Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe
-
Size
454KB
-
MD5
f5d501ea9a4d0e174bc9b0577c0b27ae
-
SHA1
058bb6836936e389187475bdbb85571ff69d4663
-
SHA256
2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9
-
SHA512
c83da3e8ae7a52664fb3ee4db12cb5352123e1df81dbb6d6cce19a59f81c5b98735bfe6ec91a836c00ae1634a72d576692ba643462a68fdbc1b52881f10b1a2a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2756-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-91-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2496-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-150-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2092-170-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-380-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2100-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1456-651-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-731-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-736-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-749-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-970-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-996-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2968 tnhhhn.exe 2404 hbnttn.exe 2552 5dpjj.exe 2772 xlrlxlx.exe 2608 thbbbt.exe 1928 tnnntn.exe 332 thnhhh.exe 592 pjppp.exe 2108 hbnthb.exe 2144 jjdvj.exe 2888 rlfrrxf.exe 2496 bbbnbh.exe 2912 rlffllx.exe 2824 ddvdj.exe 2940 lrfxflx.exe 2436 3rfrflx.exe 2092 xfxxlrf.exe 2292 btbhhn.exe 2996 llxfrxr.exe 2988 pjpvd.exe 768 rxrrlrl.exe 1800 hhtthb.exe 1900 nhhhnn.exe 2356 ttntbb.exe 1692 1dvdj.exe 628 9rfffll.exe 2468 bhhbht.exe 1936 5lxlxfr.exe 2036 vjjdp.exe 1684 hhtbnn.exe 3028 dvppv.exe 1540 ttbnbh.exe 2848 9thnnn.exe 2692 1vdvp.exe 1592 rlxxllr.exe 2544 bhhtht.exe 1680 jvjpv.exe 2580 rflrllf.exe 2532 tnhbhh.exe 880 dpvvv.exe 1136 jdpjd.exe 1424 rlxflfl.exe 2152 9htbhb.exe 1868 ddppv.exe 2304 xlfxfxf.exe 2900 xrllrlr.exe 2884 nbthnn.exe 2496 dddjp.exe 2876 rlrxffr.exe 2904 hnhbhh.exe 2824 thnhtt.exe 1564 1vppd.exe 1720 lflllff.exe 2032 lfrxfrf.exe 2100 tnbtbt.exe 2788 dpdjp.exe 2412 rrfrflx.exe 1888 lflrxfl.exe 2408 nbnhtn.exe 1072 vpjpv.exe 1012 pdpvd.exe 3000 5fffxll.exe 2972 nhbbhh.exe 2044 7pddj.exe -
resource yara_rule behavioral1/memory/2968-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-884-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-943-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-996-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-1022-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2968 2756 2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe 30 PID 2756 wrote to memory of 2968 2756 2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe 30 PID 2756 wrote to memory of 2968 2756 2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe 30 PID 2756 wrote to memory of 2968 2756 2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe 30 PID 2968 wrote to memory of 2404 2968 tnhhhn.exe 31 PID 2968 wrote to memory of 2404 2968 tnhhhn.exe 31 PID 2968 wrote to memory of 2404 2968 tnhhhn.exe 31 PID 2968 wrote to memory of 2404 2968 tnhhhn.exe 31 PID 2404 wrote to memory of 2552 2404 hbnttn.exe 32 PID 2404 wrote to memory of 2552 2404 hbnttn.exe 32 PID 2404 wrote to memory of 2552 2404 hbnttn.exe 32 PID 2404 wrote to memory of 2552 2404 hbnttn.exe 32 PID 2552 wrote to memory of 2772 2552 5dpjj.exe 