Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:37
Behavioral task
behavioral1
Sample
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe
-
Size
344KB
-
MD5
620c97e244bcfb3d324dfa549280b4c8
-
SHA1
5ce5411c88c5099db7985828a284038d3f76528b
-
SHA256
982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc
-
SHA512
2fa57f9f95e77bfc1658d7ac946cc7389c1eb8729e1ece6b22d64e90b7cc4c6e09bf000f719ac743e95ae193692db918ef331d8b64fdd975c8c6bdcd168aa889
-
SSDEEP
6144:Lcm4FmowdHoSEYW5fNZWB5hFfci3Add4kGYA2:R4wFHoS3WXZshJX2VGd2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2544-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1852-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1324-34-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1324-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2212-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-102-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2656-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2520-151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2520-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1644-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1344-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1536-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2256-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2900-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2180-512-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1780-555-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-561-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1588-562-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-599-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-618-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1792-622-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/532-690-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1036-754-0x0000000001B70000-0x0000000001B97000-memory.dmp family_blackmoon behavioral1/memory/2448-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2236-834-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2980-886-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1784-1011-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-10352-0x00000000771F0000-0x000000007730F000-memory.dmp family_blackmoon behavioral1/memory/2300-20230-0x00000000770F0000-0x00000000771EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1852 3djdj.exe 3060 1rllxfr.exe 1324 bbtnhh.exe 2800 frlxrfl.exe 2720 lrfrxrx.exe 2872 nhthnh.exe 2904 1jppv.exe 2648 htnttt.exe 2212 pvdvp.exe 2724 fxllllr.exe 2676 xrffrrx.exe 2656 rflrrrr.exe 580 7nhbnn.exe 352 5tnhtn.exe 2792 3rfrffl.exe 1460 rlrxfll.exe 2520 nbnthh.exe 2368 xlrrrlf.exe 1644 9btntn.exe 1192 bnbbbb.exe 2112 vdppp.exe 2968 xlxlxfl.exe 1820 bnbbbb.exe 3032 ppvpv.exe 1344 5rxrrrx.exe 988 pvdpp.exe 1536 9vddd.exe 764 btnhnt.exe 1808 btnnnn.exe 2476 dpdjp.exe 2108 rfrlxxx.exe 1752 thhttb.exe 1156 bntnnn.exe 2292 vjppd.exe 912 9frxflr.exe 2264 thnbtn.exe 2300 bbhhnh.exe 1708 pdpjp.exe 2236 thhhbn.exe 3064 pdpjd.exe 2256 pjpvd.exe 2196 xxfllxl.exe 2696 tbtbht.exe 2828 thbtbb.exe 2484 vdjdd.exe 2744 ppjdj.exe 2756 lfffffr.exe 2640 1tbbbb.exe 2900 hhttbt.exe 2880 dpdvd.exe 2212 xxxfrrx.exe 2664 3rllrlr.exe 2644 1thbbt.exe 2492 hbnnhb.exe 1424 jvdjj.exe 2948 3rffrrx.exe 1280 rflflfl.exe 1416 btbhnn.exe 776 vvppp.exe 1460 djppj.exe 2920 7fxlrxf.exe 1528 3bnntt.exe 1900 nhbbtn.exe 1644 jjvdj.exe -
