Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:57
Behavioral task
behavioral1
Sample
e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe
-
Size
97KB
-
MD5
f8be9eede00e894ac0b580bd1d8295e0
-
SHA1
09bf84677dc31b9513e6d8e3187f74d0e7746717
-
SHA256
e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bd
-
SHA512
a71d2856f5475d5b2d3c02194c002626ce54df61fb60a412317063e9e1757220689600849cb6d6866d70cb34adab2fa72ac4d7339c6ae9fca4fa02d57a7fac97
-
SSDEEP
3072:8hOmTsF93UYfwC6GIout0fmCiiiXA6mzgRG:8cm4FmowdHoSgWrXUgU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2100-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2168-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1684-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1408-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2956-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/852-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/896-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2952-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-371-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2812-382-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1508-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-413-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1820-429-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2936-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2124-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-447-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/3028-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-533-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-556-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2264-567-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-573-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1932-576-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2628-594-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2656-601-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1340-622-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/680-632-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/680-631-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2020-648-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2020-669-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1364-707-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/3064-710-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2324-14687-0x0000000077320000-0x000000007741A000-memory.dmp family_blackmoon behavioral1/memory/2324-20079-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2168 tnbhnn.exe 2528 pdppp.exe 1672 rlxxfff.exe 1968 lxxxrlr.exe 2868 5hntbt.exe 2716 bnnntn.exe 2904 jdppp.exe 2640 1ppvv.exe 2772 rlfrrxf.exe 2616 5xxxxrr.exe 1684 tnhbht.exe 2084 tnhntb.exe 1876 jdjdd.exe 1908 dvjjv.exe 264 dvjvj.exe 1992 rlxflxf.exe 1408 5hbnbb.exe 1056 nhhhtt.exe 1584 jdjpv.exe 1664 dpjdd.exe 2956 lfrxxxf.exe 2432 nbhhnt.exe 852 thttbb.exe 2532 dpjjj.exe 1384 7lfrrxr.exe 1240 frxfrlr.exe 1548 nbnnnn.exe 1300 3jddj.exe 1760 7jjdj.exe 2224 fxllrrx.exe 1668 tthnnh.exe 3032 nbnttt.exe 896 dvjpj.exe 1412 1dppp.exe 2060 flrrlrr.exe 2168 fxllxrf.exe 1708 bnttbb.exe 1624 1nhnht.exe 2796 dvdpv.exe 2748 vpddj.exe 2756 lxxflxr.exe 2884 rlxflrx.exe 2868 btbbhb.exe 2612 bntnnn.exe 2768 jvddd.exe 2640 ddpdp.exe 2952 1llxxfr.exe 2600 5hbbnt.exe 2680 tntbbh.exe 2608 5jjjj.exe 2672 ddpdj.exe 2084 3xffffr.exe 1108 fxllllr.exe 2812 bbbhtt.exe 600 tnnttn.exe 1508 7jdvd.exe 2816 dvpvp.exe 1656 9frlllx.exe 1820 tbbbhn.exe 1844 tnnbtb.exe 1764 3jdvj.exe 2708 vdvpv.exe 2936 flxxfxf.exe 2124 rrflxfl.exe -
