786-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1336-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-867-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2880 fxlrrrf.exe 1336 7frxffl.exe 2876 jdjjp.exe 2212 rlrrllr.exe 2780 bhbnbt.exe 2160 5djjd.exe 2828 frfrrrr.exe 2792 hnbbhn.exe 2488 pvjdd.exe 2688 1lrlfxx.exe 2980 htbbbh.exe 1688 jvdjp.exe 2468 frfxxrx.exe 1704 tbhbhb.exe 1632 1xxxllr.exe 1796 5flfrlr.exe 1312 vdvjj.exe 2636 lxfxxxx.exe 2024 tntbhb.exe 2272 vjpjj.exe 2868 1xffxxx.exe 1084 1ntnnh.exe 708 xrflllx.exe 1868 nbhbbb.exe 2260 jvpjd.exe 788 lxfxffl.exe 2296 nbbnnb.exe 2356 1fxxllr.exe 1932 lxrxrrr.exe 2368 1xlxxxf.exe 588 nhbbhn.exe 1692 5rrlffl.exe 1336 thttbb.exe 2660 jvdjd.exe 2784 lxfflff.exe 2212 rffffxx.exe 2724 9thbtn.exe 2852 djvpj.exe 2692 flffffl.exe 2684 9rxfxrl.exe 2192 nnnnhb.exe 2584 jvppd.exe 2972 fxxllxr.exe 636 3rfxfxf.exe 3052 nbnntn.exe 1936 vppvj.exe 2364 pjvvv.exe 1696 5rlrrrx.exe 1248 nbhhnn.exe 2388 ttttnt.exe 1096 jpvvd.exe 1188 rlxfflr.exe 864 9xxrrll.exe 1452 hnhthn.exe 2992 dvdvj.exe 2264 frrlxfr.exe 2964 fxrfxfx.exe 2248 9nhhtb.exe 1132 thnbbt.exe 1720 dvppv.exe 1600 lllllrl.exe 1636 xrffxfr.exe 1668 bthntn.exe 2544 vdpdp.exe -
resource yara_rule behavioral1/memory/2880-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-325-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2212-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-629-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2976-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-786-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2896-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-848-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bhnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2880 2324 238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe 31 PID 2324 wrote to memory of 2880 2324 238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe 31 PID 2324 wrote to memory of 2880 2324 238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe 31 PID 2324 wrote to memory of 2880 2324 238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe 31 PID 2880 wrote to memory of 1336 2880 fxlrrrf.exe 32 PID 2880 wrote to memory of 1336 2880 fxlrrrf.exe 32 PID 2880 wrote to memory of 1336 2880 fxlrrrf.exe 32 PID 2880 wrote to memory of 1336 2880 fxlrrrf.exe 32 PID 1336 wrote to memory of 2876 1336 7frxffl.exe 33 PID 1336 wrote to memory of 2876 1336 7frxffl.exe 33 PID 1336 wrote to memory of 2876 1336 7frxffl.exe 33 PID 1336 wrote to memory of 2876 1336 7frxffl.exe 33 PID 2876 wrote to memory of 2212 2876 jdjjp.exe 34 PID 2876 wrote to memory of 2212 2876 jdjjp.exe 34 PID 2876 wrote to memory of 2212 2876 jdjjp.exe 34 PID 2876 wrote to memory of 2212 2876 jdjjp.exe 34 PID 2212 wrote to memory of 2780 2212 rlrrllr.exe 35 PID 2212 wrote to memory of 2780 2212 rlrrllr.exe 35 PID 2212 wrote to memory of 2780 2212 rlrrllr.exe 35 PID 2212 wrote to memory of 2780 2212 rlrrllr.exe 35 PID 2780 wrote to memory of 2160 2780 bhbnbt.exe 36 PID 2780 wrote to memory of 2160 2780 bhbnbt.exe 36 PID 2780 wrote to memory of 2160 2780 bhbnbt.exe 36 PID 2780 wrote to memory