Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe
-
Size
455KB
-
MD5
3bdbc74e2652b7b492e9ac08389c5c4b
-
SHA1
a3211ac53589ae7b8f59c37699bf4753fdc3cddb
-
SHA256
465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8
-
SHA512
c9f66e562017c008fc1e535179fdfee72fe3c57f2e291eab26564df34290c530875f464ef4d0c9092635532100037ccdf5a2cdd93c91d4e7b81cd391695a7883
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRU:q7Tc2NYHUrAwfMp3CDRU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-341-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/672-390-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2324-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-541-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1884-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-647-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1240-661-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2156-676-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2036-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/708-772-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2688 llxxffl.exe 2792 rfxfrxl.exe 2784 pjjpd.exe 2296 btnthn.exe 2720 rfrrxrx.exe 2560 bbthth.exe 3036 ddvdp.exe 276 flxfrfx.exe 1764 jjdjv.exe 1172 3rrrrxl.exe 2348 5nbthb.exe 2164 9fxxllx.exe 2372 nbtbnt.exe 2924 1vpdj.exe 2748 llxrrrx.exe 2608 7tbthb.exe 1400 vpddp.exe 2188 lfrlffr.exe 2232 dvppd.exe 2336 9tnhtt.exe 2500 jdvdj.exe 776 lfflrrf.exe 1932 nbtthh.exe 1476 xlrxffl.exe 1956 tnhnbb.exe 1072 vvppd.exe 372 fxlrlrx.exe 2464 3bbnbh.exe 2044 9fxxfxf.exe 1804 hbnntt.exe 2992 ppjpv.exe 2796 nnhnbb.exe 2676 nnnntt.exe 2652 xrflxxl.exe 2940 7rlxxfr.exe 2876 9thhhh.exe 2832 jdjjv.exe 2592 vpddj.exe 2556 3xlrrxx.exe 324 3bhhnn.exe 2292 1pdjv.exe 1396 5fxxffr.exe 276 lfrlxxr.exe 2520 bbtbhn.exe 1296 jjvdd.exe 672 3fflllr.exe 480 5lllffr.exe 2128 tnhnhh.exe 2864 pjdjp.exe 2908 lfrlrrr.exe 2324 rflxfxf.exe 2532 bbhnth.exe 532 7vdjp.exe 1964 9rfxxrx.exe 1668 1xlrrxl.exe 112 bbnnbb.exe 2240 vvdjv.exe 568 jvpjj.exe 1576 lllxrrr.exe 1720 9bnnbh.exe 1040 7djpv.exe 1368 3djpv.exe 1792 5rlrffr.exe 780 nbbbhb.exe -
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-676-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2036-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/708-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-912-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrxfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2688 2092 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 2092 wrote to memory of 2688 2092 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 2092 wrote to memory of 2688 2092 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 2092 wrote to memory of 2688 2092 465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe 30 PID 2688 wrote to memory of 2792 2688 llxxffl.exe 31 PID 2688 wrote to memory of 2792 2688 llxxffl.exe 31 PID 2688 wrote to memory of 2792 2688 llxxffl.exe 31 PID 2688 wrote to memory of 2792 2688 llxxffl.exe 31 PID 2792 wrote to memory of 2784 2792 rfxfrxl.exe 32 PID 2792 wrote to memory of 2784 2792 rfxfrxl.exe 32 PID 2792 wrote to memory of 2784 2792 rfxfrxl.exe 32 PID 2792 wrote to memory of 2784 2792 rfxfrxl.exe 32 PID 2784 wrote to memory of 2296 2784 pjjpd.exe 33 PID 2784 wrote to memory of 2296 2784 pjjpd.exe 33 PID 2784 wrote to memory of 2296 