Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe
-
Size
454KB
-
MD5
8c4ab384aec4dc1a4469b69270bf6680
-
SHA1
86c84656a2229377c04da56d37261150c6fe48f9
-
SHA256
cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003f
-
SHA512
61410de44890130319ea4779a3f78796cd1756dd70e916a791c4b0600478c2edc4300b7754bf022b01a68ca7e01dd9d8875b84ebbbae791479f0ec72e2ebc3a5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbei:q7Tc2NYHUrAwfMp3CDi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2104-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-97-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2672-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1148-173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-302-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2848-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-347-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/376-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-527-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/3008-601-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/596-688-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-768-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-907-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1824-926-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-927-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-1079-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1976-1089-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1976-1091-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-1167-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/560-1178-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-1210-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2948-1253-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2084 bntbbb.exe 2368 1xrrflr.exe 3008 pddjj.exe 2760 vpdvv.exe 2916 lxlfxrx.exe 2736 7thntb.exe 2772 lfxrxxx.exe 2632 vjvdd.exe 2804 xlfxffl.exe 2684 xlrlllr.exe 2672 jdpvv.exe 680 frfxrrl.exe 2680 dpvvd.exe 776 nhtttn.exe 2876 pjvjj.exe 2028 9dpvd.exe 2044 3xfxxxx.exe 1148 dpdvd.exe 2956 3hnntb.exe 2132 lxlllll.exe 1736 3thhbb.exe 2032 dvjjp.exe 2556 hbtnnh.exe 3036 hthhnh.exe 1320 rfllrrx.exe 1532 tthhhh.exe 2160 rrxrrrx.exe 2308 htttbb.exe 616 7htnbb.exe 1744 rrrrrlf.exe 3068 nhttnn.exe 1576 jjvdd.exe 2400 1xxflrr.exe 2100 1hnhbh.exe 2368 vjddd.exe 2296 9lrxlfl.exe 2848 9rlrllr.exe 1076 tthbhh.exe 1084 pdppp.exe 3024 pjvvj.exe 2712 rxlrxrx.exe 2724 bnbthh.exe 2612 dvppp.exe 2676 dvdvj.exe 2480 fxrrxrx.exe 2020 thnhhh.exe 1116 hbhttn.exe 1140 jvddd.exe 1796 5rlrxxl.exe 2036 rfrrrrx.exe 776 ntbtbt.exe 376 pdppp.exe 2496 9vvvd.exe 1340 rlrrxxl.exe 1392 bntttb.exe 2892 bntttn.exe 2960 3djdd.exe 2236 1rxrxrx.exe 2708 lxlllff.exe 576 nhtbhh.exe 2184 dvjjv.exe 448 pdpdd.exe 2588 frflllf.exe 3036 1bhhnh.exe -
resource yara_rule behavioral1/memory/2104-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-119-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/680-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-302-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/2848-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-688-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1636-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-926-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-940-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-979-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-1089-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1976-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-1167-0x00000000005C0000-0x00000000005EA000-memory.dmp upx