Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe
-
Size
456KB
-
MD5
cda80708b9e86fc9463d251970cc4640
-
SHA1
1017bf88044459a00eaa827bac148b1b8958972c
-
SHA256
991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30c
-
SHA512
64735fcb47d704ed080746883ba0012fa5eef889c219bef60f70a08479fa972acfe7c4caca23d9797dd847c3e334c2ff560b9222da12f91ddfc2f1d86ef6662a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeY:q7Tc2NYHUrAwfMp3CDY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-42-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2684-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-122-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1948-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-140-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-276-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2372-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-309-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-481-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1280-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-527-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/548-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-577-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-597-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-903-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-1115-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2944-1132-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2644-1227-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/804-1255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-1304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2264 rlxlxrf.exe 2992 jdpjv.exe 2544 hbttbb.exe 2684 jdppj.exe 2816 tttbnt.exe 2836 thbhbb.exe 2692 jdvdj.exe 2712 hbnnnn.exe 2572 1vpdj.exe 2968 rfrrlrf.exe 560 1htnbb.exe 1948 dvjjj.exe 324 lflflrx.exe 1708 5fxxffl.exe 1892 vvjpv.exe 1844 thbhtt.exe 1044 ddpvd.exe 1580 hbttbb.exe 1684 pdjjv.exe 2952 9dpvd.exe 536 bnbhnb.exe 3052 frfxrxl.exe 1672 jvddj.exe 1108 rfxrfxr.exe 1224 tnttbh.exe 1596 jvddj.exe 936 hhbbtt.exe 2464 7dvdp.exe 1976 ttntbh.exe 1604 5bthnh.exe 808 fxxfxfx.exe 1996 3btbnt.exe 2372 xxrxlrf.exe 2956 rxxxxlx.exe 2384 7bnnnt.exe 2352 pvvjp.exe 3060 vpdpd.exe 2784 3xxfllr.exe 2856 btnbnt.exe 2708 9ppjv.exe 2860 9dvvv.exe 2768 fxllrxf.exe 2600 hhbbbb.exe 2596 ttnthn.exe 2640 9vvdv.exe 2208 ffxllrx.exe 1852 fxrfffl.exe 1388 nnhtbb.exe 1836 5pjjj.exe 2020 xxrxfrf.exe 1720 1lxfrrx.exe 2328 hnhnhh.exe 1992 ddpvv.exe 1952 pjpvd.exe 1668 1lrrrxl.exe 1192 nhthbh.exe 2224 5tnntt.exe 2388 dvvvp.exe 772 1llfrxf.exe 964 rlxxxxf.exe 320 9htttb.exe 1280 9jpjv.exe 968 1dvvp.exe 1776 xrlrlrl.exe -
resource yara_rule behavioral1/memory/2496-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-256-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1996-291-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2372-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-903-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-979-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-1209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-1242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-1255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-1304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-2398-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2264 2496 991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe 30 PID 2496 wrote to memory of 2264 2496 991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe 30 PID 