Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe
-
Size
456KB
-
MD5
9648ae7111ea1879ef32de44eafd5ca0
-
SHA1
e6251d50ee54b0b86ceb015d6ab3d0b6f13d4e2c
-
SHA256
a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683
-
SHA512
808bccc5fe38d2de0e8166add7fe658d8a8c16ff379acbda031b3dea2d9ccce788572a02eacbcccdcd19e729df61f8fb6c1d93538c86c58ad089091a254c8b45
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRi:q7Tc2NYHUrAwfMp3CDRi
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2212-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-429-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2032-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-754-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-890-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2144 3dddp.exe 2820 pjvvp.exe 2832 lxfxrfx.exe 2584 ffxfrfr.exe 2716 frlrxxl.exe 2564 vvvvj.exe 3000 fxxfxfr.exe 3024 3jdpd.exe 3052 rrlrflr.exe 2088 pvjpv.exe 2876 lrlrflx.exe 2312 7dpdj.exe 2860 xrrflrx.exe 2844 vpjdd.exe 2856 5flxfrf.exe 1820 jdvdj.exe 264 xrllxlf.exe 3064 vjddp.exe 2924 llxfxxl.exe 1264 5dppp.exe 1076 3xllrxf.exe 1044 3bntbh.exe 1672 dddpv.exe 1864 3tbnht.exe 2040 7vjpj.exe 2264 rxfxfff.exe 2368 9vpvj.exe 2452 tttbhn.exe 1948 jpjjj.exe 1752 tbntbn.exe 1848 5nhthn.exe 1692 lrxrrll.exe 2144 hbthth.exe 2680 5pddd.exe 2656 lfflxfx.exe 2832 bbnntt.exe 2664 ddvjp.exe 2552 3lrxlrl.exe 2592 3xllxfr.exe 2020 hbntbh.exe 576 pppdj.exe 2976 fxrxffl.exe 2216 hhbhnb.exe 2104 nhhhnt.exe 1664 djjdp.exe 828 xxrxlrf.exe 340 9tntbh.exe 2764 tnbhtt.exe 1240 jjvdp.exe 1484 9xfllrf.exe 2896 btnhnt.exe 1708 djjpj.exe 604 7jvvj.exe 1768 rrffllx.exe 2032 5bnbbn.exe 2084 djvdp.exe 1156 3xfxlxl.exe 2924 tbthtb.exe 1132 7nhhtt.exe 2116 jjdpj.exe 2152 lffflrf.exe 952 hbtthn.exe 1604 jvppd.exe 1804 lxxlrfl.exe -
resource yara_rule behavioral1/memory/2212-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-128-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-727-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-890-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1764-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-1106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-1131-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2212 wrote to memory of 2144 2212 a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe 30 PID 2212 wrote to memory of 2144 2212 a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe 30 PID 2212 wrote to memory of 2144 2212 a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe 30 PID 2212 wrote to memory of 2144 2212 a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe 30 PID 2144 wrote to memory of 2820 2144 3dddp.exe 31 PID 2144 wrote to memory of 2820 2144 3dddp.exe 31 PID 2144 wrote to memory of 2820 2144 3dddp.exe 31 PID 2144 wrote to memory of 2820 2144 3dddp.exe 31 PID 2820 wrote to memory of 2832 2820 pjvvp.exe 32 PID 2820 wrote to memory of 2832 2820 pjvvp.exe 32 PID 2820 wrote to memory of 2832 2820 pjvvp.exe 32 PID 2820 wrote to memory of 2832 2820 pjvvp.exe 32 PID 2832 wrote to memory of 2584 2832 lxfxrfx.exe 33 PID 2832 wrote to memory of 2584 2832 lxfxrfx.exe 33 PID 2832 wrote to memory of 2584 2832 lxfxrfx.exe 33 PID 2832 wrote to memory of 2584 2832 lxfxrfx.exe 33 PID 2584 wrote