Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe
-
Size
454KB
-
MD5
1473e792116bb9e4d6b3f4743850321b
-
SHA1
68d45f1e626f51647bdfb0514c6a09fcace5d417
-
SHA256
3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af
-
SHA512
b8cfe6ae57e3da358702c057a425738f6e108c4b8f0ba046a5e1c4b5a248515d97a68f0b8e2c5a41f017ae65d3c2512c0edd720989e673c1f9e8d568b2466cff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbed:q7Tc2NYHUrAwfMp3CDd
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/320-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-67-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2912-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-123-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1432-141-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2956-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-211-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1984-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-223-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/840-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-221-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-262-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1728-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/108-387-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1704-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-422-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2864-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3036-469-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1988-484-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1832-502-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1768-510-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2972-523-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2548-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1324-564-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-802-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-825-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1724-846-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1656-862-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-913-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-914-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-921-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/1432-934-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-947-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 536 frflxfl.exe 2896 tnhhtb.exe 2028 3bnttt.exe 2752 rfrxrrx.exe 2872 hhbhnt.exe 2612 1frxlrx.exe 2912 jdpdp.exe 2776 rfrxxxf.exe 2656 btnthn.exe 2648 5tntbh.exe 2344 5fxfrfr.exe 2924 7hbhnt.exe 340 nbtbnt.exe 1432 5dvjp.exe 2864 1thhtb.exe 676 btntnt.exe 2956 rlxrxxl.exe 3060 xllrllf.exe 2480 1pddp.exe 2192 9vvvd.exe 604 xxxfrlx.exe 1984 tthnhn.exe 840 vvvvv.exe 1544 xrfrxfl.exe 2432 9btnnn.exe 1848 jdjjv.exe 592 fffxllr.exe 2196 bnbhnt.exe 1504 vpvdd.exe 1616 3ffffff.exe 2064 hhthhb.exe 1728 pdpvv.exe 1608 frffrrx.exe 2024 btntbb.exe 2384 vpvpd.exe 2736 lfxrffl.exe 2840 thttbh.exe 2792 pvdvp.exe 2612 btnnbt.exe 2880 hbtbhn.exe 2772 pdvpv.exe 2680 llrrxrr.exe 2304 xxxlxxl.exe 1052 htnttt.exe 108 pjddp.exe 1704 5vvdj.exe 2900 lfrxxfl.exe 2140 9nbtbt.exe 2436 jvppv.exe 2864 vpjjp.exe 1624 7rfflrx.exe 2208 9thbbb.exe 2084 pdvdj.exe 2096 dpdjp.exe 2240 5lxxfll.exe 2460 xxrxfll.exe 3036 tthnbh.exe 1992 5jvvd.exe 1988 fxxxllx.exe 576 xrllxxf.exe 1692 thttbh.exe 1832 3djjv.exe 1768 jdjjv.exe 2112 7fxflrf.exe -
