Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe
-
Size
454KB
-
MD5
447825776fd9a59b8af261b95d15cb99
-
SHA1
c9ddbfee7d8df52f5e44021ffe1f0191d1182eca
-
SHA256
bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf
-
SHA512
611621a4cc9572edf97d707992b75db77a09203f34cd50528a6f8aec1abfe71f705daec2b24958f2973924e99a464d722e73197ae4440ceaa880d34405e2f619
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1m:q7Tc2NYHUrAwfMp3CD1m
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2560-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-34-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2920-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-101-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1400-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-119-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2204-110-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/548-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-184-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2728-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-204-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1028-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-363-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2756-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-385-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2164-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-447-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-563-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2800-895-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-909-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2040-935-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-1014-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-1024-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2308-1025-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-1051-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/3008-1076-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2868-1140-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2664-1153-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-1172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1936-1191-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1152 bnbhnn.exe 2540 rrlrxxf.exe 2940 lllxxrl.exe 1692 jjjpj.exe 2912 pdjdj.exe 2636 bhntbn.exe 2920 3vjdp.exe 2768 vpdvd.exe 2628 xrffrlr.exe 1936 dvppp.exe 2204 xfrflff.exe 1400 9htbhn.exe 2864 jdjjp.exe 548 5btbhh.exe 2692 5pddj.exe 1532 5xlrfrf.exe 2028 1htntt.exe 1884 7dppv.exe 2900 rlrrxrl.exe 2072 ppjpj.exe 2728 jvddp.exe 1004 flrxfrx.exe 1608 vpjjj.exe 1308 vpdjp.exe 2500 dvdpv.exe 2228 9rxxxff.exe 3048 3dppj.exe 628 xrfffll.exe 2396 bnttbt.exe 284 3jvvj.exe 1776 lxflrlr.exe 2560 5thhnt.exe 1636 jvpvd.exe 2460 vdppp.exe 2472 xrflfff.exe 3060 bntnbt.exe 2296 jdddp.exe 1028 jvppd.exe 2904 rrxfllr.exe 2272 bnbnbt.exe 2804 htttnh.exe 2768 vjvjv.exe 2756 1frrfxl.exe 2632 tthnhh.exe 2164 jjvpd.exe 2292 dpdvj.exe 1948 llrffxx.exe 960 tntthh.exe 600 ttnntt.exe 2448 ppdpp.exe 400 xlllxrl.exe 2452 bbnntt.exe 1032 nnhbnt.exe 2028 jjpjv.exe 2860 rxllrlr.exe 2080 fxrrxxl.exe 2344 bnthtb.exe 1792 vjjdd.exe 1292 vjdpv.exe 2812 5rrllll.exe 1656 nnhnbb.exe 1048 9vvpp.exe 1648 9pddp.exe 1772 xfrrxlr.exe -
