Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe
-
Size
455KB
-
MD5
6b72dfa9d0b33d6b2e6ef05fcc128dad
-
SHA1
e3adfb6b810cb2c76610d2ce96ba716de4d1d8fb
-
SHA256
aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c
-
SHA512
45f57d5f7f1780502bf2187d057ccdc20fe78038d004197a41855ec4addfb1a1197b90ca5cb07b7eb5d7f372eb57608da1f6ea8cbd276a0dff656ac5ebe29000
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRm:q7Tc2NYHUrAwfMp3CDRm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2356-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-85-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3060-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-142-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2008-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-177-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2528-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-188-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2372-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-298-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2016-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-313-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1656-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-337-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-437-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2008-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-470-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1324-501-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2448-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-654-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-670-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-699-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2900-711-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2376-724-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2976-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1376-787-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2380-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-858-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 hthnhh.exe 2504 5jvvv.exe 3068 7rxrxrx.exe 2760 nbhbbn.exe 2712 dpddv.exe 2772 3bbbtt.exe 2856 vdppp.exe 2132 5lxfxrr.exe 1592 9vvdp.exe 2588 rxlxxrx.exe 3060 jjvvd.exe 2044 lxlfffl.exe 2876 7bbttn.exe 1564 pvjvv.exe 2812 1fllfff.exe 2888 nthhnh.exe 2008 pjppv.exe 2528 rflflfx.exe 2804 nhnntb.exe 2372 vjjjd.exe 1408 lfxxllx.exe 408 9btnnh.exe 2556 vpvpp.exe 776 9fxxxxl.exe 956 thhbtn.exe 1320 7vdvv.exe 1672 thnbht.exe 2296 dpvpv.exe 896 bhnntt.exe 2380 9vjdv.exe 1956 pjvvd.exe 2016 lrfxfxl.exe 1656 thtntn.exe 2864 jdvjj.exe 2144 btthhh.exe 2716 jpvjj.exe 2724 7ffxrlf.exe 2748 bnbbhh.exe 2944 jvdpp.exe 2612 dpvpp.exe 2620 lfrrrlr.exe 2828 tnhhtt.exe 580 vdjdj.exe 2816 pdpjp.exe 1960 frffllx.exe 2896 9lfrffl.exe 1640 bnthhb.exe 2384 pdjjj.exe 2004 vvjpd.exe 2880 rfrlfff.exe 1168 htbbbb.exe 2008 3hbhhh.exe 1428 jdpjp.exe 2912 flrlffl.exe 2188 lrxxfxl.exe 2392 hbnntn.exe 1696 dvdvp.exe 1140 7dvdv.exe 448 fllllll.exe 1996 fxlrxxl.exe 1324 bhhbtn.exe 1124 1jppv.exe 1704 9frrlff.exe 1304 xrfxxrr.exe -
