Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe
-
Size
454KB
-
MD5
6eb9a4596d14f5bd8e3d6403b3ee2012
-
SHA1
996feb705a86e00b5f1e17ef0dd5b6a6e43239d9
-
SHA256
6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7
-
SHA512
673e07ca57e01e4880f1efa1e6fb996a12b22178948e1e68496741e56c1adedd15699a4361110e5580621730257ce51ed896d816b44eac0be24ebb21d3c0dd20
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2636-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-120-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2964-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2392-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-383-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/692-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-457-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/772-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-465-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2392-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-492-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/344-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1176-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-869-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2752 rxlrlxr.exe 2632 5lxfllx.exe 2176 ntbhnb.exe 2852 1xxxllx.exe 1676 hhhnnb.exe 2560 3fflrrf.exe 2168 bnbnth.exe 1496 lrflrxf.exe 1960 hnhnbh.exe 2232 fllflrl.exe 2112 1fxlrrf.exe 2964 rrlfrff.exe 2848 7hnntb.exe 2884 9rrxflr.exe 1064 tththn.exe 2508 3frlxfr.exe 1604 tthhhh.exe 2092 ddddj.exe 2392 xxlflrr.exe 2120 llxlxxl.exe 976 1bhtht.exe 1644 1xxfrxr.exe 1752 7htntt.exe 1628 rxllrxl.exe 296 1fxflrx.exe 1744 ppdpd.exe 2492 xxfflrr.exe 2056 1vddj.exe 1276 fxxllfr.exe 1176 nnbhnb.exe 868 vdpvj.exe 2668 nbnhnt.exe 1576 ppppj.exe 1572 rxrxflr.exe 2788 hhbbnn.exe 2704 ppvvv.exe 3040 1pjvp.exe 2824 3rlrxlx.exe 2548 5bnntt.exe 3012 jdvvd.exe 2560 xlxllrf.exe 3064 bhhhtt.exe 448 1hhhtt.exe 2960 ddpvd.exe 1960 xxrlfrr.exe 2100 bbnthn.exe 692 vvjpp.exe 2208 llfflrx.exe 1068 hhntbh.exe 2860 jpddj.exe 2848 vvpvj.exe 2872 xfxlrxr.exe 1700 tbtbht.exe 332 vdjvd.exe 772 5xlrlfr.exe 324 lrllffr.exe 2220 bhtthn.exe 2364 5xflxfl.exe 2392 flxflxf.exe 2280 nnhnnb.exe 1084 3hhnht.exe 1492 vdpdp.exe 2064 1xrlrfl.exe 344 tthhnt.exe -
resource yara_rule behavioral1/memory/2636-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-441-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/772-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-771-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-837-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-876-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2752 2636 6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe 30 PID 2636 wrote to memory of 2752 2636 6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe 30 PID 2636 wrote to memory of 2752 2636 6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe 30 PID 2636 wrote to memory of 2752 2636 6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe 30 PID 2752 wrote to memory of 2632 2752 rxlrlxr.exe 31 PID 2752 wrote to memory of 2632 2752 rxlrlxr.exe 31 PID 2752 wrote to memory of 2632 2752 rxlrlxr.exe 31 PID 2752 wrote to memory of 2632 2752 rxlrlxr.exe 31 PID 2632 wrote to memory of 2176 2632 5lxfllx.exe 32 PID 2632 wrote to memory of 2176 2632 5lxfllx.exe 32 PID 2632 wrote to memory of 2176 2632 5lxfllx.exe 32 PID 2632 wrote to memory of 2176 2632 