to memory of 2716 2584 ffxfrfr.exe 34 PID 2584 wrote to memory of 2716 2584 ffxfrfr.exe 34 PID 2584 wrote to memory of 2716 2584 ffxfrfr.exe 34 PID 2584 wrote to memory of 2716 2584 ffxfrfr.exe 34 PID 2716 wrote to memory of 2564 2716 frlrxxl.exe 35 PID 2716 wrote to memory of 2564 2716 frlrxxl.exe 35 PID 2716 wrote to memory of 2564 2716 frlrxxl.exe 35 PID 2716 wrote to memory of 2564 2716 frlrxxl.exe 35 PID 2564 wrote to memory of 3000 2564 vvvvj.exe 36 PID 2564 wrote to memory of 3000 2564 vvvvj.exe 36 PID 2564 wrote to memory of 3000 2564 vvvvj.exe 36 PID 2564 wrote to memory of 3000 2564 vvvvj.exe 36 PID 3000 wrote to memory of 3024 3000 fxxfxfr.exe 37 PID 3000 wrote to memory of 3024 3000 fxxfxfr.exe 37 PID 3000 wrote to memory of 3024 3000 fxxfxfr.exe 37 PID 3000 wrote to memory of 3024 3000 fxxfxfr.exe 37 PID 3024 wrote to memory of 3052 3024 3jdpd.exe 38 PID 3024 wrote to memory of 3052 3024 3jdpd.exe 38 PID 3024 wrote to memory of 3052 3024 3jdpd.exe 38 PID 3024 wrote to memory of 3052 3024 3jdpd.exe 38 PID 3052 wrote to memory of 2088 3052 rrlrflr.exe 39 PID 3052 wrote to memory of 2088 3052 rrlrflr.exe 39 PID 3052 wrote to memory of 2088 3052 rrlrflr.exe 39 PID 3052 wrote to memory of 2088 3052 rrlrflr.exe 39 PID 2088 wrote to memory of 2876 2088 pvjpv.exe 40 PID 2088 wrote to memory of 2876 2088 pvjpv.exe 40 PID 2088 wrote to memory of 2876 2088 pvjpv.exe 40 PID 2088 wrote to memory of 2876 2088 pvjpv.exe 40 PID 2876 wrote to memory of 2312 2876 lrlrflx.exe 41 PID 2876 wrote to memory of 2312 2876 lrlrflx.exe 41 PID 2876 wrote to memory of 2312 2876 lrlrflx.exe 41 PID 2876 wrote to memory of 2312 2876 lrlrflx.exe 41 PID 2312 wrote to memory of 2860 2312 7dpdj.exe 42 PID 2312 wrote to memory of 2860 2312 7dpdj.exe 42 PID 2312 wrote to memory of 2860 2312 7dpdj.exe 42 PID 2312 wrote to memory of 2860 2312 7dpdj.exe 42 PID 2860 wrote to memory of 2844 2860 xrrflrx.exe 43 PID 2860 wrote to memory of 2844 2860 xrrflrx.exe 43 PID 2860 wrote to memory of 2844 2860 xrrflrx.exe 43 PID 2860 wrote to memory of 2844 2860 xrrflrx.exe 43 PID 2844 wrote to memory of 2856 2844 vpjdd.exe 44 PID 2844 wrote to memory of 2856 2844 vpjdd.exe 44 PID 2844 wrote to memory of 2856 2844 vpjdd.exe 44 PID 2844 wrote to memory of 2856 2844 vpjdd.exe 44 PID 2856 wrote to memory of 1820 2856 5flxfrf.exe 45 PID 2856 wrote to memory of 1820 2856 5flxfrf.exe 45 PID 2856 wrote to memory of 1820 2856 5flxfrf.exe 45 PID 2856 wrote to memory of 1820 2856 5flxfrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe"C:\Users\Admin\AppData\Local\Temp\a474a395de4e37cf4578809426f6b3129cd3f87b4c51b601c7b02bad05ae5683N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\3dddp.exec:\3dddp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\pjvvp.exec:\pjvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lxfxrfx.exec:\lxfxrfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\frlrxxl.exec:\frlrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vvvvj.exec:\vvvvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxxfxfr.exec:\fxxfxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3jdpd.exec:\3jdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\rrlrflr.exec:\rrlrflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\pvjpv.