2496 wrote to memory of 2264 2496 991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe 30 PID 2496 wrote to memory of 2264 2496 991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe 30 PID 2264 wrote to memory of 2992 2264 rlxlxrf.exe 31 PID 2264 wrote to memory of 2992 2264 rlxlxrf.exe 31 PID 2264 wrote to memory of 2992 2264 rlxlxrf.exe 31 PID 2264 wrote to memory of 2992 2264 rlxlxrf.exe 31 PID 2992 wrote to memory of 2544 2992 jdpjv.exe 32 PID 2992 wrote to memory of 2544 2992 jdpjv.exe 32 PID 2992 wrote to memory of 2544 2992 jdpjv.exe 32 PID 2992 wrote to memory of 2544 2992 jdpjv.exe 32 PID 2544 wrote to memory of 2684 2544 hbttbb.exe 33 PID 2544 wrote to memory of 2684 2544 hbttbb.exe 33 PID 2544 wrote to memory of 2684 2544 hbttbb.exe 33 PID 2544 wrote to memory of 2684 2544 hbttbb.exe 33 PID 2684 wrote to memory of 2816 2684 jdppj.exe 34 PID 2684 wrote to memory of 2816 2684 jdppj.exe 34 PID 2684 wrote to memory of 2816 2684 jdppj.exe 34 PID 2684 wrote to memory of 2816 2684 jdppj.exe 34 PID 2816 wrote to memory of 2836 2816 tttbnt.exe 35 PID 2816 wrote to memory of 2836 2816 tttbnt.exe 35 PID 2816 wrote to memory of 2836 2816 tttbnt.exe 35 PID 2816 wrote to memory of 2836 2816 tttbnt.exe 35 PID 2836 wrote to memory of 2692 2836 thbhbb.exe 36 PID 2836 wrote to memory of 2692 2836 thbhbb.exe 36 PID 2836 wrote to memory of 2692 2836 thbhbb.exe 36 PID 2836 wrote to memory of 2692 2836 thbhbb.exe 36 PID 2692 wrote to memory of 2712 2692 jdvdj.exe 37 PID 2692 wrote to memory of 2712 2692 jdvdj.exe 37 PID 2692 wrote to memory of 2712 2692 jdvdj.exe 37 PID 2692 wrote to memory of 2712 2692 jdvdj.exe 37 PID 2712 wrote to memory of 2572 2712 hbnnnn.exe 38 PID 2712 wrote to memory of 2572 2712 hbnnnn.exe 38 PID 2712 wrote to memory of 2572 2712 hbnnnn.exe 38 PID 2712 wrote to memory of 2572 2712 hbnnnn.exe 38 PID 2572 wrote to memory of 2968 2572 1vpdj.exe 39 PID 2572 wrote to memory of 2968 2572 1vpdj.exe 39 PID 2572 wrote to memory of 2968 2572 1vpdj.exe 39 PID 2572 wrote to memory of 2968 2572 1vpdj.exe 39 PID 2968 wrote to memory of 560 2968 rfrrlrf.exe 40 PID 2968 wrote to memory of 560 2968 rfrrlrf.exe 40 PID 2968 wrote to memory of 560 2968 rfrrlrf.exe 40 PID 2968 wrote to memory of 560 2968 rfrrlrf.exe 40 PID 560 wrote to memory of 1948 560 1htnbb.exe 41 PID 560 wrote to memory of 1948 560 1htnbb.exe 41 PID 560 wrote to memory of 1948 560 1htnbb.exe 41 PID 560 wrote to memory of 1948 560 1htnbb.exe 41 PID 1948 wrote to memory of 324 1948 dvjjj.exe 42 PID 1948 wrote to memory of 324 1948 dvjjj.exe 42 PID 1948 wrote to memory of 324 1948 dvjjj.exe 42 PID 1948 wrote to memory of 324 1948 dvjjj.exe 42 PID 324 wrote to memory of 1708 324 lflflrx.exe 43 PID 324 wrote to memory of 1708 324 lflflrx.exe 43 PID 324 wrote to memory of 1708 324 lflflrx.exe 43 PID 324 wrote to memory of 1708 324 lflflrx.exe 43 PID 1708 wrote to memory of 1892 1708 5fxxffl.exe 44 PID 1708 wrote to memory of 1892 1708 5fxxffl.exe 44 PID 1708 wrote to memory of 1892 1708 5fxxffl.exe 44 PID 1708 wrote to memory of 1892 1708 5fxxffl.exe 44 PID 1892 wrote to memory of 1844 1892 vvjpv.exe 45 PID 1892 wrote to memory of 1844 1892 vvjpv.exe 45 PID 1892 wrote to memory of 1844 1892 vvjpv.exe 45 PID 1892 wrote to memory of 1844 1892 