Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe
-
Size
454KB
-
MD5
56db38ccd66a77ce9de011b14d6e3a5d
-
SHA1
1a5ea7ece55dbccdbc077d82e41ffc1728b7dee0
-
SHA256
9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc
-
SHA512
d9d995c28f5b0af077bc2c1fcc28d24de2ca17fb36f88c2fcfa37266198ac64c801c4fd1d2690b487d4bf80fab1be69d1a17c40571715a40566033eb8e5be3c6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeOo:q7Tc2NYHUrAwfMp3CDOo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1720-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-33-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2388-39-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2388-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-119-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1372-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/728-139-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/728-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1440-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1440-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1420-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-230-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2588-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-256-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2248-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-320-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-361-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2356-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-513-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2796-526-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3004-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-560-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1696-592-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2104-597-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1844-612-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-619-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2744-638-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-670-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1080-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-835-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1612-848-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1404-885-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1736 xrfllrf.exe 780 bntbnn.exe 308 pdppv.exe 2388 vjpvp.exe 2756 lrflfrl.exe 2848 pjjpp.exe 2840 rlxxllx.exe 2836 xlrllff.exe 2784 7rfxllr.exe 2688 9vpjp.exe 1804 flfxxrr.exe 1372 7vddj.exe 2908 xxxlllr.exe 728 pjvvv.exe 2888 xrflllr.exe 2032 lfrxxxl.exe 2012 fxxfrfr.exe 1440 pjppj.exe 2272 fxlxrlr.exe 1964 vpvpp.exe 1420 3vjjv.exe 2180 vpjpv.exe 2588 pjvdd.exe 940 jdvdp.exe 2160 pdjpv.exe 3012 dpddd.exe 2248 9frfrrx.exe 2892 vjjdd.exe 380 rlrrxxf.exe 1612 dvvjv.exe 2452 7fllxxl.exe 1692 tnbbhb.exe 2696 9vjjp.exe 280 7rrfxrl.exe 308 bthnnh.exe 2720 dpddd.exe 2880 fxlfrlr.exe 2736 fxfffxx.exe 2900 nhbbbt.exe 2804 htbbht.exe 2356 9jvpv.exe 2836 fxfffxx.exe 1800 3rfffll.exe 2732 nhtbbh.exe 2660 jpjvd.exe 1472 5fxxffl.exe 1828 5lrllff.exe 332 thbtnh.exe 1480 dvdvd.exe 1032 9dpjj.exe 2376 rfxrrlr.exe 2916 7ntbhh.exe 1540 3tbntn.exe 1908 dpppj.exe 1756 pdjdj.exe 1440 flxfxxf.exe 2272 hbhnnn.exe 2496 pdjjj.exe 1148 9vdvp.exe 1420 xlxrfxf.exe 276 lrxlrxx.exe 1988 bnbbbt.exe 1072 3vdpd.exe 2796 7dvpd.exe -