resource yara_rule behavioral1/memory/2356-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-654-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2876-670-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-699-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2392-732-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-839-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2604-885-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-908-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfflxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2056 2356 aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe 30 PID 2356 wrote to memory of 2056 2356 aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe 30 PID 2356 wrote to memory of 2056 2356 aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe 30 PID 2356 wrote to memory of 2056 2356 aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe 30 PID 2056 wrote to memory of 2504 2056 hthnhh.exe 31 PID 2056 wrote to memory of 2504 2056 hthnhh.exe 31 PID 2056 wrote to memory of 2504 2056 hthnhh.exe 31 PID 2056 wrote to memory of 2504 2056 hthnhh.exe 31 PID 2504 wrote to memory of 3068 2504 5jvvv.exe 32 PID 2504 wrote to memory of 3068 2504 5jvvv.exe 32 PID 2504 wrote to memory of 3068 2504 5jvvv.exe 32 PID 2504 wrote to memory of 3068 2504 5jvvv.exe 32 PID 3068 wrote to memory of 2760 3068 7rxrxrx.exe 33 PID 3068 wrote to memory of 2760 3068 7rxrxrx.exe 33 PID 3068 wrote to memory of 2760 3068 7rxrxrx.exe 33 PID 3068 wrote to memory of 2760 3068 7rxrxrx.exe 33 PID 2760 wrote to memory of 2712 2760 nbhbbn.exe 34 PID 2760 wrote to memory of 2712 2760 nbhbbn.exe 34 PID 2760 wrote to memory of 2712 2760 nbhbbn.exe 34 PID 2760 wrote to memory of 2712 2760 nbhbbn.exe 34 PID 2712 wrote to memory of 2772 2712 dpddv.exe 35 PID 2712 wrote to memory of 2772 2712 dpddv.exe 35 PID 2712 wrote to memory of 2772 2712 dpddv.exe 35 PID 2712 wrote to memory of 2772 2712 dpddv.exe 35 PID 2772 wrote to memory of 2856 2772 3bbbtt.exe 36 PID 2772 wrote to memory of 2856 2772 3bbbtt.exe 36 PID 2772 wrote to memory of 2856 2772 3bbbtt.exe 36 PID 2772 wrote to memory of 2856 2772 3bbbtt.exe 36 PID 2856 wrote to memory of 2132 2856 vdppp.exe 37 PID 2856 wrote to memory of 2132 2856 vdppp.exe 37 PID 2856 wrote to memory of 2132 2856 vdppp.exe 37 PID 2856 wrote to memory of 2132 2856 vdppp.exe 37 PID 2132 wrote to memory of 1592 2132 5lxfxrr.exe 38 PID 2132 wrote to memory of 1592 2132 5lxfxrr.exe 38 PID 2132 wrote to memory of 1592 2132 5lxfxrr.exe 38 PID 2132 wrote to memory of 1592 2132 5lxfxrr.exe 38 PID 1592 wrote to memory of 2588 1592 9vvdp.exe 39 PID 1592 wrote to memory of 2588 1592 9vvdp.exe 39 PID 1592 wrote to memory of 2588 1592 9vvdp.exe 39 PID 1592 wrote to memory of 2588 1592 9vvdp.exe 39 PID 2588 wrote to memory of 3060 2588 rxlxxrx.exe 40 PID 2588 wrote to memory of 3060 2588 rxlxxrx.exe 40 PID 2588 wrote to memory of 3060 2588 rxlxxrx.exe 40 PID 2588 wrote to memory of 3060 2588 rxlxxrx.exe 40 PID 3060 wrote to memory of 2044 3060 jjvvd.exe 41 PID 3060 wrote to memory of 2044 3060 jjvvd.exe 41 PID 3060 wrote to memory of 2044 3060 jjvvd.exe 41 PID 3060 wrote to memory of 2044 3060 jjvvd.exe 41 PID 2044 wrote to memory of 2876 2044 lxlfffl.exe 42 PID 2044 wrote to memory of 2876 2044 lxlfffl.exe 42 PID 2044 wrote to memory of 2876 2044 lxlfffl.exe 42 PID 2044 wrote to memory of 2876 2044 lxlfffl.exe 42 PID 2876 wrote to memory of 1564 2876 7bbttn.exe 43 PID 2876 wrote to memory of 1564 2876 7bbttn.exe 43 PID 2876 wrote to memory of 1564 2876 7bbttn.exe 43 PID 2876 wrote to memory of 1564 2876 7bbttn.exe 43 PID 1564 wrote to memory of 2812 1564 pvjvv.exe 44 PID 1564 wrote to memory of 2812 1564 pvjvv.exe 44 PID 1564 wrote to memory of 2812 1564 pvjvv.exe 44 PID 1564 wrote to memory of 2812 1564 pvjvv.exe 44 PID 2812 wrote to memory of 2888 2812 1fllfff.exe 45 PID 2812 wrote to memory of 2888 2812 1fllfff.exe 45 PID 2812 wrote to memory of 2888 2812 1fllfff.exe 45 PID 2812 wrote to memory of 2888 2812 