Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe
-
Size
454KB
-
MD5
488df8f12423650a8438ea013368e290
-
SHA1
4a7190acb923a512f6ebd836ccdc0a8cea3dc39b
-
SHA256
928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4
-
SHA512
7d732bb692a7a9814fdc4fef1bd0d259da2190ab0d57e3d2a798d7b3375d8b6ca3957c11fa09f5b9ac6f13e5bb22606d315220cdf091a957eed97aa4a8a7a178
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/884-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-410-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2940-684-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-793-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-880-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-1065-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 fxlrffl.exe 2736 xrxfrxx.exe 2756 9pdjv.exe 888 rrlxflx.exe 2728 1thnhh.exe 2616 hbnthh.exe 1664 1nbhtt.exe 1776 fxxfrxx.exe 2120 9bnntb.exe 1780 3rllllr.exe 2792 thhbnn.exe 2796 rlrrrll.exe 2856 5tnttt.exe 3040 1xflrrr.exe 2868 1ntthh.exe 2376 xxlfrxf.exe 2348 7thnth.exe 448 rfxlrxr.exe 2504 tnnnbh.exe 564 jjdjv.exe 1120 lfxflfr.exe 1240 pjvjp.exe 1936 lxxxxrl.exe 2036 7dpjv.exe 1764 xlrrxxl.exe 1072 ppjpd.exe 2276 lfrrxrx.exe 1076 ppjpj.exe 1628 3rlrlrx.exe 1784 1hnhbt.exe 884 rlxfrrf.exe 1980 5nbthb.exe 1836 9jppp.exe 2744 3bnhnt.exe 2360 7bnhhh.exe 2576 vpdvv.exe 2704 1lffffl.exe 888 nbhbnn.exe 2572 5jpjp.exe 1708 xxrlxxf.exe 2316 fxxxxxf.exe 1128 hbnthh.exe 1304 pjvpj.exe 2464 fxrrffr.exe 2524 9ntbtt.exe 2104 pvddv.exe 2116 rrxlxfl.exe 2336 lxrlxxr.exe 2916 7tbhtn.exe 2856 jvdjj.exe 2888 5xllflr.exe 2128 tnnnbb.exe 2056 bbnntt.exe 592 dvvjv.exe 1148 1lllffr.exe 540 tnhnbh.exe 2380 pdppp.exe 2964 xlxfflx.exe 3008 llfrflx.exe 1696 nthnhh.exe 856 7vjjv.exe 824 5rlfflf.exe 1644 fxfxxll.exe 2452 bntttt.exe -
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-1192-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2108-1260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-1322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1335-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2696 2644 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 30 PID 2644 wrote to memory of 2696 2644 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 30 PID 2644 wrote to memory of 2696 2644 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 30 PID 2644 wrote to memory of 2696 2644 928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe 30 PID 2696 wrote to memory of 2736 2696 fxlrffl.exe 31 PID 2696 wrote to memory of 2736 2696 fxlrffl.exe 31 PID 2696 wrote to memory of 2736 2696 fxlrffl.exe 31 PID 2696 wrote to memory of 2736 2696 fxlrffl.exe 31 PID 2736 wrote to memory of 2756 2736 xrxfrxx.exe 32 PID 2736 wrote to memory of 2756 2736 xrxfrxx.exe 32 PID 2736 wrote to memory of 2756 2736 xrxfrxx.exe 32 PID 2736 wrote to memory of 2756 2736 xrxfrxx.exe 32 PID 2756 wrote to memory of 888 2756 9pdjv.exe 33 PID 2756 wrote to memory of 888 2756 9pdjv.exe 33 PID 2756 wrote to memory of 888 2756 9pdjv.exe 33 PID 2756 wrote to memory of 888 2756 9pdjv.exe 33 PID 888 wrote to memory of 2728 888 rrlxflx.exe 34 PID 888 wrote to memory of 2728 888 rrlxflx.exe 34 PID 888 wrote to memory of 2728 888 rrlxflx.exe 34 PID 888 wrote to memory of 2728 888 