Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe
-
Size
453KB
-
MD5
649647b838a61ab9a9034cdb57197057
-
SHA1
c77715af652c043623851a8c8a069df21512fed3
-
SHA256
2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0
-
SHA512
9432263c6b99a10a38c3c176380f6ed29c3f528da6e9b5324e64add9b2e3cacd17455b2f19c512dd6ac9626e24503cb35ecd9ea377516074c487e0f1155f5c57
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-131-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-338-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3004-376-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1372-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-427-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2600-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/404-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/404-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-505-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2392-532-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1436-557-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1560-571-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1436-580-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2628-636-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/892-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-726-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1036-733-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2288-740-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-843-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1788-857-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-873-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2636-897-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-900-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1768-942-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1916 xrflxxx.exe 2180 nbtbhh.exe 2100 dpvvv.exe 2816 lxlrfff.exe 2708 bhthnt.exe 2852 7pddj.exe 2700 nbtnnn.exe 2604 5jdvj.exe 2724 rlffllr.exe 3028 dvppp.exe 636 dvjpd.exe 2840 9fxxxrx.exe 1712 hbbbtt.exe 1948 pdpvd.exe 2692 xlfxflr.exe 1932 nhbbnn.exe 1328 rfxxxxr.exe 2208 rlllrrx.exe 2288 bntttn.exe 1640 vpdjp.exe 2572 lfrxflr.exe 880 1nbhbb.exe 784 pdjdd.exe 1480 5pjjv.exe 2064 1tbttt.exe 788 1vjdv.exe 1764 xxxfllx.exe 2092 tbhnhh.exe 1960 vdjvv.exe 2072 1fffxrl.exe 1504 pdpvv.exe 1732 3jdjj.exe 2968 rxlffff.exe 1596 thtntt.exe 2404 9thhtn.exe 2080 ppvvd.exe 2864 9fllrlr.exe 2476 3rlxxxf.exe 2872 bnbhbh.exe 2944 bhhbhh.exe 2852 9pddd.exe 2600 rlxxflr.exe 2756 fxfxllx.exe 3004 htttth.exe 1840 htnthb.exe 1372 1ddpj.exe 3028 pjpvd.exe 684 lfxxfxf.exe 2432 hhtbht.exe 2912 tntbhh.exe 1896 jvjdd.exe 1316 9jpdd.exe 2664 3fllllf.exe 2888 fxfrflx.exe 1752 5tbttt.exe 2420 jdpvj.exe 2208 7thbnb.exe 404 vpddj.exe 1520 jdvvd.exe 1352 xrflrrf.exe 1736 htbbtt.exe 2204 dvjpd.exe 2960 xrffrxf.exe 1540 5lffrfr.exe -
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-466-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/404-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-505-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1560-571-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2080-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-969-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1026-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-1039-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-1064-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/648-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 1916 2504 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 30 PID 2504 wrote to memory of 