5lxfllx.exe 32 PID 2176 wrote to memory of 2852 2176 ntbhnb.exe 33 PID 2176 wrote to memory of 2852 2176 ntbhnb.exe 33 PID 2176 wrote to memory of 2852 2176 ntbhnb.exe 33 PID 2176 wrote to memory of 2852 2176 ntbhnb.exe 33 PID 2852 wrote to memory of 1676 2852 1xxxllx.exe 34 PID 2852 wrote to memory of 1676 2852 1xxxllx.exe 34 PID 2852 wrote to memory of 1676 2852 1xxxllx.exe 34 PID 2852 wrote to memory of 1676 2852 1xxxllx.exe 34 PID 1676 wrote to memory of 2560 1676 hhhnnb.exe 35 PID 1676 wrote to memory of 2560 1676 hhhnnb.exe 35 PID 1676 wrote to memory of 2560 1676 hhhnnb.exe 35 PID 1676 wrote to memory of 2560 1676 hhhnnb.exe 35 PID 2560 wrote to memory of 2168 2560 3fflrrf.exe 36 PID 2560 wrote to memory of 2168 2560 3fflrrf.exe 36 PID 2560 wrote to memory of 2168 2560 3fflrrf.exe 36 PID 2560 wrote to memory of 2168 2560 3fflrrf.exe 36 PID 2168 wrote to memory of 1496 2168 bnbnth.exe 37 PID 2168 wrote to memory of 1496 2168 bnbnth.exe 37 PID 2168 wrote to memory of 1496 2168 bnbnth.exe 37 PID 2168 wrote to memory of 1496 2168 bnbnth.exe 37 PID 1496 wrote to memory of 1960 1496 lrflrxf.exe 38 PID 1496 wrote to memory of 1960 1496 lrflrxf.exe 38 PID 1496 wrote to memory of 1960 1496 lrflrxf.exe 38 PID 1496 wrote to memory of 1960 1496 lrflrxf.exe 38 PID 1960 wrote to memory of 2232 1960 hnhnbh.exe 39 PID 1960 wrote to memory of 2232 1960 hnhnbh.exe 39 PID 1960 wrote to memory of 2232 1960 hnhnbh.exe 39 PID 1960 wrote to memory of 2232 1960 hnhnbh.exe 39 PID 2232 wrote to memory of 2112 2232 fllflrl.exe 40 PID 2232 wrote to memory of 2112 2232 fllflrl.exe 40 PID 2232 wrote to memory of 2112 2232 fllflrl.exe 40 PID 2232 wrote to memory of 2112 2232 fllflrl.exe 40 PID 2112 wrote to memory of 2964 2112 1fxlrrf.exe 41 PID 2112 wrote to memory of 2964 2112 1fxlrrf.exe 41 PID 2112 wrote to memory of 2964 2112 1fxlrrf.exe 41 PID 2112 wrote to memory of 2964 2112 1fxlrrf.exe 41 PID 2964 wrote to memory of 2848 2964 rrlfrff.exe 42 PID 2964 wrote to memory of 2848 2964 rrlfrff.exe 42 PID 2964 wrote to memory of 2848 2964 rrlfrff.exe 42 PID 2964 wrote to memory of 2848 2964 rrlfrff.exe 42 PID 2848 wrote to memory of 2884 2848 7hnntb.exe 43 PID 2848 wrote to memory of 2884 2848 7hnntb.exe 43 PID 2848 wrote to memory of 2884 2848 7hnntb.exe 43 PID 2848 wrote to memory of 2884 2848 7hnntb.exe 43 PID 2884 wrote to memory of 1064 2884 9rrxflr.exe 44 PID 2884 wrote to memory of 1064 2884 9rrxflr.exe 44 PID 2884 wrote to memory of 1064 2884 9rrxflr.exe 44 PID 2884 wrote to memory of 1064 2884 9rrxflr.exe 44 PID 1064 wrote to memory of 2508 1064 tththn.exe 45 PID 1064 wrote to memory of 2508 1064 tththn.exe 45 PID 1064 wrote to memory of 2508 1064 tththn.exe 45 PID 1064 wrote to memory of 2508 1064 tththn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe"C:\Users\Admin\AppData\Local\Temp\6cd650fbce79f4bb30bea7757fa13f9cf889c23a8b6bb4e54d6e78ebadaf5fe7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rxlrlxr.exec:\rxlrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\5lxfllx.exec:\5lxfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\ntbhnb.exec:\ntbhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\1xxxllx.exec:\1xxxllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\hhhnnb.exec:\hhhnnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\3fflrrf.exec:\3fflrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bnbnth.exec:\bnbnth