Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe
-
Size
453KB
-
MD5
84c842440c7a4c2d36db43bc1d018005
-
SHA1
f81db179b3401747130914396e96966fd3235fdd
-
SHA256
a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2
-
SHA512
8e7e999fcb24497c17eab0f1ad808121aebb76fe770deba48599df81b15de91e0741ebe8ddafcd32ca28ea52e6c06e1694e27cef73a0dde2d818246b44dfd2c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/3044-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-76-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2776-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-179-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-169-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2484-199-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-252-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2448-250-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/308-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-331-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-355-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-385-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/860-417-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1624-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-468-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2492-487-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1104-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-502-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2360-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/648-646-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2208-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-834-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2896-853-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2992-873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-892-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-1052-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/768-1071-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2064 xlxxfxf.exe 2404 vvjvp.exe 2280 rfllrrr.exe 2716 hthtbt.exe 2788 hhbnbn.exe 2456 xrxflxf.exe 2628 thtttb.exe 2776 jvjpd.exe 2636 1rrxrrx.exe 2216 ddjvd.exe 1260 7jvdj.exe 1748 bthnnt.exe 1300 7thtbt.exe 1236 pvpjp.exe 2692 lfxfrxl.exe 1308 1hbhtt.exe 2284 jvjjj.exe 2948 flllrrf.exe 2376 bbnbbt.exe 2484 7ppvv.exe 2584 lfrrxfl.exe 1584 nbnbbh.exe 1508 jvdvv.exe 624 pjvdj.exe 1340 pjvdp.exe 2448 frfxxrx.exe 1768 vjvvj.exe 2172 pdvvv.exe 308 7ntttt.exe 2536 pvjjd.exe 2684 jvjpp.exe 2388 rfxfxxr.exe 2968 5thtbn.exe 332 vjvdd.exe 2784 7djdd.exe 2992 lxlrxfr.exe 2860 lxrrxxr.exe 2848 5tbttn.exe 2820 vpddj.exe 2640 1nhhbb.exe 1740 vpjvv.exe 2652 frxllfl.exe 2616 tnbbbt.exe 2344 thhhtt.exe 2868 jdppv.exe 1660 7pvvd.exe 340 frfxfxf.exe 1032 nhttnb.exe 860 hhhnbn.exe 1624 9vppp.exe 272 xlxrxrx.exe 1640 nhbhnn.exe 1592 bthbbb.exe 2084 dpddd.exe 2416 dvdjj.exe 2200 flxxxxx.exe 2492 ttnbhh.exe 2288 5bnttt.exe 1652 dpvvv.exe 1104 jdppp.exe 2424 7lxlffr.exe 1988 5hnthn.exe 2004 9hhbhh.exe 1696 vvjdp.exe -
resource yara_rule behavioral1/memory/2064-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-565-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-810-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-907-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-982-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-995-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-1052-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/768-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-1072-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2064 3044 