exec:\pvjpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\lrlrflx.exec:\lrlrflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\7dpdj.exec:\7dpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\xrrflrx.exec:\xrrflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vpjdd.exec:\vpjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5flxfrf.exec:\5flxfrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jdvdj.exec:\jdvdj.exe17⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xrllxlf.exec:\xrllxlf.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\vjddp.exec:\vjddp.exe19⤵
- Executes dropped EXE
PID:3064 -
\??\c:\llxfxxl.exec:\llxfxxl.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5dppp.exec:\5dppp.exe21⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3xllrxf.exec:\3xllrxf.exe22⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3bntbh.exec:\3bntbh.exe23⤵
- Executes dropped EXE
PID:1044 -
\??\c:\dddpv.exec:\dddpv.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\3tbnht.exec:\3tbnht.exe25⤵
- Executes dropped EXE
PID:1864 -
\??\c:\7vjpj.exec:\7vjpj.exe26⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rxfxfff.exec:\rxfxfff.exe27⤵
- Executes dropped EXE
PID:2264 -
\??\c:\9vpvj.exec:\9vpvj.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\tttbhn.exec:\tttbhn.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jpjjj.exec:\jpjjj.exe30⤵
- Executes dropped EXE
PID:1948 -
\??\c:\tbntbn.exec:\tbntbn.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5nhthn.exec:\5nhthn.exe32⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lrxrrll.exec:\lrxrrll.exe33⤵
- Executes dropped EXE
PID:1692 -
\??\c:\hbthth.exec:\hbthth.exe34⤵
- Executes dropped EXE
PID:2144 -
\??\c:\5pddd.exec:\5pddd.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lfflxfx.exec:\lfflxfx.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\bbnntt.exec:\bbnntt.exe37⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ddvjp.exec:\ddvjp.exe38⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3lrxlrl.exec:\3lrxlrl.exe39⤵
- Executes dropped EXE
PID:2552 -
\??\c:\3xllxfr.exec:\3xllxfr.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbntbh.exec:\hbntbh.exe41⤵
- Executes dropped EXE
PID:2020 -
\??\c:\pppdj.exec:\pppdj.exe42⤵
- Executes dropped EXE
PID:576 -
\??\c:\fxrxffl.exec:\fxrxffl.exe43⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hhbhnb.exec:\hhbhnb.exe44⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nhhhnt.exec:\nhhhnt.exe45⤵
- Executes dropped EXE
PID:2104 -
\??\c:\djjdp.exec:\djjdp.exe46⤵
- Executes dropped EXE
PID:1664 -
\??\c:\xxrxlrf.exec:\xxrxlrf.exe47⤵
- Executes dropped EXE
PID:828 -
\??\c:\9tntbh.exec:\9tntbh.exe48⤵
- Executes dropped EXE
PID:340 -
\??\c:\tnbhtt.exec:\tnbhtt.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jjvdp.exec:\jjvdp.exe50⤵
- Executes dropped EXE
PID:1240 -
\??\c:\9xfllrf.exec:\9xfllrf.exe51⤵
- Executes dropped EXE
PID:1484 -
\??\c:\btnhnt.exec:\btnhnt.exe52⤵
- Executes dropped EXE
PID:2896 -
\??\c:\djjpj.exec:\djjpj.exe53⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7jvvj.exec:\7jvvj.exe54⤵
- Executes dropped EXE
PID:604 -
\??\c:\rrffllx.exec:\rrffllx.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\5bnbbn.exec:\5bnbbn.exe56⤵
