Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe
-
Size
453KB
-
MD5
92d4abcd36de51f48d961caae1306d20
-
SHA1
11d3e1cab60873f2d7ce35957d10338cb99e9c3c
-
SHA256
584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cf
-
SHA512
2fb0a3781d197cc14878eeff5bdf9145ebc1e3724aeb5a6bb61d0436d1d531696a4ad361d10fa45451e091212384d9051baf67afe19257181fa7801872213a56
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 51 IoCs
resource yara_rule behavioral1/memory/2960-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-166-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2044-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-188-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/348-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-204-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1288-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-217-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1680-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-260-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/284-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-298-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2116-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-333-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2768-334-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/308-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/444-505-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-531-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-792-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-818-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1176-957-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1176-962-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1444-1042-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2360-1049-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-1080-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2132 llxxffr.exe 2852 jdppv.exe 3032 3xrfflx.exe 1592 ppdvj.exe 1868 rllrfrf.exe 2792 7rrxllx.exe 2712 bhbbbt.exe 2772 fxxlrfx.exe 2608 bbtbnn.exe 2576 xrffrfr.exe 3040 tnhtnt.exe 1636 nhbhnt.exe 1656 3nhhth.exe 1848 btnnbb.exe 352 7bnthn.exe 2552 nhhnbh.exe 2044 pjvjp.exe 1368 hbtttt.exe 348 pjjpj.exe 2896 5nhnht.exe 1288 9dpdj.exe 904 nhhthh.exe 1680 pjddp.exe 1540 xxxlrxr.exe 1620 ppjpd.exe 284 3hhhtt.exe 2544 dpdjd.exe 2516 fxlrfxf.exe 1748 tnhtnt.exe 2116 ffxxlxf.exe 2196 nnhtht.exe 2064 xrlrrrf.exe 3024 9htbhn.exe 2768 vpvpv.exe 308 lrrlxll.exe 764 hbbbnn.exe 2688 5tnthh.exe 2296 jjvvp.exe 2832 flffxlx.exe 2252 hbtttt.exe 2712 bhhtbh.exe 2872 ddvdd.exe 2636 7rllffr.exe 2652 9rffxlr.exe 2508 hbnthh.exe 2248 vpjjv.exe 1472 9jdjv.exe 1160 llxxllx.exe 1996 9hbhnn.exe 2260 1dpvv.exe 1560 jvjjp.exe 2396 rrlfflr.exe 352 7thbbb.exe 1184 ttbthn.exe 2000 pppdj.exe 544 fxrrxfr.exe 1624 9hhhnn.exe 2640 bbnnbb.exe 2868 7pjvv.exe 2888 7xrxllr.exe 444 hbnbnn.exe 1316 3nbhtb.exe 1716 pvvdp.exe 1396 9rffflx.exe -
resource yara_rule behavioral1/memory/2960-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-219-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1680-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-493-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/444-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-531-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-873-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-934-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-947-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1176-957-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2132 2960 584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe 30 PID 2960 wrote to memory of 2132 2960 584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe 30 PID 2960 wrote to memory of 2132 2960 584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe 30 PID 2960 wrote to memory of 2132 2960 584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe 30 PID 2132 wrote to memory of 2852 2132 llxxffr.exe 31 PID 2132 wrote to memory of 2852 2132 llxxffr.exe 31 PID 2132 wrote to memory of 2852 2132 llxxffr.exe 31 PID 2132 wrote to memory of 2852 2132 llxxffr.exe 31 PID 2852 wrote to memory of 3032 2852 jdppv.exe 32 PID 2852 wrote to memory of 3032 2852 jdppv.exe 32 PID 2852 wrote to memory of 3032 2852 jdppv.exe 32 PID 2852 wrote to memory of 3032 2852 jdppv.exe 32 PID 3032 wrote to memory of 1592 3032 3xrfflx.exe 33 PID 3032 wrote to memory of 1592 3032 3xrfflx.exe 33 PID 3032 wrote to memory of 1592 3032 3xrfflx.exe 33 PID 3032 wrote to memory of 1592 3032 3xrfflx.exe 33 PID 1592 wrote to memory of 1868 1592 ppdvj.exe 34 PID 1592 wrote to memory of 1868 1592 ppdvj.exe 34 PID 1592 wrote to memory of 1868 1592 ppdvj.exe 34 PID 1592 wrote to memory of 1868 1592 ppdvj.exe 34 PID 1868 wrote to memory of 2792 1868 rllrfrf.exe 35 PID 1868 wrote to memory of 2792 1868 rllrfrf.exe 35 PID 1868 wrote to memory of 2792 1868 rllrfrf.exe 35 PID 1868 wrote to memory of 2792 1868 rllrfrf.exe 35 PID 2792 wrote to memory of 2712 2792 7rrxllx.exe 36 PID 2792 wrote to memory of 2712 2792 7rrxllx.exe 36 PID 2792 wrote to memory of 2712 2792 7rrxllx.exe 36 PID 2792 wrote to memory of 2712 2792 7rrxllx.exe 36 PID 2712 wrote to memory of 2772 2712 bhbbbt.exe 37 PID 2712 wrote to memory of 2772 2712 bhbbbt.exe 37 PID 2712 wrote to memory of 2772 2712 bhbbbt.exe 37 PID 2712 wrote to memory of 2772 2712 bhbbbt.exe 37 PID 2772 wrote to memory of 2608 2772 fxxlrfx.exe 38 PID 2772 wrote to memory of 2608 2772 fxxlrfx.exe 38 PID 2772 wrote to memory of 2608 2772 fxxlrfx.exe 38 PID 2772 wrote to memory of 2608 2772 fxxlrfx.exe 38 PID 2608 wrote to memory of 2576 2608 bbtbnn.exe 39 PID 2608 wrote to memory of 2576 2608 bbtbnn.exe 39 PID 2608 wrote to memory of 2576 2608 bbtbnn.exe 39 PID 2608 wrote to memory of 2576 2608 bbtbnn.exe 39 PID 2576 wrote to memory of 3040 2576 xrffrfr.exe 40 PID 2576 wrote to memory of 3040 2576 xrffrfr.exe 40 PID 2576 wrote to memory of 3040 2576 xrffrfr.exe 40 PID 2576 wrote to memory of 3040 2576 xrffrfr.exe 40 PID 3040 wrote to memory of 1636 3040 tnhtnt.exe 41 PID 3040 wrote to memory of 1636 3040 tnhtnt.exe 41 PID 3040 wrote to memory of 1636 3040 tnhtnt.exe 41 PID 3040 wrote to memory of 1636 3040 tnhtnt.exe 41 PID 1636 wrote to memory of 1656 1636 nhbhnt.exe 42 PID 1636 wrote to memory of 1656 1636 nhbhnt.exe 42 PID 1636 wrote to memory of 1656 1636 nhbhnt.exe 42 PID 1636 wrote to memory of 1656 1636 nhbhnt.exe 42 PID 1656 wrote to memory of 1848 1656 3nhhth.exe 43 PID 1656 wrote to memory of 1848 1656 3nhhth.exe 43 PID 1656 wrote to memory of 1848 1656 3nhhth.exe 43 PID 1656 wrote to memory of 1848 1656 3nhhth.exe 43 PID 1848 wrote to memory of 352 1848 btnnbb.exe 44 PID 1848 wrote to memory of 352 1848 btnnbb.exe 44 PID 1848 wrote to memory of 352 1848 btnnbb.exe 44 PID 1848 wrote to memory of 352 1848 btnnbb.exe 44 PID 352 wrote to memory of 2552 352 7bnthn.exe 45 PID 352 wrote to memory of 2552 352 7bnthn.exe 45 PID 352 wrote to memory of 2552 352 7bnthn.exe 45 PID 352 wrote to memory of 2552 352 