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\lrflrxf.exec:\lrflrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\hnhnbh.exec:\hnhnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\fllflrl.exec:\fllflrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\1fxlrrf.exec:\1fxlrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\rrlfrff.exec:\rrlfrff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\7hnntb.exec:\7hnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\9rrxflr.exec:\9rrxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tththn.exec:\tththn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\3frlxfr.exec:\3frlxfr.exe17⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tthhhh.exec:\tthhhh.exe18⤵
- Executes dropped EXE
PID:1604 -
\??\c:\ddddj.exec:\ddddj.exe19⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xxlflrr.exec:\xxlflrr.exe20⤵
- Executes dropped EXE
PID:2392 -
\??\c:\llxlxxl.exec:\llxlxxl.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\1bhtht.exec:\1bhtht.exe22⤵
- Executes dropped EXE
PID:976 -
\??\c:\1xxfrxr.exec:\1xxfrxr.exe23⤵
- Executes dropped EXE
PID:1644 -
\??\c:\7htntt.exec:\7htntt.exe24⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rxllrxl.exec:\rxllrxl.exe25⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1fxflrx.exec:\1fxflrx.exe26⤵
- Executes dropped EXE
PID:296 -
\??\c:\ppdpd.exec:\ppdpd.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xxfflrr.exec:\xxfflrr.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1vddj.exec:\1vddj.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\fxxllfr.exec:\fxxllfr.exe30⤵
- Executes dropped EXE
PID:1276 -
\??\c:\nnbhnb.exec:\nnbhnb.exe31⤵
- Executes dropped EXE
PID:1176 -
\??\c:\vdpvj.exec:\vdpvj.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\nbnhnt.exec:\nbnhnt.exe33⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ppppj.exec:\ppppj.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rxrxflr.exec:\rxrxflr.exe35⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hhbbnn.exec:\hhbbnn.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ppvvv.exec:\ppvvv.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1pjvp.exec:\1pjvp.exe38⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3rlrxlx.exec:\3rlrxlx.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5bnntt.exec:\5bnntt.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jdvvd.exec:\jdvvd.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlxllrf.exec:\xlxllrf.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bhhhtt.exec:\bhhhtt.exe43⤵
- Executes dropped EXE
PID:3064 -
\??\c:\1hhhtt.exec:\1hhhtt.exe44⤵
- Executes dropped EXE
PID:448 -
\??\c:\ddpvd.exec:\ddpvd.exe45⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xxrlfrr.exec:\xxrlfrr.exe46⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bbnthn.exec:\bbnthn.exe47⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vvjpp.exec:\vvjpp.exe48⤵
- Executes dropped EXE
PID:692 -
\??\c:\llfflrx.exec:\llfflrx.exe49⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hhntbh.exec:\hhntbh.exe50⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jpddj.exec:\jpddj.exe51⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vvpvj.exec:\vvpvj.exe52⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xfxlrxr.exec:\xfxlrxr.exe53⤵
- Executes dropped EXE
PID:2872 -
\??\c:\tbtbht.exec:\tbtbht.exe54⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vdjvd.exec:\vdjvd.exe55⤵