resource yara_rule behavioral1/memory/320-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-381-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1704-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-802-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1724-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-886-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-906-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1748-914-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-948-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 320 wrote to memory of 536 320 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 30 PID 320 wrote to memory of 536 320 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 30 PID 320 wrote to memory of 536 320 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 30 PID 320 wrote to memory of 536 320 3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe 30 PID 536 wrote to memory of 2896 536 frflxfl.exe 31 PID 536 wrote to memory of 2896 536 frflxfl.exe 31 PID 536 wrote to memory of 2896 536 frflxfl.exe 31 PID 536 wrote to memory of 2896 536 frflxfl.exe 31 PID 2896 wrote to memory of 2028 2896 tnhhtb.exe 32 PID 2896 wrote to memory of 2028 2896 tnhhtb.exe 32 PID 2896 wrote to memory of 2028 2896 tnhhtb.exe 32 PID 2896 wrote to memory of 2028 2896 tnhhtb.exe 32 PID 2028 wrote to memory of 2752 2028 3bnttt.exe 34 PID 2028 wrote to memory of 2752 2028 3bnttt.exe 34 PID 2028 wrote to memory of 2752 2028 3bnttt.exe 34 PID 2028 wrote to memory of 2752 2028 3bnttt.exe 34 PID 2752 wrote to memory of 2872 2752 rfrxrrx.exe 35 PID 2752 wrote to memory of 2872 2752 rfrxrrx.exe 35 PID 2752 wrote to memory of 2872 2752 rfrxrrx.exe 35 PID 2752 wrote to memory of 2872 2752 rfrxrrx.exe 35 PID 2872 wrote to memory of 2612 2872 hhbhnt.exe 36 PID 2872 wrote to memory of 2612 2872 hhbhnt.exe 36 PID 2872 wrote to memory of 2612 2872 hhbhnt.exe 36 PID 2872 wrote to memory of 2612 2872 hhbhnt.exe 36 PID 2612 wrote to memory of 2912 2612 1frxlrx.exe 37 PID 2612 wrote to memory of 2912 2612 1frxlrx.exe 37 PID 2612 wrote to memory of 2912 2612 1frxlrx.exe 37 PID 2612 wrote to memory of 2912 2612 1frxlrx.exe 37 PID 2912 wrote to memory of 2776 2912 jdpdp.exe 38 PID 2912 wrote to memory of 2776 2912 jdpdp.exe 38 PID 2912 wrote to memory of 2776 2912 jdpdp.exe 38 PID 2912 wrote to memory of 2776 2912 jdpdp.exe 38 PID 2776 wrote to memory of 2656 2776 rfrxxxf.exe 39 PID 2776 wrote to memory of 2656 2776 rfrxxxf.exe 39 PID 2776 wrote to memory of 2656 2776 rfrxxxf.exe 39 PID 2776 wrote to memory of 2656 2776 rfrxxxf.exe 39 PID 2656 wrote to memory of 2648 2656 btnthn.exe 40 PID 2656 wrote to memory of 2648 2656 btnthn.exe 40 PID 2656 wrote to memory of 2648 2656 btnthn.exe 40 PID 2656 wrote to memory of 2648 2656 btnthn.exe 40 PID 2648 wrote to memory of 2344 2648 5tntbh.exe 41 PID 2648 wrote to memory of 2344 2648 5tntbh.exe 41 PID 2648 wrote to memory of 2344 2648 5tntbh.exe 41 PID 2648 wrote to memory of 2344 2648 5tntbh.exe 41 PID 2344 wrote to memory of 2924 2344 5fxfrfr.exe 42 PID 2344 wrote to memory of 2924 2344 5fxfrfr.exe 42 PID 2344 wrote to memory of 2924 2344 5fxfrfr.exe 42 PID 2344 wrote to memory of 2924 2344 5fxfrfr.exe 42 PID 2924 wrote to memory of 340 2924 7hbhnt.exe 43 PID 2924 wrote to memory of 340 2924 7hbhnt.exe 43 PID 2924 wrote to memory of 340 2924 7hbhnt.exe 43 PID 2924 wrote to memory of 340 2924 7hbhnt.exe 43 PID 340 wrote to memory of 1432 340 nbtbnt.exe 44 PID 340 wrote to memory of 1432 340 nbtbnt.exe 44 PID 340 wrote to memory of 1432 340 nbtbnt.exe 44 PID 340 wrote to memory of 1432 340 nbtbnt.exe 44 PID 1432 wrote to memory of 2864 1432 5dvjp.exe 45 PID 1432 wrote to memory of 2864 1432 5dvjp.exe 45 PID 1432 wrote to memory of 2864 1432 5dvjp.exe 45 PID 1432 wrote to memory of 2864 1432 5dvjp.exe 45 PID 2864 wrote to memory of 676 2864 1thhtb.exe 46 PID 2864 wrote to memory of 676 2864 1thhtb.exe 46 PID 2864 wrote to memory of 676 2864 1thhtb.exe 46 PID 2864 wrote to memory of 676 2864 1thhtb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe"C:\Users\Admin\AppData\Local\Temp\3e1e73e66e6e1d264525fa7fe0b8bc52c0ddc73222914168f1d6bf799d6ad6af.