resource yara_rule behavioral1/memory/2544-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120ff-8.dat upx behavioral1/memory/2544-7-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2544-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1852-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019273-18.dat upx behavioral1/memory/1852-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000192f0-27.dat upx behavioral1/memory/3060-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001933e-45.dat upx behavioral1/files/0x000600000001932a-36.dat upx behavioral1/memory/1324-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019346-54.dat upx behavioral1/memory/2720-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019384-65.dat upx behavioral1/memory/2904-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2872-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2904-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000194f6-71.dat upx behavioral1/memory/2648-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41a-79.dat upx behavioral1/files/0x000500000001a41b-89.dat upx behavioral1/memory/2212-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41c-95.dat upx behavioral1/files/0x000500000001a41d-104.dat upx behavioral1/files/0x000500000001a41e-112.dat upx behavioral1/memory/2656-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a455-120.dat upx behavioral1/files/0x000500000001a477-128.dat upx behavioral1/memory/352-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a478-137.dat upx behavioral1/memory/2792-136-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x000500000001a486-144.dat upx behavioral1/files/0x000500000001a48a-152.dat upx behavioral1/memory/2520-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1644-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a497-162.dat upx behavioral1/memory/2368-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a0-169.dat upx behavioral1/files/0x000500000001a4a2-176.dat upx behavioral1/files/0x000500000001a4a8-185.dat upx behavioral1/memory/2112-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019234-194.dat upx behavioral1/files/0x000500000001a4aa-200.dat upx behavioral1/memory/1820-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1344-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ac-208.dat upx behavioral1/files/0x000500000001a4af-215.dat upx behavioral1/memory/1536-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b1-223.dat upx behavioral1/files/0x000500000001a4b3-230.dat upx behavioral1/memory/1808-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b5-238.dat upx behavioral1/files/0x000500000001a4b7-245.dat upx behavioral1/files/0x000500000001a4b9-252.dat upx behavioral1/files/0x000500000001a4bb-259.dat upx behavioral1/memory/1780-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2300-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2256-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2484-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2900-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-359-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1852 2544 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 30 PID 2544 wrote to memory of 1852 2544 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 30 PID 2544 wrote to memory of 1852 2544 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 30 PID 2544 wrote to memory of 1852 2544 982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe 30 PID 1852 wrote to memory of 3060 1852 3djdj.exe 31 