Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe
-
Size
454KB
-
MD5
948f63e472e5ad9dccff0c88ebe700e0
-
SHA1
db1f3a8025c65d4b4d9dc7f30ca09ba575212e8d
-
SHA256
a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93
-
SHA512
621adfbd8410ef98140f79074158af53277a95a3ab3d8f4627e543e536fdd47fcfa34cd43bf538aea2083f9ae6371692aaf0dd3be87fbf389d089b9dacb20f5b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/1996-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-34-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2704-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-96-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-358-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/544-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-464-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1908-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-312-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-615-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2892-616-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-629-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2688-655-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/976-681-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1304-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1304-693-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-708-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2128-716-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-715-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/448-724-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-783-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-935-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1252-948-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2128-984-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-1003-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1156-1056-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1780 nhhtbb.exe 2236 vpddp.exe 2932 xlrlrff.exe 2704 7vjjv.exe 2760 lrflxxf.exe 2764 dvjpv.exe 2620 xrlrxfl.exe 2964 vjdjp.exe 2724 rlxxfxx.exe 2684 bntnhn.exe 2176 3vjjp.exe 1096 hbntbt.exe 1256 5djpj.exe 696 lrlrxfl.exe 2848 hbthht.exe 1124 7pjpd.exe 2936 nhtntt.exe 1984 vppdd.exe 1520 1fxxxfr.exe 3036 ddpvd.exe 628 jdvpv.exe 1856 lxrxxxf.exe 1536 9htbnt.exe 1968 lllrlrf.exe 840 xrflrxl.exe 2804 nhtbtb.exe 2208 1tntbh.exe 1156 ffrfllx.exe 3020 bthhtt.exe 892 vpdjp.exe 2192 rlfflxl.exe 1580 btbbhh.exe 1512 5dpvp.exe 2480 rfrrxxf.exe 2196 lfxlrrx.exe 2692 htnnhb.exe 2816 7djjj.exe 2812 3xrrxfr.exe 2904 bhnhtt.exe 2728 pdvvd.exe 3012 vdpdv.exe 2880 rxfxfrl.exe 2676 7lffxxf.exe 2252 tnbnnn.exe 1804 9jpvp.exe 2028 7pjjp.exe 676 3ddjp.exe 1096 fllrrrf.exe 976 1bnnnt.exe 300 hbthnt.exe 1380 7jjpv.exe 1128 dvpvj.exe 1552 llxfffl.exe 2968 5lflrxr.exe 1908 hbnbbn.exe 2652 3jddj.exe 1608 jjpvj.exe 1344 rfrrxrf.exe 2552 rlxflrr.exe 2416 7btbbb.exe 2080 nnhthn.exe 1332 vvvdj.exe 544 ffxlrrl.exe 2856 lfxfrrf.exe -
resource yara_rule behavioral1/memory/1996-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-616-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-724-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3040-725-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-722-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2524-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-936-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-948-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2040-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-984-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-1056-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/1156-1058-0x00000000003B0000-0x00000000003DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1780 1996 a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe 30 PID 1996 wrote to memory of 1780 1996 a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe 30 PID 1996 wrote to memory of 1780 1996 a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe 30 PID 1996 wrote to memory of 1780 1996 a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe 30 PID 1780 wrote to memory of 2236 1780 nhhtbb.exe 31 PID 1780 wrote to memory of 2236 1780 nhhtbb.exe 31 PID 1780 wrote to memory of 2236 1780 nhhtbb.exe 31 PID 1780 wrote to memory of 2236 1780 nhhtbb.exe 31 PID 2236 wrote to memory of 2932 2236 vpddp.exe 32 PID 2236 wrote to memory of 2932 2236 vpddp.exe 32 PID 2236 wrote to memory of 2932 2236 vpddp.exe 32 PID 2236 wrote to memory of 2932 2236 vpddp.exe 32 PID 2932 wrote to memory of 2704 2932 xlrlrff.exe 33 PID 2932 wrote to memory of 2704 2932 xlrlrff.exe 33 PID 2932 wrote to memory of 2704 2932 xlrlrff.exe 33 PID 2932 wrote to memory of 2704 2932 xlrlrff.exe 33 PID 2704 wrote to memory of 2760 2704 7vjjv.exe 34 PID 2704 wrote to memory of 2760 2704 7vjjv.exe 34 PID 2704 wrote to memory of 2760 