- Executes dropped EXE
PID:2032 -
\??\c:\djvdp.exec:\djvdp.exe57⤵
- Executes dropped EXE
PID:2084 -
\??\c:\3xfxlxl.exec:\3xfxlxl.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\tbthtb.exec:\tbthtb.exe59⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7nhhtt.exec:\7nhhtt.exe60⤵
- Executes dropped EXE
PID:1132 -
\??\c:\jjdpj.exec:\jjdpj.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lffflrf.exec:\lffflrf.exe62⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hbtthn.exec:\hbtthn.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\jvppd.exec:\jvppd.exe64⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxxlrfl.exec:\lxxlrfl.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9lfrflx.exec:\9lfrflx.exe66⤵PID:2476
-
\??\c:\tbttbh.exec:\tbttbh.exe67⤵PID:3028
-
\??\c:\jjjpv.exec:\jjjpv.exe68⤵PID:2268
-
\??\c:\lllfrxl.exec:\lllfrxl.exe69⤵PID:2972
-
\??\c:\llflxlx.exec:\llflxlx.exe70⤵PID:2944
-
\??\c:\tthnbh.exec:\tthnbh.exe71⤵PID:2480
-
\??\c:\dvpjp.exec:\dvpjp.exe72⤵PID:892
-
\??\c:\dvpdv.exec:\dvpdv.exe73⤵PID:3048
-
\??\c:\xrlrflx.exec:\xrlrflx.exe74⤵PID:2212
-
\??\c:\1ttbbt.exec:\1ttbbt.exe75⤵PID:2696
-
\??\c:\vvpvd.exec:\vvpvd.exe76⤵PID:2928
-
\??\c:\vpvvj.exec:\vpvvj.exe77⤵PID:2820
-
\??\c:\rffllrr.exec:\rffllrr.exe78⤵PID:2136
-
\??\c:\ttthtb.exec:\ttthtb.exe79⤵PID:2668
-
\??\c:\jjdpp.exec:\jjdpp.exe80⤵PID:2572
-
\??\c:\9fxlrxl.exec:\9fxlrxl.exe81⤵PID:2872
-
\??\c:\rllxlxl.exec:\rllxlxl.exe82⤵PID:2716
-
\??\c:\5btbth.exec:\5btbth.exe83⤵PID:2600
-
\??\c:\3ppdd.exec:\3ppdd.exe84⤵PID:1660
-
\??\c:\5rrrllr.exec:\5rrrllr.exe85⤵PID:2276
-
\??\c:\ffffxfx.exec:\ffffxfx.exe86⤵PID:3016
-
\??\c:\hhthbb.exec:\hhthbb.exe87⤵PID:1996
-
\??\c:\jjpjp.exec:\jjpjp.exe88⤵PID:2588
-
\??\c:\1xxflrf.exec:\1xxflrf.exe89⤵PID:2128
-
\??\c:\rrlxlrx.exec:\rrlxlrx.exe90⤵PID:1764
-
\??\c:\tbtbht.exec:\tbtbht.exe91⤵PID:984
-
\??\c:\5vvjp.exec:\5vvjp.exe92⤵PID:2860
-
\??\c:\rrrxffr.exec:\rrrxffr.exe93⤵PID:1240
-
\??\c:\5rlrlxr.exec:\5rlrlxr.exe94⤵PID:2124
-
\??\c:\nhbbbt.exec:\nhbbbt.exe95⤵PID:536
-
\??\c:\ppdpv.exec:\ppdpv.exe96⤵PID:588
-
\??\c:\7xrflrr.exec:\7xrflrr.exe97⤵PID:2352
-
\??\c:\llllxfl.exec:\llllxfl.exe98⤵PID:2172
-
\??\c:\nntbnt.exec:\nntbnt.exe99⤵PID:1788
-
\??\c:\ddpvj.exec:\ddpvj.exe100⤵PID:2320
-
\??\c:\ppjjp.exec:\ppjjp.exe101⤵PID:2456
-
\??\c:\rlflrfr.exec:\rlflrfr.exe102⤵PID:444
-
\??\c:\7bbtbh.exec:\7bbtbh.exe103⤵PID:1960
-
\??\c:\ttthtt.exec:\ttthtt.exe104⤵PID:1372
-
\??\c:\5pdpj.exec:\5pdpj.exe105⤵PID:956
-
\??\c:\fllxlfr.exec:\fllxlfr.exe106⤵PID:760
-
\??\c:\tbbhnt.exec:\tbbhnt.exe107⤵PID:2496
-
\??\c:\7hbtbb.exec:\7hbtbb.exe108⤵PID:640
-
\??\c:\3vjdj.exec:\3vjdj.exe109⤵PID:3028
-
\??\c:\lrlxlxl.exec:\lrlxlxl.exe110⤵PID:2268
-
\??\c:\btnbnt.exec:\btnbnt.exe111⤵PID:1320
-
\??\c:\djpjp.exec:\djpjp.exe112⤵PID:1924
-
\??\c:\vpdvd.exec:\vpdvd.exe113⤵PID:2908
-
\??\c:\9bbnnt.exec:\9bbnnt.exe114⤵PID:2376
-
\??\c:\jjjdp.exec:\jjjdp.exe115⤵PID:3048
-
\??\c:\5xrflrf.exec:\5xrflrf.exe116⤵PID:2804
-
\??\c:\jjpvj.exec:\jjpvj.exe117⤵PID:2700
-
\??\c:\7ddjv.exec:\7ddjv.exe118⤵PID:2660
-
\??\c:\lxxfxxl.exec:\lxxfxxl.exe119⤵PID:2008
-
\??\c:\5bbhnn.exec:\5bbhnn.exe120⤵PID:2744
-
\??\c:\1ppjd.exec:\1ppjd.exe121⤵PID:2884
-
\??\c:\dvdpd.exec:\dvdpd.exe122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-