Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe
-
Size
455KB
-
MD5
29805fa41a039100f4c9a5550ffed390
-
SHA1
d6311bb6671dbc65a324b6daa2ee9f019eaa2428
-
SHA256
f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440b
-
SHA512
8c903cc9bb859a35bb15ae1416b4cc2dc271b985af35b82c7354b258c3beab60f0039440eee3f40a273608b4657515598e64c877b9ec954369082ef4191b77c9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-124-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2320-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/608-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-294-0x00000000771E0000-0x00000000772FF000-memory.dmp family_blackmoon behavioral1/memory/2376-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-343-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2744-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-522-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/684-545-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/484-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-602-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2644-656-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2552-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-681-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-695-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1956-702-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2420-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-717-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1976 lfrflxl.exe 1548 vdddv.exe 2120 llxrxfr.exe 2788 9jpvd.exe 3068 frffllx.exe 2768 bhbtbn.exe 2856 9jjpv.exe 2624 nttnhb.exe 1968 lflllff.exe 2504 nbttbb.exe 2940 rlrxllx.exe 2960 nbhtbb.exe 1852 xffrxxl.exe 1928 lfrrxrx.exe 1252 dvvjv.exe 2320 rflffxf.exe 1732 hhhhnt.exe 1896 1djjp.exe 1344 xrlxxxf.exe 2684 ththhh.exe 2732 xlfxflf.exe 1424 bthhnh.exe 2692 3pvvv.exe 1972 xxxxlrf.exe 1236 hhtbhh.exe 2480 jpjvp.exe 608 5hbhnn.exe 812 nhbhnb.exe 2412 9fflxfr.exe 1408 fllrlrx.exe 756 vpvpj.exe 2376 9ddpd.exe 2988 xrfxfrf.exe 2688 btbbbt.exe 2468 jdddv.exe 2712 1rflrxf.exe 3068 7hbnbn.exe 2744 3btbnt.exe 2740 ddpdd.exe 2544 rfrxlxr.exe 2668 frxxflx.exe 2512 ttnnnn.exe 2528 9dpdp.exe 2520 rxxrllr.exe 2472 xxrlrrx.exe 2260 bhhbnn.exe 1868 3dvdj.exe 1620 7pdjj.exe 1464 rrxrxfx.exe 2456 tthnbb.exe 2248 5nnthn.exe 2320 jjddp.exe 2264 rlllxlf.exe 1912 fxrfllr.exe 2416 tbtbnt.exe 1200 ppdvp.exe 2928 vpddj.exe 380 lxflrrf.exe 2732 bthhtn.exe 1696 hhhttt.exe 336 ddppv.exe 2188 1rfxllr.exe 1468 3rlllll.exe 908 nnhthh.exe -
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-83-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1968-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-512-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/484-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-761-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1976 2336 f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe 30 PID 2336 wrote to memory of 1976 2336 f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe 30 PID 2336 wrote to memory of 1976 2336 f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe 30 PID 2336 wrote to memory of 1976 2336 f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe 30 PID 1976 wrote to memory of 1548 1976 lfrflxl.exe 31 PID 1976 wrote to memory of 1548 1976 lfrflxl.exe 31 PID 1976 wrote to memory of 1548 1976 lfrflxl.exe 31 PID 1976 wrote to memory of 1548 1976 lfrflxl.exe 31 PID 