behavioral1/memory/2680-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-1210-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2948-1253-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2032-1273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-1280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-1342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-1367-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2084 2104 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 30 PID 2104 wrote to memory of 2084 2104 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 30 PID 2104 wrote to memory of 2084 2104 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 30 PID 2104 wrote to memory of 2084 2104 cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe 30 PID 2084 wrote to memory of 2368 2084 bntbbb.exe 31 PID 2084 wrote to memory of 2368 2084 bntbbb.exe 31 PID 2084 wrote to memory of 2368 2084 bntbbb.exe 31 PID 2084 wrote to memory of 2368 2084 bntbbb.exe 31 PID 2368 wrote to memory of 3008 2368 1xrrflr.exe 32 PID 2368 wrote to memory of 3008 2368 1xrrflr.exe 32 PID 2368 wrote to memory of 3008 2368 1xrrflr.exe 32 PID 2368 wrote to memory of 3008 2368 1xrrflr.exe 32 PID 3008 wrote to memory of 2760 3008 pddjj.exe 33 PID 3008 wrote to memory of 2760 3008 pddjj.exe 33 PID 3008 wrote to memory of 2760 3008 pddjj.exe 33 PID 3008 wrote to memory of 2760 3008 pddjj.exe 33 PID 2760 wrote to memory of 2916 2760 vpdvv.exe 34 PID 2760 wrote to memory of 2916 2760 vpdvv.exe 34 PID 2760 wrote to memory of 2916 2760 vpdvv.exe 34 PID 2760 wrote to memory of 2916 2760 vpdvv.exe 34 PID 2916 wrote to memory of 2736 2916 lxlfxrx.exe 35 PID 2916 wrote to memory of 2736 2916 lxlfxrx.exe 35 PID 2916 wrote to memory of 2736 2916 lxlfxrx.exe 35 PID 2916 wrote to memory of 2736 2916 lxlfxrx.exe 35 PID 2736 wrote to memory of 2772 2736 7thntb.exe 36 PID 2736 wrote to memory of 2772 2736 7thntb.exe 36 PID 2736 wrote to memory of 2772 2736 7thntb.exe 36 PID 2736 wrote to memory of 2772 2736 7thntb.exe 36 PID 2772 wrote to memory of 2632 2772 lfxrxxx.exe 37 PID 2772 wrote to memory of 2632 2772 lfxrxxx.exe 37 PID 2772 wrote to memory of 2632 2772 lfxrxxx.exe 37 PID 2772 wrote to memory of 2632 2772 lfxrxxx.exe 37 PID 2632 wrote to memory of 2804 2632 vjvdd.exe 38 PID 2632 wrote to memory of 2804 2632 vjvdd.exe 38 PID 2632 wrote to memory of 2804 2632 vjvdd.exe 38 PID 2632 wrote to memory of 2804 2632 vjvdd.exe 38 PID 2804 wrote to memory of 2684 2804 xlfxffl.exe 39 PID 2804 wrote to memory of 2684 2804 xlfxffl.exe 39 PID 2804 wrote to memory of 2684 2804 xlfxffl.exe 39 PID 2804 wrote to memory of 2684 2804 xlfxffl.exe 39 PID 2684 wrote to memory of 2672 2684 xlrlllr.exe 40 PID 2684 wrote to memory of 2672 2684 xlrlllr.exe 40 PID 2684 wrote to memory of 2672 2684 xlrlllr.exe 40 PID 2684 wrote to memory of 2672 2684 xlrlllr.exe 40 PID 2672 wrote to memory of 680 2672 jdpvv.exe 41 PID 2672 wrote to memory of 680 2672 jdpvv.exe 41 PID 2672 wrote to memory of 680 2672 jdpvv.exe 41 PID 2672 wrote to memory of 680 2672 jdpvv.exe 41 PID 680 wrote to memory of 2680 680 frfxrrl.exe 42 PID 680 wrote to memory of 2680 680 frfxrrl.exe 42 PID 680 wrote to memory of 2680 680 frfxrrl.exe 42 PID 680 wrote to memory of 2680 680 frfxrrl.exe 42 PID 2680 wrote to memory of 776 2680 dpvvd.exe 43 PID 2680 wrote to memory of 776 2680 dpvvd.exe 43 PID 2680 wrote to memory of 776 2680 dpvvd.exe 43 PID 2680 wrote to memory of 776 2680 dpvvd.exe 43 PID 776 wrote to memory of 2876 776 nhtttn.exe 44 PID 776 wrote to memory of 2876 776 nhtttn.exe 44 PID 776 wrote to memory of 2876 776 nhtttn.exe 44 PID 776 wrote to memory of 2876 776 nhtttn.exe 44 PID 2876 wrote to memory of 2028 2876 pjvjj.exe 45 PID 2876 wrote to memory of 2028 2876 pjvjj.exe 45 PID 2876 wrote to memory of 2028 2876 pjvjj.exe 45 PID 2876 wrote to