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 3044 wrote to memory of 2064 3044 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 3044 wrote to memory of 2064 3044 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 3044 wrote to memory of 2064 3044 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 2064 wrote to memory of 2404 2064 xlxxfxf.exe 32 PID 2064 wrote to memory of 2404 2064 xlxxfxf.exe 32 PID 2064 wrote to memory of 2404 2064 xlxxfxf.exe 32 PID 2064 wrote to memory of 2404 2064 xlxxfxf.exe 32 PID 2404 wrote to memory of 2280 2404 vvjvp.exe 33 PID 2404 wrote to memory of 2280 2404 vvjvp.exe 33 PID 2404 wrote to memory of 2280 2404 vvjvp.exe 33 PID 2404 wrote to memory of 2280 2404 vvjvp.exe 33 PID 2280 wrote to memory of 2716 2280 rfllrrr.exe 34 PID 2280 wrote to memory of 2716 2280 rfllrrr.exe 34 PID 2280 wrote to memory of 2716 2280 rfllrrr.exe 34 PID 2280 wrote to memory of 2716 2280 rfllrrr.exe 34 PID 2716 wrote to memory of 2788 2716 hthtbt.exe 35 PID 2716 wrote to memory of 2788 2716 hthtbt.exe 35 PID 2716 wrote to memory of 2788 2716 hthtbt.exe 35 PID 2716 wrote to memory of 2788 2716 hthtbt.exe 35 PID 2788 wrote to memory of 2456 2788 hhbnbn.exe 36 PID 2788 wrote to memory of 2456 2788 hhbnbn.exe 36 PID 2788 wrote to memory of 2456 2788 hhbnbn.exe 36 PID 2788 wrote to memory of 2456 2788 hhbnbn.exe 36 PID 2456 wrote to memory of 2628 2456 xrxflxf.exe 37 PID 2456 wrote to memory of 2628 2456 xrxflxf.exe 37 PID 2456 wrote to memory of 2628 2456 xrxflxf.exe 37 PID 2456 wrote to memory of 2628 2456 xrxflxf.exe 37 PID 2628 wrote to memory of 2776 2628 thtttb.exe 38 PID 2628 wrote to memory of 2776 2628 thtttb.exe 38 PID 2628 wrote to memory of 2776 2628 thtttb.exe 38 PID 2628 wrote to memory of 2776 2628 thtttb.exe 38 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 39 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 39 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 39 PID 2776 wrote to memory of 2636 2776 jvjpd.exe 39 PID 2636 wrote to memory of 2216 2636 1rrxrrx.exe 40 PID 2636 wrote to memory of 2216 2636 1rrxrrx.exe 40 PID 2636 wrote to memory of 2216 2636 1rrxrrx.exe 40 PID 2636 wrote to memory of 2216 2636 1rrxrrx.exe 40 PID 2216 wrote to memory of 1260 2216 ddjvd.exe 41 PID 2216 wrote to memory of 1260 2216 ddjvd.exe 41 PID 2216 wrote to memory of 1260 2216 ddjvd.exe 41 PID 2216 wrote to memory of 1260 2216 ddjvd.exe 41 PID 1260 wrote to memory of 1748 1260 7jvdj.exe 42 PID 1260 wrote to memory of 1748 1260 7jvdj.exe 42 PID 1260 wrote to memory of 1748 1260 7jvdj.exe 42 PID 1260 wrote to memory of 1748 1260 7jvdj.exe 42 PID 1748 wrote to memory of 1300 1748 bthnnt.exe 43 PID 1748 wrote to memory of 1300 1748 bthnnt.exe 43 PID 1748 wrote to memory of 1300 1748 bthnnt.exe 43 PID 1748 wrote to memory of 1300 1748 bthnnt.exe 43 PID 1300 wrote to memory of 1236 1300 7thtbt.exe 44 PID 1300 wrote to memory of 1236 1300 7thtbt.exe 44 PID 1300 wrote to memory of 1236 1300 7thtbt.exe 44 PID 1300 wrote to memory of 1236 1300 7thtbt.exe 44 PID 1236 wrote to memory of 2692 1236 pvpjp.exe 45 PID 1236 wrote to memory of 2692 1236 pvpjp.exe 45 PID 1236 wrote to memory of 2692 1236 pvpjp.exe 45 PID 1236 wrote to memory of 2692 1236 pvpjp.exe 45 PID 2692 wrote to memory of 1308 2692 lfxfrxl.exe 46 PID 2692 wrote to memory of 1308 2692 lfxfrxl.exe 46 PID 2692 wrote to memory of 1308 2692 lfxfrxl.exe 46 PID 2692 wrote to memory of 1308 2692 lfxfrxl.