1548 wrote to memory of 2120 1548 vdddv.exe 32 PID 1548 wrote to memory of 2120 1548 vdddv.exe 32 PID 1548 wrote to memory of 2120 1548 vdddv.exe 32 PID 1548 wrote to memory of 2120 1548 vdddv.exe 32 PID 2120 wrote to memory of 2788 2120 llxrxfr.exe 33 PID 2120 wrote to memory of 2788 2120 llxrxfr.exe 33 PID 2120 wrote to memory of 2788 2120 llxrxfr.exe 33 PID 2120 wrote to memory of 2788 2120 llxrxfr.exe 33 PID 2788 wrote to memory of 3068 2788 9jpvd.exe 34 PID 2788 wrote to memory of 3068 2788 9jpvd.exe 34 PID 2788 wrote to memory of 3068 2788 9jpvd.exe 34 PID 2788 wrote to memory of 3068 2788 9jpvd.exe 34 PID 3068 wrote to memory of 2768 3068 frffllx.exe 35 PID 3068 wrote to memory of 2768 3068 frffllx.exe 35 PID 3068 wrote to memory of 2768 3068 frffllx.exe 35 PID 3068 wrote to memory of 2768 3068 frffllx.exe 35 PID 2768 wrote to memory of 2856 2768 bhbtbn.exe 36 PID 2768 wrote to memory of 2856 2768 bhbtbn.exe 36 PID 2768 wrote to memory of 2856 2768 bhbtbn.exe 36 PID 2768 wrote to memory of 2856 2768 bhbtbn.exe 36 PID 2856 wrote to memory of 2624 2856 9jjpv.exe 37 PID 2856 wrote to memory of 2624 2856 9jjpv.exe 37 PID 2856 wrote to memory of 2624 2856 9jjpv.exe 37 PID 2856 wrote to memory of 2624 2856 9jjpv.exe 37 PID 2624 wrote to memory of 1968 2624 nttnhb.exe 38 PID 2624 wrote to memory of 1968 2624 nttnhb.exe 38 PID 2624 wrote to memory of 1968 2624 nttnhb.exe 38 PID 2624 wrote to memory of 1968 2624 nttnhb.exe 38 PID 1968 wrote to memory of 2504 1968 lflllff.exe 39 PID 1968 wrote to memory of 2504 1968 lflllff.exe 39 PID 1968 wrote to memory of 2504 1968 lflllff.exe 39 PID 1968 wrote to memory of 2504 1968 lflllff.exe 39 PID 2504 wrote to memory of 2940 2504 nbttbb.exe 40 PID 2504 wrote to memory of 2940 2504 nbttbb.exe 40 PID 2504 wrote to memory of 2940 2504 nbttbb.exe 40 PID 2504 wrote to memory of 2940 2504 nbttbb.exe 40 PID 2940 wrote to memory of 2960 2940 rlrxllx.exe 41 PID 2940 wrote to memory of 2960 2940 rlrxllx.exe 41 PID 2940 wrote to memory of 2960 2940 rlrxllx.exe 41 PID 2940 wrote to memory of 2960 2940 rlrxllx.exe 41 PID 2960 wrote to memory of 1852 2960 nbhtbb.exe 42 PID 2960 wrote to memory of 1852 2960 nbhtbb.exe 42 PID 2960 wrote to memory of 1852 2960 nbhtbb.exe 42 PID 2960 wrote to memory of 1852 2960 nbhtbb.exe 42 PID 1852 wrote to memory of 1928 1852 xffrxxl.exe 43 PID 1852 wrote to memory of 1928 1852 xffrxxl.exe 43 PID 1852 wrote to memory of 1928 1852 xffrxxl.exe 43 PID 1852 wrote to memory of 1928 1852 xffrxxl.exe 43 PID 1928 wrote to memory of 1252 1928 lfrrxrx.exe 44 PID 1928 wrote to memory of 1252 1928 lfrrxrx.exe 44 PID 1928 wrote to memory of 1252 1928 lfrrxrx.exe 44 PID 1928 wrote to memory of 1252 1928 lfrrxrx.exe 44 PID 1252 wrote to memory of 2320 1252 dvvjv.exe 45 PID 1252 wrote to memory of 2320 1252 dvvjv.exe 45 PID 1252 wrote to memory of 2320 1252 dvvjv.exe 45 PID 1252 wrote to memory of 2320 1252 dvvjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe"C:\Users\Admin\AppData\Local\Temp\f5fe62b5441935de42cb636dfa877d0817cfa702d028509dbab3be1140cf440bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\lfrflxl.exec:\lfrflxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vdddv.exec:\vdddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\llxrxfr.exec:\llxrxfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\9jpvd.exec:\9jpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\frffllx.exec:\frffllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