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\frflxfl.exec:\frflxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\tnhhtb.exec:\tnhhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3bnttt.exec:\3bnttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hhbhnt.exec:\hhbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1frxlrx.exec:\1frxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\jdpdp.exec:\jdpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\btnthn.exec:\btnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5tntbh.exec:\5tntbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\5fxfrfr.exec:\5fxfrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\7hbhnt.exec:\7hbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\nbtbnt.exec:\nbtbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\5dvjp.exec:\5dvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\1thhtb.exec:\1thhtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\btntnt.exec:\btntnt.exe17⤵
- Executes dropped EXE
PID:676 -
\??\c:\rlxrxxl.exec:\rlxrxxl.exe18⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xllrllf.exec:\xllrllf.exe19⤵
- Executes dropped EXE
PID:3060 -
\??\c:\1pddp.exec:\1pddp.exe20⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9vvvd.exec:\9vvvd.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xxxfrlx.exec:\xxxfrlx.exe22⤵
- Executes dropped EXE
PID:604 -
\??\c:\tthnhn.exec:\tthnhn.exe23⤵
- Executes dropped EXE
PID:1984 -
\??\c:\vvvvv.exec:\vvvvv.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9btnnn.exec:\9btnnn.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jdjjv.exec:\jdjjv.exe27⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fffxllr.exec:\fffxllr.exe28⤵
- Executes dropped EXE
PID:592 -
\??\c:\bnbhnt.exec:\bnbhnt.exe29⤵
- Executes dropped EXE
PID:2196 -
\??\c:\vpvdd.exec:\vpvdd.exe30⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3ffffff.exec:\3ffffff.exe31⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hhthhb.exec:\hhthhb.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pdpvv.exec:\pdpvv.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\frffrrx.exec:\frffrrx.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\btntbb.exec:\btntbb.exe35⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vpvpd.exec:\vpvpd.exe36⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lfxrffl.exec:\lfxrffl.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\thttbh.exec:\thttbh.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\pvdvp.exec:\pvdvp.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\btnnbt.exec:\btnnbt.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hbtbhn.exec:\hbtbhn.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pdvpv.exec:\pdvpv.exe42⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llrrxrr.exec:\llrrxrr.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe44⤵
- Executes dropped EXE
PID:2304 -
\??\c:\htnttt.exec:\htnttt.exe45⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pjddp.exec:\pjddp.exe46⤵
- Executes dropped EXE
PID:108 -
\??\c:\5vvdj.exec:\5vvdj.exe47⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfrxxfl.exec:\lfrxxfl.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9nbtbt.exec:\9nbtbt.exe49⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jvppv.exec:\jvppv.exe50⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpjjp.exec:\vpjjp.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7rfflrx.exec:\7rfflrx.exe52⤵
