Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe
-
Size
454KB
-
MD5
2b4459e27da1049220207176c17f50d2
-
SHA1
7f59eb24954ad250efdaec961443b87efb91b4f1
-
SHA256
114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7
-
SHA512
5d4358f477f9b89ffd89adad2fe9ce226525f5006d4757b2bc61adc556555083dce4d5755aeea282f991f90826ccc173aae54e82659b7e4a046c6dd49a8c3553
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1960-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-63-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2780-72-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2780-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-358-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1968-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2228-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-592-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-706-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-774-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2788-833-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-876-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-915-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2936-1165-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2288-1191-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1976 nttbnt.exe 1856 jjvjv.exe 2120 jjvjj.exe 2428 rrlxflf.exe 3068 hbbnbn.exe 2748 frllrrx.exe 2780 tnhbbh.exe 2852 vvjvp.exe 2964 9btttt.exe 2508 vpvvv.exe 2628 lxfrxrr.exe 2956 rrllxxf.exe 1852 nhtbbb.exe 1352 rrrxfxl.exe 1668 tnhbnn.exe 2300 xrfrxfr.exe 1732 7nbbhh.exe 1876 pdvdv.exe 1632 1bnttb.exe 2684 9dvjd.exe 2496 rllxrfr.exe 2012 hhhnbn.exe 2876 9jvdj.exe 2380 xxrxlrl.exe 2480 hnbnbh.exe 1692 lfffrll.exe 3004 thntbh.exe 1860 vdvjj.exe 1832 vppdj.exe 2180 1llrxfl.exe 1976 1pjvj.exe 2912 ffxlfrl.exe 1836 dpvdp.exe 3000 xrxlfrf.exe 2468 hhtbht.exe 2428 jvppd.exe 2720 frrrxrl.exe 2856 lllrflf.exe 2740 bbbtnh.exe 2204 5vjvj.exe 2784 lrrxfll.exe 1968 xxxfxfx.exe 2772 nthbhh.exe 2552 1pvvj.exe 1188 5rrxfrf.exe 2228 5flxrxf.exe 1180 nnhnbh.exe 1852 1bbbbb.exe 1352 jjvpp.exe 1840 fxxxlrl.exe 2284 nnbhbt.exe 1724 hnhthh.exe 1892 ppjvp.exe 1704 llflxfx.exe 1720 lfxfrfx.exe 1568 nnhtnt.exe 2568 jdvdp.exe 1532 jdvdp.exe 1388 xxxlrxl.exe 1424 nbnhhb.exe 2020 btttht.exe 2716 vjdjj.exe 336 9fxfrff.exe 1456 hhhtbb.exe -
resource yara_rule behavioral1/memory/1960-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-63-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2780-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-372-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1180-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-802-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-833-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-922-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-1018-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-1110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-1185-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1976 1960 114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe 30 PID 1960 wrote to memory of 1976 1960 114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe 30 PID 1960 wrote to memory of 1976 1960 114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe 30 PID 1960 wrote to memory of 1976 1960 114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe 30 PID 1976 wrote to memory of 1856 1976 nttbnt.exe 31 PID 1976 wrote to memory of 1856 1976 nttbnt.exe 31 PID 1976 