vvjpv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe"C:\Users\Admin\AppData\Local\Temp\991b9595b3b73c344647c3ad30389bb49b5573ba8edd8a9c5297bda44e63d30cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\rlxlxrf.exec:\rlxlxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\jdpjv.exec:\jdpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hbttbb.exec:\hbttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jdppj.exec:\jdppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\tttbnt.exec:\tttbnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\thbhbb.exec:\thbhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jdvdj.exec:\jdvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hbnnnn.exec:\hbnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1vpdj.exec:\1vpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rfrrlrf.exec:\rfrrlrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1htnbb.exec:\1htnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\dvjjj.exec:\dvjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\lflflrx.exec:\lflflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\5fxxffl.exec:\5fxxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\vvjpv.exec:\vvjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\thbhtt.exec:\thbhtt.exe17⤵
- Executes dropped EXE
PID:1844 -
\??\c:\ddpvd.exec:\ddpvd.exe18⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hbttbb.exec:\hbttbb.exe19⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pdjjv.exec:\pdjjv.exe20⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9dpvd.exec:\9dpvd.exe21⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bnbhnb.exec:\bnbhnb.exe22⤵
- Executes dropped EXE
PID:536 -
\??\c:\frfxrxl.exec:\frfxrxl.exe23⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jvddj.exec:\jvddj.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rfxrfxr.exec:\rfxrfxr.exe25⤵
- Executes dropped EXE
PID:1108 -
\??\c:\tnttbh.exec:\tnttbh.exe26⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jvddj.exec:\jvddj.exe27⤵
- Executes dropped EXE
PID:1596 -
\??\c:\hhbbtt.exec:\hhbbtt.exe28⤵
- Executes dropped EXE
PID:936 -
\??\c:\7dvdp.exec:\7dvdp.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ttntbh.exec:\ttntbh.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5bthnh.exec:\5bthnh.exe31⤵
- Executes dropped EXE
PID:1604 -
\??\c:\fxxfxfx.exec:\fxxfxfx.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\3btbnt.exec:\3btbnt.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe34⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rxxxxlx.exec:\rxxxxlx.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\7bnnnt.exec:\7bnnnt.exe36⤵
- Executes dropped EXE
PID:2384 -
\??\c:\pvvjp.exec:\pvvjp.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\vpdpd.exec:\vpdpd.exe38⤵
- Executes dropped EXE
PID:3060 -
\??\c:\3xxfllr.exec:\3xxfllr.exe39⤵
- Executes dropped EXE
PID:2784 -
\??\c:\btnbnt.exec:\btnbnt.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\9ppjv.exec:\9ppjv.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\9dvvv.exec:\9dvvv.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fxllrxf.exec:\fxllrxf.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\hhbbbb.exec:\hhbbbb.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ttnthn.exec:\ttnthn.exe45⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9vvdv.exec:\9vvdv.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ffxllrx.exec:\ffxllrx.exe47⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxrfffl.exec:\fxrfffl.exe48⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nnhtbb.exec:\nnhtbb.exe49⤵
- Executes dropped EXE
PID:1388 -