rrlxflx.exe 34 PID 2728 wrote to memory of 2616 2728 1thnhh.exe 35 PID 2728 wrote to memory of 2616 2728 1thnhh.exe 35 PID 2728 wrote to memory of 2616 2728 1thnhh.exe 35 PID 2728 wrote to memory of 2616 2728 1thnhh.exe 35 PID 2616 wrote to memory of 1664 2616 hbnthh.exe 36 PID 2616 wrote to memory of 1664 2616 hbnthh.exe 36 PID 2616 wrote to memory of 1664 2616 hbnthh.exe 36 PID 2616 wrote to memory of 1664 2616 hbnthh.exe 36 PID 1664 wrote to memory of 1776 1664 1nbhtt.exe 37 PID 1664 wrote to memory of 1776 1664 1nbhtt.exe 37 PID 1664 wrote to memory of 1776 1664 1nbhtt.exe 37 PID 1664 wrote to memory of 1776 1664 1nbhtt.exe 37 PID 1776 wrote to memory of 2120 1776 fxxfrxx.exe 38 PID 1776 wrote to memory of 2120 1776 fxxfrxx.exe 38 PID 1776 wrote to memory of 2120 1776 fxxfrxx.exe 38 PID 1776 wrote to memory of 2120 1776 fxxfrxx.exe 38 PID 2120 wrote to memory of 1780 2120 9bnntb.exe 39 PID 2120 wrote to memory of 1780 2120 9bnntb.exe 39 PID 2120 wrote to memory of 1780 2120 9bnntb.exe 39 PID 2120 wrote to memory of 1780 2120 9bnntb.exe 39 PID 1780 wrote to memory of 2792 1780 3rllllr.exe 40 PID 1780 wrote to memory of 2792 1780 3rllllr.exe 40 PID 1780 wrote to memory of 2792 1780 3rllllr.exe 40 PID 1780 wrote to memory of 2792 1780 3rllllr.exe 40 PID 2792 wrote to memory of 2796 2792 thhbnn.exe 41 PID 2792 wrote to memory of 2796 2792 thhbnn.exe 41 PID 2792 wrote to memory of 2796 2792 thhbnn.exe 41 PID 2792 wrote to memory of 2796 2792 thhbnn.exe 41 PID 2796 wrote to memory of 2856 2796 rlrrrll.exe 42 PID 2796 wrote to memory of 2856 2796 rlrrrll.exe 42 PID 2796 wrote to memory of 2856 2796 rlrrrll.exe 42 PID 2796 wrote to memory of 2856 2796 rlrrrll.exe 42 PID 2856 wrote to memory of 3040 2856 5tnttt.exe 43 PID 2856 wrote to memory of 3040 2856 5tnttt.exe 43 PID 2856 wrote to memory of 3040 2856 5tnttt.exe 43 PID 2856 wrote to memory of 3040 2856 5tnttt.exe 43 PID 3040 wrote to memory of 2868 3040 1xflrrr.exe 44 PID 3040 wrote to memory of 2868 3040 1xflrrr.exe 44 PID 3040 wrote to memory of 2868 3040 1xflrrr.exe 44 PID 3040 wrote to memory of 2868 3040 1xflrrr.exe 44 PID 2868 wrote to memory of 2376 2868 1ntthh.exe 45 PID 2868 wrote to memory of 2376 2868 1ntthh.exe 45 PID 2868 wrote to memory of 2376 2868 1ntthh.exe 45 PID 2868 wrote to memory of 2376 2868 1ntthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe"C:\Users\Admin\AppData\Local\Temp\928d6c636ab4f9792cc4c9b48c51b2fcd9edb5dcd74a86b2708b1d82a57c01f4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\fxlrffl.exec:\fxlrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrxfrxx.exec:\xrxfrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9pdjv.exec:\9pdjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\rrlxflx.exec:\rrlxflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\1thnhh.exec:\1thnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\hbnthh.exec:\hbnthh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\1nbhtt.exec:\1nbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\fxxfrxx.exec:\fxxfrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\9bnntb.exec:\9bnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\3rllllr.exec:\3rllllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\thhbnn.exec:\thhbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rlrrrll.exec:\rlrrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5tnttt.exec:\5tnttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\1xflrrr.exec:\1xflrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\1ntthh.exec:\1ntthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xxlfrxf.exec:\xxlfrxf.