Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe
-
Size
454KB
-
MD5
364198f648cbacbf6ab5f99e5e52a3e0
-
SHA1
fc608554b133acda1e8e66f1c885f1091dd52fb5
-
SHA256
9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6
-
SHA512
100fd71a11be35b610063e3f8e2346432597c90f3d2492119142b24e5ef170f922a990c0079ab99340bf2458af778e89365abd062a67315f70c3312808c243f6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1608-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-121-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1052-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-133-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1444-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-292-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2984-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-323-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-329-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-385-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2928-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-564-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-596-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1500-613-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-704-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1872 vjvvv.exe 3036 rrfrxll.exe 2132 jdvdp.exe 2668 fflflll.exe 2864 nhtntn.exe 2656 1dpvp.exe 2468 btnbhn.exe 2556 1pdjp.exe 2364 5tnthn.exe 2344 jvdvv.exe 1452 bhbnbh.exe 1052 3vvvp.exe 2740 7hbhtt.exe 1444 dppjv.exe 1212 fxlrflf.exe 2416 5bnttt.exe 1780 xrxlxlx.exe 2240 tnhntb.exe 536 dvpdj.exe 2292 nbhttn.exe 1732 7dvjv.exe 2164 rlllffl.exe 2080 vpdpd.exe 1684 jvvvd.exe 1540 5nbbhh.exe 1472 xrlrflx.exe 1708 tbtthh.exe 2104 1jppp.exe 2296 nbnnnn.exe 2984 pvvpd.exe 2280 9frxflr.exe 2312 thbhbb.exe 1608 vpjvj.exe 2324 1lrrlff.exe 2316 ttnthh.exe 2728 pjvvd.exe 2552 xxrxlrf.exe 2572 thtbhh.exe 2660 dppvj.exe 2568 vvjdd.exe 2764 rxrflxl.exe 2580 hbttbb.exe 2468 nbttbh.exe 2496 5pdvv.exe 2556 3xlflll.exe 2928 frlrrrx.exe 1756 hbbntt.exe 2036 7pvjj.exe 2680 xfrrrfl.exe 2760 fxfxxrx.exe 2632 bbbhbh.exe 1444 pdjjj.exe 1180 lxllrxl.exe 1276 5lllxfl.exe 1828 hbntbb.exe 2232 3dpjj.exe 2032 7dvvd.exe 2276 fxrrflf.exe 2176 3tntbb.exe 1740 jjvdj.exe 636 jvvvd.exe 920 3lflrxf.exe 2368 hbhhnt.exe 2300 pjjdp.exe -
resource yara_rule behavioral1/memory/1608-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1444-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-564-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2128-596-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2588-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-678-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-704-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-743-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1608 wrote to memory of 1872 1608 9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe 28 PID 1608 wrote to memory of 1872 1608 9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe 28 PID 1608 wrote to memory of 1872 1608 9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe 28 PID 1608 wrote to memory of 1872 1608 9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe 28 PID 1872 wrote to memory of 3036 1872 vjvvv.exe 29 PID 1872 wrote to memory of 3036 1872 vjvvv.exe 29 PID 1872 wrote to memory of 3036 1872 vjvvv.exe 29 PID 1872 wrote to memory of 3036 1872 vjvvv.exe 29 