\??\c:\5pjjj.exec:\5pjjj.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\1lxfrrx.exec:\1lxfrrx.exe52⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hnhnhh.exec:\hnhnhh.exe53⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddpvv.exec:\ddpvv.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pjpvd.exec:\pjpvd.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1lrrrxl.exec:\1lrrrxl.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nhthbh.exec:\nhthbh.exe57⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5tnntt.exec:\5tnntt.exe58⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvvvp.exec:\dvvvp.exe59⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1llfrxf.exec:\1llfrxf.exe60⤵
- Executes dropped EXE
PID:772 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe61⤵
- Executes dropped EXE
PID:964 -
\??\c:\9htttb.exec:\9htttb.exe62⤵
- Executes dropped EXE
PID:320 -
\??\c:\9jpjv.exec:\9jpjv.exe63⤵
- Executes dropped EXE
PID:1280 -
\??\c:\1dvvp.exec:\1dvvp.exe64⤵
- Executes dropped EXE
PID:968 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe65⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5btbhn.exec:\5btbhn.exe66⤵PID:1460
-
\??\c:\bbnntt.exec:\bbnntt.exe67⤵PID:1660
-
\??\c:\vdvdj.exec:\vdvdj.exe68⤵PID:1548
-
\??\c:\5rffllr.exec:\5rffllr.exe69⤵PID:540
-
\??\c:\fxlrxrf.exec:\fxlrxrf.exe70⤵PID:2776
-
\??\c:\hthnbb.exec:\hthnbb.exe71⤵PID:2376
-
\??\c:\jjjjv.exec:\jjjjv.exe72⤵PID:2072
-
\??\c:\jdppv.exec:\jdppv.exe73⤵PID:548
-
\??\c:\5fxxfrf.exec:\5fxxfrf.exe74⤵PID:2888
-
\??\c:\3tntbb.exec:\3tntbb.exe75⤵PID:3048
-
\??\c:\jppdd.exec:\jppdd.exe76⤵PID:2508
-
\??\c:\llfffrx.exec:\llfffrx.exe77⤵PID:2144
-
\??\c:\rlxxflx.exec:\rlxxflx.exe78⤵PID:2948
-
\??\c:\9tnnnn.exec:\9tnnnn.exe79⤵PID:2880
-
\??\c:\3jddj.exec:\3jddj.exe80⤵PID:3028
-
\??\c:\xxrrfrf.exec:\xxrrfrf.exe81⤵PID:2668
-
\??\c:\xxxxflr.exec:\xxxxflr.exe82⤵PID:2820
-
\??\c:\bbnthn.exec:\bbnthn.exe83⤵PID:2584
-
\??\c:\vpddj.exec:\vpddj.exe84⤵PID:2708
-
\??\c:\fffxfrx.exec:\fffxfrx.exe85⤵PID:2860
-
\??\c:\lflrxrr.exec:\lflrxrr.exe86⤵PID:2604
-
\??\c:\tnttnh.exec:\tnttnh.exe87⤵PID:2592
-
\??\c:\1vdjp.exec:\1vdjp.exe88⤵PID:2972
-
\??\c:\7rllrxf.exec:\7rllrxf.exe89⤵PID:2316
-
\??\c:\fxlllfl.exec:\fxlllfl.exe90⤵PID:1020
-
\??\c:\3tntbh.exec:\3tntbh.exe91⤵PID:1240
-
\??\c:\jvjpp.exec:\jvjpp.exe92⤵PID:848
-
\??\c:\3jddj.exec:\3jddj.exe93⤵PID:1940
-
\??\c:\llxxxxf.exec:\llxxxxf.exe94⤵PID:2128
-
\??\c:\btbnbh.exec:\btbnbh.exe95⤵PID:372
-
\??\c:\nhttbt.exec:\nhttbt.exe96⤵PID:1016
-
\??\c:\vvpvj.exec:\vvpvj.exe97⤵PID:2328
-
\??\c:\3rffffr.exec:\3rffffr.exe98⤵PID:1884
-
\??\c:\thtbhn.exec:\thtbhn.exe99⤵PID:1820
-
\??\c:\tnttnh.exec:\tnttnh.exe100⤵PID:1176
-
\??\c:\vvvjv.exec:\vvvjv.exe101⤵PID:2196
-
\??\c:\xlxrffr.exec:\xlxrffr.exe102⤵PID:2224
-
\??\c:\5frxflx.exec:\5frxflx.exe103⤵PID:2388
-
\??\c:\ttnbnt.exec:\ttnbnt.exe104⤵PID:1036
-
\??\c:\pjppv.exec:\pjppv.exe105⤵PID:1876
-
\??\c:\djdpj.exec:\djdpj.exe106⤵PID:3052
-
\??\c:\ffxlffl.exec:\ffxlffl.exe107⤵PID:3024
-
\??\c:\tnbhtn.exec:\tnbhtn.exe108⤵PID:1672
-
\??\c:\hbhnbb.exec:\hbhnbb.exe109⤵PID:1592
-
\??\c:\3vjjj.exec:\3vjjj.exe110⤵PID:1472
-
\??\c:\xlxrxfl.exec:\xlxrxfl.exe111⤵PID:680
-
\??\c:\lfffffl.exec:\lfffffl.exe112⤵PID:2300
-
\??\c:\hhbhtt.exec:\hhbhtt.exe113⤵PID:2336
-
\??\c:\vpjjj.exec:\vpjjj.exe114⤵PID:2464
-
\??\c:\3vjpp.exec:\3vjpp.exe115⤵PID:3064
-
\??\c:\rlrrxff.exec:\rlrrxff.exe116⤵PID:2332
-
\??\c:\1lxrrrx.exec:\1lxrrrx.exe117⤵PID:1416
-
\??\c:\btbbnt.exec:\btbbnt.exe118⤵PID:1432
-
\??\c:\pjdpv.exec:\pjdpv.exe119⤵PID:2936
-
\??\c:\rlxflxf.exec:\rlxflxf.exe120⤵PID:2960
-
\??\c:\3lxxrrx.exec:\3lxxrrx.exe121⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-