resource yara_rule behavioral1/memory/2100-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-6.dat upx behavioral1/memory/2168-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000162e4-15.dat upx behavioral1/memory/2528-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016399-25.dat upx behavioral1/files/0x00080000000164de-32.dat upx behavioral1/memory/1672-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1968-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016689-41.dat upx behavioral1/memory/1968-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016b86-48.dat upx behavioral1/files/0x0007000000016c89-55.dat upx behavioral1/files/0x0007000000016ca0-65.dat upx behavioral1/memory/2904-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2616-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174f8-82.dat upx behavioral1/files/0x0009000000016cf0-74.dat upx behavioral1/memory/2640-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1684-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000017570-90.dat upx behavioral1/files/0x00060000000175f1-99.dat upx behavioral1/memory/1684-97-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x00060000000175f7-107.dat upx behavioral1/memory/2084-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1876-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000018683-115.dat upx behavioral1/memory/1908-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-124.dat upx behavioral1/memory/1908-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018706-131.dat upx behavioral1/files/0x000500000001870c-140.dat upx behavioral1/memory/1992-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1408-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001871c-147.dat upx behavioral1/files/0x0005000000018745-155.dat upx behavioral1/files/0x0006000000018be7-162.dat upx behavioral1/files/0x0006000000018d7b-170.dat upx behavioral1/memory/1664-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2956-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d83-177.dat upx behavioral1/files/0x0006000000018fdf-186.dat upx behavioral1/memory/2432-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/852-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019056-193.dat upx behavioral1/files/0x0005000000019203-202.dat upx behavioral1/memory/2532-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019237-210.dat upx behavioral1/files/0x000500000001924f-217.dat upx behavioral1/files/0x0005000000019261-225.dat upx behavioral1/memory/1548-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019274-232.dat upx behavioral1/files/0x000500000001927a-239.dat upx behavioral1/files/0x0005000000019299-246.dat upx behavioral1/files/0x00050000000192a1-253.dat upx behavioral1/memory/896-265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2168-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-287-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2884-313-0x0000000000220000-0x0000000000247000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2168 2100 e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe 31 PID 2100 wrote to memory of 2168 2100 e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe 31 PID 2100 wrote to memory of 2168 2100 e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe 31 PID 2100 wrote to memory of 2168 2100 e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe 31 PID 2168 wrote to memory of 2528 2168 tnbhnn.exe 32 PID 2168 wrote to memory of 2528 2168 tnbhnn.exe 32 PID 2168 wrote to memory of 2528 2168 tnbhnn.exe 32 PID 2168 wrote to memory of 2528 2168 tnbhnn.exe 32 PID 2528 wrote to memory of 1672 2528 pdppp.exe 33 PID 2528 wrote to memory of 1672 2528 pdppp.exe 33 PID 2528 wrote to memory of 1672 2528 pdppp.exe 33 PID 2528 wrote to memory of 1672 2528 pdppp.exe 33 PID 1672 wrote to memory of 1968 1672 rlxxfff.exe 34 PID 1672 wrote to memory of 1968 1672 rlxxfff.exe 34 PID 1672 wrote to memory of 1968 1672 rlxxfff.exe 34 PID 1672 wrote to memory of 1968 1672 rlxxfff.exe 34 PID 1968 wrote to memory of 2868 1968 lxxxrlr.exe 35 PID 1968 wrote to memory of 2868 1968 lxxxrlr.exe 35 PID 1968 wrote to memory of 2868 1968 lxxxrlr.exe 35 PID 1968 wrote to memory of 2868 1968 lxxxrlr.exe 35 PID 2868 wrote to memory of 2716 2868 5hntbt.exe 36 PID 2868 wrote to memory of 2716 2868 5hntbt.exe 36 PID 2868 wrote to memory of 2716 2868 5hntbt.exe 36 PID 2868 wrote to memory of 2716 2868 5hntbt.exe 36 PID 2716 wrote to memory of 2904 2716 bnnntn.exe 37 PID 2716 wrote to memory of 2904 2716 bnnntn.exe 37 PID 2716 wrote to memory of 2904 2716 bnnntn.exe 37 PID 2716 wrote to memory of 2904 2716 bnnntn.exe 37 PID 2904 wrote to memory of 2640 2904 jdppp.exe 38 PID 2904 wrote to memory of 2640 2904 jdppp.exe 38 PID 2904 wrote to memory of 2640 2904 jdppp.exe 38 PID 2904 wrote to memory of 2640 2904 jdppp.exe 38 PID 2640 wrote to memory of 2772 2640 1ppvv.exe 39 PID 2640 wrote to memory of 2772 2640 1ppvv.exe 39 PID 2640 wrote to memory of 2772 2640 1ppvv.exe 39 PID 2640 wrote to memory of 2772 2640 1ppvv.exe 39 PID 2772 wrote to memory of 2616 2772 rlfrrxf.exe 40 PID 2772 wrote to memory of 2616 2772 rlfrrxf.exe 40 PID 2772 wrote to memory of 2616 2772 rlfrrxf.exe 40 PID 2772 wrote to memory of 2616 2772 rlfrrxf.exe 40 PID 2616 wrote to memory of 1684 2616 5xxxxrr.exe 41 PID 2616 wrote to memory of 1684 2616 5xxxxrr.exe 41 PID 2616 wrote to memory of 1684 2616 5xxxxrr.exe 41 PID 2616 wrote to memory of 1684 2616 5xxxxrr.exe 41 PID 1684 wrote to memory of 2084 1684 tnhbht.exe 42 PID 1684 wrote to memory of 2084 1684 tnhbht.exe 42 PID 1684 wrote to memory of 2084 1684 tnhbht.exe 42 PID 1684 wrote to memory of 2084 1684 tnhbht.exe 42 PID 2084 wrote to memory of 1876 2084 tnhntb.exe 43 PID 2084 wrote to memory of 1876 2084 tnhntb.exe 43 PID 2084 wrote to memory of 1876 2084 tnhntb.exe 43 PID 2084 wrote to memory of 1876 2084 tnhntb.exe 43 PID 1876 wrote to memory of 1908 1876 jdjdd.exe 44 PID 1876 wrote to memory of 1908 1876 jdjdd.exe 44 PID 1876 wrote to memory of 1908 1876 jdjdd.exe 44 PID 1876 wrote to memory of 1908 1876 jdjdd.exe 44 PID 1908 wrote to memory of 264 1908 dvjjv.exe 45 PID 1908 wrote to memory of 264 1908 dvjjv.exe 45 PID 1908 wrote to memory of 264 1908 dvjjv.exe 45 PID 1908 wrote to memory of 264 1908 dvjjv.exe 45 PID 264 wrote to memory of 1992 264 dvjvj.exe 46 PID 264 wrote to memory of 1992 264 dvjvj.exe 46 PID 264 wrote to memory of 1992 264 dvjvj.exe 46 PID 264 wrote to memory of 1992 264 dvjvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe"C:\Users\Admin\AppData\Local\Temp\e61110ee80f39048a0f4fe9c86c9118fb13ecade7dcc816ea34c1587ac7b51bdN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\tnbhnn.exec:\tnbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\pdppp.exec:\pdppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rlxxfff.exec:\rlxxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\lxxxrlr.exec:\lxxxrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\5hntbt.exec:\5hntbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bnnntn.exec:\bnnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\jdppp.exec:\jdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\1ppvv.exec:\1ppvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\5xxxxrr.exec:\5xxxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\tnhbht.exec:\tnhbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\tnhntb.exec:\tnhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\jdjdd.exec:\jdjdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\dvjjv.exec:\dvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\dvjvj.exec:\dvjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\rlxflxf.exec:\rlxflxf.exe17⤵
- Executes dropped EXE
PID:1992 -
\??\c:\5hbnbb.exec:\5hbnbb.exe18⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nhhhtt.exec:\nhhhtt.exe19⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jdjpv.exec:\jdjpv.exe20⤵
- Executes dropped EXE
PID:1584 -
\??\c:\dpjdd.exec:\dpjdd.exe21⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe22⤵
- Executes dropped EXE
PID:2956 -
\??\c:\nbhhnt.exec:\nbhhnt.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\thttbb.exec:\thttbb.exe24⤵
- Executes dropped EXE
PID:852 -
\??\c:\dpjjj.exec:\dpjjj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\7lfrrxr.exec:\7lfrrxr.exe26⤵
- Executes dropped EXE
PID:1384 -
\??\c:\frxfrlr.exec:\frxfrlr.exe27⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nbnnnn.exec:\nbnnnn.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3jddj.exec:\3jddj.exe29⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7jjdj.exec:\7jjdj.exe30⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxllrrx.exec:\fxllrrx.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tthnnh.exec:\tthnnh.exe32⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nbnttt.exec:\nbnttt.exe33⤵
- Executes dropped EXE
PID:3032 -
\??\c:\dvjpj.exec:\dvjpj.exe34⤵
- Executes dropped EXE
PID:896 -
\??\c:\1dppp.exec:\1dppp.exe35⤵
- Executes dropped EXE
PID:1412 -
\??\c:\flrrlrr.exec:\flrrlrr.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxllxrf.exec:\fxllxrf.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bnttbb.exec:\bnttbb.exe38⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1nhnht.exec:\1nhnht.exe39⤵
- Executes dropped EXE
PID:1624 -
\??\c:\dvdpv.exec:\dvdpv.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vpddj.exec:\vpddj.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lxxflxr.exec:\lxxflxr.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rlxflrx.exec:\rlxflrx.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\btbbhb.exec:\btbbhb.exe44⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bntnnn.exec:\bntnnn.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jvddd.exec:\jvddd.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\ddpdp.exec:\ddpdp.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\1llxxfr.exec:\1llxxfr.exe48⤵
- Executes dropped EXE
PID:2952 -
\??\c:\5hbbnt.exec:\5hbbnt.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tntbbh.exec:\tntbbh.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5jjjj.exec:\5jjjj.exe51⤵
- Executes dropped EXE
PID:2608 -
\??\c:\ddpdj.exec:\ddpdj.exe52⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3xffffr.exec:\3xffffr.exe53⤵
- Executes dropped EXE