1916 2504 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 30 PID 2504 wrote to memory of 1916 2504 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 30 PID 2504 wrote to memory of 1916 2504 2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe 30 PID 1916 wrote to memory of 2180 1916 xrflxxx.exe 31 PID 1916 wrote to memory of 2180 1916 xrflxxx.exe 31 PID 1916 wrote to memory of 2180 1916 xrflxxx.exe 31 PID 1916 wrote to memory of 2180 1916 xrflxxx.exe 31 PID 2180 wrote to memory of 2100 2180 nbtbhh.exe 32 PID 2180 wrote to memory of 2100 2180 nbtbhh.exe 32 PID 2180 wrote to memory of 2100 2180 nbtbhh.exe 32 PID 2180 wrote to memory of 2100 2180 nbtbhh.exe 32 PID 2100 wrote to memory of 2816 2100 dpvvv.exe 33 PID 2100 wrote to memory of 2816 2100 dpvvv.exe 33 PID 2100 wrote to memory of 2816 2100 dpvvv.exe 33 PID 2100 wrote to memory of 2816 2100 dpvvv.exe 33 PID 2816 wrote to memory of 2708 2816 lxlrfff.exe 34 PID 2816 wrote to memory of 2708 2816 lxlrfff.exe 34 PID 2816 wrote to memory of 2708 2816 lxlrfff.exe 34 PID 2816 wrote to memory of 2708 2816 lxlrfff.exe 34 PID 2708 wrote to memory of 2852 2708 bhthnt.exe 70 PID 2708 wrote to memory of 2852 2708 bhthnt.exe 70 PID 2708 wrote to memory of 2852 2708 bhthnt.exe 70 PID 2708 wrote to memory of 2852 2708 bhthnt.exe 70 PID 2852 wrote to memory of 2700 2852 7pddj.exe 36 PID 2852 wrote to memory of 2700 2852 7pddj.exe 36 PID 2852 wrote to memory of 2700 2852 7pddj.exe 36 PID 2852 wrote to memory of 2700 2852 7pddj.exe 36 PID 2700 wrote to memory of 2604 2700 nbtnnn.exe 37 PID 2700 wrote to memory of 2604 2700 nbtnnn.exe 37 PID 2700 wrote to memory of 2604 2700 nbtnnn.exe 37 PID 2700 wrote to memory of 2604 2700 nbtnnn.exe 37 PID 2604 wrote to memory of 2724 2604 5jdvj.exe 38 PID 2604 wrote to memory of 2724 2604 5jdvj.exe 38 PID 2604 wrote to memory of 2724 2604 5jdvj.exe 38 PID 2604 wrote to memory of 2724 2604 5jdvj.exe 38 PID 2724 wrote to memory of 3028 2724 rlffllr.exe 76 PID 2724 wrote to memory of 3028 2724 rlffllr.exe 76 PID 2724 wrote to memory of 3028 2724 rlffllr.exe 76 PID 2724 wrote to memory of 3028 2724 rlffllr.exe 76 PID 3028 wrote to memory of 636 3028 dvppp.exe 40 PID 3028 wrote to memory of 636 3028 dvppp.exe 40 PID 3028 wrote to memory of 636 3028 dvppp.exe 40 PID 3028 wrote to memory of 636 3028 dvppp.exe 40 PID 636 wrote to memory of 2840 636 dvjpd.exe 41 PID 636 wrote to memory of 2840 636 dvjpd.exe 41 PID 636 wrote to memory of 2840 636 dvjpd.exe 41 PID 636 wrote to memory of 2840 636 dvjpd.exe 41 PID 2840 wrote to memory of 1712 2840 9fxxxrx.exe 42 PID 2840 wrote to memory of 1712 2840 9fxxxrx.exe 42 PID 2840 wrote to memory of 1712 2840 9fxxxrx.exe 42 PID 2840 wrote to memory of 1712 2840 9fxxxrx.exe 42 PID 1712 wrote to memory of 1948 1712 hbbbtt.exe 43 PID 1712 wrote to memory of 1948 1712 hbbbtt.exe 43 PID 1712 wrote to memory of 1948 1712 hbbbtt.exe 43 PID 1712 wrote to memory of 1948 1712 hbbbtt.exe 43 PID 1948 wrote to memory of 2692 1948 pdpvd.exe 44 PID 1948 wrote to memory of 2692 1948 pdpvd.exe 44 PID 1948 wrote to memory of 2692 1948 pdpvd.exe 44 PID 1948 wrote to memory of 2692 1948 pdpvd.exe 44 PID 2692 wrote to memory of 1932 2692 xlfxflr.exe 45 PID 2692 wrote to memory of 1932 2692 xlfxflr.exe 45 PID 2692 wrote to memory of 1932 2692 xlfxflr.exe 45 PID 2692 wrote to memory of 1932 2692 