resource yara_rule behavioral1/memory/2560-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-1133-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2560 wrote to memory of 1152 2560 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 30 PID 2560 wrote to memory of 1152 2560 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 30 PID 2560 wrote to memory of 1152 2560 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 30 PID 2560 wrote to memory of 1152 2560 bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe 30 PID 1152 wrote to memory of 2540 1152 bnbhnn.exe 31 PID 1152 wrote to memory of 2540 1152 bnbhnn.exe 31 PID 1152 wrote to memory of 2540 1152 bnbhnn.exe 31 PID 1152 wrote to memory of 2540 1152 bnbhnn.exe 31 PID 2540 wrote to memory of 2940 2540 rrlrxxf.exe 32 PID 2540 wrote to memory of 2940 2540 rrlrxxf.exe 32 PID 2540 wrote to memory of 2940 2540 rrlrxxf.exe 32 PID 2540 wrote to memory of 2940 2540 rrlrxxf.exe 32 PID 2940 wrote to memory of 1692 2940 lllxxrl.exe 33 PID 2940 wrote to memory of 1692 2940 lllxxrl.exe 33 PID 2940 wrote to memory of 1692 2940 lllxxrl.exe 33 PID 2940 wrote to memory of 1692 2940 lllxxrl.exe 33 PID 1692 wrote to memory of 2912 1692 jjjpj.exe 34 PID 1692 wrote to memory of 2912 1692 jjjpj.exe 34 PID 1692 wrote to memory of 2912 1692 jjjpj.exe 34 PID 1692 wrote to memory of 2912 1692 jjjpj.exe 34 PID 2912 wrote to memory of 2636 2912 pdjdj.exe 35 PID 2912 wrote to memory of 2636 2912 pdjdj.exe 35 PID 2912 wrote to memory of 2636 2912 pdjdj.exe 35 PID 2912 wrote to memory of 2636 2912 pdjdj.exe 35 PID 2636 wrote to memory of 2920 2636 bhntbn.exe 36 PID 2636 wrote to memory of 2920 2636 bhntbn.exe 36 PID 2636 wrote to memory of 2920 2636 bhntbn.exe 36 PID 2636 wrote to memory of 2920 2636 bhntbn.exe 36 PID 2920 wrote to memory of 2768 2920 3vjdp.exe 37 PID 2920 wrote to memory of 2768 2920 3vjdp.exe 37 PID 2920 wrote to memory of 2768 2920 3vjdp.exe 37 PID 2920 wrote to memory of 2768 2920 3vjdp.exe 37 PID 2768 wrote to memory of 2628 2768 vpdvd.exe 38 PID 2768 wrote to memory of 2628 2768 vpdvd.exe 38 PID 2768 wrote to memory of 2628 2768 vpdvd.exe 38 PID 2768 wrote to memory of 2628 2768 vpdvd.exe 38 PID 2628 wrote to memory of 1936 2628 xrffrlr.exe 39 PID 2628 wrote to memory of 1936 2628 xrffrlr.exe 39 PID 2628 wrote to memory of 1936 2628 xrffrlr.exe 39 PID 2628 wrote to memory of 1936 2628 xrffrlr.exe 39 PID 1936 wrote to memory of 2204 1936 dvppp.exe 40 PID 1936 wrote to memory of 2204 1936 dvppp.exe 40 PID 1936 wrote to memory of 2204 1936 dvppp.exe 40 PID 1936 wrote to memory of 2204 1936 dvppp.exe 40 PID 2204 wrote to memory of 1400 2204 xfrflff.exe 41 PID 2204 wrote to memory of 1400 2204 xfrflff.exe 41 PID 2204 wrote to memory of 1400 2204 xfrflff.exe 41 PID 2204 wrote to memory of 1400 2204 xfrflff.exe 41 PID 1400 wrote to memory of 2864 1400 9htbhn.exe 42 PID 1400 wrote to memory of 2864 1400 9htbhn.exe 42 PID 1400 wrote to memory of 2864 1400 9htbhn.exe 42 PID 1400 wrote to memory of 2864 1400 9htbhn.exe 42 PID 2864 wrote to memory of 548 2864 jdjjp.exe 43 PID 2864 wrote to memory of 548 2864 jdjjp.exe 43 PID 2864 wrote to memory of 548 2864 jdjjp.exe 43 PID 2864 wrote to memory of 548 2864 jdjjp.exe 43 PID 548 wrote to memory of 2692 548 5btbhh.exe 44 PID 548 wrote to memory of 2692 548 5btbhh.exe 44 PID 548 wrote to memory of 2692 548 5btbhh.exe 44 PID 548 wrote to memory of 2692 548 5btbhh.exe 44 PID 2692 wrote to memory of 1532 2692 5pddj.exe 45 PID 2692 wrote to memory of 1532 2692 5pddj.exe 45 PID 2692 wrote to memory of 1532 2692 5pddj.exe 45 PID 2692 wrote to memory of 1532 2692 5pddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe"C:\Users\Admin\AppData\Local\Temp\bead6586be3766e954768b2351cc9fd72a58b7695ea64028b84ebe4e720d0daf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bnbhnn.exec:\bnbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lllxxrl.exec:\lllxxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jjjpj.exec:\jjjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\pdjdj.exec:\pdjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\bhntbn.exec:\bhntbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3vjdp.exec:\3vjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vpdvd.exec:\vpdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xrffrlr.exec:\xrffrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\dvppp.exec:\dvppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\xfrflff.exec:\xfrflff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\9htbhn.exec:\9htbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\jdjjp.exec:\jdjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\5btbhh.exec:\5btbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\5pddj.exec:\5pddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5xlrfrf.exec:\5xlrfrf.exe17⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1htntt.exec:\1htntt.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7dppv.exec:\7dppv.exe19⤵
- Executes dropped EXE
PID:1884 -
\??\c:\rlrrxrl.exec:\rlrrxrl.exe20⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ppjpj.exec:\ppjpj.exe21⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jvddp.exec:\jvddp.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\flrxfrx.exec:\flrxfrx.exe23⤵
- Executes dropped EXE
PID:1004 -
\??\c:\vpjjj.exec:\vpjjj.exe24⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vpdjp.exec:\vpdjp.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\dvdpv.exec:\dvdpv.exe26⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9rxxxff.exec:\9rxxxff.exe27⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3dppj.exec:\3dppj.exe28⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrfffll.exec:\xrfffll.exe29⤵
- Executes dropped EXE
PID:628 -
\??\c:\bnttbt.exec:\bnttbt.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3jvvj.exec:\3jvvj.exe31⤵
- Executes dropped EXE
PID:284 -
\??\c:\lxflrlr.exec:\lxflrlr.exe32⤵
- Executes dropped EXE
PID:1776 -
\??\c:\5thhnt.exec:\5thhnt.exe33⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvpvd.exec:\jvpvd.exe34⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vdppp.exec:\vdppp.exe35⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xrflfff.exec:\xrflfff.exe36⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bntnbt.exec:\bntnbt.exe37⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jdddp.exec:\jdddp.exe38⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jvppd.exec:\jvppd.exe39⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rrxfllr.exec:\rrxfllr.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bnbnbt.exec:\bnbnbt.exe41⤵
- Executes dropped EXE
PID:2272 -
\??\c:\htttnh.exec:\htttnh.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\vjvjv.exec:\vjvjv.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\1frrfxl.exec:\1frrfxl.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tthnhh.exec:\tthnhh.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jjvpd.exec:\jjvpd.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\dpdvj.exec:\dpdvj.exe47⤵
- Executes dropped EXE
PID:2292 -
\??\c:\llrffxx.exec:\llrffxx.exe48⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tntthh.exec:\tntthh.exe49⤵
- Executes dropped EXE
PID:960 -
\??\c:\ttnntt.exec:\ttnntt.exe50⤵
- Executes dropped EXE
PID:600 -
\??\c:\ppdpp.exec:\ppdpp.exe51⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xlllxrl.exec:\xlllxrl.exe52⤵
- Executes dropped EXE
PID:400 -