of 2160 2780 bhbnbt.exe 36 PID 2160 wrote to memory of 2828 2160 5djjd.exe 37 PID 2160 wrote to memory of 2828 2160 5djjd.exe 37 PID 2160 wrote to memory of 2828 2160 5djjd.exe 37 PID 2160 wrote to memory of 2828 2160 5djjd.exe 37 PID 2828 wrote to memory of 2792 2828 frfrrrr.exe 38 PID 2828 wrote to memory of 2792 2828 frfrrrr.exe 38 PID 2828 wrote to memory of 2792 2828 frfrrrr.exe 38 PID 2828 wrote to memory of 2792 2828 frfrrrr.exe 38 PID 2792 wrote to memory of 2488 2792 hnbbhn.exe 39 PID 2792 wrote to memory of 2488 2792 hnbbhn.exe 39 PID 2792 wrote to memory of 2488 2792 hnbbhn.exe 39 PID 2792 wrote to memory of 2488 2792 hnbbhn.exe 39 PID 2488 wrote to memory of 2688 2488 pvjdd.exe 40 PID 2488 wrote to memory of 2688 2488 pvjdd.exe 40 PID 2488 wrote to memory of 2688 2488 pvjdd.exe 40 PID 2488 wrote to memory of 2688 2488 pvjdd.exe 40 PID 2688 wrote to memory of 2980 2688 1lrlfxx.exe 41 PID 2688 wrote to memory of 2980 2688 1lrlfxx.exe 41 PID 2688 wrote to memory of 2980 2688 1lrlfxx.exe 41 PID 2688 wrote to memory of 2980 2688 1lrlfxx.exe 41 PID 2980 wrote to memory of 1688 2980 htbbbh.exe 42 PID 2980 wrote to memory of 1688 2980 htbbbh.exe 42 PID 2980 wrote to memory of 1688 2980 htbbbh.exe 42 PID 2980 wrote to memory of 1688 2980 htbbbh.exe 42 PID 1688 wrote to memory of 2468 1688 jvdjp.exe 43 PID 1688 wrote to memory of 2468 1688 jvdjp.exe 43 PID 1688 wrote to memory of 2468 1688 jvdjp.exe 43 PID 1688 wrote to memory of 2468 1688 jvdjp.exe 43 PID 2468 wrote to memory of 1704 2468 frfxxrx.exe 44 PID 2468 wrote to memory of 1704 2468 frfxxrx.exe 44 PID 2468 wrote to memory of 1704 2468 frfxxrx.exe 44 PID 2468 wrote to memory of 1704 2468 frfxxrx.exe 44 PID 1704 wrote to memory of 1632 1704 tbhbhb.exe 45 PID 1704 wrote to memory of 1632 1704 tbhbhb.exe 45 PID 1704 wrote to memory of 1632 1704 tbhbhb.exe 45 PID 1704 wrote to memory of 1632 1704 tbhbhb.exe 45 PID 1632 wrote to memory of 1796 1632 1xxxllr.exe 46 PID 1632 wrote to memory of 1796 1632 1xxxllr.exe 46 PID 1632 wrote to memory of 1796 1632 1xxxllr.exe 46 PID 1632 wrote to memory of 1796 1632 1xxxllr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe"C:\Users\Admin\AppData\Local\Temp\238de9b2082e87e70803a0c566a4c42c4c9b407687a98eecc1935deacc8543edN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\7frxffl.exec:\7frxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\jdjjp.exec:\jdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\rlrrllr.exec:\rlrrllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\bhbnbt.exec:\bhbnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\5djjd.exec:\5djjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\frfrrrr.exec:\frfrrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\hnbbhn.exec:\hnbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pvjdd.exec:\pvjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\1lrlfxx.exec:\1lrlfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\htbbbh.exec:\htbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\jvdjp.exec:\jvdjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\frfxxrx.exec:\frfxxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\tbhbhb.exec:\tbhbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\1xxxllr.exec:\1xxxllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\5flfrlr.exec:\5flfrlr.exe17⤵