PID 3036 wrote to memory of 2132 3036 rrfrxll.exe 30 PID 3036 wrote to memory of 2132 3036 rrfrxll.exe 30 PID 3036 wrote to memory of 2132 3036 rrfrxll.exe 30 PID 3036 wrote to memory of 2132 3036 rrfrxll.exe 30 PID 2132 wrote to memory of 2668 2132 jdvdp.exe 31 PID 2132 wrote to memory of 2668 2132 jdvdp.exe 31 PID 2132 wrote to memory of 2668 2132 jdvdp.exe 31 PID 2132 wrote to memory of 2668 2132 jdvdp.exe 31 PID 2668 wrote to memory of 2864 2668 fflflll.exe 32 PID 2668 wrote to memory of 2864 2668 fflflll.exe 32 PID 2668 wrote to memory of 2864 2668 fflflll.exe 32 PID 2668 wrote to memory of 2864 2668 fflflll.exe 32 PID 2864 wrote to memory of 2656 2864 nhtntn.exe 33 PID 2864 wrote to memory of 2656 2864 nhtntn.exe 33 PID 2864 wrote to memory of 2656 2864 nhtntn.exe 33 PID 2864 wrote to memory of 2656 2864 nhtntn.exe 33 PID 2656 wrote to memory of 2468 2656 1dpvp.exe 34 PID 2656 wrote to memory of 2468 2656 1dpvp.exe 34 PID 2656 wrote to memory of 2468 2656 1dpvp.exe 34 PID 2656 wrote to memory of 2468 2656 1dpvp.exe 34 PID 2468 wrote to memory of 2556 2468 btnbhn.exe 35 PID 2468 wrote to memory of 2556 2468 btnbhn.exe 35 PID 2468 wrote to memory of 2556 2468 btnbhn.exe 35 PID 2468 wrote to memory of 2556 2468 btnbhn.exe 35 PID 2556 wrote to memory of 2364 2556 1pdjp.exe 36 PID 2556 wrote to memory of 2364 2556 1pdjp.exe 36 PID 2556 wrote to memory of 2364 2556 1pdjp.exe 36 PID 2556 wrote to memory of 2364 2556 1pdjp.exe 36 PID 2364 wrote to memory of 2344 2364 5tnthn.exe 37 PID 2364 wrote to memory of 2344 2364 5tnthn.exe 37 PID 2364 wrote to memory of 2344 2364 5tnthn.exe 37 PID 2364 wrote to memory of 2344 2364 5tnthn.exe 37 PID 2344 wrote to memory of 1452 2344 jvdvv.exe 38 PID 2344 wrote to memory of 1452 2344 jvdvv.exe 38 PID 2344 wrote to memory of 1452 2344 jvdvv.exe 38 PID 2344 wrote to memory of 1452 2344 jvdvv.exe 38 PID 1452 wrote to memory of 1052 1452 bhbnbh.exe 39 PID 1452 wrote to memory of 1052 1452 bhbnbh.exe 39 PID 1452 wrote to memory of 1052 1452 bhbnbh.exe 39 PID 1452 wrote to memory of 1052 1452 bhbnbh.exe 39 PID 1052 wrote to memory of 2740 1052 3vvvp.exe 40 PID 1052 wrote to memory of 2740 1052 3vvvp.exe 40 PID 1052 wrote to memory of 2740 1052 3vvvp.exe 40 PID 1052 wrote to memory of 2740 1052 3vvvp.exe 40 PID 2740 wrote to memory of 1444 2740 7hbhtt.exe 41 PID 2740 wrote to memory of 1444 2740 7hbhtt.exe 41 PID 2740 wrote to memory of 1444 2740 7hbhtt.exe 41 PID 2740 wrote to memory of 1444 2740 7hbhtt.exe 41 PID 1444 wrote to memory of 1212 1444 dppjv.exe 42 PID 1444 wrote to memory of 1212 1444 dppjv.exe 42 PID 1444 wrote to memory of 1212 1444 dppjv.exe 42 PID 1444 wrote to memory of 1212 1444 dppjv.exe 42 PID 1212 wrote to memory of 2416 1212 fxlrflf.exe 43 PID 1212 wrote to memory of 2416 1212 fxlrflf.exe 43 PID 1212 wrote to memory of 2416 1212 fxlrflf.exe 43 PID 1212 wrote to memory of 2416 1212 