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe"C:\Users\Admin\AppData\Local\Temp\a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\xlxxfxf.exec:\xlxxfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vvjvp.exec:\vvjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\rfllrrr.exec:\rfllrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\hthtbt.exec:\hthtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\hhbnbn.exec:\hhbnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xrxflxf.exec:\xrxflxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\thtttb.exec:\thtttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jvjpd.exec:\jvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\1rrxrrx.exec:\1rrxrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\ddjvd.exec:\ddjvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\7jvdj.exec:\7jvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\bthnnt.exec:\bthnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\7thtbt.exec:\7thtbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\pvpjp.exec:\pvpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\lfxfrxl.exec:\lfxfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1hbhtt.exec:\1hbhtt.exe17⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jvjjj.exec:\jvjjj.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\flllrrf.exec:\flllrrf.exe19⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbnbbt.exec:\bbnbbt.exe20⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7ppvv.exec:\7ppvv.exe21⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe22⤵
- Executes dropped EXE
PID:2584 -
\??\c:\nbnbbh.exec:\nbnbbh.exe23⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jvdvv.exec:\jvdvv.exe24⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pjvdj.exec:\pjvdj.exe25⤵
- Executes dropped EXE
PID:624 -
\??\c:\pjvdp.exec:\pjvdp.exe26⤵
- Executes dropped EXE
PID:1340 -
\??\c:\frfxxrx.exec:\frfxxrx.exe27⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vjvvj.exec:\vjvvj.exe28⤵
- Executes dropped EXE
PID:1768 -
\??\c:\pdvvv.exec:\pdvvv.exe29⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7ntttt.exec:\7ntttt.exe30⤵
- Executes dropped EXE
PID:308 -
\??\c:\pvjjd.exec:\pvjjd.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jvjpp.exec:\jvjpp.exe32⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rfxfxxr.exec:\rfxfxxr.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\5thtbn.exec:\5thtbn.exe34⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vjvdd.exec:\vjvdd.exe35⤵
- Executes dropped EXE
PID:332 -
\??\c:\7djdd.exec:\7djdd.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\lxlrxfr.exec:\lxlrxfr.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lxrrxxr.exec:\lxrrxxr.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5tbttn.exec:\5tbttn.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpddj.exec:\vpddj.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\1nhhbb.exec:\1nhhbb.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpjvv.exec:\vpjvv.exe42⤵
- Executes dropped EXE
PID:1740 -
\??\c:\frxllfl.exec:\frxllfl.exe43⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnbbbt.exec:\tnbbbt.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\thhhtt.exec:\thhhtt.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jdppv.exec:\jdppv.exe46⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7pvvd.exec:\7pvvd.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\frfxfxf.exec:\frfxfxf.exe48⤵
- Executes dropped EXE
PID:340 -
\??\c:\nhttnb.exec:\nhttnb.exe49⤵
- Executes dropped EXE
PID:1032 -
\??\c:\hhhnbn.exec:\hhhnbn.exe50⤵
- Executes dropped EXE
PID:860 -
\??\c:\9vppp.exec:\9vppp.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xlxrxrx.exec:\xlxrxrx.exe52⤵