PID 1852 wrote to memory of 3060 1852 3djdj.exe 31 PID 1852 wrote to memory of 3060 1852 3djdj.exe 31 PID 1852 wrote to memory of 3060 1852 3djdj.exe 31 PID 3060 wrote to memory of 1324 3060 1rllxfr.exe 32 PID 3060 wrote to memory of 1324 3060 1rllxfr.exe 32 PID 3060 wrote to memory of 1324 3060 1rllxfr.exe 32 PID 3060 wrote to memory of 1324 3060 1rllxfr.exe 32 PID 1324 wrote to memory of 2800 1324 bbtnhh.exe 33 PID 1324 wrote to memory of 2800 1324 bbtnhh.exe 33 PID 1324 wrote to memory of 2800 1324 bbtnhh.exe 33 PID 1324 wrote to memory of 2800 1324 bbtnhh.exe 33 PID 2800 wrote to memory of 2720 2800 frlxrfl.exe 34 PID 2800 wrote to memory of 2720 2800 frlxrfl.exe 34 PID 2800 wrote to memory of 2720 2800 frlxrfl.exe 34 PID 2800 wrote to memory of 2720 2800 frlxrfl.exe 34 PID 2720 wrote to memory of 2872 2720 lrfrxrx.exe 35 PID 2720 wrote to memory of 2872 2720 lrfrxrx.exe 35 PID 2720 wrote to memory of 2872 2720 lrfrxrx.exe 35 PID 2720 wrote to memory of 2872 2720 lrfrxrx.exe 35 PID 2872 wrote to memory of 2904 2872 nhthnh.exe 36 PID 2872 wrote to memory of 2904 2872 nhthnh.exe 36 PID 2872 wrote to memory of 2904 2872 nhthnh.exe 36 PID 2872 wrote to memory of 2904 2872 nhthnh.exe 36 PID 2904 wrote to memory of 2648 2904 1jppv.exe 37 PID 2904 wrote to memory of 2648 2904 1jppv.exe 37 PID 2904 wrote to memory of 2648 2904 1jppv.exe 37 PID 2904 wrote to memory of 2648 2904 1jppv.exe 37 PID 2648 wrote to memory of 2212 2648 htnttt.exe 38 PID 2648 wrote to memory of 2212 2648 htnttt.exe 38 PID 2648 wrote to memory of 2212 2648 htnttt.exe 38 PID 2648 wrote to memory of 2212 2648 htnttt.exe 38 PID 2212 wrote to memory of 2724 2212 pvdvp.exe 39 PID 2212 wrote to memory of 2724 2212 pvdvp.exe 39 PID 2212 wrote to memory of 2724 2212 pvdvp.exe 39 PID 2212 wrote to memory of 2724 2212 pvdvp.exe 39 PID 2724 wrote to memory of 2676 2724 fxllllr.exe 40 PID 2724 wrote to memory of 2676 2724 fxllllr.exe 40 PID 2724 wrote to memory of 2676 2724 fxllllr.exe 40 PID 2724 wrote to memory of 2676 2724 fxllllr.exe 40 PID 2676 wrote to memory of 2656 2676 xrffrrx.exe 41 PID 2676 wrote to memory of 2656 2676 xrffrrx.exe 41 PID 2676 wrote to memory of 2656 2676 xrffrrx.exe 41 PID 2676 wrote to memory of 2656 2676 xrffrrx.exe 41 PID 2656 wrote to memory of 580 2656 rflrrrr.exe 42 PID 2656 wrote to memory of 580 2656 rflrrrr.exe 42 PID 2656 wrote to memory of 580 2656 rflrrrr.exe 42 PID 2656 wrote to memory of 580 2656 rflrrrr.exe 42 PID 580 wrote to memory of 352 580 7nhbnn.exe 43 PID 580 wrote to memory of 352 580 7nhbnn.exe 43 PID 580 wrote to memory of 352 580 7nhbnn.exe 43 PID 580 wrote to memory of 352 580 7nhbnn.exe 43 PID 352 wrote to memory of 2792 352 5tnhtn.exe 44 PID 352 wrote to memory of 2792 352 5tnhtn.exe 44 PID 352 wrote to memory of 2792 352 5tnhtn.exe 44 PID 352 wrote to memory of 2792 352 5tnhtn.exe 44 PID 2792 wrote to memory of 1460 2792 3rfrffl.exe 45 PID 2792 wrote to memory of 1460 2792 3rfrffl.exe 45 PID 2792 wrote to memory of 1460 2792 3rfrffl.exe 45 PID 2792 wrote to memory of 1460 2792 3rfrffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe"C:\Users\Admin\AppData\Local\Temp\982f59d2ec8e12a11c573bb9d5818548dbf22762a78e400238943bd30489a9bc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\3djdj.exec:\3djdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\1rllxfr.exec:\1rllxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\bbtnhh.exec:\bbtnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\frlxrfl.exec:\frlxrfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lrfrxrx.exec:\lrfrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhthnh.exec:\nhthnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\1jppv.exec:\1jppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\htnttt.exec:\htnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pvdvp.exec:\pvdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\fxllllr.exec:\fxllllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\xrffrrx.exec:\xrffrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rflrrrr.exec:\rflrrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7nhbnn.exec:\7nhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\5tnhtn.exec:\5tnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\3rfrffl.exec:\3rfrffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rlrxfll.exec:\rlrxfll.exe17⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nbnthh.exec:\nbnthh.exe18⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xlrrrlf.exec:\xlrrrlf.exe19⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9btntn.exec:\9btntn.exe20⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bnbbbb.exec:\bnbbbb.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1192 -
\??\c:\vdppp.exec:\vdppp.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlxlxfl.exec:\xlxlxfl.exe23⤵
- Executes dropped EXE
PID:2968 -
\??\c:\bnbbbb.exec:\bnbbbb.exe24⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ppvpv.exec:\ppvpv.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5rxrrrx.exec:\5rxrrrx.exe26⤵
- Executes dropped EXE
PID:1344 -
\??\c:\pvdpp.exec:\pvdpp.exe27⤵
- Executes dropped EXE
PID:988 -
\??\c:\9vddd.exec:\9vddd.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\btnhnt.exec:\btnhnt.exe29⤵
- Executes dropped EXE
PID:764 -
\??\c:\btnnnn.exec:\btnnnn.exe30⤵
- Executes dropped EXE
PID:1808 -
\??\c:\dpdjp.exec:\dpdjp.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe32⤵
- Executes dropped EXE
PID:2108 -
\??\c:\thhttb.exec:\thhttb.exe33⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bntnnn.exec:\bntnnn.exe34⤵
- Executes dropped EXE
PID:1156 -
\??\c:\vjppd.exec:\vjppd.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\9frxflr.exec:\9frxflr.exe36⤵
- Executes dropped EXE
PID:912 -
\??\c:\thnbtn.exec:\thnbtn.exe37⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bbhhnh.exec:\bbhhnh.exe38⤵
- Executes dropped EXE
PID:2300 -
\??\c:\jpvvd.exec:\jpvvd.exe39⤵PID:1780
-
\??\c:\pdpjp.exec:\pdpjp.exe40⤵
- Executes dropped EXE
PID:1708 -
\??\c:\thhhbn.exec:\thhhbn.exe41⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pdpjd.exec:\pdpjd.exe42⤵
- Executes dropped EXE
PID:3064 -
\??\c:\pjpvd.exec:\pjpvd.exe43⤵
- Executes dropped EXE
PID:2256 -
\??\c:\xxfllxl.exec:\xxfllxl.exe44⤵
- Executes dropped EXE
PID:2196 -
\??\c:\tbtbht.exec:\tbtbht.exe45⤵
- Executes dropped EXE
PID:2696 -
\??\c:\thbtbb.exec:\thbtbb.exe46⤵
- Executes dropped EXE
PID:2828 -
\??\c:\vdjdd.exec:\vdjdd.exe47⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ppjdj.exec:\ppjdj.exe48⤵
- Executes dropped EXE
PID:2744 -
