Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe
-
Size
456KB
-
MD5
c37b11f7fcf6aacc1dab7519a8dd92a0
-
SHA1
56b15d97c28bde53ba0e3cd2c6d71e1aed19d9fe
-
SHA256
5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0b
-
SHA512
e7049c708361f30ed003dc21dc9be862b425b0bb686d343aef8c25fcd55e174f5eb819068a4b1a9b4807dc4b180b9783f960d3b0ee47a1f6cc5360fd732d4094
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRm:q7Tc2NYHUrAwfMp3CDRm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2420-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-57-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-55-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-115-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1260-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-155-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1604-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-667-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/300-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-747-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-794-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1336-842-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2596 btbhtb.exe 2056 jdjdd.exe 2888 ffxlrxl.exe 2768 1bbhnt.exe 2920 1dddj.exe 2848 vdddd.exe 2716 3rflllr.exe 2724 ttnbtn.exe 2328 lrflrxf.exe 2944 9fffrxl.exe 2156 3vjjp.exe 1932 lxlxlrx.exe 1992 9lffrxl.exe 652 ffrxffl.exe 1260 vvvjp.exe 1912 rrlrlxl.exe 1572 pjvvj.exe 892 5xffffl.exe 2100 vpvdj.exe 1604 xxfffff.exe 2216 dvppp.exe 2176 xxxxfxf.exe 3008 9djdd.exe 3020 nttbbb.exe 1452 jjpvd.exe 992 5xxfffl.exe 1716 bnhbht.exe 2632 rlxfrrf.exe 2352 hhtbnt.exe 1972 1rxlllr.exe 1964 3hhbbn.exe 2312 xrxxfll.exe 1584 hnnthh.exe 2596 1dppv.exe 2348 flrrxff.exe 2984 bttttt.exe 2792 jjvdj.exe 2868 fflflff.exe 1528 bhtbnt.exe 2760 bbnnbt.exe 2772 5dpvj.exe 304 3frxfxx.exe 2540 5hbbhn.exe 3060 3pddp.exe 2728 5vpvd.exe 2448 7frxlrx.exe 2512 nnttbb.exe 780 9nhtbt.exe 2024 vdppp.exe 2012 xxfflll.exe 1376 7bttbb.exe 652 vdpvv.exe 2564 jjvvj.exe 1260 fflfrlr.exe 1436 hthhtt.exe 1572 5dvdj.exe 1072 3pddj.exe 2372 rrfxfff.exe 1424 nhttbb.exe 1604 ddppj.exe 1632 5dvvd.exe 1896 9fffrxf.exe 1852 nthnbh.exe 2968 pvddj.exe -
resource yara_rule behavioral1/memory/2596-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-115-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1260-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-809-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1336-842-0x0000000000230000-0x000000000025A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2596 2420 5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe 29 PID 2420 wrote to memory of 2596 2420 5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe 29 PID 2420 wrote to memory of 2596 2420 5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe 29 PID 2420 wrote to memory of 2596 2420 5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe 29 PID 2596 wrote to memory of 2056 2596 btbhtb.exe 30 PID 2596 wrote to memory of 2056 2596 btbhtb.exe 30 PID 2596 wrote to memory of 2056 2596 btbhtb.exe 30 PID 2596 wrote to memory of 2056 2596 btbhtb.exe 30 PID 2056 wrote to memory of 2888 2056 jdjdd.exe 31 PID 2056 wrote to memory of 2888 2056 jdjdd.exe 31 PID 2056 wrote to memory of 2888 2056 jdjdd.exe 31 PID 2056 wrote to memory of 2888 2056 jdjdd.exe 31 PID 2888 wrote to memory of 2768 