- Executes dropped EXE
PID:1796 -
\??\c:\vdvjj.exec:\vdvjj.exe18⤵
- Executes dropped EXE
PID:1312 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe19⤵
- Executes dropped EXE
PID:2636 -
\??\c:\tntbhb.exec:\tntbhb.exe20⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjpjj.exec:\vjpjj.exe21⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1xffxxx.exec:\1xffxxx.exe22⤵
- Executes dropped EXE
PID:2868 -
\??\c:\1ntnnh.exec:\1ntnnh.exe23⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xrflllx.exec:\xrflllx.exe24⤵
- Executes dropped EXE
PID:708 -
\??\c:\nbhbbb.exec:\nbhbbb.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jvpjd.exec:\jvpjd.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2260 -
\??\c:\lxfxffl.exec:\lxfxffl.exe27⤵
- Executes dropped EXE
PID:788 -
\??\c:\nbbnnb.exec:\nbbnnb.exe28⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1fxxllr.exec:\1fxxllr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2356 -
\??\c:\lxrxrrr.exec:\lxrxrrr.exe30⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1xlxxxf.exec:\1xlxxxf.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nhbbhn.exec:\nhbbhn.exe32⤵
- Executes dropped EXE
PID:588 -
\??\c:\5rrlffl.exec:\5rrlffl.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thttbb.exec:\thttbb.exe34⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jvdjd.exec:\jvdjd.exe35⤵
- Executes dropped EXE
PID:2660 -
\??\c:\lxfflff.exec:\lxfflff.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rffffxx.exec:\rffffxx.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\9thbtn.exec:\9thbtn.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djvpj.exec:\djvpj.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\flffffl.exec:\flffffl.exe40⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9rxfxrl.exec:\9rxfxrl.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\nnnnhb.exec:\nnnnhb.exe42⤵
- Executes dropped EXE
PID:2192 -
\??\c:\jvppd.exec:\jvppd.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxxllxr.exec:\fxxllxr.exe44⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3rfxfxf.exec:\3rfxfxf.exe45⤵
- Executes dropped EXE
PID:636 -
\??\c:\nbnntn.exec:\nbnntn.exe46⤵
- Executes dropped EXE
PID:3052 -
\??\c:\vppvj.exec:\vppvj.exe47⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjvvv.exec:\pjvvv.exe48⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5rlrrrx.exec:\5rlrrrx.exe49⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbhhnn.exec:\nbhhnn.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\ttttnt.exec:\ttttnt.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jpvvd.exec:\jpvvd.exe52⤵
- Executes dropped EXE
PID:1096 -
\??\c:\rlxfflr.exec:\rlxfflr.exe53⤵
- Executes dropped EXE
PID:1188 -
\??\c:\9xxrrll.exec:\9xxrrll.exe54⤵
- Executes dropped EXE
PID:864 -
\??\c:\hnhthn.exec:\hnhthn.exe55⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvdvj.exec:\dvdvj.exe56⤵
- Executes dropped EXE
PID:2992 -