\??\c:\lfffffr.exec:\lfffffr.exe49⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1tbbbb.exec:\1tbbbb.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhttbt.exec:\hhttbt.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dpdvd.exec:\dpdvd.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxxfrrx.exec:\xxxfrrx.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3rllrlr.exec:\3rllrlr.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1thbbt.exec:\1thbbt.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hbnnhb.exec:\hbnnhb.exe56⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jvdjj.exec:\jvdjj.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3rffrrx.exec:\3rffrrx.exe58⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rflflfl.exec:\rflflfl.exe59⤵
- Executes dropped EXE
PID:1280 -
\??\c:\btbhnn.exec:\btbhnn.exe60⤵
- Executes dropped EXE
PID:1416 -
\??\c:\vvppp.exec:\vvppp.exe61⤵
- Executes dropped EXE
PID:776 -
\??\c:\djppj.exec:\djppj.exe62⤵
- Executes dropped EXE
PID:1460 -
\??\c:\7fxlrxf.exec:\7fxlrxf.exe63⤵
- Executes dropped EXE
PID:2920 -
\??\c:\3bnntt.exec:\3bnntt.exe64⤵
- Executes dropped EXE
PID:1528 -
\??\c:\nhbbtn.exec:\nhbbtn.exe65⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jjvdj.exec:\jjvdj.exe66⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lxxrrlr.exec:\lxxrrlr.exe67⤵PID:2996
-
\??\c:\xxrflrl.exec:\xxrflrl.exe68⤵PID:2860
-
\??\c:\nbbbbt.exec:\nbbbbt.exe69⤵PID:2112
-
\??\c:\7thntt.exec:\7thntt.exe70⤵PID:2332
-
\??\c:\9vpjj.exec:\9vpjj.exe71⤵PID:2592
-
\??\c:\9llllrr.exec:\9llllrr.exe72⤵PID:1612
-
\??\c:\btbhnb.exec:\btbhnb.exe73⤵PID:1920
-
\??\c:\btntnt.exec:\btntnt.exe74⤵PID:652
-
\??\c:\7pddd.exec:\7pddd.exe75⤵PID:316
-
\??\c:\vjvdv.exec:\vjvdv.exe76⤵PID:1536
-
\??\c:\5frrrlr.exec:\5frrrlr.exe77⤵PID:1328
-
\??\c:\7lxfllr.exec:\7lxfllr.exe78⤵PID:1788
-
\??\c:\7btbbt.exec:\7btbbt.exe79⤵PID:2804
-
\??\c:\5vpjj.exec:\5vpjj.exe80⤵PID:2180
-
\??\c:\vjpjd.exec:\vjpjd.exe81⤵PID:2164
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe82⤵PID:2600
-
\??\c:\nhtbbb.exec:\nhtbbb.exe83⤵PID:2280
-
\??\c:\bnnhhh.exec:\bnnhhh.exe84⤵PID:356
-
\??\c:\dvdvd.exec:\dvdvd.exe85⤵PID:892
-
\??\c:\1pjvp.exec:\1pjvp.exe86⤵PID:912
-
\??\c:\lxfrrlr.exec:\lxfrrlr.exe87⤵PID:2544
-
\??\c:\5nhhhh.exec:\5nhhhh.exe88⤵PID:1780
-
\??\c:\vdjdv.exec:\vdjdv.exe89⤵PID:1588
-
\??\c:\dvpvv.exec:\dvpvv.exe90⤵PID:2344
-
\??\c:\frlxxxx.exec:\frlxxxx.exe91⤵PID:1560
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe92⤵PID:1736
-
\??\c:\1ntnnn.exec:\1ntnnn.exe93⤵PID:2428
-
\??\c:\9vdvv.exec:\9vdvv.exe94⤵PID:2912
-
\??\c:\lrfrlxl.exec:\lrfrlxl.exe95⤵PID:2312
-
\??\c:\1rxrxrx.exec:\1rxrxrx.exe96⤵PID:2928
-
\??\c:\5nthhb.exec:\5nthhb.exe97⤵PID:2824
-
\??\c:\7thhnh.exec:\7thhnh.exe98⤵PID:2892
-
\??\c:\vpjjp.exec:\vpjjp.exe99⤵PID:2728
-
\??\c:\dvjdj.exec:\dvjdj.exe100⤵PID:2776
-
\??\c:\lxlrllr.exec:\lxlrllr.exe101⤵PID:1792
-
\??\c:\nbhntn.exec:\nbhntn.exe102⤵PID:1264
-
\??\c:\3tnnhn.exec:\3tnnhn.exe103⤵PID:2136
-
\??\c:\1vddj.exec:\1vddj.exe104⤵
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\vjdjd.exec:\vjdjd.exe105⤵PID:676
-
\??\c:\rflllrr.exec:\rflllrr.exe106⤵PID:800
-
\??\c:\3nbttt.exec:\3nbttt.exe107⤵PID:1804
-
\??\c:\7bhhhh.exec:\7bhhhh.exe108⤵PID:352
-
\??\c:\7pdjj.exec:\7pdjj.exe109⤵PID:320
-
\??\c:\lfxlllx.exec:\lfxlllx.exe110⤵PID:300
-
\??\c:\xlxxffl.exec:\xlxxffl.exe111⤵PID:1564
-
\??\c:\bbtbhh.exec:\bbtbhh.exe112⤵PID:1124
-
\??\c:\nhnbhb.exec:\nhnbhb.exe113⤵PID:532
-
\??\c:\vjppp.exec:\vjppp.exe114⤵PID:2864
-
\??\c:\rxfrrrr.exec:\rxfrrrr.exe115⤵PID:2512
-
\??\c:\7nbbhn.exec:\7nbbhn.exe116⤵PID:2976
-
\??\c:\btbbtn.exec:\btbbtn.exe117⤵PID:2992
-
\??\c:\pdvpj.exec:\pdvpj.exe118⤵PID:2040
-
\??\c:\pdpdv.exec:\pdpdv.exe119⤵PID:2988
-
\??\c:\fxxrfrx.exec:\fxxrfrx.exe120⤵PID:1980
-
\??\c:\frxxxrx.exec:\frxxxrx.exe121⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-