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7thnth.exec:\7thnth.exe18⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rfxlrxr.exec:\rfxlrxr.exe19⤵
- Executes dropped EXE
PID:448 -
\??\c:\tnnnbh.exec:\tnnnbh.exe20⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jjdjv.exec:\jjdjv.exe21⤵
- Executes dropped EXE
PID:564 -
\??\c:\lfxflfr.exec:\lfxflfr.exe22⤵
- Executes dropped EXE
PID:1120 -
\??\c:\pjvjp.exec:\pjvjp.exe23⤵
- Executes dropped EXE
PID:1240 -
\??\c:\lxxxxrl.exec:\lxxxxrl.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7dpjv.exec:\7dpjv.exe25⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xlrrxxl.exec:\xlrrxxl.exe26⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ppjpd.exec:\ppjpd.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe28⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ppjpj.exec:\ppjpj.exe29⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3rlrlrx.exec:\3rlrlrx.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1hnhbt.exec:\1hnhbt.exe31⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe32⤵
- Executes dropped EXE
PID:884 -
\??\c:\5nbthb.exec:\5nbthb.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\9jppp.exec:\9jppp.exe34⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3bnhnt.exec:\3bnhnt.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7bnhhh.exec:\7bnhhh.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vpdvv.exec:\vpdvv.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1lffffl.exec:\1lffffl.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nbhbnn.exec:\nbhbnn.exe39⤵
- Executes dropped EXE
PID:888 -
\??\c:\5jpjp.exec:\5jpjp.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xxrlxxf.exec:\xxrlxxf.exe41⤵
- Executes dropped EXE
PID:1708 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hbnthh.exec:\hbnthh.exe43⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pjvpj.exec:\pjvpj.exe44⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxrrffr.exec:\fxrrffr.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9ntbtt.exec:\9ntbtt.exe46⤵
- Executes dropped EXE
PID:2524 -
\??\c:\pvddv.exec:\pvddv.exe47⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrxlxfl.exec:\rrxlxfl.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7tbhtn.exec:\7tbhtn.exe50⤵
- Executes dropped EXE
PID:2916 -
\??\c:\jvdjj.exec:\jvdjj.exe51⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5xllflr.exec:\5xllflr.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnnnbb.exec:\tnnnbb.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbnntt.exec:\bbnntt.exe54⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvvjv.exec:\dvvjv.exe55⤵
- Executes dropped EXE
PID:592 -
\??\c:\1lllffr.exec:\1lllffr.exe56⤵
- Executes dropped EXE
PID:1148 -
\??\c:\tnhnbh.exec:\tnhnbh.exe57⤵
- Executes dropped EXE
PID:540 -
\??\c:\pdppp.exec:\pdppp.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xlxfflx.exec:\xlxfflx.exe59⤵