PID:2084 -
\??\c:\fxllllr.exec:\fxllllr.exe54⤵
- Executes dropped EXE
PID:1108 -
\??\c:\bbbhtt.exec:\bbbhtt.exe55⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tnnttn.exec:\tnnttn.exe56⤵
- Executes dropped EXE
PID:600 -
\??\c:\7jdvd.exec:\7jdvd.exe57⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dvpvp.exec:\dvpvp.exe58⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9frlllx.exec:\9frlllx.exe59⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tbbbhn.exec:\tbbbhn.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tnnbtb.exec:\tnnbtb.exe61⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3jdvj.exec:\3jdvj.exe62⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vdvpv.exec:\vdvpv.exe63⤵
- Executes dropped EXE
PID:2708 -
\??\c:\flxxfxf.exec:\flxxfxf.exe64⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rrflxfl.exec:\rrflxfl.exe65⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hnthhn.exec:\hnthhn.exe66⤵PID:2432
-
\??\c:\ddpdj.exec:\ddpdj.exe67⤵PID:1836
-
\??\c:\pjpvj.exec:\pjpvj.exe68⤵PID:2532
-
\??\c:\rfrrllx.exec:\rfrrllx.exe69⤵PID:1924
-
\??\c:\5ffrflx.exec:\5ffrflx.exe70⤵PID:2320
-
\??\c:\tnnbth.exec:\tnnbth.exe71⤵PID:1240
-
\??\c:\bthnth.exec:\bthnth.exe72⤵PID:2468
-
\??\c:\rlffllr.exec:\rlffllr.exe73⤵PID:2268
-
\??\c:\fxfrxxf.exec:\fxfrxxf.exe74⤵PID:1092
-
\??\c:\nhnnnh.exec:\nhnnnh.exe75⤵PID:2440
-
\??\c:\bthbtt.exec:\bthbtt.exe76⤵PID:3028
-
\??\c:\1dvjd.exec:\1dvjd.exe77⤵PID:2140
-
\??\c:\jvjdj.exec:\jvjdj.exe78⤵PID:848
-
\??\c:\xlfllrf.exec:\xlfllrf.exe79⤵PID:3056
-
\??\c:\3rlrffl.exec:\3rlrffl.exe80⤵PID:896
-
\??\c:\thnhhb.exec:\thnhhb.exe81⤵PID:2408
-
\??\c:\bnbbbb.exec:\bnbbbb.exe82⤵PID:2540
-
\??\c:\5pdvd.exec:\5pdvd.exe83⤵PID:812
-
\??\c:\dvvpv.exec:\dvvpv.exe84⤵PID:2340
-
\??\c:\xrxlfff.exec:\xrxlfff.exe85⤵PID:2260
-
\??\c:\lfllxxr.exec:\lfllxxr.exe86⤵PID:1968
-
\??\c:\hbhntt.exec:\hbhntt.exe87⤵PID:2264
-
\??\c:\7tbbbt.exec:\7tbbbt.exe88⤵PID:2712
-
\??\c:\pddpd.exec:\pddpd.exe89⤵PID:1932
-
\??\c:\vjvpv.exec:\vjvpv.exe90⤵PID:2240
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe91⤵PID:2780
-
\??\c:\lfffxrr.exec:\lfffxrr.exe92⤵PID:2628
-
\??\c:\htttth.exec:\htttth.exe93⤵PID:2656
-
\??\c:\thnhhh.exec:\thnhhh.exe94⤵PID:996
-
\??\c:\1vjdd.exec:\1vjdd.exe95⤵PID:1688
-
\??\c:\jvddv.exec:\jvddv.exe96⤵PID:2608
-
\??\c:\rlrrrlf.exec:\rlrrrlf.exe97⤵PID:1340
-
\??\c:\1lxrrlr.exec:\1lxrrlr.exe98⤵PID:680
-
\??\c:\3tthht.exec:\3tthht.exe99⤵PID:1908
-
\??\c:\3htthb.exec:\3htthb.exe100⤵PID:768
-
\??\c:\7vjjp.exec:\7vjjp.exe101⤵PID:2020
-
\??\c:\vjvpp.exec:\vjvpp.exe102⤵PID:1496
-
\??\c:\frxxxrl.exec:\frxxxrl.exe103⤵PID:1992
-
\??\c:\rfffllr.exec:\rfffllr.exe104⤵PID:1408
-
\??\c:\9bhnnh.exec:\9bhnnh.exe105⤵PID:2000
-
\??\c:\nbnntt.exec:\nbnntt.exe106⤵PID:1640
-
\??\c:\hbbbnh.exec:\hbbbnh.exe107⤵PID:2144
-
\??\c:\jvddd.exec:\jvddd.exe108⤵PID:2188
-
\??\c:\pdjdd.exec:\pdjdd.exe109⤵PID:2956
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe110⤵PID:872
-
\??\c:\frfxxxf.exec:\frfxxxf.exe111⤵PID:2704
-
\??\c:\bthnnn.exec:\bthnnn.exe112⤵PID:1364
-
\??\c:\tnttnb.exec:\tnttnb.exe113⤵PID:3064
-
\??\c:\jdpdp.exec:\jdpdp.exe114⤵PID:2960
-
\??\c:\9jvpp.exec:\9jvpp.exe115⤵PID:2368
-
\??\c:\rxlxflf.exec:\rxlxflf.exe116⤵PID:920
-
\??\c:\lxlrrff.exec:\lxlrrff.exe117⤵PID:3000
-
\??\c:\nhhbbt.exec:\nhhbbt.exe118⤵PID:1444
-
\??\c:\vjjjj.exec:\vjjjj.exe119⤵PID:2108
-
\??\c:\vjjjj.exec:\vjjjj.exe120⤵PID:2304
-
\??\c:\frxlrlx.exec:\frxlrlx.exe121⤵PID:1532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-