resource yara_rule behavioral1/memory/1720-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-33-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2388-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/728-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/728-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-177-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1440-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-320-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2696-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-513-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/3004-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-670-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1080-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-814-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1252-835-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1404-885-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1736 1720 9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe 30 PID 1720 wrote to memory of 1736 1720 9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe 30 PID 1720 wrote to memory of 1736 1720 9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe 30 PID 1720 wrote to memory of 1736 1720 9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe 30 PID 1736 wrote to memory of 780 1736 xrfllrf.exe 31 PID 1736 wrote to memory of 780 1736 xrfllrf.exe 31 PID 1736 wrote to memory of 780 1736 xrfllrf.exe 31 PID 1736 wrote to memory of 780 1736 xrfllrf.exe 31 PID 780 wrote to memory of 308 780 bntbnn.exe 32 PID 780 wrote to memory of 308 780 bntbnn.exe 32 PID 780 wrote to memory of 308 780 bntbnn.exe 32 PID 780 wrote to memory of 308 780 bntbnn.exe 32 PID 308 wrote to memory of 2388 308 pdppv.exe 33 PID 308 wrote to memory of 2388 308 pdppv.exe 33 PID 308 wrote to memory of 2388 308 pdppv.exe 33 PID 308 wrote to memory of 2388 308 pdppv.exe 33 PID 2388 wrote to memory of 2756 2388 vjpvp.exe 34 PID 2388 wrote to memory of 2756 2388 vjpvp.exe 34 PID 2388 wrote to memory of 2756 2388 vjpvp.exe 34 PID 2388 wrote to memory of 2756 2388 vjpvp.exe 34 PID 2756 wrote to memory of 2848 2756 lrflfrl.exe 35 PID 2756 wrote to memory of 2848 2756 lrflfrl.exe 35 PID 2756 wrote to memory of 2848 2756 lrflfrl.exe 35 PID 2756 wrote to memory of 2848 2756 lrflfrl.exe 35 PID 2848 wrote to memory of 2840 2848 pjjpp.exe 36 PID 2848 wrote to memory of 2840 2848 pjjpp.exe 36 PID 2848 wrote to memory of 2840 2848 pjjpp.exe 36 PID 2848 wrote to memory of 2840 2848 pjjpp.exe 36 PID 2840 wrote to memory of 2836 2840 rlxxllx.exe 37 PID 2840 wrote to memory of 2836 2840 rlxxllx.exe 37 PID 2840 wrote to memory of 2836 2840 rlxxllx.exe 37 PID 2840 wrote to memory of 2836 2840 rlxxllx.exe 37 PID 2836 wrote to memory of 2784 2836 xlrllff.exe 38 PID 2836 wrote to memory of 2784 2836 xlrllff.exe 38 PID 2836 wrote to memory of 2784 2836 xlrllff.exe 38 PID 2836 wrote to memory of 2784 2836 xlrllff.exe 38 PID 2784 wrote to memory of 2688 2784 7rfxllr.exe 39 PID 2784 wrote to memory of 2688 2784 7rfxllr.exe 39 PID 2784 wrote to memory of 2688 2784 7rfxllr.exe 39 PID 2784 wrote to memory of 2688 2784 7rfxllr.exe 39 PID 2688 wrote to memory of 1804 2688 9vpjp.exe 40 PID 2688 wrote to memory of 1804 2688 9vpjp.exe 40 PID 2688 wrote to memory of 1804 2688 9vpjp.exe 40 PID 2688 wrote to memory of 1804 2688 9vpjp.exe 40 PID 1804 wrote to memory of 1372 1804 flfxxrr.exe 41 PID 1804 wrote to memory of 1372 1804 flfxxrr.exe 41 PID 1804 wrote to memory of 1372 1804 flfxxrr.exe 41 PID 1804 wrote to memory of 1372 1804 flfxxrr.exe 41 PID 1372 wrote to memory of 2908 1372 7vddj.exe 42 PID 1372 wrote to memory of 2908 1372 7vddj.exe 42 PID 1372 wrote to memory of 2908 1372 7vddj.exe 42 PID 1372 wrote to memory of 2908 1372 7vddj.exe 42 PID 2908 wrote to memory of 728 2908 xxxlllr.exe 43 PID 2908 wrote to memory of 728 2908 xxxlllr.exe 43 PID 2908 wrote to memory of 728 2908 xxxlllr.exe 43 PID 2908 wrote to memory of 728 2908 xxxlllr.exe 43 PID 728 wrote to memory of 2888 728 pjvvv.exe 44 PID 728 wrote to memory of 2888 728 pjvvv.exe 44 PID 728 wrote to memory of 2888 728 pjvvv.exe 44 PID 728 wrote to memory of 2888 728 pjvvv.exe 44 PID 2888 wrote to memory