- Executes dropped EXE
PID:2964 -
\??\c:\llfrflx.exec:\llfrflx.exe60⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nthnhh.exec:\nthnhh.exe61⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7vjjv.exec:\7vjjv.exe62⤵
- Executes dropped EXE
PID:856 -
\??\c:\5rlfflf.exec:\5rlfflf.exe63⤵
- Executes dropped EXE
PID:824 -
\??\c:\fxfxxll.exec:\fxfxxll.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1644 -
\??\c:\bntttt.exec:\bntttt.exe65⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pjdvd.exec:\pjdvd.exe66⤵PID:1856
-
\??\c:\lfrlffl.exec:\lfrlffl.exe67⤵PID:1296
-
\??\c:\ttnnhn.exec:\ttnnhn.exe68⤵PID:608
-
\??\c:\hbhhhh.exec:\hbhhhh.exe69⤵PID:2276
-
\??\c:\vpvvv.exec:\vpvvv.exe70⤵PID:1076
-
\??\c:\frfxlfl.exec:\frfxlfl.exe71⤵PID:336
-
\??\c:\nhnhnn.exec:\nhnhnn.exe72⤵PID:1628
-
\??\c:\bnhbbh.exec:\bnhbbh.exe73⤵PID:1904
-
\??\c:\3vpjj.exec:\3vpjj.exe74⤵PID:1900
-
\??\c:\rlxfrrf.exec:\rlxfrrf.exe75⤵PID:2644
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe76⤵PID:2740
-
\??\c:\btntnt.exec:\btntnt.exe77⤵PID:1836
-
\??\c:\dvjjj.exec:\dvjjj.exe78⤵PID:2968
-
\??\c:\llflxxf.exec:\llflxxf.exe79⤵PID:2664
-
\??\c:\1lrrxrx.exec:\1lrrxrx.exe80⤵PID:2576
-
\??\c:\bbtbtt.exec:\bbtbtt.exe81⤵PID:2676
-
\??\c:\1vpvd.exec:\1vpvd.exe82⤵PID:2836
-
\??\c:\vvjjd.exec:\vvjjd.exe83⤵PID:528
-
\??\c:\rffxrrx.exec:\rffxrrx.exe84⤵PID:3052
-
\??\c:\1hbhnn.exec:\1hbhnn.exe85⤵PID:1044
-
\??\c:\jdppv.exec:\jdppv.exe86⤵
- System Location Discovery: System Language Discovery
PID:2212 -
\??\c:\rrflxxl.exec:\rrflxxl.exe87⤵
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\1tntbt.exec:\1tntbt.exe88⤵PID:2908
-
\??\c:\btttbb.exec:\btttbb.exe89⤵PID:2928
-
\??\c:\jvjjj.exec:\jvjjj.exe90⤵PID:2204
-
\??\c:\3lxxfxl.exec:\3lxxfxl.exe91⤵PID:2340
-
\??\c:\tnbbnt.exec:\tnbbnt.exe92⤵PID:2892
-
\??\c:\nhbttt.exec:\nhbttt.exe93⤵PID:2940
-
\??\c:\dvvdp.exec:\dvvdp.exe94⤵PID:2916
-
\??\c:\lxrlrll.exec:\lxrlrll.exe95⤵PID:3064
-
\??\c:\9nbhth.exec:\9nbhth.exe96⤵PID:2408
-
\??\c:\jjvvv.exec:\jjvvv.exe97⤵PID:1348
-
\??\c:\jvpvv.exec:\jvpvv.exe98⤵PID:2460
-
\??\c:\frllxfx.exec:\frllxfx.exe99⤵PID:592
-
\??\c:\hhbntt.exec:\hhbntt.exe100⤵PID:1148
-
\??\c:\vdppd.exec:\vdppd.exe101⤵PID:2976
-
\??\c:\jvdjj.exec:\jvdjj.exe102⤵PID:3012
-
\??\c:\rxrrrxf.exec:\rxrrrxf.exe103⤵PID:2964
-
\??\c:\bbttbb.exec:\bbttbb.exe104⤵PID:3008
-
\??\c:\btnttt.exec:\btnttt.exe105⤵PID:1120
-
\??\c:\7vjdj.exec:\7vjdj.exe106⤵PID:3024
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe107⤵PID:876
-
\??\c:\bthhhn.exec:\bthhhn.exe108⤵PID:2004
-
\??\c:\jjjpd.exec:\jjjpd.exe109⤵PID:1088
-
\??\c:\pjjjd.exec:\pjjjd.exe110⤵PID:2312
-
\??\c:\lfxxflx.exec:\lfxxflx.exe111⤵PID:1988
-
\??\c:\tnbbnt.exec:\tnbbnt.exe112⤵PID:2372
-
\??\c:\dpdjp.exec:\dpdjp.exe113⤵PID:2040
-
\??\c:\bnhhbb.exec:\bnhhbb.exe114⤵PID:2236
-
\??\c:\btnhbb.exec:\btnhbb.exe115⤵PID:2016
-
\??\c:\9jppd.exec:\9jppd.exe116⤵PID:1784
-
\??\c:\xlxfllr.exec:\xlxfllr.exe117⤵PID:1796
-
\??\c:\frrrxfr.exec:\frrrxfr.exe118⤵PID:2668
-
\??\c:\bhbbtb.exec:\bhbbtb.exe119⤵PID:2748
-
\??\c:\pjvpv.exec:\pjvpv.exe120⤵PID:2772
-
\??\c:\dvjjv.exec:\dvjjv.exe121⤵PID:2672
-
\??\c:\xrllrxf.exec:\xrllrxf.exe122⤵PID:2736
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-