fxlrflf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe"C:\Users\Admin\AppData\Local\Temp\9719d1ade37e3f138ea90b16f38dd31763dc71ea9e6a9b1ba72b4c36fb36bce6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vjvvv.exec:\vjvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\rrfrxll.exec:\rrfrxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\jdvdp.exec:\jdvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\fflflll.exec:\fflflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nhtntn.exec:\nhtntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\1dpvp.exec:\1dpvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\btnbhn.exec:\btnbhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\1pdjp.exec:\1pdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5tnthn.exec:\5tnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jvdvv.exec:\jvdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\bhbnbh.exec:\bhbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\3vvvp.exec:\3vvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\7hbhtt.exec:\7hbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dppjv.exec:\dppjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\fxlrflf.exec:\fxlrflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\5bnttt.exec:\5bnttt.exe17⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrxlxlx.exec:\xrxlxlx.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnhntb.exec:\tnhntb.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dvpdj.exec:\dvpdj.exe20⤵
- Executes dropped EXE
PID:536 -
\??\c:\nbhttn.exec:\nbhttn.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7dvjv.exec:\7dvjv.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1732 -
\??\c:\rlllffl.exec:\rlllffl.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vpdpd.exec:\vpdpd.exe24⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jvvvd.exec:\jvvvd.exe25⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5nbbhh.exec:\5nbbhh.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xrlrflx.exec:\xrlrflx.exe27⤵
- Executes dropped EXE
PID:1472 -
\??\c:\tbtthh.exec:\tbtthh.exe28⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1jppp.exec:\1jppp.exe29⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nbnnnn.exec:\nbnnnn.exe30⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pvvpd.exec:\pvvpd.exe31⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9frxflr.exec:\9frxflr.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\thbhbb.exec:\thbhbb.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vpjvj.exec:\vpjvj.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1lrrlff.exec:\1lrrlff.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\ttnthh.exec:\ttnthh.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pjvvd.exec:\pjvvd.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\thtbhh.exec:\thtbhh.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dppvj.exec:\dppvj.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvjdd.exec:\vvjdd.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rxrflxl.exec:\rxrflxl.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hbttbb.exec:\hbttbb.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nbttbh.exec:\nbttbh.exe44⤵
- Executes dropped EXE
PID:2468 -
\??\c:\5pdvv.exec:\5pdvv.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3xlflll.exec:\3xlflll.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\frlrrrx.exec:\frlrrrx.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hbbntt.exec:\hbbntt.exe48⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7pvjj.exec:\7pvjj.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\xfrrrfl.exec:\xfrrrfl.exe50⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbbhbh.exec:\bbbhbh.exe52⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdjjj.exec:\pdjjj.exe53⤵
- Executes dropped EXE
PID:1444 -
\??\c:\lxllrxl.exec:\lxllrxl.exe54⤵