of 2032 2888 xrflllr.exe 45 PID 2888 wrote to memory of 2032 2888 xrflllr.exe 45 PID 2888 wrote to memory of 2032 2888 xrflllr.exe 45 PID 2888 wrote to memory of 2032 2888 xrflllr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe"C:\Users\Admin\AppData\Local\Temp\9e4636e9a1b2ade5a7509b5e3289efc3982c49e9c3b73168788ddc0be40818cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\xrfllrf.exec:\xrfllrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\bntbnn.exec:\bntbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\pdppv.exec:\pdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\vjpvp.exec:\vjpvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\lrflfrl.exec:\lrflfrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\pjjpp.exec:\pjjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\rlxxllx.exec:\rlxxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\xlrllff.exec:\xlrllff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\7rfxllr.exec:\7rfxllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\9vpjp.exec:\9vpjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\flfxxrr.exec:\flfxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\7vddj.exec:\7vddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\xxxlllr.exec:\xxxlllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pjvvv.exec:\pjvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\xrflllr.exec:\xrflllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lfrxxxl.exec:\lfrxxxl.exe17⤵
- Executes dropped EXE
PID:2032 -
\??\c:\fxxfrfr.exec:\fxxfrfr.exe18⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjppj.exec:\pjppj.exe19⤵
- Executes dropped EXE
PID:1440 -
\??\c:\fxlxrlr.exec:\fxlxrlr.exe20⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vpvpp.exec:\vpvpp.exe21⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3vjjv.exec:\3vjjv.exe22⤵
- Executes dropped EXE
PID:1420 -
\??\c:\vpjpv.exec:\vpjpv.exe23⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjvdd.exec:\pjvdd.exe24⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jdvdp.exec:\jdvdp.exe25⤵
- Executes dropped EXE
PID:940 -
\??\c:\pdjpv.exec:\pdjpv.exe26⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dpddd.exec:\dpddd.exe27⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9frfrrx.exec:\9frfrrx.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vjjdd.exec:\vjjdd.exe29⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe30⤵
- Executes dropped EXE
PID:380 -
\??\c:\dvvjv.exec:\dvvjv.exe31⤵
- Executes dropped EXE
PID:1612 -
\??\c:\7fllxxl.exec:\7fllxxl.exe32⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tnbbhb.exec:\tnbbhb.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\9vjjp.exec:\9vjjp.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7rrfxrl.exec:\7rrfxrl.exe35⤵
- Executes dropped EXE
PID:280 -
\??\c:\bthnnh.exec:\bthnnh.exe36⤵
- Executes dropped EXE
PID:308 -
\??\c:\dpddd.exec:\dpddd.exe37⤵
- Executes dropped EXE
PID:2720 -
\??\c:\fxlfrlr.exec:\fxlfrlr.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fxfffxx.exec:\fxfffxx.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhbbbt.exec:\nhbbbt.exe40⤵
- Executes dropped EXE
PID:2900 -
\??\c:\htbbht.exec:\htbbht.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9jvpv.exec:\9jvpv.exe42⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fxfffxx.exec:\fxfffxx.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3rfffll.exec:\3rfffll.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhtbbh.exec:\nhtbbh.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jpjvd.exec:\jpjvd.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\5fxxffl.exec:\5fxxffl.exe47⤵
- Executes dropped EXE
PID:1472 -
\??\c:\5lrllff.exec:\5lrllff.exe48⤵
- Executes dropped EXE
PID:1828 -
\??\c:\thbtnh.exec:\thbtnh.exe49⤵
- Executes dropped EXE