2888 ffxlrxl.exe 32 PID 2888 wrote to memory of 2768 2888 ffxlrxl.exe 32 PID 2888 wrote to memory of 2768 2888 ffxlrxl.exe 32 PID 2888 wrote to memory of 2768 2888 ffxlrxl.exe 32 PID 2768 wrote to memory of 2920 2768 1bbhnt.exe 33 PID 2768 wrote to memory of 2920 2768 1bbhnt.exe 33 PID 2768 wrote to memory of 2920 2768 1bbhnt.exe 33 PID 2768 wrote to memory of 2920 2768 1bbhnt.exe 33 PID 2920 wrote to memory of 2848 2920 1dddj.exe 34 PID 2920 wrote to memory of 2848 2920 1dddj.exe 34 PID 2920 wrote to memory of 2848 2920 1dddj.exe 34 PID 2920 wrote to memory of 2848 2920 1dddj.exe 34 PID 2848 wrote to memory of 2716 2848 vdddd.exe 35 PID 2848 wrote to memory of 2716 2848 vdddd.exe 35 PID 2848 wrote to memory of 2716 2848 vdddd.exe 35 PID 2848 wrote to memory of 2716 2848 vdddd.exe 35 PID 2716 wrote to memory of 2724 2716 3rflllr.exe 36 PID 2716 wrote to memory of 2724 2716 3rflllr.exe 36 PID 2716 wrote to memory of 2724 2716 3rflllr.exe 36 PID 2716 wrote to memory of 2724 2716 3rflllr.exe 36 PID 2724 wrote to memory of 2328 2724 ttnbtn.exe 37 PID 2724 wrote to memory of 2328 2724 ttnbtn.exe 37 PID 2724 wrote to memory of 2328 2724 ttnbtn.exe 37 PID 2724 wrote to memory of 2328 2724 ttnbtn.exe 37 PID 2328 wrote to memory of 2944 2328 lrflrxf.exe 38 PID 2328 wrote to memory of 2944 2328 lrflrxf.exe 38 PID 2328 wrote to memory of 2944 2328 lrflrxf.exe 38 PID 2328 wrote to memory of 2944 2328 lrflrxf.exe 38 PID 2944 wrote to memory of 2156 2944 9fffrxl.exe 39 PID 2944 wrote to memory of 2156 2944 9fffrxl.exe 39 PID 2944 wrote to memory of 2156 2944 9fffrxl.exe 39 PID 2944 wrote to memory of 2156 2944 9fffrxl.exe 39 PID 2156 wrote to memory of 1932 2156 3vjjp.exe 40 PID 2156 wrote to memory of 1932 2156 3vjjp.exe 40 PID 2156 wrote to memory of 1932 2156 3vjjp.exe 40 PID 2156 wrote to memory of 1932 2156 3vjjp.exe 40 PID 1932 wrote to memory of 1992 1932 lxlxlrx.exe 41 PID 1932 wrote to memory of 1992 1932 lxlxlrx.exe 41 PID 1932 wrote to memory of 1992 1932 lxlxlrx.exe 41 PID 1932 wrote to memory of 1992 1932 lxlxlrx.exe 41 PID 1992 wrote to memory of 652 1992 9lffrxl.exe 42 PID 1992 wrote to memory of 652 1992 9lffrxl.exe 42 PID 1992 wrote to memory of 652 1992 9lffrxl.exe 42 PID 1992 wrote to memory of 652 1992 9lffrxl.exe 42 PID 652 wrote to memory of 1260 652 ffrxffl.exe 43 PID 652 wrote to memory of 1260 652 ffrxffl.exe 43 PID 652 wrote to memory of 1260 652 ffrxffl.exe 43 PID 652 wrote to memory of 1260 652 ffrxffl.exe 43 PID 1260 wrote to memory of 1912 1260 vvvjp.exe 44 PID 1260 wrote to memory of 1912 1260 vvvjp.exe 44 PID 1260 wrote to memory of 1912 1260 vvvjp.exe 44 PID 1260 wrote to memory of 1912 1260 vvvjp.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe"C:\Users\Admin\AppData\Local\Temp\5ae479976e0edc5b3bbd5a49cd052405162c44ee752b608829dedd5b5e0c0f0bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\btbhtb.exec:\btbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jdjdd.exec:\jdjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\1bbhnt.exec:\1bbhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1dddj.exec:\1dddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vdddd.exec:\vdddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3rflllr.exec:\3rflllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ttnbtn.exec:\ttnbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\lrflrxf.exec:\lrflrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\9fffrxl.exec:\9fffrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\3vjjp.exec:\3vjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\lxlxlrx.exec:\lxlxlrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\9lffrxl.exec:\9lffrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\ffrxffl.exec:\ffrxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\vvvjp.exec:\vvvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\rrlrlxl.exec:\rrlrlxl.exe17⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pjvvj.exec:\pjvvj.exe18⤵
- Executes dropped EXE
PID:1572 -
\??\c:\5xffffl.exec:\5xffffl.exe19⤵
- Executes dropped EXE
PID:892 -
\??\c:\vpvdj.exec:\vpvdj.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\xxfffff.exec:\xxfffff.exe21⤵
- Executes dropped EXE
PID:1604 -
\??\c:\dvppp.exec:\dvppp.exe22⤵
- Executes dropped EXE
PID:2216 -
\??\c:\xxxxfxf.exec:\xxxxfxf.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\9djdd.exec:\9djdd.exe24⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nttbbb.exec:\nttbbb.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\jjpvd.exec:\jjpvd.exe26⤵
- Executes dropped EXE
PID:1452 -
\??\c:\5xxfffl.exec:\5xxfffl.exe27⤵
- Executes dropped EXE
PID:992 -
\??\c:\bnhbht.exec:\bnhbht.exe28⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe29⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hhtbnt.exec:\hhtbnt.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1rxlllr.exec:\1rxlllr.exe31⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3hhbbn.exec:\3hhbbn.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xrxxfll.exec:\xrxxfll.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hnnthh.exec:\hnnthh.exe34⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1dppv.exec:\1dppv.exe35⤵
- Executes dropped EXE
PID:2596 -
\??\c:\flrrxff.exec:\flrrxff.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bttttt.exec:\bttttt.exe37⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jjvdj.exec:\jjvdj.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\fflflff.exec:\fflflff.exe39⤵
- Executes dropped EXE
PID:2868 -
\??\c:\bhtbnt.exec:\bhtbnt.exe40⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bbnnbt.exec:\bbnnbt.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5dpvj.exec:\5dpvj.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3frxfxx.exec:\3frxfxx.exe43⤵
- Executes dropped EXE
PID:304 -
\??\c:\5hbbhn.exec:\5hbbhn.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3pddp.exec:\3pddp.exe45⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5vpvd.exec:\5vpvd.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7frxlrx.exec:\7frxlrx.exe47⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nnttbb.exec:\nnttbb.exe48⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9nhtbt.exec:\9nhtbt.exe49⤵
- Executes dropped EXE
PID:780 -
\??\c:\vdppp.exec:\vdppp.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xxfflll.exec:\xxfflll.exe51⤵
- Executes dropped EXE
PID:2012 -
\??\c:\7bttbb.exec:\7bttbb.exe52⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vdpvv.exec:\vdpvv.exe53⤵
- Executes dropped EXE
PID:652 -
\??\c:\jjvvj.exec:\jjvvj.exe54⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fflfrlr.exec:\fflfrlr.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hthhtt.exec:\hthhtt.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\5dvdj.exec:\5dvdj.exe57⤵
