Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe
-
Size
454KB
-
MD5
488c52cd631d9edaea3e83bb9212c330
-
SHA1
2b6154f8f8d5a725dd5d874099cd1e71098a74d9
-
SHA256
d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bf
-
SHA512
4deaed94b8cc6be02479a0128d335a6d48e1bbe6fb784cb0cfbe6765704340b756e5c890f50b4c3a9b42b2aed4e6bc5ef901e0eeb0ed572e520999e0b2d9a511
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbev:q7Tc2NYHUrAwfMp3CDv
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2100-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-42-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2816-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-44-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2824-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-133-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2520-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-240-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-303-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/832-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-339-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2796-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-357-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2704-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1088-426-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2736-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-453-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-498-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-550-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1992-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-669-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1020-696-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1132-783-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-931-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2312-1016-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 rlrxlfl.exe 832 nnhhbb.exe 2120 9jdjj.exe 2272 tthhnt.exe 2816 3xrrxrx.exe 2824 7vppv.exe 2932 xrlrxxf.exe 2704 hbbbnh.exe 1468 jvjpv.exe 2604 1ffxflr.exe 2404 7pjdp.exe 900 1dvjv.exe 2800 fxxfrrx.exe 596 jdvjv.exe 2520 fxffrxf.exe 1604 5nnbht.exe 2748 vpjjp.exe 764 lfxxxxf.exe 2768 btnthh.exe 1928 7xxrrxf.exe 1272 hbtbnt.exe 2312 frflllr.exe 444 tnttbb.exe 704 pjvdp.exe 848 3lxxxrx.exe 1320 vpjdp.exe 2992 rxfllrf.exe 2380 thtbhn.exe 1060 tnhnbn.exe 1636 9hnntn.exe 2448 xrxflrf.exe 2316 3hnhnh.exe 2328 9vjjj.exe 3008 1rxxffl.exe 832 thbbhh.exe 2676 dvpdj.exe 2812 5dvvv.exe 2940 lxrrfxf.exe 2816 bttttn.exe 2796 bnthhn.exe 2668 jdjjv.exe 2704 xllrrrx.exe 1468 btnntb.exe 2092 htbbnt.exe 1384 ddvvd.exe 836 xrllrxl.exe 1088 bthbhb.exe 2800 1hbbnn.exe 1868 jdjjv.exe 1980 rflllfl.exe 784 hhtbhh.exe 1036 7nttbh.exe 2736 dpdvj.exe 284 7xllrff.exe 2904 lflllfl.exe 2220 3bhhnt.exe 1928 vjvpv.exe 3012 jdppp.exe 1132 1frrlfl.exe 2908 5nttbb.exe 584 pjppp.exe 1432 9pdjd.exe 2208 xlrlfxl.exe 1320 thtthh.exe -
resource yara_rule behavioral1/memory/2100-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-370-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/784-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-453-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2220-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-669-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2352-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2060 2100 d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe 31 PID 2100 wrote to memory of 2060 2100 d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe 31 PID 2100 wrote to memory of 2060 2100 d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe 31 PID 2100 wrote to memory of 2060 2100 d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe 31 PID 2060 wrote to memory of 832 2060 rlrxlfl.exe 32 PID 2060 wrote to memory of 832 2060 rlrxlfl.exe 32 PID 2060 wrote to memory of 832 2060 rlrxlfl.exe 32 PID 2060 wrote to memory of 832 2060 rlrxlfl.exe 32 PID 832 wrote to memory of 2120 832 nnhhbb.exe 33 PID 832 wrote to memory of 2120 832 nnhhbb.exe 33 PID 832 wrote to memory of 2120 832 nnhhbb.exe 33 PID 832 wrote to memory of 2120 832 nnhhbb.exe 33 PID 2120 wrote to memory of 2272 2120 9jdjj.exe 34 PID 2120 wrote to memory of 2272 2120 9jdjj.exe 34 PID 2120 wrote to memory of 2272 2120 9jdjj.exe 34 PID 2120 wrote to memory of 2272 2120 9jdjj.exe 34 PID 2272 wrote to memory of 2816 2272 tthhnt.exe 35 PID 2272 wrote to memory of 2816 2272 tthhnt.exe 35 PID 2272 wrote to memory of 2816 2272 tthhnt.exe 35 PID 2272 wrote to memory of 2816 2272 tthhnt.exe 35 PID 2816 wrote to memory of 2824 2816 3xrrxrx.exe 36 PID 2816 wrote to memory of 2824 2816 3xrrxrx.exe 36 PID 2816 wrote to memory of 2824 2816 3xrrxrx.exe 36 PID 2816 wrote to memory of 2824 2816 3xrrxrx.exe 36 PID 2824 wrote to memory of 2932 2824 7vppv.exe 37 PID 2824 wrote to memory of 2932 2824 7vppv.exe 37 PID 2824 wrote to memory of 2932 2824 7vppv.exe 37 PID 2824 wrote to memory of 2932 2824 7vppv.exe 37 PID 2932 wrote to memory of 2704 2932 xrlrxxf.exe 38 PID 2932 wrote to memory of 2704 2932 xrlrxxf.exe 38 PID 2932 wrote to memory of 2704 2932 xrlrxxf.exe 38 PID 2932 wrote to memory of 2704 2932 xrlrxxf.exe 38 PID 2704 wrote to memory of 1468 2704 hbbbnh.exe 39 PID 2704 wrote to memory of 1468 2704 hbbbnh.exe 39 PID 2704 wrote to memory of 1468 2704 hbbbnh.exe 39 PID 2704 wrote to memory of 1468 2704 hbbbnh.exe 39 PID 1468 wrote to memory of 2604 1468 jvjpv.exe 40 PID 1468 wrote to memory of 2604 1468 jvjpv.exe 40 PID 1468 wrote to memory of 2604 1468 jvjpv.exe 40 PID 1468 wrote to memory of 2604 1468 jvjpv.exe 40 PID 2604 wrote to memory of 2404 2604 1ffxflr.exe 41 PID 2604 wrote to memory of 2404 2604 1ffxflr.exe 41 PID 2604 wrote to memory of 2404 2604 1ffxflr.exe 41 PID 2604 wrote to memory of 2404 2604 1ffxflr.exe 41 PID 2404 wrote to memory of 900 2404 7pjdp.exe 42 PID 2404 wrote to memory of 900 2404 7pjdp.exe 42 PID 2404 wrote to memory of 900 2404 7pjdp.exe 42 PID 2404 wrote to memory of 900 2404 7pjdp.exe 42 PID 900 wrote to memory of 2800 900 1dvjv.exe 43 PID 900 wrote to memory of 2800 900 1dvjv.exe 43 PID 900 wrote to memory of 2800 900 1dvjv.exe 43 PID 900 wrote to memory of 2800 900 1dvjv.exe 43 PID 2800 wrote to memory of 596 2800 fxxfrrx.exe 44 PID 2800 wrote to memory of 596 2800 fxxfrrx.exe 44 PID 2800 wrote to memory of 596 2800 fxxfrrx.exe 44 PID 2800 wrote to memory of 596 2800 fxxfrrx.exe 44 PID 596 wrote to memory of 2520 596 jdvjv.exe 45 PID 596 wrote to memory of 2520 596 jdvjv.exe 45 PID 596 wrote to memory of 2520 596 jdvjv.exe 45 PID 596 wrote to memory of 2520 596 jdvjv.exe 45 PID 2520 wrote to memory of 1604 2520 fxffrxf.exe 46 PID 2520 wrote to memory of 1604 2520 fxffrxf.exe 46 PID 2520 wrote to memory of 1604 2520 fxffrxf.exe 46 PID 2520 wrote to memory of 1604 2520 fxffrxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe"C:\Users\Admin\AppData\Local\Temp\d4511a6d4b58ce7b582055192b79629044aa9cb92fc4933926a1ef80619113bfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rlrxlfl.exec:\rlrxlfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\nnhhbb.exec:\nnhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\9jdjj.exec:\9jdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\tthhnt.exec:\tthhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\3xrrxrx.exec:\3xrrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\7vppv.exec:\7vppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hbbbnh.exec:\hbbbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\jvjpv.exec:\jvjpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\1ffxflr.exec:\1ffxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7pjdp.exec:\7pjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\1dvjv.exec:\1dvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\fxxfrrx.exec:\fxxfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jdvjv.exec:\jdvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\fxffrxf.exec:\fxffrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5nnbht.exec:\5nnbht.exe17⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vpjjp.exec:\vpjjp.exe18⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lfxxxxf.exec:\lfxxxxf.exe19⤵
- Executes dropped EXE
PID:764 -
\??\c:\btnthh.exec:\btnthh.exe20⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7xxrrxf.exec:\7xxrrxf.exe21⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hbtbnt.exec:\hbtbnt.exe22⤵
- Executes dropped EXE
PID:1272 -
\??\c:\frflllr.exec:\frflllr.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnttbb.exec:\tnttbb.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\pjvdp.exec:\pjvdp.exe25⤵
- Executes dropped EXE
PID:704 -
\??\c:\3lxxxrx.exec:\3lxxxrx.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\vpjdp.exec:\vpjdp.exe27⤵
- Executes dropped EXE
PID:1320 -
\??\c:\rxfllrf.exec:\rxfllrf.exe28⤵
- Executes dropped EXE
PID:2992 -
\??\c:\thtbhn.exec:\thtbhn.exe29⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tnhnbn.exec:\tnhnbn.exe30⤵
- Executes dropped EXE
PID:1060 -
\??\c:\9hnntn.exec:\9hnntn.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrxflrf.exec:\xrxflrf.exe32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\3hnhnh.exec:\3hnhnh.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9vjjj.exec:\9vjjj.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\1rxxffl.exec:\1rxxffl.exe35⤵
- Executes dropped EXE
PID:3008 -
\??\c:\thbbhh.exec:\thbbhh.exe36⤵
- Executes dropped EXE
PID:832 -
\??\c:\dvpdj.exec:\dvpdj.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\5dvvv.exec:\5dvvv.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lxrrfxf.exec:\lxrrfxf.exe39⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bttttn.exec:\bttttn.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bnthhn.exec:\bnthhn.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jdjjv.exec:\jdjjv.exe42⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xllrrrx.exec:\xllrrrx.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\btnntb.exec:\btnntb.exe44⤵
- Executes dropped EXE
PID:1468 -
\??\c:\htbbnt.exec:\htbbnt.exe45⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ddvvd.exec:\ddvvd.exe46⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xrllrxl.exec:\xrllrxl.exe47⤵
- Executes dropped EXE
PID:836 -
\??\c:\bthbhb.exec:\bthbhb.exe48⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1hbbnn.exec:\1hbbnn.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jdjjv.exec:\jdjjv.exe50⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rflllfl.exec:\rflllfl.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hhtbhh.exec:\hhtbhh.exe52⤵
- Executes dropped EXE