- Executes dropped EXE
PID:332 -
\??\c:\5xlrlfr.exec:\5xlrlfr.exe56⤵
- Executes dropped EXE
PID:772 -
\??\c:\lrllffr.exec:\lrllffr.exe57⤵
- Executes dropped EXE
PID:324 -
\??\c:\bhtthn.exec:\bhtthn.exe58⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5xflxfl.exec:\5xflxfl.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\flxflxf.exec:\flxflxf.exe60⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nnhnnb.exec:\nnhnnb.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3hhnht.exec:\3hhnht.exe62⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vdpdp.exec:\vdpdp.exe63⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1xrlrfl.exec:\1xrlrfl.exe64⤵
- Executes dropped EXE
PID:2064 -
\??\c:\tthhnt.exec:\tthhnt.exe65⤵
- Executes dropped EXE
PID:344 -
\??\c:\vdpvv.exec:\vdpvv.exe66⤵PID:1340
-
\??\c:\9rlxflx.exec:\9rlxflx.exe67⤵PID:1584
-
\??\c:\lrflrxl.exec:\lrflrxl.exe68⤵PID:1772
-
\??\c:\hnbnbh.exec:\hnbnbh.exe69⤵PID:2492
-
\??\c:\jvppd.exec:\jvppd.exe70⤵PID:1096
-
\??\c:\fxrrfrl.exec:\fxrrfrl.exe71⤵PID:1756
-
\??\c:\hnhnbh.exec:\hnhnbh.exe72⤵PID:1176
-
\??\c:\tbhnbh.exec:\tbhnbh.exe73⤵PID:2832
-
\??\c:\djvvj.exec:\djvvj.exe74⤵PID:2636
-
\??\c:\llxxflx.exec:\llxxflx.exe75⤵PID:2352
-
\??\c:\nbnthb.exec:\nbnthb.exe76⤵PID:2760
-
\??\c:\nbntbh.exec:\nbntbh.exe77⤵PID:2780
-
\??\c:\dpjjv.exec:\dpjjv.exe78⤵PID:2672
-
\??\c:\5rfflrx.exec:\5rfflrx.exe79⤵PID:2340
-
\??\c:\bhnthn.exec:\bhnthn.exe80⤵PID:2664
-
\??\c:\hnbhnb.exec:\hnbhnb.exe81⤵PID:2556
-
\??\c:\jpdjd.exec:\jpdjd.exe82⤵PID:2600
-
\??\c:\rxllrrf.exec:\rxllrrf.exe83⤵PID:1640
-
\??\c:\1fflrxl.exec:\1fflrxl.exe84⤵PID:3060
-
\??\c:\ntntnt.exec:\ntntnt.exe85⤵PID:2708
-
\??\c:\9pjpd.exec:\9pjpd.exe86⤵PID:1496
-
\??\c:\jvjpv.exec:\jvjpv.exe87⤵PID:468
-
\??\c:\rxrrrxr.exec:\rxrrrxr.exe88⤵PID:2172
-
\??\c:\hnbhhn.exec:\hnbhhn.exe89⤵PID:2124
-
\??\c:\bhbnbh.exec:\bhbnbh.exe90⤵PID:2112
-
\??\c:\jpdpv.exec:\jpdpv.exe91⤵PID:2744
-
\??\c:\1xrrflx.exec:\1xrrflx.exe92⤵PID:2784
-
\??\c:\3nnnth.exec:\3nnnth.exe93⤵PID:2912
-
\??\c:\hntbhh.exec:\hntbhh.exe94⤵PID:2344
-
\??\c:\pjvdj.exec:\pjvdj.exe95⤵PID:2164
-
\??\c:\9ffllrl.exec:\9ffllrl.exe96⤵PID:1888
-
\??\c:\ttnthn.exec:\ttnthn.exe97⤵PID:1724
-
\??\c:\5nnthn.exec:\5nnthn.exe98⤵PID:332
-
\??\c:\vvpvd.exec:\vvpvd.exe99⤵PID:772
-
\??\c:\rxxlfrl.exec:\rxxlfrl.exe100⤵PID:2356
-
\??\c:\hnntbh.exec:\hnntbh.exe101⤵PID:1236
-
\??\c:\tbbnbh.exec:\tbbnbh.exe102⤵PID:2272
-
\??\c:\pvjvj.exec:\pvjvj.exe103⤵PID:2120
-
\??\c:\rxxrrxr.exec:\rxxrrxr.exe104⤵PID:1812
-
\??\c:\bbnbnb.exec:\bbnbnb.exe105⤵PID:2416
-
\??\c:\nhhtht.exec:\nhhtht.exe106⤵PID:1508
-
\??\c:\pvppd.exec:\pvppd.exe107⤵PID:816
-
\??\c:\1rllfxl.exec:\1rllfxl.exe108⤵PID:492
-
\??\c:\rxrflxr.exec:\rxrflxr.exe109⤵PID:296
-
\??\c:\hthhhn.exec:\hthhhn.exe110⤵PID:2308
-
\??\c:\jjjvd.exec:\jjjvd.exe111⤵PID:2968
-
\??\c:\3llrxfr.exec:\3llrxfr.exe112⤵PID:2056
-
\??\c:\9rrrfrl.exec:\9rrrfrl.exe113⤵PID:1516
-
\??\c:\tbtbnh.exec:\tbtbnh.exe114⤵PID:1124
-
\??\c:\jvjpd.exec:\jvjpd.exe115⤵
- System Location Discovery: System Language Discovery
PID:2836 -
\??\c:\xxrxfxx.exec:\xxrxfxx.exe116⤵PID:2276
-
\??\c:\nhtbnn.exec:\nhtbnn.exe117⤵PID:2668
-
\??\c:\7tntbt.exec:\7tntbt.exe118⤵PID:2940
-
\??\c:\7vjvj.exec:\7vjvj.exe119⤵PID:2352
-
\??\c:\lxrrxlx.exec:\lxrrxlx.exe120⤵PID:2760
-
\??\c:\7rlxrxl.exec:\7rlxrxl.exe121⤵PID:2932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-