xlfxflr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe"C:\Users\Admin\AppData\Local\Temp\2e9db0e04859b081d32d846cccf9daa17fad76d01c6cb1107e8ee98ee9cc3ea0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\xrflxxx.exec:\xrflxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\nbtbhh.exec:\nbtbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\dpvvv.exec:\dpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\lxlrfff.exec:\lxlrfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\bhthnt.exec:\bhthnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\7pddj.exec:\7pddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nbtnnn.exec:\nbtnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\5jdvj.exec:\5jdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rlffllr.exec:\rlffllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dvppp.exec:\dvppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\dvjpd.exec:\dvjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\9fxxxrx.exec:\9fxxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\hbbbtt.exec:\hbbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\pdpvd.exec:\pdpvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\xlfxflr.exec:\xlfxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nhbbnn.exec:\nhbbnn.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rfxxxxr.exec:\rfxxxxr.exe18⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rlllrrx.exec:\rlllrrx.exe19⤵
- Executes dropped EXE
PID:2208 -
\??\c:\bntttn.exec:\bntttn.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\vpdjp.exec:\vpdjp.exe21⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lfrxflr.exec:\lfrxflr.exe22⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1nbhbb.exec:\1nbhbb.exe23⤵
- Executes dropped EXE
PID:880 -
\??\c:\pdjdd.exec:\pdjdd.exe24⤵
- Executes dropped EXE
PID:784 -
\??\c:\5pjjv.exec:\5pjjv.exe25⤵
- Executes dropped EXE
PID:1480 -
\??\c:\1tbttt.exec:\1tbttt.exe26⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1vjdv.exec:\1vjdv.exe27⤵
- Executes dropped EXE
PID:788 -
\??\c:\xxxfllx.exec:\xxxfllx.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1764 -
\??\c:\tbhnhh.exec:\tbhnhh.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vdjvv.exec:\vdjvv.exe30⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1fffxrl.exec:\1fffxrl.exe31⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pdpvv.exec:\pdpvv.exe32⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3jdjj.exec:\3jdjj.exe33⤵
- Executes dropped EXE
PID:1732 -
\??\c:\rxlffff.exec:\rxlffff.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\thtntt.exec:\thtntt.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9thhtn.exec:\9thhtn.exe36⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ppvvd.exec:\ppvvd.exe37⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9fllrlr.exec:\9fllrlr.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3rlxxxf.exec:\3rlxxxf.exe39⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bnbhbh.exec:\bnbhbh.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bhhbhh.exec:\bhhbhh.exe41⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9pddd.exec:\9pddd.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rlxxflr.exec:\rlxxflr.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxfxllx.exec:\fxfxllx.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\htttth.exec:\htttth.exe45⤵
- Executes dropped EXE
PID:3004 -
\??\c:\htnthb.exec:\htnthb.exe46⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1ddpj.exec:\1ddpj.exe47⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pjpvd.exec:\pjpvd.exe48⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lfxxfxf.exec:\lfxxfxf.exe49⤵
- Executes dropped EXE
PID:684 -
\??\c:\hhtbht.exec:\hhtbht.exe50⤵
- Executes dropped EXE
PID:2432 -