memory of 2028 2876 pjvjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe"C:\Users\Admin\AppData\Local\Temp\cfbc83ffa9963558fde2b2469389fabdcd8d81398cf245f1006ba2e2077b003fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\bntbbb.exec:\bntbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\1xrrflr.exec:\1xrrflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pddjj.exec:\pddjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vpdvv.exec:\vpdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\lxlfxrx.exec:\lxlfxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\7thntb.exec:\7thntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\lfxrxxx.exec:\lfxrxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vjvdd.exec:\vjvdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xlfxffl.exec:\xlfxffl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\xlrlllr.exec:\xlrlllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\jdpvv.exec:\jdpvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\frfxrrl.exec:\frfxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\dpvvd.exec:\dpvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nhtttn.exec:\nhtttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\pjvjj.exec:\pjvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\9dpvd.exec:\9dpvd.exe17⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3xfxxxx.exec:\3xfxxxx.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\dpdvd.exec:\dpdvd.exe19⤵
- Executes dropped EXE
PID:1148 -
\??\c:\3hnntb.exec:\3hnntb.exe20⤵
- Executes dropped EXE
PID:2956 -
\??\c:\lxlllll.exec:\lxlllll.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3thhbb.exec:\3thhbb.exe22⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvjjp.exec:\dvjjp.exe23⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hbtnnh.exec:\hbtnnh.exe24⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hthhnh.exec:\hthhnh.exe25⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rfllrrx.exec:\rfllrrx.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\tthhhh.exec:\tthhhh.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe28⤵
- Executes dropped EXE
PID:2160 -
\??\c:\htttbb.exec:\htttbb.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7htnbb.exec:\7htnbb.exe30⤵
- Executes dropped EXE
PID:616 -
\??\c:\rrrrrlf.exec:\rrrrrlf.exe31⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nhttnn.exec:\nhttnn.exe32⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jjvdd.exec:\jjvdd.exe33⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1xxflrr.exec:\1xxflrr.exe34⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1hnhbh.exec:\1hnhbh.exe35⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vjddd.exec:\vjddd.exe36⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9lrxlfl.exec:\9lrxlfl.exe37⤵
- Executes dropped EXE
PID:2296 -
\??\c:\9rlrllr.exec:\9rlrllr.exe38⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tthbhh.exec:\tthbhh.exe39⤵
- Executes dropped EXE
PID:1076 -
\??\c:\pdppp.exec:\pdppp.exe40⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pjvvj.exec:\pjvvj.exe41⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rxlrxrx.exec:\rxlrxrx.exe42⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bnbthh.exec:\bnbthh.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dvppp.exec:\dvppp.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dvdvj.exec:\dvdvj.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\fxrrxrx.exec:\fxrrxrx.exe46⤵
- Executes dropped EXE
PID:2480 -
\??\c:\thnhhh.exec:\thnhhh.exe47⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hbhttn.exec:\hbhttn.exe48⤵
- Executes dropped EXE
PID:1116 -
\??\c:\jvddd.exec:\jvddd.exe49⤵
- Executes dropped EXE
PID:1140 -