- Executes dropped EXE
PID:272 -
\??\c:\nhbhnn.exec:\nhbhnn.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1640 -
\??\c:\bthbbb.exec:\bthbbb.exe54⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dpddd.exec:\dpddd.exe55⤵
- Executes dropped EXE
PID:2084 -
\??\c:\dvdjj.exec:\dvdjj.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\flxxxxx.exec:\flxxxxx.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ttnbhh.exec:\ttnbhh.exe58⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5bnttt.exec:\5bnttt.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\dpvvv.exec:\dpvvv.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jdppp.exec:\jdppp.exe61⤵
- Executes dropped EXE
PID:1104 -
\??\c:\7lxlffr.exec:\7lxlffr.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5hnthn.exec:\5hnthn.exe63⤵
- Executes dropped EXE
PID:1988 -
\??\c:\9hhbhh.exec:\9hhbhh.exe64⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vvjdp.exec:\vvjdp.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9pppj.exec:\9pppj.exe66⤵PID:1644
-
\??\c:\flxxlfl.exec:\flxxlfl.exe67⤵PID:2360
-
\??\c:\hbhnnt.exec:\hbhnnt.exe68⤵PID:1856
-
\??\c:\bbnthh.exec:\bbnthh.exe69⤵PID:2520
-
\??\c:\ppddd.exec:\ppddd.exe70⤵PID:812
-
\??\c:\1rrxllx.exec:\1rrxllx.exe71⤵PID:3044
-
\??\c:\nbbhhn.exec:\nbbhhn.exe72⤵PID:2536
-
\??\c:\tnbtnn.exec:\tnbtnn.exe73⤵PID:1612
-
\??\c:\9vdvp.exec:\9vdvp.exe74⤵PID:1608
-
\??\c:\fxllxxx.exec:\fxllxxx.exe75⤵PID:2220
-
\??\c:\rrlrffr.exec:\rrlrffr.exe76⤵PID:2968
-
\??\c:\1bnttt.exec:\1bnttt.exe77⤵PID:2064
-
\??\c:\pdvvv.exec:\pdvvv.exe78⤵PID:2796
-
\??\c:\7vdjd.exec:\7vdjd.exe79⤵PID:2872
-
\??\c:\1xlffff.exec:\1xlffff.exe80⤵PID:2760
-
\??\c:\nhbbnt.exec:\nhbbnt.exe81⤵PID:2724
-
\??\c:\htnnhb.exec:\htnnhb.exe82⤵PID:2936
-
\??\c:\pdpvv.exec:\pdpvv.exe83⤵PID:2628
-
\??\c:\pdpvd.exec:\pdpvd.exe84⤵PID:2676
-
\??\c:\lflrrlx.exec:\lflrrlx.exe85⤵PID:2772
-
\??\c:\nhttbb.exec:\nhttbb.exe86⤵PID:648
-
\??\c:\nbhnnn.exec:\nbhnnn.exe87⤵PID:2216
-
\??\c:\9vjpp.exec:\9vjpp.exe88⤵PID:2152
-
\??\c:\9vvvj.exec:\9vvvj.exe89⤵PID:1704
-
\??\c:\xlrfxff.exec:\xlrfxff.exe90⤵PID:2664
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe91⤵PID:340
-
\??\c:\7nbbtt.exec:\7nbbtt.exe92⤵PID:1792
-
\??\c:\jpvpp.exec:\jpvpp.exe93⤵PID:2856
-
\??\c:\pjddv.exec:\pjddv.exe94⤵PID:1772
-
\??\c:\xrxxxfr.exec:\xrxxxfr.exe95⤵PID:284
-
\??\c:\xlrllll.exec:\xlrllll.exe96⤵PID:2208
-
\??\c:\5tnnnn.exec:\5tnnnn.exe97⤵PID:2488
-
\??\c:\5vjjd.exec:\5vjjd.exe98⤵PID:2960
-
\??\c:\vdpdp.exec:\vdpdp.exe99⤵PID:2132
-
\??\c:\xxffllr.exec:\xxffllr.exe100⤵PID:1128
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe101⤵PID:1780
-
\??\c:\5ttbbh.exec:\5ttbbh.exe102⤵PID:1476
-
\??\c:\vjjjj.exec:\vjjjj.exe103⤵PID:536
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe104⤵PID:1700
-
\??\c:\5frrrrr.exec:\5frrrrr.exe105⤵PID:1276
-
\??\c:\1bntbh.exec:\1bntbh.exe106⤵PID:1692
-
\??\c:\hbtbnn.exec:\hbtbnn.exe107⤵PID:936
-
\??\c:\djjvj.exec:\djjvj.exe108⤵PID:2012
-
\??\c:\xlfrxfl.exec:\xlfrxfl.exe109⤵PID:2112
-
\??\c:\9lxxxxl.exec:\9lxxxxl.exe110⤵PID:2448
-
\??\c:\7nhnhn.exec:\7nhnhn.exe111⤵PID:2328
-
\??\c:\vpvvd.exec:\vpvvd.exe112⤵PID:2020
-
\??\c:\vpjdp.exec:\vpjdp.exe113⤵PID:2160
-
\??\c:\xfrlllr.exec:\xfrlllr.exe114⤵PID:2984
-
\??\c:\thnhnt.exec:\thnhnt.exe115⤵PID:1708
-
\??\c:\bnbtbb.exec:\bnbtbb.exe116⤵PID:2896
-
\??\c:\pjppd.exec:\pjppd.exe117⤵PID:2688
-
\??\c:\9lxxxrr.exec:\9lxxxrr.exe118⤵PID:2816
-
\??\c:\frllffx.exec:\frllffx.exe119⤵PID:2696
-
\??\c:\hbnntt.exec:\hbnntt.exe120⤵PID:2716
-
\??\c:\jjvpv.exec:\jjvpv.exe121⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-