PID:332 -
\??\c:\dvdvd.exec:\dvdvd.exe50⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9dpjj.exec:\9dpjj.exe51⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rfxrrlr.exec:\rfxrrlr.exe52⤵
- Executes dropped EXE
PID:2376 -
\??\c:\7ntbhh.exec:\7ntbhh.exe53⤵
- Executes dropped EXE
PID:2916 -
\??\c:\3tbntn.exec:\3tbntn.exe54⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dpppj.exec:\dpppj.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pdjdj.exec:\pdjdj.exe56⤵
- Executes dropped EXE
PID:1756 -
\??\c:\flxfxxf.exec:\flxfxxf.exe57⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hbhnnn.exec:\hbhnnn.exe58⤵
- Executes dropped EXE
PID:2272 -
\??\c:\pdjjj.exec:\pdjjj.exe59⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9vdvp.exec:\9vdvp.exe60⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xlxrfxf.exec:\xlxrfxf.exe61⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lrxlrxx.exec:\lrxlrxx.exe62⤵
- Executes dropped EXE
PID:276 -
\??\c:\bnbbbt.exec:\bnbbbt.exe63⤵
- Executes dropped EXE
PID:1988 -
\??\c:\3vdpd.exec:\3vdpd.exe64⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7dvpd.exec:\7dvpd.exe65⤵
- Executes dropped EXE
PID:2796 -
\??\c:\lxlfrrx.exec:\lxlfrrx.exe66⤵PID:3004
-
\??\c:\3thhhb.exec:\3thhhb.exe67⤵PID:3024
-
\??\c:\nntttt.exec:\nntttt.exe68⤵PID:2140
-
\??\c:\jdvdd.exec:\jdvdd.exe69⤵PID:1040
-
\??\c:\rxrlfff.exec:\rxrlfff.exe70⤵PID:2968
-
\??\c:\thnbnh.exec:\thnbnh.exe71⤵PID:2584
-
\??\c:\nbnttn.exec:\nbnttn.exe72⤵PID:2288
-
\??\c:\dvjdd.exec:\dvjdd.exe73⤵PID:2076
-
\??\c:\vpvdj.exec:\vpvdj.exe74⤵PID:1932
-
\??\c:\lxrrxrr.exec:\lxrrxrr.exe75⤵PID:1696
-
\??\c:\hnbnnn.exec:\hnbnnn.exe76⤵PID:2104
-
\??\c:\pdjjj.exec:\pdjjj.exe77⤵PID:1404
-
\??\c:\pjvdj.exec:\pjvdj.exe78⤵PID:1844
-
\??\c:\xfrlxrx.exec:\xfrlxrx.exe79⤵PID:2860
-
\??\c:\nhhtnt.exec:\nhhtnt.exe80⤵PID:2764
-
\??\c:\bhthnh.exec:\bhthnh.exe81⤵PID:2980
-
\??\c:\pjdjj.exec:\pjdjj.exe82⤵PID:2744
-
\??\c:\5lxxlll.exec:\5lxxlll.exe83⤵PID:2904
-
\??\c:\lxfffrr.exec:\lxfffrr.exe84⤵PID:2612
-
\??\c:\1htthb.exec:\1htthb.exe85⤵PID:2640
-
\??\c:\dvjjj.exec:\dvjjj.exe86⤵PID:2836
-
\??\c:\vjpvp.exec:\vjpvp.exe87⤵PID:2608
-
\??\c:\fxffrrx.exec:\fxffrrx.exe88⤵PID:2688
-
\??\c:\bnbnhh.exec:\bnbnhh.exe89⤵PID:3060
-
\??\c:\bbnnbt.exec:\bbnnbt.exe90⤵PID:1472
-
\??\c:\3vddd.exec:\3vddd.exe91⤵PID:796
-
\??\c:\7xrrrxl.exec:\7xrrrxl.exe92⤵PID:1080
-
\??\c:\xlxxllr.exec:\xlxxllr.exe93⤵PID:2144
-
\??\c:\bnbbbh.exec:\bnbbbh.exe94⤵PID:728
-
\??\c:\jvdpp.exec:\jvdpp.exe95⤵PID:2932
-
\??\c:\dpjjp.exec:\dpjjp.exe96⤵PID:2044
-
\??\c:\rflxrlr.exec:\rflxrlr.exe97⤵PID:1228
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe98⤵PID:316
-
\??\c:\5bhbbb.exec:\5bhbbb.exe99⤵PID:2244
-
\??\c:\5jddj.exec:\5jddj.exe100⤵PID:2260
-
\??\c:\dppjp.exec:\dppjp.exe101⤵PID:2540
-
\??\c:\xxrxrxf.exec:\xxrxrxf.exe102⤵PID:2516
-
\??\c:\bbnnbh.exec:\bbnnbh.exe103⤵PID:2500
-
\??\c:\5dvvd.exec:\5dvvd.exe104⤵PID:1036
-
\??\c:\1pdjj.exec:\1pdjj.exe105⤵PID:2332
-
\??\c:\fxlxrxf.exec:\fxlxrxf.exe106⤵PID:2672
-
\??\c:\bbtbtb.exec:\bbtbtb.exe107⤵PID:940
-
\??\c:\hbtthh.exec:\hbtthh.exe108⤵PID:2300
-
\??\c:\djdvd.exec:\djdvd.exe109⤵PID:2160
-
\??\c:\xrrxrxf.exec:\xrrxrxf.exe110⤵PID:2352
-
\??\c:\lflflff.exec:\lflflff.exe111⤵PID:2204
-
\??\c:\hbbhnt.exec:\hbbhnt.exe112⤵PID:1328
-
\??\c:\ddpvj.exec:\ddpvj.exe113⤵PID:1252
-
\??\c:\5djjp.exec:\5djjp.exe114⤵PID:380
-
\??\c:\1lrrxxf.exec:\1lrrxxf.exe115⤵PID:1612
-
\??\c:\tbhhhb.exec:\tbhhhb.exe116⤵PID:2528
-
\??\c:\hbhtbt.exec:\hbhtbt.exe117⤵PID:1604
-
\??\c:\1vdvv.exec:\1vdvv.exe118⤵PID:2368
-
\??\c:\1xrflrf.exec:\1xrflrf.exe119⤵
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\flrlrfl.exec:\flrlrfl.exe120⤵PID:1684
-
\??\c:\nbhhtn.exec:\nbhhtn.exe121⤵PID:1404
-
\??\c:\jpvvv.exec:\jpvvv.exe122⤵PID:1844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-