\??\c:\5rlrxxl.exec:\5rlrxxl.exe50⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rfrrrrx.exec:\rfrrrrx.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ntbtbt.exec:\ntbtbt.exe52⤵
- Executes dropped EXE
PID:776 -
\??\c:\pdppp.exec:\pdppp.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:376 -
\??\c:\9vvvd.exec:\9vvvd.exe54⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe55⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bntttb.exec:\bntttb.exe56⤵
- Executes dropped EXE
PID:1392 -
\??\c:\bntttn.exec:\bntttn.exe57⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3djdd.exec:\3djdd.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\1rxrxrx.exec:\1rxrxrx.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lxlllff.exec:\lxlllff.exe60⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nhtbhh.exec:\nhtbhh.exe61⤵
- Executes dropped EXE
PID:576 -
\??\c:\dvjjv.exec:\dvjjv.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pdpdd.exec:\pdpdd.exe63⤵
- Executes dropped EXE
PID:448 -
\??\c:\frflllf.exec:\frflllf.exe64⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1bhhnh.exec:\1bhhnh.exe65⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jvvpj.exec:\jvvpj.exe66⤵PID:1400
-
\??\c:\3jpjj.exec:\3jpjj.exe67⤵PID:1860
-
\??\c:\1xlffrr.exec:\1xlffrr.exe68⤵PID:2936
-
\??\c:\hbnbhb.exec:\hbnbhb.exe69⤵PID:696
-
\??\c:\vpppj.exec:\vpppj.exe70⤵PID:2140
-
\??\c:\dvdvp.exec:\dvdvp.exe71⤵PID:848
-
\??\c:\3lxxrff.exec:\3lxxrff.exe72⤵PID:2512
-
\??\c:\7tbtbt.exec:\7tbtbt.exe73⤵PID:2116
-
\??\c:\vpvpp.exec:\vpvpp.exe74⤵PID:2104
-
\??\c:\jdjjj.exec:\jdjjj.exe75⤵PID:1576
-
\??\c:\lxllxrx.exec:\lxllxrx.exe76⤵PID:2504
-
\??\c:\rfrrlll.exec:\rfrrlll.exe77⤵PID:2928
-
\??\c:\hbntbh.exec:\hbntbh.exe78⤵PID:3008
-
\??\c:\5dpjv.exec:\5dpjv.exe79⤵PID:2824
-
\??\c:\3lxrxrr.exec:\3lxrxrr.exe80⤵PID:2768
-
\??\c:\frxrrlr.exec:\frxrrlr.exe81⤵PID:2744
-
\??\c:\9hnbbb.exec:\9hnbbb.exe82⤵PID:1144
-
\??\c:\3jvjp.exec:\3jvjp.exe83⤵PID:2836
-
\??\c:\djjjp.exec:\djjjp.exe84⤵PID:2772
-
\??\c:\3rxxxrr.exec:\3rxxxrr.exe85⤵PID:2636
-
\??\c:\nbnntn.exec:\nbnntn.exe86⤵PID:2724
-
\??\c:\1hnnhh.exec:\1hnnhh.exe87⤵PID:2612
-
\??\c:\jdpvd.exec:\jdpvd.exe88⤵PID:2676
-
\??\c:\9dvpv.exec:\9dvpv.exe89⤵PID:2456
-
\??\c:\7xfxxxx.exec:\7xfxxxx.exe90⤵PID:2020
-
\??\c:\1thhhn.exec:\1thhhn.exe91⤵PID:536
-
\??\c:\ntbttt.exec:\ntbttt.exe92⤵PID:596
-
\??\c:\jpdvv.exec:\jpdvv.exe93⤵PID:760
-
\??\c:\fxlllll.exec:\fxlllll.exe94⤵PID:1724
-
\??\c:\1flllff.exec:\1flllff.exe95⤵PID:1540
-
\??\c:\9bnnnn.exec:\9bnnnn.exe96⤵PID:1924
-
\??\c:\jvjpp.exec:\jvjpp.exe97⤵PID:796
-
\??\c:\7xrrxxx.exec:\7xrrxxx.exe98⤵PID:1760
-
\??\c:\1llrffx.exec:\1llrffx.exe99⤵PID:1392
-
\??\c:\3btttt.exec:\3btttt.exe100⤵PID:1636
-
\??\c:\ppddj.exec:\ppddj.exe101⤵PID:2052
-
\??\c:\jjvpp.exec:\jjvpp.exe102⤵PID:2460
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe103⤵PID:2992
-
\??\c:\bthntt.exec:\bthntt.exe104⤵PID:1736
-
\??\c:\nhtbhh.exec:\nhtbhh.exe105⤵PID:1872
-
\??\c:\jvjjv.exec:\jvjjv.exe106⤵PID:612
-
\??\c:\1rfxffr.exec:\1rfxffr.exe107⤵PID:2564
-
\??\c:\rlllrrx.exec:\rlllrrx.exe108⤵PID:2260
-
\??\c:\nbnnnn.exec:\nbnnnn.exe109⤵PID:2284
-
\??\c:\vjvvv.exec:\vjvvv.exe110⤵PID:2144
-
\??\c:\7xxlfxx.exec:\7xxlfxx.exe111⤵PID:2160
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe112⤵PID:380
-
\??\c:\bnntbb.exec:\bnntbb.exe113⤵PID:1740
-
\??\c:\dvpdj.exec:\dvpdj.exe114⤵PID:768
-
\??\c:\rrffxxx.exec:\rrffxxx.exe115⤵PID:3028
-
\??\c:\lfrxfxl.exec:\lfrxfxl.exe116⤵PID:1584
-
\??\c:\bnnhbt.exec:\bnnhbt.exe117⤵PID:2576
-
\??\c:\3bnntt.exec:\3bnntt.exe118⤵PID:2380
-
\??\c:\ppvdd.exec:\ppvdd.exe119⤵PID:2504
-
\??\c:\fxxflrf.exec:\fxxflrf.exe120⤵PID:2168
-
\??\c:\frrrxff.exec:\frrrxff.exe121⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-