\??\c:\bbnntt.exec:\bbnntt.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnhbnt.exec:\nnhbnt.exe54⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jjpjv.exec:\jjpjv.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rxllrlr.exec:\rxllrlr.exe56⤵
- Executes dropped EXE
PID:2860 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe57⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bnthtb.exec:\bnthtb.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vjjdd.exec:\vjjdd.exe59⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vjdpv.exec:\vjdpv.exe60⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5rrllll.exec:\5rrllll.exe61⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nnhnbb.exec:\nnhnbb.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\9vvpp.exec:\9vvpp.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\9pddp.exec:\9pddp.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xfrrxlr.exec:\xfrrxlr.exe65⤵
- Executes dropped EXE
PID:1772 -
\??\c:\xrfffll.exec:\xrfffll.exe66⤵PID:3052
-
\??\c:\hhhnnt.exec:\hhhnnt.exe67⤵PID:2228
-
\??\c:\jdvpv.exec:\jdvpv.exe68⤵PID:2388
-
\??\c:\dvdvd.exec:\dvdvd.exe69⤵PID:2328
-
\??\c:\rrlrffx.exec:\rrlrffx.exe70⤵PID:2332
-
\??\c:\nbbbnn.exec:\nbbbnn.exe71⤵PID:900
-
\??\c:\hbhnhh.exec:\hbhnhh.exe72⤵PID:2224
-
\??\c:\3pddd.exec:\3pddd.exe73⤵PID:2112
-
\??\c:\lfrrfxx.exec:\lfrrfxx.exe74⤵PID:2108
-
\??\c:\rflflff.exec:\rflflff.exe75⤵PID:1152
-
\??\c:\tnnhtt.exec:\tnnhtt.exe76⤵PID:1604
-
\??\c:\9pdvd.exec:\9pdvd.exe77⤵PID:1684
-
\??\c:\djddv.exec:\djddv.exe78⤵PID:2472
-
\??\c:\xlxrxff.exec:\xlxrxff.exe79⤵PID:2940
-
\??\c:\5thhhh.exec:\5thhhh.exe80⤵PID:2880
-
\??\c:\nhbhnt.exec:\nhbhnt.exe81⤵PID:2840
-
\??\c:\9jvdv.exec:\9jvdv.exe82⤵PID:2372
-
\??\c:\lfrfllf.exec:\lfrfllf.exe83⤵PID:2944
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe84⤵PID:2908
-
\??\c:\9htbhb.exec:\9htbhb.exe85⤵PID:2624
-
\??\c:\1nhntb.exec:\1nhntb.exe86⤵PID:2652
-
\??\c:\3vddd.exec:\3vddd.exe87⤵PID:2356
-
\??\c:\5frllll.exec:\5frllll.exe88⤵PID:1936
-
\??\c:\lfxxflx.exec:\lfxxflx.exe89⤵PID:1336
-
\??\c:\3tbtbh.exec:\3tbtbh.exe90⤵PID:844
-
\??\c:\vjvdj.exec:\vjvdj.exe91⤵PID:1948
-
\??\c:\lfrxffl.exec:\lfrxffl.exe92⤵PID:532
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe93⤵PID:800
-
\??\c:\bnbtbb.exec:\bnbtbb.exe94⤵PID:1180
-
\??\c:\ppjdj.exec:\ppjdj.exe95⤵PID:1932
-
\??\c:\vvjvv.exec:\vvjvv.exe96⤵PID:2036
-
\??\c:\9lllxxf.exec:\9lllxxf.exe97⤵PID:1972
-
\??\c:\fxxflfl.exec:\fxxflfl.exe98⤵PID:1884
-
\??\c:\hbthtt.exec:\hbthtt.exe99⤵PID:2028
-
\??\c:\jdjjv.exec:\jdjjv.exe100⤵PID:2860
-
\??\c:\3vdvv.exec:\3vdvv.exe101⤵PID:2572
-
\??\c:\llxrffl.exec:\llxrffl.exe102⤵PID:2612
-
\??\c:\bbntbb.exec:\bbntbb.exe103⤵PID:1792
-
\??\c:\vpddd.exec:\vpddd.exe104⤵PID:2412
-
\??\c:\3lrxfxf.exec:\3lrxfxf.exe105⤵PID:2812
-
\??\c:\7xlxfxx.exec:\7xlxfxx.exe106⤵PID:1656
-
\??\c:\3bbtbb.exec:\3bbtbb.exe107⤵PID:1348
-
\??\c:\1djjj.exec:\1djjj.exe108⤵PID:1524
-
\??\c:\pjpvd.exec:\pjpvd.exe109⤵PID:1052
-
\??\c:\fffxxrr.exec:\fffxxrr.exe110⤵PID:3052
-
\??\c:\3xrrxrx.exec:\3xrrxrx.exe111⤵PID:3048
-
\??\c:\nbhhtt.exec:\nbhhtt.exe112⤵PID:3008
-
\??\c:\vpppd.exec:\vpppd.exe113⤵PID:2328
-
\??\c:\3pjjj.exec:\3pjjj.exe114⤵PID:2332
-
\??\c:\lxfxfrx.exec:\lxfxfrx.exe115⤵PID:1408
-
\??\c:\7thntt.exec:\7thntt.exe116⤵PID:2224
-
\??\c:\5hnhnn.exec:\5hnhnn.exe117⤵PID:2560
-
\??\c:\jjdjv.exec:\jjdjv.exe118⤵PID:2724
-
\??\c:\rfrxllr.exec:\rfrxllr.exe119⤵PID:2136
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe120⤵PID:2552
-
\??\c:\7bthnn.exec:\7bthnn.exe121⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-