\??\c:\frrlxfr.exec:\frrlxfr.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxrfxfx.exec:\fxrfxfx.exe58⤵
- Executes dropped EXE
PID:2964 -
\??\c:\9nhhtb.exec:\9nhhtb.exe59⤵
- Executes dropped EXE
PID:2248 -
\??\c:\thnbbt.exec:\thnbbt.exe60⤵
- Executes dropped EXE
PID:1132 -
\??\c:\dvppv.exec:\dvppv.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lllllrl.exec:\lllllrl.exe62⤵
- Executes dropped EXE
PID:1600 -
\??\c:\xrffxfr.exec:\xrffxfr.exe63⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bthntn.exec:\bthntn.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vdpdp.exec:\vdpdp.exe65⤵
- Executes dropped EXE
PID:2544 -
\??\c:\pvpvj.exec:\pvpvj.exe66⤵PID:992
-
\??\c:\rrffffr.exec:\rrffffr.exe67⤵PID:1928
-
\??\c:\hbthbb.exec:\hbthbb.exe68⤵PID:2372
-
\??\c:\pvvpv.exec:\pvvpv.exe69⤵PID:2940
-
\??\c:\jvjjp.exec:\jvjjp.exe70⤵PID:2324
-
\??\c:\5lxrxff.exec:\5lxrxff.exe71⤵PID:1256
-
\??\c:\thnhbt.exec:\thnhbt.exe72⤵PID:572
-
\??\c:\btntbh.exec:\btntbh.exe73⤵PID:2216
-
\??\c:\dvpjj.exec:\dvpjj.exe74⤵PID:2016
-
\??\c:\llxlxfx.exec:\llxlxfx.exe75⤵PID:2876
-
\??\c:\lfrxffr.exec:\lfrxffr.exe76⤵PID:2236
-
\??\c:\hbnntb.exec:\hbnntb.exe77⤵PID:2784
-
\??\c:\jjdjv.exec:\jjdjv.exe78⤵PID:2212
-
\??\c:\pvjpv.exec:\pvjpv.exe79⤵PID:2724
-
\??\c:\rxxfxxl.exec:\rxxfxxl.exe80⤵PID:2852
-
\??\c:\9hntht.exec:\9hntht.exe81⤵PID:2732
-
\??\c:\1bbthb.exec:\1bbthb.exe82⤵PID:2564
-
\??\c:\7ddjp.exec:\7ddjp.exe83⤵PID:2588
-
\??\c:\rfxfxxf.exec:\rfxfxxf.exe84⤵PID:2976
-
\??\c:\rlxxflx.exec:\rlxxflx.exe85⤵PID:2600
-
\??\c:\nnhthh.exec:\nnhthh.exe86⤵PID:872
-
\??\c:\ppjdv.exec:\ppjdv.exe87⤵PID:1688
-
\??\c:\1pjpj.exec:\1pjpj.exe88⤵PID:596
-
\??\c:\fllrxlx.exec:\fllrxlx.exe89⤵PID:1708
-
\??\c:\xlrrrlf.exec:\xlrrrlf.exe90⤵PID:1704
-
\??\c:\nhnthh.exec:\nhnthh.exe91⤵PID:1040
-
\??\c:\ppjjp.exec:\ppjjp.exe92⤵PID:1408
-
\??\c:\vvddd.exec:\vvddd.exe93⤵PID:2040
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe94⤵PID:2008
-
\??\c:\nhbbhh.exec:\nhbbhh.exe95⤵PID:1856
-
\??\c:\9btthn.exec:\9btthn.exe96⤵PID:2024
-
\??\c:\jvvvp.exec:\jvvvp.exe97⤵PID:1980
-
\??\c:\9frrrxf.exec:\9frrrxf.exe98⤵PID:2088
-
\??\c:\5rlrxrx.exec:\5rlrxrx.exe99⤵PID:2856
-
\??\c:\hthhbt.exec:\hthhbt.exe100⤵PID:2248
-
\??\c:\7vvjj.exec:\7vvjj.exe101⤵PID:1084
-
\??\c:\7vvdj.exec:\7vvdj.exe102⤵PID:1976
-
\??\c:\7rxlxxr.exec:\7rxlxxr.exe103⤵PID:1600
-
\??\c:\fxflrrx.exec:\fxflrrx.exe104⤵PID:1636
-
\??\c:\thtbnt.exec:\thtbnt.exe105⤵PID:1668
-
\??\c:\3jddd.exec:\3jddd.exe106⤵PID:1536
-
\??\c:\pjddj.exec:\pjddj.exe107⤵PID:992
-
\??\c:\xxfffll.exec:\xxfffll.exe108⤵PID:1156
-
\??\c:\nnnntt.exec:\nnnntt.exe109⤵PID:2072
-
\??\c:\5hhthn.exec:\5hhthn.exe110⤵PID:2896
-
\??\c:\dvpvj.exec:\dvpvj.exe111⤵PID:2956
-
\??\c:\7lrlxrx.exec:\7lrlxrx.exe112⤵PID:1804
-
\??\c:\flrrrfl.exec:\flrrrfl.exe113⤵PID:1256
-
\??\c:\hbhnnn.exec:\hbhnnn.exe114⤵PID:588
-
\??\c:\djjdj.exec:\djjdj.exe115⤵PID:1336
-
\??\c:\fxffxxx.exec:\fxffxxx.exe116⤵PID:2004
-
\??\c:\nhhhhh.exec:\nhhhhh.exe117⤵PID:2672
-
\??\c:\nhbhhh.exec:\nhbhhh.exe118⤵PID:2760
-
\??\c:\5pvpp.exec:\5pvpp.exe119⤵PID:2700
-
\??\c:\dpjdv.exec:\dpjdv.exe120⤵PID:2888
-
\??\c:\rlxxffl.exec:\rlxxffl.exe121⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-