1fllfff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe"C:\Users\Admin\AppData\Local\Temp\aba7db44321a625ca7d4e0d2c08a9b03a49a695ff1e2c52c56102c614b5eaf3c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\hthnhh.exec:\hthnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5jvvv.exec:\5jvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\7rxrxrx.exec:\7rxrxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nbhbbn.exec:\nbhbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dpddv.exec:\dpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3bbbtt.exec:\3bbbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\vdppp.exec:\vdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\5lxfxrr.exec:\5lxfxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\9vvdp.exec:\9vvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\rxlxxrx.exec:\rxlxxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\jjvvd.exec:\jjvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\lxlfffl.exec:\lxlfffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\7bbttn.exec:\7bbttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pvjvv.exec:\pvjvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\1fllfff.exec:\1fllfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\nthhnh.exec:\nthhnh.exe17⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjppv.exec:\pjppv.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\rflflfx.exec:\rflflfx.exe19⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nhnntb.exec:\nhnntb.exe20⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vjjjd.exec:\vjjjd.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\lfxxllx.exec:\lfxxllx.exe22⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9btnnh.exec:\9btnnh.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\vpvpp.exec:\vpvpp.exe24⤵
- Executes dropped EXE
PID:2556 -
\??\c:\9fxxxxl.exec:\9fxxxxl.exe25⤵
- Executes dropped EXE
PID:776 -
\??\c:\thhbtn.exec:\thhbtn.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\7vdvv.exec:\7vdvv.exe27⤵
- Executes dropped EXE
PID:1320 -
\??\c:\thnbht.exec:\thnbht.exe28⤵
- Executes dropped EXE
PID:1672 -
\??\c:\dpvpv.exec:\dpvpv.exe29⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bhnntt.exec:\bhnntt.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\9vjdv.exec:\9vjdv.exe31⤵
- Executes dropped EXE
PID:2380 -
\??\c:\pjvvd.exec:\pjvvd.exe32⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lrfxfxl.exec:\lrfxfxl.exe33⤵
- Executes dropped EXE
PID:2016 -
\??\c:\thtntn.exec:\thtntn.exe34⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jdvjj.exec:\jdvjj.exe35⤵
- Executes dropped EXE
PID:2864 -
\??\c:\btthhh.exec:\btthhh.exe36⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jpvjj.exec:\jpvjj.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\7ffxrlf.exec:\7ffxrlf.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bnbbhh.exec:\bnbbhh.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\jvdpp.exec:\jvdpp.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\dpvpp.exec:\dpvpp.exe41⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfrrrlr.exec:\lfrrrlr.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tnhhtt.exec:\tnhhtt.exe43⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vdjdj.exec:\vdjdj.exe44⤵
- Executes dropped EXE
PID:580 -
\??\c:\pdpjp.exec:\pdpjp.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\frffllx.exec:\frffllx.exe46⤵
- Executes dropped EXE
PID:1960 -
\??\c:\9lfrffl.exec:\9lfrffl.exe47⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bnthhb.exec:\bnthhb.exe48⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pdjjj.exec:\pdjjj.exe49⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vvjpd.exec:\vvjpd.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rfrlfff.exec:\rfrlfff.exe51⤵