2784 pjjpd.exe 33 PID 2784 wrote to memory of 2296 2784 pjjpd.exe 33 PID 2296 wrote to memory of 2720 2296 btnthn.exe 34 PID 2296 wrote to memory of 2720 2296 btnthn.exe 34 PID 2296 wrote to memory of 2720 2296 btnthn.exe 34 PID 2296 wrote to memory of 2720 2296 btnthn.exe 34 PID 2720 wrote to memory of 2560 2720 rfrrxrx.exe 35 PID 2720 wrote to memory of 2560 2720 rfrrxrx.exe 35 PID 2720 wrote to memory of 2560 2720 rfrrxrx.exe 35 PID 2720 wrote to memory of 2560 2720 rfrrxrx.exe 35 PID 2560 wrote to memory of 3036 2560 bbthth.exe 36 PID 2560 wrote to memory of 3036 2560 bbthth.exe 36 PID 2560 wrote to memory of 3036 2560 bbthth.exe 36 PID 2560 wrote to memory of 3036 2560 bbthth.exe 36 PID 3036 wrote to memory of 276 3036 ddvdp.exe 37 PID 3036 wrote to memory of 276 3036 ddvdp.exe 37 PID 3036 wrote to memory of 276 3036 ddvdp.exe 37 PID 3036 wrote to memory of 276 3036 ddvdp.exe 37 PID 276 wrote to memory of 1764 276 flxfrfx.exe 38 PID 276 wrote to memory of 1764 276 flxfrfx.exe 38 PID 276 wrote to memory of 1764 276 flxfrfx.exe 38 PID 276 wrote to memory of 1764 276 flxfrfx.exe 38 PID 1764 wrote to memory of 1172 1764 jjdjv.exe 39 PID 1764 wrote to memory of 1172 1764 jjdjv.exe 39 PID 1764 wrote to memory of 1172 1764 jjdjv.exe 39 PID 1764 wrote to memory of 1172 1764 jjdjv.exe 39 PID 1172 wrote to memory of 2348 1172 3rrrrxl.exe 40 PID 1172 wrote to memory of 2348 1172 3rrrrxl.exe 40 PID 1172 wrote to memory of 2348 1172 3rrrrxl.exe 40 PID 1172 wrote to memory of 2348 1172 3rrrrxl.exe 40 PID 2348 wrote to memory of 2164 2348 5nbthb.exe 41 PID 2348 wrote to memory of 2164 2348 5nbthb.exe 41 PID 2348 wrote to memory of 2164 2348 5nbthb.exe 41 PID 2348 wrote to memory of 2164 2348 5nbthb.exe 41 PID 2164 wrote to memory of 2372 2164 9fxxllx.exe 42 PID 2164 wrote to memory of 2372 2164 9fxxllx.exe 42 PID 2164 wrote to memory of 2372 2164 9fxxllx.exe 42 PID 2164 wrote to memory of 2372 2164 9fxxllx.exe 42 PID 2372 wrote to memory of 2924 2372 nbtbnt.exe 43 PID 2372 wrote to memory of 2924 2372 nbtbnt.exe 43 PID 2372 wrote to memory of 2924 2372 nbtbnt.exe 43 PID 2372 wrote to memory of 2924 2372 nbtbnt.exe 43 PID 2924 wrote to memory of 2748 2924 1vpdj.exe 44 PID 2924 wrote to memory of 2748 2924 1vpdj.exe 44 PID 2924 wrote to memory of 2748 2924 1vpdj.exe 44 PID 2924 wrote to memory of 2748 2924 1vpdj.exe 44 PID 2748 wrote to memory of 2608 2748 llxrrrx.exe 45 PID 2748 wrote to memory of 2608 2748 llxrrrx.exe 45 PID 2748 wrote to memory of 2608 2748 llxrrrx.exe 45 PID 2748 wrote to memory of 2608 2748 llxrrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe"C:\Users\Admin\AppData\Local\Temp\465090978fe86ba232e951e0c5716bca7b6a6b82950dcbf16cc6c7f62c7e25e8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\llxxffl.exec:\llxxffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rfxfrxl.exec:\rfxfrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pjjpd.exec:\pjjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\btnthn.exec:\btnthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rfrrxrx.exec:\rfrrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bbthth.exec:\bbthth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\ddvdp.exec:\ddvdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\flxfrfx.exec:\flxfrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\jjdjv.exec:\jjdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\3rrrrxl.exec:\3rrrrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\5nbthb.exec:\5nbthb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\9fxxllx.exec:\9fxxllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nbtbnt.exec:\nbtbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1vpdj.exec:\1vpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llxrrrx.exec:\llxrrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\7tbthb.exec:\7tbthb.exe17⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vpddp.exec:\vpddp.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lfrlffr.exec:\lfrlffr.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\dvppd.exec:\dvppd.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9tnhtt.exec:\9tnhtt.exe21⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdvdj.exec:\jdvdj.exe22⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lfflrrf.exec:\lfflrrf.exe23⤵
- Executes dropped EXE
PID:776 -
\??\c:\nbtthh.exec:\nbtthh.exe24⤵
- Executes dropped EXE
PID:1932 -
\??\c:\xlrxffl.exec:\xlrxffl.exe25⤵
- Executes dropped EXE
PID:1476 -
\??\c:\tnhnbb.exec:\tnhnbb.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvppd.exec:\vvppd.exe27⤵
- Executes dropped EXE
PID:1072 -
\??\c:\fxlrlrx.exec:\fxlrlrx.exe28⤵
- Executes dropped EXE
PID:372 -
\??\c:\3bbnbh.exec:\3bbnbh.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9fxxfxf.exec:\9fxxfxf.exe30⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbnntt.exec:\hbnntt.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ppjpv.exec:\ppjpv.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nnhnbb.exec:\nnhnbb.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nnnntt.exec:\nnnntt.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrflxxl.exec:\xrflxxl.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\7rlxxfr.exec:\7rlxxfr.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9thhhh.exec:\9thhhh.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jdjjv.exec:\jdjjv.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpddj.exec:\vpddj.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3xlrrxx.exec:\3xlrrxx.exe40⤵
- Executes dropped EXE
PID:2556 -
\??\c:\3bhhnn.exec:\3bhhnn.exe41⤵
- Executes dropped EXE
PID:324 -
\??\c:\1pdjv.exec:\1pdjv.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\5fxxffr.exec:\5fxxffr.exe43⤵
- Executes dropped EXE
PID:1396 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe44⤵
- Executes dropped EXE
PID:276 -
\??\c:\bbtbhn.exec:\bbtbhn.exe45⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jjvdd.exec:\jjvdd.exe46⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3fflllr.exec:\3fflllr.exe47⤵
- Executes dropped EXE
PID:672 -
\??\c:\5lllffr.exec:\5lllffr.exe48⤵
- Executes dropped EXE
PID:480 -
\??\c:\tnhnhh.exec:\tnhnhh.exe49⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjdjp.exec:\pjdjp.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rflxfxf.exec:\rflxfxf.exe52⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bbhnth.exec:\bbhnth.exe53⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7vdjp.exec:\7vdjp.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\9rfxxrx.exec:\9rfxxrx.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\1xlrrxl.exec:\1xlrrxl.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bbnnbb.exec:\bbnnbb.exe57⤵