33 PID 2552 wrote to memory of 2772 2552 5dpjj.exe 33 PID 2552 wrote to memory of 2772 2552 5dpjj.exe 33 PID 2552 wrote to memory of 2772 2552 5dpjj.exe 33 PID 2772 wrote to memory of 2608 2772 xlrlxlx.exe 34 PID 2772 wrote to memory of 2608 2772 xlrlxlx.exe 34 PID 2772 wrote to memory of 2608 2772 xlrlxlx.exe 34 PID 2772 wrote to memory of 2608 2772 xlrlxlx.exe 34 PID 2608 wrote to memory of 1928 2608 thbbbt.exe 35 PID 2608 wrote to memory of 1928 2608 thbbbt.exe 35 PID 2608 wrote to memory of 1928 2608 thbbbt.exe 35 PID 2608 wrote to memory of 1928 2608 thbbbt.exe 35 PID 1928 wrote to memory of 332 1928 tnnntn.exe 36 PID 1928 wrote to memory of 332 1928 tnnntn.exe 36 PID 1928 wrote to memory of 332 1928 tnnntn.exe 36 PID 1928 wrote to memory of 332 1928 tnnntn.exe 36 PID 332 wrote to memory of 592 332 thnhhh.exe 37 PID 332 wrote to memory of 592 332 thnhhh.exe 37 PID 332 wrote to memory of 592 332 thnhhh.exe 37 PID 332 wrote to memory of 592 332 thnhhh.exe 37 PID 592 wrote to memory of 2108 592 pjppp.exe 38 PID 592 wrote to memory of 2108 592 pjppp.exe 38 PID 592 wrote to memory of 2108 592 pjppp.exe 38 PID 592 wrote to memory of 2108 592 pjppp.exe 38 PID 2108 wrote to memory of 2144 2108 hbnthb.exe 39 PID 2108 wrote to memory of 2144 2108 hbnthb.exe 39 PID 2108 wrote to memory of 2144 2108 hbnthb.exe 39 PID 2108 wrote to memory of 2144 2108 hbnthb.exe 39 PID 2144 wrote to memory of 2888 2144 jjdvj.exe 40 PID 2144 wrote to memory of 2888 2144 jjdvj.exe 40 PID 2144 wrote to memory of 2888 2144 jjdvj.exe 40 PID 2144 wrote to memory of 2888 2144 jjdvj.exe 40 PID 2888 wrote to memory of 2496 2888 rlfrrxf.exe 41 PID 2888 wrote to memory of 2496 2888 rlfrrxf.exe 41 PID 2888 wrote to memory of 2496 2888 rlfrrxf.exe 41 PID 2888 wrote to memory of 2496 2888 rlfrrxf.exe 41 PID 2496 wrote to memory of 2912 2496 bbbnbh.exe 42 PID 2496 wrote to memory of 2912 2496 bbbnbh.exe 42 PID 2496 wrote to memory of 2912 2496 bbbnbh.exe 42 PID 2496 wrote to memory of 2912 2496 bbbnbh.exe 42 PID 2912 wrote to memory of 2824 2912 rlffllx.exe 43 PID 2912 wrote to memory of 2824 2912 rlffllx.exe 43 PID 2912 wrote to memory of 2824 2912 rlffllx.exe 43 PID 2912 wrote to memory of 2824 2912 rlffllx.exe 43 PID 2824 wrote to memory of 2940 2824 ddvdj.exe 44 PID 2824 wrote to memory of 2940 2824 ddvdj.exe 44 PID 2824 wrote to memory of 2940 2824 ddvdj.exe 44 PID 2824 wrote to memory of 2940 2824 ddvdj.exe 44 PID 2940 wrote to memory of 2436 2940 lrfxflx.exe 45 PID 2940 wrote to memory of 2436 2940 lrfxflx.exe 45 PID 2940 wrote to memory of 2436 2940 lrfxflx.exe 45 PID 2940 wrote to memory of 2436 2940 lrfxflx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe"C:\Users\Admin\AppData\Local\Temp\2f120824aba5b994224413939b621ec95585d704b3926a586a57094d82b8edf9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tnhhhn.exec:\tnhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\hbnttn.exec:\hbnttn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\5dpjj.exec:\5dpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\xlrlxlx.exec:\xlrlxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\thbbbt.exec:\thbbbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnnntn.exec:\tnnntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\thnhhh.exec:\thnhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\pjppp.exec:\pjppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\hbnthb.exec:\hbnthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\jjdvj.exec:\jjdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bbbnbh.exec:\bbbnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rlffllx.exec:\rlffllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\ddvdj.exec:\ddvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lrfxflx.exec:\lrfxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\3rfrflx.exec:\3rfrflx.exe17⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xfxxlrf.exec:\xfxxlrf.exe18⤵
- Executes dropped EXE
PID:2092 -
\??\c:\btbhhn.exec:\btbhhn.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\llxfrxr.exec:\llxfrxr.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pjpvd.exec:\pjpvd.exe21⤵
- Executes dropped EXE
PID:2988 -
\??\c:\rxrrlrl.exec:\rxrrlrl.exe22⤵
- Executes dropped EXE
PID:768 -
\??\c:\hhtthb.exec:\hhtthb.exe23⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhhhnn.exec:\nhhhnn.exe24⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ttntbb.exec:\ttntbb.exe25⤵
- Executes dropped EXE
PID:2356 -
\??\c:\1dvdj.exec:\1dvdj.exe26⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9rfffll.exec:\9rfffll.exe27⤵
- Executes dropped EXE
PID:628 -
\??\c:\bhhbht.exec:\bhhbht.exe28⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5lxlxfr.exec:\5lxlxfr.exe29⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vjjdp.exec:\vjjdp.exe30⤵
- Executes dropped EXE
PID:2036 -
\??\c:\hhtbnn.exec:\hhtbnn.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dvppv.exec:\dvppv.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ttbnbh.exec:\ttbnbh.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\9thnnn.exec:\9thnnn.exe34⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1vdvp.exec:\1vdvp.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rlxxllr.exec:\rlxxllr.exe36⤵
- Executes dropped EXE
PID:1592 -
\??\c:\bhhtht.exec:\bhhtht.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jvjpv.exec:\jvjpv.exe38⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rflrllf.exec:\rflrllf.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnhbhh.exec:\tnhbhh.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dpvvv.exec:\dpvvv.exe41⤵
- Executes dropped EXE
PID:880 -
\??\c:\jdpjd.exec:\jdpjd.exe42⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rlxflfl.exec:\rlxflfl.exe43⤵
- Executes dropped EXE
PID:1424 -
\??\c:\9htbhb.exec:\9htbhb.exe44⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ddppv.exec:\ddppv.exe45⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xlfxfxf.exec:\xlfxfxf.exe46⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xrllrlr.exec:\xrllrlr.exe47⤵
- Executes dropped EXE
PID:2900 -
\??\c:\nbthnn.exec:\nbthnn.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dddjp.exec:\dddjp.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rlrxffr.exec:\rlrxffr.exe50⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hnhbhh.exec:\hnhbhh.exe51⤵
- Executes dropped EXE
PID:2904 -
\??\c:\thnhtt.exec:\thnhtt.exe52⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1vppd.exec:\1vppd.exe53⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lflllff.exec:\lflllff.exe54⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\tnbtbt.exec:\tnbtbt.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\dpdjp.exec:\dpdjp.exe57⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrfrflx.exec:\rrfrflx.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\lflrxfl.exec:\lflrxfl.exe59⤵