\bhbtbn.exec:\bhbtbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\9jjpv.exec:\9jjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nttnhb.exec:\nttnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\lflllff.exec:\lflllff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nbttbb.exec:\nbttbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\rlrxllx.exec:\rlrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\nbhtbb.exec:\nbhtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xffrxxl.exec:\xffrxxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\lfrrxrx.exec:\lfrrxrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\dvvjv.exec:\dvvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\rflffxf.exec:\rflffxf.exe17⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhhhnt.exec:\hhhhnt.exe18⤵
- Executes dropped EXE
PID:1732 -
\??\c:\1djjp.exec:\1djjp.exe19⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xrlxxxf.exec:\xrlxxxf.exe20⤵
- Executes dropped EXE
PID:1344 -
\??\c:\ththhh.exec:\ththhh.exe21⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xlfxflf.exec:\xlfxflf.exe22⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bthhnh.exec:\bthhnh.exe23⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3pvvv.exec:\3pvvv.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe25⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hhtbhh.exec:\hhtbhh.exe26⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jpjvp.exec:\jpjvp.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\5hbhnn.exec:\5hbhnn.exe28⤵
- Executes dropped EXE
PID:608 -
\??\c:\nhbhnb.exec:\nhbhnb.exe29⤵
- Executes dropped EXE
PID:812 -
\??\c:\9fflxfr.exec:\9fflxfr.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fllrlrx.exec:\fllrlrx.exe31⤵
- Executes dropped EXE
PID:1408 -
\??\c:\vpvpj.exec:\vpvpj.exe32⤵
- Executes dropped EXE
PID:756 -
\??\c:\3bnnnn.exec:\3bnnnn.exe33⤵PID:1512
-
\??\c:\9ddpd.exec:\9ddpd.exe34⤵
- Executes dropped EXE
PID:2376 -
\??\c:\xrfxfrf.exec:\xrfxfrf.exe35⤵
- Executes dropped EXE
PID:2988 -
\??\c:\btbbbt.exec:\btbbbt.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdddv.exec:\jdddv.exe37⤵
- Executes dropped EXE
PID:2468 -
\??\c:\1rflrxf.exec:\1rflrxf.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\7hbnbn.exec:\7hbnbn.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3btbnt.exec:\3btbnt.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ddpdd.exec:\ddpdd.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rfrxlxr.exec:\rfrxlxr.exe42⤵
- Executes dropped EXE
PID:2544 -
\??\c:\frxxflx.exec:\frxxflx.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ttnnnn.exec:\ttnnnn.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9dpdp.exec:\9dpdp.exe45⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rxxrllr.exec:\rxxrllr.exe46⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bhhbnn.exec:\bhhbnn.exe48⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3dvdj.exec:\3dvdj.exe49⤵
- Executes dropped EXE
PID:1868 -
\??\c:\7pdjj.exec:\7pdjj.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrxrxfx.exec:\rrxrxfx.exe51⤵
- Executes dropped EXE
PID:1464 -
\??\c:\tthnbb.exec:\tthnbb.exe52⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5nnthn.exec:\5nnthn.exe53⤵
- Executes dropped EXE
PID:2248 -
\??\c:\jjddp.exec:\jjddp.exe54⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rlllxlf.exec:\rlllxlf.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxrfllr.exec:\fxrfllr.exe56⤵