PID:784 -
\??\c:\7nttbh.exec:\7nttbh.exe53⤵
- Executes dropped EXE
PID:1036 -
\??\c:\dpdvj.exec:\dpdvj.exe54⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7xllrff.exec:\7xllrff.exe55⤵
- Executes dropped EXE
PID:284 -
\??\c:\lflllfl.exec:\lflllfl.exe56⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3bhhnt.exec:\3bhhnt.exe57⤵
- Executes dropped EXE
PID:2220 -
\??\c:\vjvpv.exec:\vjvpv.exe58⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdppp.exec:\jdppp.exe59⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1frrlfl.exec:\1frrlfl.exe60⤵
- Executes dropped EXE
PID:1132 -
\??\c:\5nttbb.exec:\5nttbb.exe61⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pjppp.exec:\pjppp.exe62⤵
- Executes dropped EXE
PID:584 -
\??\c:\9pdjd.exec:\9pdjd.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xlrlfxl.exec:\xlrlfxl.exe64⤵
- Executes dropped EXE
PID:2208 -
\??\c:\thtthh.exec:\thtthh.exe65⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hbhhnn.exec:\hbhhnn.exe66⤵PID:1720
-
\??\c:\pjdjv.exec:\pjdjv.exe67⤵PID:2276
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe68⤵PID:2380
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe69⤵PID:1628
-
\??\c:\nhttbb.exec:\nhttbb.exe70⤵PID:1632
-
\??\c:\dpdpv.exec:\dpdpv.exe71⤵PID:1992
-
\??\c:\xxrxfff.exec:\xxrxfff.exe72⤵PID:1580
-
\??\c:\rlffffl.exec:\rlffffl.exe73⤵PID:2300
-
\??\c:\nbnnnn.exec:\nbnnnn.exe74⤵PID:1608
-
\??\c:\3dpvp.exec:\3dpvp.exe75⤵PID:3008
-
\??\c:\1lxrllr.exec:\1lxrllr.exe76⤵PID:2636
-
\??\c:\flflxxf.exec:\flflxxf.exe77⤵PID:2840
-
\??\c:\tnntbb.exec:\tnntbb.exe78⤵PID:2792
-
\??\c:\nhhntt.exec:\nhhntt.exe79⤵PID:2940
-
\??\c:\vjvvd.exec:\vjvvd.exe80⤵PID:2808
-
\??\c:\lfrxfrr.exec:\lfrxfrr.exe81⤵PID:2648
-
\??\c:\7xffrrf.exec:\7xffrrf.exe82⤵PID:2580
-
\??\c:\nhthhh.exec:\nhthhh.exe83⤵PID:2528
-
\??\c:\3dpvd.exec:\3dpvd.exe84⤵PID:3052
-
\??\c:\dvpvd.exec:\dvpvd.exe85⤵PID:1468
-
\??\c:\frfxrrx.exec:\frfxrrx.exe86⤵PID:2352
-
\??\c:\hbnthh.exec:\hbnthh.exe87⤵PID:896
-
\??\c:\1bhhhh.exec:\1bhhhh.exe88⤵PID:1020
-
\??\c:\3jvjp.exec:\3jvjp.exe89⤵PID:1948
-
\??\c:\rrffllx.exec:\rrffllx.exe90⤵PID:1596
-
\??\c:\bnbhnt.exec:\bnbhnt.exe91⤵PID:2592
-
\??\c:\thtttb.exec:\thtttb.exe92⤵PID:1212
-
\??\c:\dvpdd.exec:\dvpdd.exe93⤵PID:1624
-
\??\c:\9frfllr.exec:\9frfllr.exe94⤵PID:2748
-
\??\c:\tnbnnn.exec:\tnbnnn.exe95⤵PID:1752
-
\??\c:\hhtttb.exec:\hhtttb.exe96⤵PID:2772
-
\??\c:\vjvpv.exec:\vjvpv.exe97⤵PID:2232
-
\??\c:\3lxrllr.exec:\3lxrllr.exe98⤵PID:2176
-
\??\c:\9rffrll.exec:\9rffrll.exe99⤵PID:2900
-
\??\c:\bthhtt.exec:\bthhtt.exe100⤵PID:1032
-
\??\c:\dpdjj.exec:\dpdjj.exe101⤵PID:3012
-
\??\c:\7pdvd.exec:\7pdvd.exe102⤵PID:1132
-
\??\c:\xrfrffl.exec:\xrfrffl.exe103⤵PID:2908
-
\??\c:\hbnnnt.exec:\hbnnnt.exe104⤵PID:2160
-
\??\c:\nhbtbh.exec:\nhbtbh.exe105⤵PID:1792
-
\??\c:\vpjjp.exec:\vpjjp.exe106⤵PID:1100
-
\??\c:\rllrrxf.exec:\rllrrxf.exe107⤵PID:2260
-
\??\c:\lxfrrrr.exec:\lxfrrrr.exe108⤵PID:2236
-
\??\c:\bthntn.exec:\bthntn.exe109⤵PID:1616
-
\??\c:\7bnhbt.exec:\7bnhbt.exe110⤵PID:2440
-
\??\c:\dpdjv.exec:\dpdjv.exe111⤵PID:1740
-
\??\c:\ffffrxl.exec:\ffffrxl.exe112⤵PID:2944
-
\??\c:\fxffrlr.exec:\fxffrlr.exe113⤵PID:2100
-
\??\c:\bbtbhn.exec:\bbtbhn.exe114⤵PID:1552
-
\??\c:\pjvvd.exec:\pjvvd.exe115⤵PID:2032
-
\??\c:\xrllrxf.exec:\xrllrxf.exe116⤵PID:1896
-
\??\c:\1xllffl.exec:\1xllffl.exe117⤵PID:2472
-
\??\c:\5nbhhh.exec:\5nbhhh.exe118⤵PID:2624
-
\??\c:\pjjjd.exec:\pjjjd.exe119⤵PID:2688
-
\??\c:\dpvpd.exec:\dpvpd.exe120⤵PID:2656
-
\??\c:\lxllllx.exec:\lxllllx.exe121⤵PID:2684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-