7bnthn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe"C:\Users\Admin\AppData\Local\Temp\584e704930b002073688bff1025442e759494609fcafb07ecf54254e142c64cfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\llxxffr.exec:\llxxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\jdppv.exec:\jdppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\3xrfflx.exec:\3xrfflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\ppdvj.exec:\ppdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\rllrfrf.exec:\rllrfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\7rrxllx.exec:\7rrxllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\bhbbbt.exec:\bhbbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\fxxlrfx.exec:\fxxlrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bbtbnn.exec:\bbtbnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xrffrfr.exec:\xrffrfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\tnhtnt.exec:\tnhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\nhbhnt.exec:\nhbhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3nhhth.exec:\3nhhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\btnnbb.exec:\btnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\7bnthn.exec:\7bnthn.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\nhhnbh.exec:\nhhnbh.exe17⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pjvjp.exec:\pjvjp.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbtttt.exec:\hbtttt.exe19⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pjjpj.exec:\pjjpj.exe20⤵
- Executes dropped EXE
PID:348 -
\??\c:\5nhnht.exec:\5nhnht.exe21⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9dpdj.exec:\9dpdj.exe22⤵
- Executes dropped EXE
PID:1288 -
\??\c:\nhhthh.exec:\nhhthh.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:904 -
\??\c:\pjddp.exec:\pjddp.exe24⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xxxlrxr.exec:\xxxlrxr.exe25⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ppjpd.exec:\ppjpd.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3hhhtt.exec:\3hhhtt.exe27⤵
- Executes dropped EXE
PID:284 -
\??\c:\dpdjd.exec:\dpdjd.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe29⤵
- Executes dropped EXE
PID:2516 -
\??\c:\tnhtnt.exec:\tnhtnt.exe30⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ffxxlxf.exec:\ffxxlxf.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nnhtht.exec:\nnhtht.exe32⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xrlrrrf.exec:\xrlrrrf.exe33⤵
- Executes dropped EXE
PID:2064 -
\??\c:\9htbhn.exec:\9htbhn.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vpvpv.exec:\vpvpv.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lrrlxll.exec:\lrrlxll.exe36⤵
- Executes dropped EXE
PID:308 -
\??\c:\hbbbnn.exec:\hbbbnn.exe37⤵
- Executes dropped EXE
PID:764 -
\??\c:\5tnthh.exec:\5tnthh.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jjvvp.exec:\jjvvp.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\flffxlx.exec:\flffxlx.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbtttt.exec:\hbtttt.exe41⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bhhtbh.exec:\bhhtbh.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\ddvdd.exec:\ddvdd.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7rllffr.exec:\7rllffr.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\9rffxlr.exec:\9rffxlr.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbnthh.exec:\hbnthh.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vpjjv.exec:\vpjjv.exe47⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9jdjv.exec:\9jdjv.exe48⤵
- Executes dropped EXE
PID:1472 -
\??\c:\llxxllx.exec:\llxxllx.exe49⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9hbhnn.exec:\9hbhnn.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1dpvv.exec:\1dpvv.exe51⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jvjjp.exec:\jvjjp.exe52⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rrlfflr.exec:\rrlfflr.exe53⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7thbbb.exec:\7thbbb.exe54⤵