- Executes dropped EXE
PID:1912 -
\??\c:\tbtbnt.exec:\tbtbnt.exe57⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ppdvp.exec:\ppdvp.exe58⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vpddj.exec:\vpddj.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\lxflrrf.exec:\lxflrrf.exe60⤵
- Executes dropped EXE
PID:380 -
\??\c:\bthhtn.exec:\bthhtn.exe61⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhhttt.exec:\hhhttt.exe62⤵
- Executes dropped EXE
PID:1696 -
\??\c:\ddppv.exec:\ddppv.exe63⤵
- Executes dropped EXE
PID:336 -
\??\c:\1rfxllr.exec:\1rfxllr.exe64⤵
- Executes dropped EXE
PID:2188 -
\??\c:\3rlllll.exec:\3rlllll.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\nnhthh.exec:\nnhthh.exe66⤵
- Executes dropped EXE
PID:908 -
\??\c:\pdjvd.exec:\pdjvd.exe67⤵PID:936
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe68⤵PID:2208
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe69⤵PID:684
-
\??\c:\tnbhtt.exec:\tnbhtt.exe70⤵
- System Location Discovery: System Language Discovery
PID:484 -
\??\c:\9jjjd.exec:\9jjjd.exe71⤵PID:2224
-
\??\c:\3ddjj.exec:\3ddjj.exe72⤵PID:2348
-
\??\c:\xlxfllr.exec:\xlxfllr.exe73⤵PID:1412
-
\??\c:\7bhhtb.exec:\7bhhtb.exe74⤵PID:1660
-
\??\c:\jdppd.exec:\jdppd.exe75⤵PID:2972
-
\??\c:\lfxlrrf.exec:\lfxlrrf.exe76⤵PID:1848
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe77⤵PID:2988
-
\??\c:\nhtbhn.exec:\nhtbhn.exe78⤵PID:3000
-
\??\c:\3dvvv.exec:\3dvvv.exe79⤵PID:1884
-
\??\c:\xxxrxrl.exec:\xxxrxrl.exe80⤵PID:2648
-
\??\c:\xxrrffl.exec:\xxrrffl.exe81⤵PID:2700
-
\??\c:\hbntbb.exec:\hbntbb.exe82⤵PID:2768
-
\??\c:\7jvvj.exec:\7jvvj.exe83⤵PID:3024
-
\??\c:\lfxrfrr.exec:\lfxrfrr.exe84⤵PID:2852
-
\??\c:\1frxrfr.exec:\1frxrfr.exe85⤵PID:2672
-
\??\c:\hbtbtt.exec:\hbtbtt.exe86⤵PID:2644
-
\??\c:\btnntt.exec:\btnntt.exe87⤵PID:2580
-
\??\c:\jjjjv.exec:\jjjjv.exe88⤵PID:2552
-
\??\c:\rrlflxf.exec:\rrlflxf.exe89⤵PID:276
-
\??\c:\1rxxlrx.exec:\1rxxlrx.exe90⤵PID:1120
-
\??\c:\ttnhnt.exec:\ttnhnt.exe91⤵PID:1740
-
\??\c:\vvpvv.exec:\vvpvv.exe92⤵PID:1956
-
\??\c:\xrrrflx.exec:\xrrrflx.exe93⤵PID:1744
-
\??\c:\9nthtb.exec:\9nthtb.exe94⤵PID:2420
-
\??\c:\hbnthh.exec:\hbnthh.exe95⤵PID:2312
-
\??\c:\pjvvd.exec:\pjvvd.exe96⤵PID:1724
-
\??\c:\5fxfxfl.exec:\5fxfxfl.exe97⤵PID:1920
-
\??\c:\rxrlrxf.exec:\rxrlrxf.exe98⤵PID:1632
-
\??\c:\hbnthh.exec:\hbnthh.exe99⤵PID:1568
-
\??\c:\5pjjp.exec:\5pjjp.exe100⤵PID:2496
-
\??\c:\dvvvj.exec:\dvvvj.exe101⤵PID:1532
-
\??\c:\xrlxlxf.exec:\xrlxlxf.exe102⤵PID:2576
-
\??\c:\9btbnb.exec:\9btbnb.exe103⤵PID:1388
-
\??\c:\nnhnbb.exec:\nnhnbb.exe104⤵PID:2716
-
\??\c:\jdjpd.exec:\jdjpd.exe105⤵PID:336
-
\??\c:\3fxxflx.exec:\3fxxflx.exe106⤵PID:1588
-
\??\c:\nhbbth.exec:\nhbbth.exe107⤵PID:1700
-
\??\c:\nnnntt.exec:\nnnntt.exe108⤵PID:2480
-
\??\c:\jjddj.exec:\jjddj.exe109⤵PID:608
-
\??\c:\dvjvj.exec:\dvjvj.exe110⤵PID:1600
-
\??\c:\lfrrflr.exec:\lfrrflr.exe111⤵PID:992
-
\??\c:\1nhnth.exec:\1nhnth.exe112⤵PID:1860
-
\??\c:\9bnthn.exec:\9bnthn.exe113⤵PID:2180
-
\??\c:\pjjdj.exec:\pjjdj.exe114⤵PID:1948
-
\??\c:\pddvp.exec:\pddvp.exe115⤵PID:1512
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe116⤵PID:2848
-
\??\c:\nnbthn.exec:\nnbthn.exe117⤵PID:2792
-
\??\c:\ttbhbh.exec:\ttbhbh.exe118⤵PID:2120
-
\??\c:\vpvvv.exec:\vpvvv.exe119⤵PID:2392
-
\??\c:\3vdjp.exec:\3vdjp.exe120⤵PID:2720
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe121⤵PID:1884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-