- Executes dropped EXE
PID:1572 -
\??\c:\3pddj.exec:\3pddj.exe58⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rrfxfff.exec:\rrfxfff.exe59⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhttbb.exec:\nhttbb.exe60⤵
- Executes dropped EXE
PID:1424 -
\??\c:\ddppj.exec:\ddppj.exe61⤵
- Executes dropped EXE
PID:1604 -
\??\c:\5dvvd.exec:\5dvvd.exe62⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9fffrxf.exec:\9fffrxf.exe63⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nthnbh.exec:\nthnbh.exe64⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pvddj.exec:\pvddj.exe65⤵
- Executes dropped EXE
PID:2968 -
\??\c:\3jddj.exec:\3jddj.exe66⤵PID:3020
-
\??\c:\frlrrxf.exec:\frlrrxf.exe67⤵PID:616
-
\??\c:\bbhtht.exec:\bbhtht.exe68⤵PID:3064
-
\??\c:\ddvdd.exec:\ddvdd.exe69⤵PID:2044
-
\??\c:\lrflxxf.exec:\lrflxxf.exe70⤵PID:1088
-
\??\c:\nnbbnt.exec:\nnbbnt.exe71⤵PID:2632
-
\??\c:\hntbnt.exec:\hntbnt.exe72⤵PID:976
-
\??\c:\ppdjp.exec:\ppdjp.exe73⤵PID:888
-
\??\c:\lrfrxll.exec:\lrfrxll.exe74⤵PID:2388
-
\??\c:\frflxfl.exec:\frflxfl.exe75⤵
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\tbnthh.exec:\tbnthh.exe76⤵PID:1592
-
\??\c:\djdjv.exec:\djdjv.exe77⤵PID:2288
-
\??\c:\1lrxlrf.exec:\1lrxlrf.exe78⤵PID:2952
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe79⤵PID:2812
-
\??\c:\7hhbbh.exec:\7hhbbh.exe80⤵PID:2904
-
\??\c:\pvjpd.exec:\pvjpd.exe81⤵PID:2820
-
\??\c:\3rffrrx.exec:\3rffrrx.exe82⤵PID:2668
-
\??\c:\hnhhtb.exec:\hnhhtb.exe83⤵PID:2920
-
\??\c:\7nhthh.exec:\7nhthh.exe84⤵PID:2848
-
\??\c:\vdjpv.exec:\vdjpv.exe85⤵PID:2676
-
\??\c:\5xllflr.exec:\5xllflr.exe86⤵PID:2716
-
\??\c:\9nnthh.exec:\9nnthh.exe87⤵PID:2612
-
\??\c:\ntbhnn.exec:\ntbhnn.exe88⤵PID:3048
-
\??\c:\ddjpp.exec:\ddjpp.exe89⤵PID:2700
-
\??\c:\xxflfxf.exec:\xxflfxf.exe90⤵PID:2464
-
\??\c:\bhntnt.exec:\bhntnt.exe91⤵
- System Location Discovery: System Language Discovery
PID:1876 -
\??\c:\vdppv.exec:\vdppv.exe92⤵PID:300
-
\??\c:\jjjjj.exec:\jjjjj.exe93⤵PID:1500
-
\??\c:\rxlllrx.exec:\rxlllrx.exe94⤵PID:268
-
\??\c:\3htbhn.exec:\3htbhn.exe95⤵PID:2560
-
\??\c:\tthnbb.exec:\tthnbb.exe96⤵PID:984
-
\??\c:\lrrlrlx.exec:\lrrlrlx.exe97⤵PID:2720
-
\??\c:\lrxxflx.exec:\lrxxflx.exe98⤵PID:816
-
\??\c:\5bhnhn.exec:\5bhnhn.exe99⤵PID:1308
-
\??\c:\pdjjp.exec:\pdjjp.exe100⤵PID:1712
-
\??\c:\jjjjv.exec:\jjjjv.exe101⤵PID:2396
-
\??\c:\xflfrfl.exec:\xflfrfl.exe102⤵PID:2100
-
\??\c:\nntthh.exec:\nntthh.exe103⤵PID:2244
-
\??\c:\jjvdj.exec:\jjvdj.exe104⤵PID:2020
-
\??\c:\5xxfrrf.exec:\5xxfrrf.exe105⤵PID:2356
-
\??\c:\flflrfl.exec:\flflrfl.exe106⤵PID:2648
-
\??\c:\3bnthh.exec:\3bnthh.exe107⤵PID:1784
-
\??\c:\pdvjp.exec:\pdvjp.exe108⤵
- System Location Discovery: System Language Discovery
PID:956 -
\??\c:\5rfflrx.exec:\5rfflrx.exe109⤵PID:1808
-
\??\c:\rrflrff.exec:\rrflrff.exe110⤵PID:1920
-
\??\c:\hhntbh.exec:\hhntbh.exe111⤵PID:1740
-
\??\c:\vvjjp.exec:\vvjjp.exe112⤵PID:1716
-
\??\c:\flxxffr.exec:\flxxffr.exe113⤵PID:1088
-
\??\c:\ffrrflr.exec:\ffrrflr.exe114⤵PID:1336
-
\??\c:\vvvdd.exec:\vvvdd.exe115⤵PID:1512
-
\??\c:\jvppd.exec:\jvppd.exe116⤵PID:1936
-
\??\c:\lrfxlrr.exec:\lrfxlrr.exe117⤵PID:1744
-
\??\c:\hhtbhn.exec:\hhtbhn.exe118⤵PID:1588
-
\??\c:\7pdjp.exec:\7pdjp.exe119⤵PID:2788
-
\??\c:\pdjjv.exec:\pdjjv.exe120⤵PID:2924
-
\??\c:\lxrrfrx.exec:\lxrrfrx.exe121⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-