\??\c:\tntbhh.exec:\tntbhh.exe51⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jvjdd.exec:\jvjdd.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\9jpdd.exec:\9jpdd.exe53⤵
- Executes dropped EXE
PID:1316 -
\??\c:\3fllllf.exec:\3fllllf.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\fxfrflx.exec:\fxfrflx.exe55⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5tbttt.exec:\5tbttt.exe56⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jdpvj.exec:\jdpvj.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7thbnb.exec:\7thbnb.exe58⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vpddj.exec:\vpddj.exe59⤵
- Executes dropped EXE
PID:404 -
\??\c:\jdvvd.exec:\jdvvd.exe60⤵
- Executes dropped EXE
PID:1520 -
\??\c:\xrflrrf.exec:\xrflrrf.exe61⤵
- Executes dropped EXE
PID:1352 -
\??\c:\htbbtt.exec:\htbbtt.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjpd.exec:\dvjpd.exe63⤵
- Executes dropped EXE
PID:2204 -
\??\c:\xrffrxf.exec:\xrffrxf.exe64⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5lffrfr.exec:\5lffrfr.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3hnthb.exec:\3hnthb.exe66⤵PID:316
-
\??\c:\jvppj.exec:\jvppj.exe67⤵PID:492
-
\??\c:\xrffllx.exec:\xrffllx.exe68⤵PID:972
-
\??\c:\frxfrrr.exec:\frxfrrr.exe69⤵PID:1244
-
\??\c:\hbthnh.exec:\hbthnh.exe70⤵PID:2392
-
\??\c:\jjddj.exec:\jjddj.exe71⤵PID:2092
-
\??\c:\btnthn.exec:\btnthn.exe72⤵PID:996
-
\??\c:\ppjpj.exec:\ppjpj.exe73⤵PID:1436
-
\??\c:\jvvpj.exec:\jvvpj.exe74⤵PID:2516
-
\??\c:\lfflxxf.exec:\lfflxxf.exe75⤵PID:1560
-
\??\c:\hhtntt.exec:\hhtntt.exe76⤵PID:1788
-
\??\c:\vpjjj.exec:\vpjjj.exe77⤵PID:1500
-
\??\c:\fxlrffl.exec:\fxlrffl.exe78⤵PID:2712
-
\??\c:\nhbhnt.exec:\nhbhnt.exe79⤵PID:2836
-
\??\c:\bnhbbh.exec:\bnhbbh.exe80⤵PID:2080
-
\??\c:\1pvdj.exec:\1pvdj.exe81⤵PID:2868
-
\??\c:\7jjdv.exec:\7jjdv.exe82⤵PID:2140
-
\??\c:\7rllllr.exec:\7rllllr.exe83⤵PID:2428
-
\??\c:\5nbttn.exec:\5nbttn.exe84⤵PID:2860
-
\??\c:\tbhntt.exec:\tbhntt.exe85⤵PID:2628
-
\??\c:\dvdvd.exec:\dvdvd.exe86⤵PID:2100
-
\??\c:\7jpjp.exec:\7jpjp.exe87⤵PID:3008
-
\??\c:\7flfffl.exec:\7flfffl.exe88⤵PID:280
-
\??\c:\hbtbhn.exec:\hbtbhn.exe89⤵PID:2232
-
\??\c:\pjddp.exec:\pjddp.exe90⤵PID:308
-
\??\c:\vjvdp.exec:\vjvdp.exe91⤵PID:892
-
\??\c:\7xlffxl.exec:\7xlffxl.exe92⤵PID:2988
-
\??\c:\7hbbhh.exec:\7hbbhh.exe93⤵PID:1320
-
\??\c:\bnthth.exec:\bnthth.exe94⤵PID:2884
-
\??\c:\5ddvv.exec:\5ddvv.exe95⤵PID:1992
-
\??\c:\ffxxllr.exec:\ffxxllr.exe96⤵PID:2588
-
\??\c:\lfrrffx.exec:\lfrrffx.exe97⤵PID:2780
-
\??\c:\thttbt.exec:\thttbt.exe98⤵PID:1512
-
\??\c:\5jddd.exec:\5jddd.exe99⤵PID:1108
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe100⤵PID:1036
-
\??\c:\1rfllll.exec:\1rfllll.exe101⤵PID:2288
-
\??\c:\nnhbbb.exec:\nnhbbb.exe102⤵PID:2084
-
\??\c:\jdvdv.exec:\jdvdv.exe103⤵PID:1520
-
\??\c:\vvjjd.exec:\vvjjd.exe104⤵PID:1308
-
\??\c:\rlxlxlf.exec:\rlxlxlf.exe105⤵PID:2004
-
\??\c:\thnnnn.exec:\thnnnn.exe106⤵PID:440
-
\??\c:\nhtbhn.exec:\nhtbhn.exe107⤵PID:2480
-
\??\c:\ppjpd.exec:\ppjpd.exe108⤵PID:1624
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe109⤵PID:480
-
\??\c:\bnhhbt.exec:\bnhhbt.exe110⤵PID:2172
-
\??\c:\pdvdd.exec:\pdvdd.exe111⤵PID:2324
-
\??\c:\jppvj.exec:\jppvj.exe112⤵PID:1764
-
\??\c:\3lrlrxx.exec:\3lrlrxx.exe113⤵PID:1552
-
\??\c:\hnbhnh.exec:\hnbhnh.exe114⤵PID:1776
-
\??\c:\hbttbb.exec:\hbttbb.exe115⤵PID:996
-
\??\c:\pjpjj.exec:\pjpjj.exe116⤵PID:2076
-
\??\c:\3vvpp.exec:\3vvpp.exe117⤵PID:2388
-
\??\c:\1xxrrrr.exec:\1xxrrrr.exe118⤵PID:1732
-
\??\c:\9tnnbb.exec:\9tnnbb.exe119⤵PID:1788
-
\??\c:\hnhbhb.exec:\hnhbhb.exe120⤵PID:2688
-
\??\c:\5jvpp.exec:\5jvpp.exe121⤵PID:2916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-