wrote to memory of 1856 1976 nttbnt.exe 31 PID 1976 wrote to memory of 1856 1976 nttbnt.exe 31 PID 1856 wrote to memory of 2120 1856 jjvjv.exe 32 PID 1856 wrote to memory of 2120 1856 jjvjv.exe 32 PID 1856 wrote to memory of 2120 1856 jjvjv.exe 32 PID 1856 wrote to memory of 2120 1856 jjvjv.exe 32 PID 2120 wrote to memory of 2428 2120 jjvjj.exe 33 PID 2120 wrote to memory of 2428 2120 jjvjj.exe 33 PID 2120 wrote to memory of 2428 2120 jjvjj.exe 33 PID 2120 wrote to memory of 2428 2120 jjvjj.exe 33 PID 2428 wrote to memory of 3068 2428 rrlxflf.exe 34 PID 2428 wrote to memory of 3068 2428 rrlxflf.exe 34 PID 2428 wrote to memory of 3068 2428 rrlxflf.exe 34 PID 2428 wrote to memory of 3068 2428 rrlxflf.exe 34 PID 3068 wrote to memory of 2748 3068 hbbnbn.exe 35 PID 3068 wrote to memory of 2748 3068 hbbnbn.exe 35 PID 3068 wrote to memory of 2748 3068 hbbnbn.exe 35 PID 3068 wrote to memory of 2748 3068 hbbnbn.exe 35 PID 2748 wrote to memory of 2780 2748 frllrrx.exe 36 PID 2748 wrote to memory of 2780 2748 frllrrx.exe 36 PID 2748 wrote to memory of 2780 2748 frllrrx.exe 36 PID 2748 wrote to memory of 2780 2748 frllrrx.exe 36 PID 2780 wrote to memory of 2852 2780 tnhbbh.exe 37 PID 2780 wrote to memory of 2852 2780 tnhbbh.exe 37 PID 2780 wrote to memory of 2852 2780 tnhbbh.exe 37 PID 2780 wrote to memory of 2852 2780 tnhbbh.exe 37 PID 2852 wrote to memory of 2964 2852 vvjvp.exe 38 PID 2852 wrote to memory of 2964 2852 vvjvp.exe 38 PID 2852 wrote to memory of 2964 2852 vvjvp.exe 38 PID 2852 wrote to memory of 2964 2852 vvjvp.exe 38 PID 2964 wrote to memory of 2508 2964 9btttt.exe 39 PID 2964 wrote to memory of 2508 2964 9btttt.exe 39 PID 2964 wrote to memory of 2508 2964 9btttt.exe 39 PID 2964 wrote to memory of 2508 2964 9btttt.exe 39 PID 2508 wrote to memory of 2628 2508 vpvvv.exe 40 PID 2508 wrote to memory of 2628 2508 vpvvv.exe 40 PID 2508 wrote to memory of 2628 2508 vpvvv.exe 40 PID 2508 wrote to memory of 2628 2508 vpvvv.exe 40 PID 2628 wrote to memory of 2956 2628 lxfrxrr.exe 41 PID 2628 wrote to memory of 2956 2628 lxfrxrr.exe 41 PID 2628 wrote to memory of 2956 2628 lxfrxrr.exe 41 PID 2628 wrote to memory of 2956 2628 lxfrxrr.exe 41 PID 2956 wrote to memory of 1852 2956 rrllxxf.exe 42 PID 2956 wrote to memory of 1852 2956 rrllxxf.exe 42 PID 2956 wrote to memory of 1852 2956 rrllxxf.exe 42 PID 2956 wrote to memory of 1852 2956 rrllxxf.exe 42 PID 1852 wrote to memory of 1352 1852 nhtbbb.exe 43 PID 1852 wrote to memory of 1352 1852 nhtbbb.exe 43 PID 1852 wrote to memory of 1352 1852 nhtbbb.exe 43 PID 1852 wrote to memory of 1352 1852 nhtbbb.exe 43 PID 1352 wrote to memory of 1668 1352 rrrxfxl.exe 44 PID 1352 wrote to memory of 1668 1352 rrrxfxl.exe 44 PID 1352 wrote to memory of 1668 1352 rrrxfxl.exe 44 PID 1352 wrote to memory of 1668 1352 rrrxfxl.exe 44 PID 1668 wrote to memory of 2300 1668 tnhbnn.exe 45 PID 1668 wrote to memory of 2300 1668 tnhbnn.exe 45 PID 1668 wrote to memory of 2300 1668 tnhbnn.exe 45 PID 1668 wrote to memory of 2300 1668 tnhbnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe"C:\Users\Admin\AppData\Local\Temp\114edc41129da003b3f5cdacbbbb987eb3107f12244e0da9b4afbb1adbb1e7b7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\nttbnt.exec:\nttbnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\jjvjv.exec:\jjvjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\jjvjj.exec:\jjvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rrlxflf.exec:\rrlxflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hbbnbn.exec:\hbbnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\frllrrx.exec:\frllrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tnhbbh.exec:\tnhbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\vvjvp.exec:\vvjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\9btttt.exec:\9btttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vpvvv.exec:\vpvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\lxfrxrr.exec:\lxfrxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\rrllxxf.exec:\rrllxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\nhtbbb.exec:\nhtbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\rrrxfxl.exec:\rrrxfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\tnhbnn.exec:\tnhbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe17⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7nbbhh.exec:\7nbbhh.exe18⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pdvdv.exec:\pdvdv.exe19⤵
- Executes dropped EXE
PID:1876 -
\??\c:\1bnttb.exec:\1bnttb.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\9dvjd.exec:\9dvjd.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rllxrfr.exec:\rllxrfr.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hhhnbn.exec:\hhhnbn.exe23⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9jvdj.exec:\9jvdj.exe24⤵
- Executes dropped EXE
PID:2876 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe25⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hnbnbh.exec:\hnbnbh.exe26⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lfffrll.exec:\lfffrll.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\thntbh.exec:\thntbh.exe28⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vdvjj.exec:\vdvjj.exe29⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vppdj.exec:\vppdj.exe30⤵
- Executes dropped EXE
PID:1832 -
\??\c:\1llrxfl.exec:\1llrxfl.exe31⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1pjvj.exec:\1pjvj.exe32⤵
- Executes dropped EXE
PID:1976 -
\??\c:\ffxlfrl.exec:\ffxlfrl.exe33⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dpvdp.exec:\dpvdp.exe34⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xrxlfrf.exec:\xrxlfrf.exe35⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hhtbht.exec:\hhtbht.exe36⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jvppd.exec:\jvppd.exe37⤵
- Executes dropped EXE
PID:2428 -
\??\c:\frrrxrl.exec:\frrrxrl.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lllrflf.exec:\lllrflf.exe39⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bbbtnh.exec:\bbbtnh.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5vjvj.exec:\5vjvj.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lrrxfll.exec:\lrrxfll.exe42⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe43⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nthbhh.exec:\nthbhh.exe44⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1pvvj.exec:\1pvvj.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5rrxfrf.exec:\5rrxfrf.exe46⤵
- Executes dropped EXE
PID:1188 -
\??\c:\5flxrxf.exec:\5flxrxf.exe47⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nnhnbh.exec:\nnhnbh.exe48⤵
- Executes dropped EXE
PID:1180 -
\??\c:\1bbbbb.exec:\1bbbbb.exe49⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jjvpp.exec:\jjvpp.exe50⤵
- Executes dropped EXE
PID:1352 -
\??\c:\fxxxlrl.exec:\fxxxlrl.exe51⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nnbhbt.exec:\nnbhbt.exe52⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hnhthh.exec:\hnhthh.exe53⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ppjvp.exec:\ppjvp.exe54⤵