- Executes dropped EXE
PID:352 -
\??\c:\ttbthn.exec:\ttbthn.exe55⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pppdj.exec:\pppdj.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxrrxfr.exec:\fxrrxfr.exe57⤵
- Executes dropped EXE
PID:544 -
\??\c:\9hhhnn.exec:\9hhhnn.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bbnnbb.exec:\bbnnbb.exe59⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7pjvv.exec:\7pjvv.exe60⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7xrxllr.exec:\7xrxllr.exe61⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hbnbnn.exec:\hbnbnn.exe62⤵
- Executes dropped EXE
PID:444 -
\??\c:\3nbhtb.exec:\3nbhtb.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\pvvdp.exec:\pvvdp.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\9rffflx.exec:\9rffflx.exe65⤵
- Executes dropped EXE
PID:1396 -
\??\c:\xxlllrx.exec:\xxlllrx.exe66⤵PID:1732
-
\??\c:\hbntbh.exec:\hbntbh.exe67⤵PID:936
-
\??\c:\pvpjv.exec:\pvpjv.exe68⤵PID:2224
-
\??\c:\5dddp.exec:\5dddp.exe69⤵PID:3048
-
\??\c:\3flllrf.exec:\3flllrf.exe70⤵PID:684
-
\??\c:\nnnbbh.exec:\nnnbbh.exe71⤵PID:1532
-
\??\c:\7btbnt.exec:\7btbnt.exe72⤵PID:2448
-
\??\c:\ppjpd.exec:\ppjpd.exe73⤵PID:864
-
\??\c:\7lllxfx.exec:\7lllxfx.exe74⤵PID:1172
-
\??\c:\hhhnbh.exec:\hhhnbh.exe75⤵PID:1660
-
\??\c:\hbttnb.exec:\hbttnb.exe76⤵PID:1704
-
\??\c:\jvpvj.exec:\jvpvj.exe77⤵PID:2132
-
\??\c:\fflxlrr.exec:\fflxlrr.exe78⤵PID:2964
-
\??\c:\3rllrxf.exec:\3rllrxf.exe79⤵PID:2288
-
\??\c:\hbtntb.exec:\hbtntb.exe80⤵PID:984
-
\??\c:\ppjvj.exec:\ppjvj.exe81⤵PID:2672
-
\??\c:\ffxrxxr.exec:\ffxrxxr.exe82⤵PID:2728
-
\??\c:\7fxfflx.exec:\7fxfflx.exe83⤵PID:2808
-
\??\c:\nhtbbh.exec:\nhtbbh.exe84⤵PID:2936
-
\??\c:\djpdv.exec:\djpdv.exe85⤵PID:2744
-
\??\c:\vpdjp.exec:\vpdjp.exe86⤵PID:2684
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe87⤵PID:2800
-
\??\c:\9thhnn.exec:\9thhnn.exe88⤵PID:2772
-
\??\c:\hbnnbb.exec:\hbnnbb.exe89⤵PID:2612
-
\??\c:\pjdjv.exec:\pjdjv.exe90⤵PID:2600
-
\??\c:\rrrlxfr.exec:\rrrlxfr.exe91⤵PID:3008
-
\??\c:\hbtbtb.exec:\hbtbtb.exe92⤵PID:2096
-
\??\c:\tntbtt.exec:\tntbtt.exe93⤵PID:316
-
\??\c:\jjjdv.exec:\jjjdv.exe94⤵PID:2324
-
\??\c:\ddppp.exec:\ddppp.exe95⤵PID:2016
-
\??\c:\flflllf.exec:\flflllf.exe96⤵PID:1652
-
\??\c:\bthhth.exec:\bthhth.exe97⤵PID:2124
-
\??\c:\nhbhhn.exec:\nhbhhn.exe98⤵PID:1792
-
\??\c:\vpdvd.exec:\vpdvd.exe99⤵PID:2368
-
\??\c:\rrllffx.exec:\rrllffx.exe100⤵PID:1412
-
\??\c:\9hhhtt.exec:\9hhhtt.exe101⤵PID:1744
-
\??\c:\ntnbnt.exec:\ntnbnt.exe102⤵PID:1772
-
\??\c:\1vpvj.exec:\1vpvj.exe103⤵PID:2640
-
\??\c:\xrfflrf.exec:\xrfflrf.exe104⤵PID:2868
-
\??\c:\bbntht.exec:\bbntht.exe105⤵PID:2888
-
\??\c:\tthhtb.exec:\tthhtb.exe106⤵PID:2668
-
\??\c:\jjjvj.exec:\jjjvj.exe107⤵PID:1316
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe108⤵PID:1716
-
\??\c:\btnbbh.exec:\btnbbh.exe109⤵PID:1396
-
\??\c:\pjdvd.exec:\pjdvd.exe110⤵PID:2440
-
\??\c:\9vdvd.exec:\9vdvd.exe111⤵PID:2476
-
\??\c:\xxlrffl.exec:\xxlrffl.exe112⤵PID:2188
-
\??\c:\nnhhbh.exec:\nnhhbh.exe113⤵PID:3048
-
\??\c:\1nhhnn.exec:\1nhhnn.exe114⤵PID:2356
-
\??\c:\1vppv.exec:\1vppv.exe115⤵PID:2036
-
\??\c:\1rlfllr.exec:\1rlfllr.exe116⤵PID:2664
-
\??\c:\tbntbh.exec:\tbntbh.exe117⤵PID:2292
-
\??\c:\1nnttt.exec:\1nnttt.exe118⤵PID:1172
-
\??\c:\dpddj.exec:\dpddj.exe119⤵PID:1660
-
\??\c:\9rfllff.exec:\9rfllff.exe120⤵PID:1704
-
\??\c:\xxlxfxf.exec:\xxlxfxf.exe121⤵PID:2132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-