- Executes dropped EXE
PID:2880 -
\??\c:\htbbbb.exec:\htbbbb.exe52⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3hbhhh.exec:\3hbhhh.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jdpjp.exec:\jdpjp.exe54⤵
- Executes dropped EXE
PID:1428 -
\??\c:\flrlffl.exec:\flrlffl.exe55⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lrxxfxl.exec:\lrxxfxl.exe56⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbnntn.exec:\hbnntn.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dvdvp.exec:\dvdvp.exe58⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7dvdv.exec:\7dvdv.exe59⤵
- Executes dropped EXE
PID:1140 -
\??\c:\fllllll.exec:\fllllll.exe60⤵
- Executes dropped EXE
PID:448 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe61⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bhhbtn.exec:\bhhbtn.exe62⤵
- Executes dropped EXE
PID:1324 -
\??\c:\1jppv.exec:\1jppv.exe63⤵
- Executes dropped EXE
PID:1124 -
\??\c:\9frrlff.exec:\9frrlff.exe64⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1304 -
\??\c:\bnhnnn.exec:\bnhnnn.exe66⤵PID:1488
-
\??\c:\7dppd.exec:\7dppd.exe67⤵PID:2292
-
\??\c:\dpvpp.exec:\dpvpp.exe68⤵PID:2448
-
\??\c:\lfffffl.exec:\lfffffl.exe69⤵PID:2660
-
\??\c:\1hnbtn.exec:\1hnbtn.exe70⤵PID:2464
-
\??\c:\1nhhbh.exec:\1nhhbh.exe71⤵PID:1060
-
\??\c:\vjdpv.exec:\vjdpv.exe72⤵PID:1524
-
\??\c:\lxllrrx.exec:\lxllrrx.exe73⤵PID:2508
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe74⤵PID:2520
-
\??\c:\1thbbn.exec:\1thbbn.exe75⤵PID:2768
-
\??\c:\htnbht.exec:\htnbht.exe76⤵PID:2960
-
\??\c:\vjvvv.exec:\vjvvv.exe77⤵PID:1056
-
\??\c:\rfrflll.exec:\rfrflll.exe78⤵PID:2764
-
\??\c:\7hbhnn.exec:\7hbhnn.exe79⤵PID:2172
-
\??\c:\bnhbtt.exec:\bnhbtt.exe80⤵PID:2840
-
\??\c:\pdvvd.exec:\pdvvd.exe81⤵PID:3056
-
\??\c:\pddvp.exec:\pddvp.exe82⤵PID:1252
-
\??\c:\9rxrlfl.exec:\9rxrlfl.exe83⤵PID:2628
-
\??\c:\3hnbbt.exec:\3hnbbt.exe84⤵PID:2588
-
\??\c:\3nhtnn.exec:\3nhtnn.exe85⤵PID:2592
-
\??\c:\vvdvv.exec:\vvdvv.exe86⤵PID:2044
-
\??\c:\frrrrrx.exec:\frrrrrx.exe87⤵PID:3040
-
\??\c:\btbhnn.exec:\btbhnn.exe88⤵PID:2876
-
\??\c:\1hbbbb.exec:\1hbbbb.exe89⤵PID:1940
-
\??\c:\9jpjj.exec:\9jpjj.exe90⤵PID:2160
-
\??\c:\lxlfllr.exec:\lxlfllr.exe91⤵PID:1164
-
\??\c:\9flxrff.exec:\9flxrff.exe92⤵PID:2880
-
\??\c:\htbtnb.exec:\htbtnb.exe93⤵PID:1980
-
\??\c:\jvjdd.exec:\jvjdd.exe94⤵PID:2900
-
\??\c:\rlxxffr.exec:\rlxxffr.exe95⤵PID:1428
-
\??\c:\5fllfxx.exec:\5fllfxx.exe96⤵PID:2376
-
\??\c:\bthhnt.exec:\bthhnt.exe97⤵PID:2256
-
\??\c:\pdpvd.exec:\pdpvd.exe98⤵PID:2392
-
\??\c:\5lxrrlr.exec:\5lxrrlr.exe99⤵PID:1108
-
\??\c:\9rxlffl.exec:\9rxlffl.exe100⤵PID:680
-
\??\c:\7ntnnn.exec:\7ntnnn.exe101⤵PID:408
-
\??\c:\htnttt.exec:\htnttt.exe102⤵PID:2976
-
\??\c:\dpvpp.exec:\dpvpp.exe103⤵PID:2432
-
\??\c:\rxfrrlf.exec:\rxfrrlf.exe104⤵PID:1124
-
\??\c:\rfrlffr.exec:\rfrlffr.exe105⤵PID:2220
-
\??\c:\hbnntn.exec:\hbnntn.exe106⤵PID:1376
-
\??\c:\hntnnh.exec:\hntnnh.exe107⤵PID:2184
-
\??\c:\jdvvv.exec:\jdvvv.exe108⤵PID:2292
-
\??\c:\lfxflrl.exec:\lfxflrl.exe109⤵PID:1624
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe110⤵PID:2380
-
\??\c:\tnbhtt.exec:\tnbhtt.exe111⤵PID:2056
-
\??\c:\thnnhb.exec:\thnnhb.exe112⤵PID:2932
-
\??\c:\7pppp.exec:\7pppp.exe113⤵PID:2032
-
\??\c:\xrxxxrr.exec:\xrxxxrr.exe114⤵PID:1724
-
\??\c:\xrxfxrf.exec:\xrxfxrf.exe115⤵PID:2720
-
\??\c:\ntbtnn.exec:\ntbtnn.exe116⤵PID:2320
-
\??\c:\pdjjp.exec:\pdjjp.exe117⤵PID:2832
-
\??\c:\jvdpp.exec:\jvdpp.exe118⤵PID:2796
-
\??\c:\rlfxxxr.exec:\rlfxxxr.exe119⤵PID:2604
-
\??\c:\thtthh.exec:\thtthh.exe120⤵PID:2304
-
\??\c:\bhnhht.exec:\bhnhht.exe121⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-