- Executes dropped EXE
PID:1624 -
\??\c:\9thbbb.exec:\9thbbb.exe53⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pdvdj.exec:\pdvdj.exe54⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dpdjp.exec:\dpdjp.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\5lxxfll.exec:\5lxxfll.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xxrxfll.exec:\xxrxfll.exe57⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tthnbh.exec:\tthnbh.exe58⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5jvvd.exec:\5jvvd.exe59⤵
- Executes dropped EXE
PID:1992 -
\??\c:\fxxxllx.exec:\fxxxllx.exe60⤵
- Executes dropped EXE
PID:1988 -
\??\c:\xrllxxf.exec:\xrllxxf.exe61⤵
- Executes dropped EXE
PID:576 -
\??\c:\thttbh.exec:\thttbh.exe62⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3djjv.exec:\3djjv.exe63⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jdjjv.exec:\jdjjv.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7fxflrf.exec:\7fxflrf.exe65⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hthntt.exec:\hthntt.exe66⤵PID:2972
-
\??\c:\nhbhnn.exec:\nhbhnn.exe67⤵PID:1980
-
\??\c:\jdppp.exec:\jdppp.exe68⤵PID:2548
-
\??\c:\pjpvd.exec:\pjpvd.exe69⤵PID:2300
-
\??\c:\frxxffl.exec:\frxxffl.exe70⤵PID:2884
-
\??\c:\9hbttt.exec:\9hbttt.exe71⤵PID:2528
-
\??\c:\5jjjv.exec:\5jjjv.exe72⤵PID:1664
-
\??\c:\xrfxlff.exec:\xrfxlff.exe73⤵PID:1324
-
\??\c:\lfflxxf.exec:\lfflxxf.exe74⤵PID:2964
-
\??\c:\7tnhtt.exec:\7tnhtt.exe75⤵PID:2848
-
\??\c:\bnbbhb.exec:\bnbbhb.exe76⤵PID:2280
-
\??\c:\dvvvd.exec:\dvvvd.exe77⤵PID:2872
-
\??\c:\frxxxrx.exec:\frxxxrx.exe78⤵PID:2724
-
\??\c:\rrlrxlr.exec:\rrlrxlr.exe79⤵PID:2456
-
\??\c:\1htthh.exec:\1htthh.exe80⤵PID:2892
-
\??\c:\vjddv.exec:\vjddv.exe81⤵PID:2632
-
\??\c:\vjvpp.exec:\vjvpp.exe82⤵PID:2776
-
\??\c:\xrlrrrr.exec:\xrlrrrr.exe83⤵PID:2620
-
\??\c:\thnnth.exec:\thnnth.exe84⤵PID:2120
-
\??\c:\7nhhtb.exec:\7nhhtb.exe85⤵PID:2836
-
\??\c:\jvjdd.exec:\jvjdd.exe86⤵PID:2504
-
\??\c:\1pdvv.exec:\1pdvv.exe87⤵PID:1272
-
\??\c:\xlrxlfl.exec:\xlrxlfl.exe88⤵PID:1792
-
\??\c:\tnhnnn.exec:\tnhnnn.exe89⤵PID:2592
-
\??\c:\vpvdp.exec:\vpvdp.exe90⤵PID:1928
-
\??\c:\vpdjp.exec:\vpdjp.exe91⤵PID:1284
-
\??\c:\lxllxrx.exec:\lxllxrx.exe92⤵PID:676
-
\??\c:\rfxxllr.exec:\rfxxllr.exe93⤵PID:2700
-
\??\c:\3nbbbb.exec:\3nbbbb.exe94⤵PID:2956
-
\??\c:\5djjp.exec:\5djjp.exe95⤵PID:3048
-
\??\c:\vvvvj.exec:\vvvvj.exe96⤵PID:2200
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe97⤵PID:2296
-
\??\c:\bttnnn.exec:\bttnnn.exe98⤵PID:2128
-
\??\c:\1bbttn.exec:\1bbttn.exe99⤵PID:2004
-
\??\c:\7pddd.exec:\7pddd.exe100⤵PID:908
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe101⤵PID:1352
-
\??\c:\frffffl.exec:\frffffl.exe102⤵PID:2264
-
\??\c:\5ntttt.exec:\5ntttt.exe103⤵PID:1752
-
\??\c:\3jpjj.exec:\3jpjj.exe104⤵PID:2568
-
\??\c:\jvjjj.exec:\jvjjj.exe105⤵PID:952
-
\??\c:\fffrxll.exec:\fffrxll.exe106⤵PID:1048
-
\??\c:\ffrflrf.exec:\ffrflrf.exe107⤵PID:1644
-
\??\c:\1tbnnn.exec:\1tbnnn.exe108⤵PID:992
-
\??\c:\pppdv.exec:\pppdv.exe109⤵PID:1504
-
\??\c:\vpddp.exec:\vpddp.exe110⤵PID:1744
-
\??\c:\3rfxlrx.exec:\3rfxlrx.exe111⤵PID:1616
-
\??\c:\tbbhbb.exec:\tbbhbb.exe112⤵PID:2984
-
\??\c:\nhtttb.exec:\nhtttb.exe113⤵PID:2688
-
\??\c:\7vppv.exec:\7vppv.exe114⤵PID:1724
-
\??\c:\xxlxflr.exec:\xxlxflr.exe115⤵PID:2764
-
\??\c:\frlrxrx.exec:\frlrxrx.exe116⤵PID:1044
-
\??\c:\tntnnh.exec:\tntnnh.exe117⤵PID:2028
-
\??\c:\vjvvv.exec:\vjvvv.exe118⤵PID:2280
-
\??\c:\dvjpd.exec:\dvjpd.exe119⤵PID:2872
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe120⤵PID:1656
-
\??\c:\nhttbh.exec:\nhttbh.exe121⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-