- Executes dropped EXE
PID:1180 -
\??\c:\5lllxfl.exec:\5lllxfl.exe55⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hbntbb.exec:\hbntbb.exe56⤵
- Executes dropped EXE
PID:1828 -
\??\c:\3dpjj.exec:\3dpjj.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7dvvd.exec:\7dvvd.exe58⤵
- Executes dropped EXE
PID:2032 -
\??\c:\fxrrflf.exec:\fxrrflf.exe59⤵
- Executes dropped EXE
PID:2276 -
\??\c:\3tntbb.exec:\3tntbb.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjvdj.exec:\jjvdj.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jvvvd.exec:\jvvvd.exe62⤵
- Executes dropped EXE
PID:636 -
\??\c:\3lflrxf.exec:\3lflrxf.exe63⤵
- Executes dropped EXE
PID:920 -
\??\c:\hbhhnt.exec:\hbhhnt.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pjjdp.exec:\pjjdp.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9jddd.exec:\9jddd.exe66⤵PID:372
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe67⤵PID:1684
-
\??\c:\btnttt.exec:\btnttt.exe68⤵PID:2772
-
\??\c:\1bhnhb.exec:\1bhnhb.exe69⤵PID:1348
-
\??\c:\ddvvd.exec:\ddvvd.exe70⤵PID:1472
-
\??\c:\vpjpp.exec:\vpjpp.exe71⤵PID:908
-
\??\c:\frllrfl.exec:\frllrfl.exe72⤵PID:2068
-
\??\c:\5hbtbh.exec:\5hbtbh.exe73⤵PID:2896
-
\??\c:\dvddj.exec:\dvddj.exe74⤵PID:2892
-
\??\c:\dvddj.exec:\dvddj.exe75⤵PID:1424
-
\??\c:\lfrxrfl.exec:\lfrxrfl.exe76⤵PID:2396
-
\??\c:\frrllrr.exec:\frrllrr.exe77⤵PID:2128
-
\??\c:\hthntb.exec:\hthntb.exe78⤵PID:2312
-
\??\c:\djvpj.exec:\djvpj.exe79⤵PID:1532
-
\??\c:\dvjjj.exec:\dvjjj.exe80⤵PID:1500
-
\??\c:\1flfffl.exec:\1flfffl.exe81⤵PID:2952
-
\??\c:\nhtbhh.exec:\nhtbhh.exe82⤵PID:2548
-
\??\c:\hthhnn.exec:\hthhnn.exe83⤵PID:2588
-
\??\c:\pjjpv.exec:\pjjpv.exe84⤵PID:2708
-
\??\c:\frfxfxl.exec:\frfxfxl.exe85⤵PID:2480
-
\??\c:\rrrflxl.exec:\rrrflxl.exe86⤵PID:2720
-
\??\c:\hhttnt.exec:\hhttnt.exe87⤵PID:1504
-
\??\c:\dppvv.exec:\dppvv.exe88⤵PID:2640
-
\??\c:\1dppp.exec:\1dppp.exe89⤵PID:2468
-
\??\c:\7lfflxx.exec:\7lfflxx.exe90⤵PID:2516
-
\??\c:\thttnt.exec:\thttnt.exe91⤵PID:1916
-
\??\c:\tnhnbh.exec:\tnhnbh.exe92⤵PID:1920
-
\??\c:\5pppd.exec:\5pppd.exe93⤵PID:2348
-
\??\c:\xfxfflr.exec:\xfxfflr.exe94⤵PID:2512
-
\??\c:\hbnnnb.exec:\hbnnnb.exe95⤵PID:2736
-
\??\c:\9btntt.exec:\9btntt.exe96⤵PID:1620
-
\??\c:\dpjdp.exec:\dpjdp.exe97⤵PID:1660
-
\??\c:\dpjpp.exec:\dpjpp.exe98⤵PID:1020
-
\??\c:\frlllll.exec:\frlllll.exe99⤵PID:1664
-
\??\c:\thntnn.exec:\thntnn.exe100⤵PID:1644
-
\??\c:\nnbhbn.exec:\nnbhbn.exe101⤵PID:2768
-
\??\c:\pvjjp.exec:\pvjjp.exe102⤵PID:868
-
\??\c:\llxflfl.exec:\llxflfl.exe103⤵PID:1800
-
\??\c:\3nnhbb.exec:\3nnhbb.exe104⤵PID:1056
-
\??\c:\nbttbb.exec:\nbttbb.exe105⤵PID:1768
-
\??\c:\jdppp.exec:\jdppp.exe106⤵PID:688
-
\??\c:\frxrllr.exec:\frxrllr.exe107⤵PID:1044
-
\??\c:\hnbbbb.exec:\hnbbbb.exe108⤵PID:2220
-
\??\c:\nhtnnn.exec:\nhtnnn.exe109⤵PID:448
-
\??\c:\jjvpv.exec:\jjvpv.exe110⤵PID:276
-
\??\c:\rxfllrr.exec:\rxfllrr.exe111⤵PID:1428
-
\??\c:\9rxxxfl.exec:\9rxxxfl.exe112⤵PID:1248
-
\??\c:\tbnhnn.exec:\tbnhnn.exe113⤵PID:2772
-
\??\c:\9jppv.exec:\9jppv.exe114⤵PID:812
-
\??\c:\dpjjp.exec:\dpjjp.exe115⤵PID:2152
-
\??\c:\xffrxlf.exec:\xffrxlf.exe116⤵PID:908
-
\??\c:\hbnntt.exec:\hbnntt.exe117⤵PID:2068
-
\??\c:\1vjjj.exec:\1vjjj.exe118⤵PID:2208
-
\??\c:\djdvj.exec:\djdvj.exe119⤵PID:556
-
\??\c:\xllflfl.exec:\xllflfl.exe120⤵PID:1616
-
\??\c:\ntbnnh.exec:\ntbnnh.exe121⤵PID:1548
-
\??\c:\bhbnnb.exec:\bhbnnb.exe122⤵PID:2160
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-