- Executes dropped EXE
PID:1892 -
\??\c:\llflxfx.exec:\llflxfx.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe56⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nnhtnt.exec:\nnhtnt.exe57⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdvdp.exec:\jdvdp.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\jdvdp.exec:\jdvdp.exe59⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxxlrxl.exec:\xxxlrxl.exe60⤵
- Executes dropped EXE
PID:1388 -
\??\c:\nbnhhb.exec:\nbnhhb.exe61⤵
- Executes dropped EXE
PID:1424 -
\??\c:\btttht.exec:\btttht.exe62⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vjdjj.exec:\vjdjj.exe63⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9fxfrff.exec:\9fxfrff.exe64⤵
- Executes dropped EXE
PID:336 -
\??\c:\hhhtbb.exec:\hhhtbb.exe65⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nhbnhn.exec:\nhbnhn.exe66⤵PID:1600
-
\??\c:\ddpjv.exec:\ddpjv.exe67⤵PID:2432
-
\??\c:\lxrflxl.exec:\lxrflxl.exe68⤵PID:2268
-
\??\c:\3lrxflf.exec:\3lrxflf.exe69⤵PID:896
-
\??\c:\9ntntt.exec:\9ntntt.exe70⤵PID:1832
-
\??\c:\jjddv.exec:\jjddv.exe71⤵PID:2272
-
\??\c:\lrrfxll.exec:\lrrfxll.exe72⤵PID:764
-
\??\c:\rfxflrf.exec:\rfxflrf.exe73⤵PID:2988
-
\??\c:\hnnhnh.exec:\hnnhnh.exe74⤵PID:1512
-
\??\c:\pdjpv.exec:\pdjpv.exe75⤵PID:2088
-
\??\c:\lfrxffr.exec:\lfrxffr.exe76⤵PID:2168
-
\??\c:\1httth.exec:\1httth.exe77⤵PID:2792
-
\??\c:\7bbtbh.exec:\7bbtbh.exe78⤵PID:2704
-
\??\c:\dvdjp.exec:\dvdjp.exe79⤵PID:2648
-
\??\c:\jdvjp.exec:\jdvjp.exe80⤵PID:2764
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe81⤵PID:2856
-
\??\c:\3tnntt.exec:\3tnntt.exe82⤵PID:2740
-
\??\c:\pvjvd.exec:\pvjvd.exe83⤵PID:2676
-
\??\c:\djppp.exec:\djppp.exe84⤵PID:2528
-
\??\c:\7lfffff.exec:\7lfffff.exe85⤵PID:2936
-
\??\c:\1bttbb.exec:\1bttbb.exe86⤵PID:2580
-
\??\c:\pjvpp.exec:\pjvpp.exe87⤵PID:3028
-
\??\c:\1djjj.exec:\1djjj.exe88⤵PID:2440
-
\??\c:\7frrrrr.exec:\7frrrrr.exe89⤵PID:2960
-
\??\c:\ffrxxxf.exec:\ffrxxxf.exe90⤵PID:1464
-
\??\c:\bthhtt.exec:\bthhtt.exe91⤵PID:316
-
\??\c:\pjvdj.exec:\pjvdj.exe92⤵PID:1252
-
\??\c:\lflxxfl.exec:\lflxxfl.exe93⤵PID:2344
-
\??\c:\xrflrxx.exec:\xrflrxx.exe94⤵PID:2300
-
\??\c:\thbhhh.exec:\thbhhh.exe95⤵PID:1920
-
\??\c:\pdppd.exec:\pdppd.exe96⤵PID:1872
-
\??\c:\vjddv.exec:\vjddv.exe97⤵PID:1828
-
\??\c:\rflfflr.exec:\rflfflr.exe98⤵PID:1720
-
\??\c:\hnhhnb.exec:\hnhhnb.exe99⤵PID:2944
-
\??\c:\dvjjp.exec:\dvjjp.exe100⤵PID:2568
-
\??\c:\7jvvp.exec:\7jvvp.exe101⤵PID:2148
-
\??\c:\lffrxxl.exec:\lffrxxl.exe102⤵PID:2692
-
\??\c:\nthtbt.exec:\nthtbt.exe103⤵PID:584
-
\??\c:\htnnbh.exec:\htnnbh.exe104⤵PID:236
-
\??\c:\jvjvj.exec:\jvjvj.exe105⤵PID:3008
-
\??\c:\xrlfrrr.exec:\xrlfrrr.exe106⤵PID:2480
-
\??\c:\bthhnn.exec:\bthhnn.exe107⤵PID:1440
-
\??\c:\dvjdj.exec:\dvjdj.exe108⤵PID:1980
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe109⤵PID:1860
-
\??\c:\lxfrxxf.exec:\lxfrxxf.exe110⤵PID:2396
-
\??\c:\tbbbtb.exec:\tbbbtb.exe111⤵PID:2904
-
\??\c:\dpjjv.exec:\dpjjv.exe112⤵PID:2844
-
\??\c:\dpdjv.exec:\dpdjv.exe113⤵PID:1636
-
\??\c:\fxxfrxx.exec:\fxxfrxx.exe114⤵PID:2388
-
\??\c:\ffllxxf.exec:\ffllxxf.exe115⤵PID:2064
-
\??\c:\htnbth.exec:\htnbth.exe116⤵PID:2788
-
\??\c:\1jvvv.exec:\1jvvv.exe117⤵PID:2128
-
\??\c:\3lxrllr.exec:\3lxrllr.exe118⤵PID:2468
-
\??\c:\9rlxrrf.exec:\9rlxrrf.exe119⤵PID:2712
-
\??\c:\tthntb.exec:\tthntb.exe120⤵PID:2768
-
\??\c:\vpvpd.exec:\vpvpd.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-