- Executes dropped EXE
PID:112 -
\??\c:\vvdjv.exec:\vvdjv.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\jvpjj.exec:\jvpjj.exe59⤵
- Executes dropped EXE
PID:568 -
\??\c:\lllxrrr.exec:\lllxrrr.exe60⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9bnnbh.exec:\9bnnbh.exe61⤵
- Executes dropped EXE
PID:1720 -
\??\c:\7djpv.exec:\7djpv.exe62⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3djpv.exec:\3djpv.exe63⤵
- Executes dropped EXE
PID:1368 -
\??\c:\5rlrffr.exec:\5rlrffr.exe64⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nbbbhb.exec:\nbbbhb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:780 -
\??\c:\1dppp.exec:\1dppp.exe66⤵PID:2368
-
\??\c:\1xflflx.exec:\1xflflx.exe67⤵PID:1956
-
\??\c:\9xlllfr.exec:\9xlllfr.exe68⤵PID:824
-
\??\c:\3thbnt.exec:\3thbnt.exe69⤵PID:2308
-
\??\c:\dvpdj.exec:\dvpdj.exe70⤵PID:2100
-
\??\c:\lrfrxfl.exec:\lrfrxfl.exe71⤵PID:2252
-
\??\c:\llxxllx.exec:\llxxllx.exe72⤵PID:1884
-
\??\c:\bttntt.exec:\bttntt.exe73⤵PID:884
-
\??\c:\ppjvp.exec:\ppjvp.exe74⤵PID:2788
-
\??\c:\lxffflx.exec:\lxffflx.exe75⤵PID:2800
-
\??\c:\llxflfl.exec:\llxflfl.exe76⤵PID:2656
-
\??\c:\nhbhtt.exec:\nhbhtt.exe77⤵PID:2792
-
\??\c:\pdvvd.exec:\pdvvd.exe78⤵PID:2552
-
\??\c:\pjdpv.exec:\pjdpv.exe79⤵PID:2736
-
\??\c:\xxxxfll.exec:\xxxxfll.exe80⤵PID:2780
-
\??\c:\ttnnbn.exec:\ttnnbn.exe81⤵PID:2884
-
\??\c:\nbhhbh.exec:\nbhhbh.exe82⤵PID:2624
-
\??\c:\vvjpv.exec:\vvjpv.exe83⤵PID:2556
-
\??\c:\jdppv.exec:\jdppv.exe84⤵PID:3028
-
\??\c:\lffrrxf.exec:\lffrrxf.exe85⤵PID:2292
-
\??\c:\9tbbbh.exec:\9tbbbh.exe86⤵PID:1712
-
\??\c:\1jppj.exec:\1jppj.exe87⤵PID:440
-
\??\c:\5jdjj.exec:\5jdjj.exe88⤵PID:1240
-
\??\c:\lfrfllr.exec:\lfrfllr.exe89⤵PID:2524
-
\??\c:\xrlxflf.exec:\xrlxflf.exe90⤵PID:2724
-
\??\c:\bthtbb.exec:\bthtbb.exe91⤵PID:2156
-
\??\c:\3vvjp.exec:\3vvjp.exe92⤵PID:2120
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe93⤵PID:2036
-
\??\c:\btnttn.exec:\btnttn.exe94⤵PID:2836
-
\??\c:\hbnntb.exec:\hbnntb.exe95⤵PID:2220
-
\??\c:\ppjpd.exec:\ppjpd.exe96⤵PID:2608
-
\??\c:\xlfflrr.exec:\xlfflrr.exe97⤵PID:1308
-
\??\c:\9frrflx.exec:\9frrflx.exe98⤵PID:2980
-
\??\c:\htnntt.exec:\htnntt.exe99⤵PID:2188
-
\??\c:\9btbbt.exec:\9btbbt.exe100⤵PID:1924
-
\??\c:\1ddjj.exec:\1ddjj.exe101⤵PID:676
-
\??\c:\rrfrrrf.exec:\rrfrrrf.exe102⤵
- System Location Discovery: System Language Discovery
PID:2516 -
\??\c:\7hnhtt.exec:\7hnhtt.exe103⤵PID:2440
-
\??\c:\1ntnhb.exec:\1ntnhb.exe104⤵PID:1700
-
\??\c:\jjvvv.exec:\jjvvv.exe105⤵PID:708
-
\??\c:\9rllllr.exec:\9rllllr.exe106⤵PID:1932
-
\??\c:\xxxfrxl.exec:\xxxfrxl.exe107⤵PID:1732
-
\??\c:\7htthn.exec:\7htthn.exe108⤵PID:1032
-
\??\c:\vvjjv.exec:\vvjjv.exe109⤵PID:1072
-
\??\c:\jjvjp.exec:\jjvjp.exe110⤵PID:1692
-
\??\c:\fxrrffl.exec:\fxrrffl.exe111⤵PID:1404
-
\??\c:\htbtbb.exec:\htbtbb.exe112⤵PID:1004
-
\??\c:\jjvdp.exec:\jjvdp.exe113⤵PID:1816
-
\??\c:\jdvdj.exec:\jdvdj.exe114⤵PID:3060
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe115⤵PID:860
-
\??\c:\llxlxfx.exec:\llxlxfx.exe116⤵PID:2092
-
\??\c:\bbnttt.exec:\bbnttt.exe117⤵PID:2816
-
\??\c:\jvpjv.exec:\jvpjv.exe118⤵PID:2700
-
\??\c:\rrffrlx.exec:\rrffrlx.exe119⤵PID:2944
-
\??\c:\frllrrf.exec:\frllrrf.exe120⤵PID:2568
-
\??\c:\btnntt.exec:\btnntt.exe121⤵PID:2572
-
\??\c:\tnbntb.exec:\tnbntb.exe122⤵PID:2296
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-