- Executes dropped EXE
PID:1888 -
\??\c:\nbnhtn.exec:\nbnhtn.exe60⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vpjpv.exec:\vpjpv.exe61⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pdpvd.exec:\pdpvd.exe62⤵
- Executes dropped EXE
PID:1012 -
\??\c:\5fffxll.exec:\5fffxll.exe63⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nhbbhh.exec:\nhbbhh.exe64⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7pddj.exec:\7pddj.exe65⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7xrxxrx.exec:\7xrxxrx.exe66⤵
- System Location Discovery: System Language Discovery
PID:2364 -
\??\c:\1xxxrlr.exec:\1xxxrlr.exe67⤵PID:920
-
\??\c:\hthttn.exec:\hthttn.exe68⤵PID:2320
-
\??\c:\vjvvd.exec:\vjvvd.exe69⤵PID:272
-
\??\c:\1xlrxfr.exec:\1xlrxfr.exe70⤵PID:2468
-
\??\c:\nnhtbb.exec:\nnhtbb.exe71⤵PID:2040
-
\??\c:\3htntt.exec:\3htntt.exe72⤵PID:2188
-
\??\c:\dvvdv.exec:\dvvdv.exe73⤵PID:2676
-
\??\c:\rlrxxrx.exec:\rlrxxrx.exe74⤵PID:1684
-
\??\c:\hbntbh.exec:\hbntbh.exe75⤵PID:1504
-
\??\c:\7nhhhh.exec:\7nhhhh.exe76⤵PID:2536
-
\??\c:\1dpvd.exec:\1dpvd.exe77⤵PID:2684
-
\??\c:\dpddp.exec:\dpddp.exe78⤵PID:2404
-
\??\c:\fxrxfff.exec:\fxrxfff.exe79⤵PID:2552
-
\??\c:\bbbbbh.exec:\bbbbbh.exe80⤵PID:2584
-
\??\c:\pvpdv.exec:\pvpdv.exe81⤵PID:2604
-
\??\c:\fxllrxf.exec:\fxllrxf.exe82⤵PID:2700
-
\??\c:\nhnhhh.exec:\nhnhhh.exe83⤵PID:604
-
\??\c:\7bbtnn.exec:\7bbtnn.exe84⤵PID:580
-
\??\c:\jvpjp.exec:\jvpjp.exe85⤵PID:624
-
\??\c:\xxrxllx.exec:\xxrxllx.exe86⤵PID:2076
-
\??\c:\7tbbhn.exec:\7tbbhn.exe87⤵PID:1456
-
\??\c:\nhbhbh.exec:\nhbhbh.exe88⤵PID:1868
-
\??\c:\jdpdj.exec:\jdpdj.exe89⤵PID:2124
-
\??\c:\7rfrrrr.exec:\7rfrrrr.exe90⤵PID:2900
-
\??\c:\fxfxfff.exec:\fxfxfff.exe91⤵PID:2888
-
\??\c:\hbtttt.exec:\hbtttt.exe92⤵PID:2748
-
\??\c:\vpdjj.exec:\vpdjj.exe93⤵PID:2876
-
\??\c:\9pjdj.exec:\9pjdj.exe94⤵PID:2948
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe95⤵PID:1736
-
\??\c:\3btbbt.exec:\3btbbt.exe96⤵PID:1932
-
\??\c:\jdvdp.exec:\jdvdp.exe97⤵PID:1720
-
\??\c:\vvppd.exec:\vvppd.exe98⤵PID:2032
-
\??\c:\xxlrflx.exec:\xxlrflx.exe99⤵PID:1980
-
\??\c:\tbnnbt.exec:\tbnnbt.exe100⤵PID:2788
-
\??\c:\htntbb.exec:\htntbb.exe101⤵PID:2192
-
\??\c:\ddvdj.exec:\ddvdj.exe102⤵PID:2988
-
\??\c:\5xxlfff.exec:\5xxlfff.exe103⤵PID:2420
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe104⤵PID:1420
-
\??\c:\htntnh.exec:\htntnh.exe105⤵PID:1620
-
\??\c:\7dppp.exec:\7dppp.exe106⤵PID:2120
-
\??\c:\xrlrffr.exec:\xrlrffr.exe107⤵PID:2972
-
\??\c:\fxrfffr.exec:\fxrfffr.exe108⤵PID:968
-
\??\c:\hhhntn.exec:\hhhntn.exe109⤵PID:568
-
\??\c:\jjdjv.exec:\jjdjv.exe110⤵PID:1712
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe111⤵PID:1284
-
\??\c:\1lxllxr.exec:\1lxllxr.exe112⤵PID:1996
-
\??\c:\bthbht.exec:\bthbht.exe113⤵PID:1004
-
\??\c:\pjppj.exec:\pjppj.exe114⤵PID:932
-
\??\c:\9pddd.exec:\9pddd.exe115⤵PID:2188
-
\??\c:\xlrllfl.exec:\xlrllfl.exe116⤵PID:2764
-
\??\c:\tnbhbb.exec:\tnbhbb.exe117⤵PID:2776
-
\??\c:\vjdjv.exec:\vjdjv.exe118⤵PID:2656
-
\??\c:\bnbbbb.exec:\bnbbbb.exe119⤵PID:2664
-
\??\c:\djddp.exec:\djddp.exe120⤵PID:2696
-
\??\c:\rlxlrff.exec:\rlxlrff.exe121⤵PID:2404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-