2704 7vjjv.exe 34 PID 2704 wrote to memory of 2760 2704 7vjjv.exe 34 PID 2760 wrote to memory of 2764 2760 lrflxxf.exe 35 PID 2760 wrote to memory of 2764 2760 lrflxxf.exe 35 PID 2760 wrote to memory of 2764 2760 lrflxxf.exe 35 PID 2760 wrote to memory of 2764 2760 lrflxxf.exe 35 PID 2764 wrote to memory of 2620 2764 dvjpv.exe 36 PID 2764 wrote to memory of 2620 2764 dvjpv.exe 36 PID 2764 wrote to memory of 2620 2764 dvjpv.exe 36 PID 2764 wrote to memory of 2620 2764 dvjpv.exe 36 PID 2620 wrote to memory of 2964 2620 xrlrxfl.exe 37 PID 2620 wrote to memory of 2964 2620 xrlrxfl.exe 37 PID 2620 wrote to memory of 2964 2620 xrlrxfl.exe 37 PID 2620 wrote to memory of 2964 2620 xrlrxfl.exe 37 PID 2964 wrote to memory of 2724 2964 vjdjp.exe 38 PID 2964 wrote to memory of 2724 2964 vjdjp.exe 38 PID 2964 wrote to memory of 2724 2964 vjdjp.exe 38 PID 2964 wrote to memory of 2724 2964 vjdjp.exe 38 PID 2724 wrote to memory of 2684 2724 rlxxfxx.exe 39 PID 2724 wrote to memory of 2684 2724 rlxxfxx.exe 39 PID 2724 wrote to memory of 2684 2724 rlxxfxx.exe 39 PID 2724 wrote to memory of 2684 2724 rlxxfxx.exe 39 PID 2684 wrote to memory of 2176 2684 bntnhn.exe 40 PID 2684 wrote to memory of 2176 2684 bntnhn.exe 40 PID 2684 wrote to memory of 2176 2684 bntnhn.exe 40 PID 2684 wrote to memory of 2176 2684 bntnhn.exe 40 PID 2176 wrote to memory of 1096 2176 3vjjp.exe 77 PID 2176 wrote to memory of 1096 2176 3vjjp.exe 77 PID 2176 wrote to memory of 1096 2176 3vjjp.exe 77 PID 2176 wrote to memory of 1096 2176 3vjjp.exe 77 PID 1096 wrote to memory of 1256 1096 hbntbt.exe 42 PID 1096 wrote to memory of 1256 1096 hbntbt.exe 42 PID 1096 wrote to memory of 1256 1096 hbntbt.exe 42 PID 1096 wrote to memory of 1256 1096 hbntbt.exe 42 PID 1256 wrote to memory of 696 1256 5djpj.exe 43 PID 1256 wrote to memory of 696 1256 5djpj.exe 43 PID 1256 wrote to memory of 696 1256 5djpj.exe 43 PID 1256 wrote to memory of 696 1256 5djpj.exe 43 PID 696 wrote to memory of 2848 696 lrlrxfl.exe 44 PID 696 wrote to memory of 2848 696 lrlrxfl.exe 44 PID 696 wrote to memory of 2848 696 lrlrxfl.exe 44 PID 696 wrote to memory of 2848 696 lrlrxfl.exe 44 PID 2848 wrote to memory of 1124 2848 hbthht.exe 45 PID 2848 wrote to memory of 1124 2848 hbthht.exe 45 PID 2848 wrote to memory of 1124 2848 hbthht.exe 45 PID 2848 wrote to memory of 1124 2848 hbthht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe"C:\Users\Admin\AppData\Local\Temp\a1a467a8abb4308dcade1caac2489d15f62526efc6ec724b3761fe9f2f8b4d93N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\nhhtbb.exec:\nhhtbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\vpddp.exec:\vpddp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\xlrlrff.exec:\xlrlrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7vjjv.exec:\7vjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\lrflxxf.exec:\lrflxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dvjpv.exec:\dvjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\vjdjp.exec:\vjdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rlxxfxx.exec:\rlxxfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bntnhn.exec:\bntnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3vjjp.exec:\3vjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hbntbt.exec:\hbntbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\5djpj.exec:\5djpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\lrlrxfl.exec:\lrlrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\hbthht.exec:\hbthht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\7pjpd.exec:\7pjpd.exe17⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nhtntt.exec:\nhtntt.exe18⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vppdd.exec:\vppdd.exe19⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1fxxxfr.exec:\1fxxxfr.exe20⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ddpvd.exec:\ddpvd.exe21⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdvpv.exec:\jdvpv.exe22⤵
- Executes dropped EXE
PID:628 -
\??\c:\lxrxxxf.exec:\lxrxxxf.exe23⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9htbnt.exec:\9htbnt.exe24⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lllrlrf.exec:\lllrlrf.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xrflrxl.exec:\xrflrxl.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:840 -
\??\c:\nhtbtb.exec:\nhtbtb.exe27⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1tntbh.exec:\1tntbh.exe28⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ffrfllx.exec:\ffrfllx.exe29⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bthhtt.exec:\bthhtt.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3020 -
\??\c:\vpdjp.exec:\vpdjp.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\rlfflxl.exec:\rlfflxl.exe32⤵
- Executes dropped EXE
PID:2192 -
\??\c:\btbbhh.exec:\btbbhh.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\5dpvp.exec:\5dpvp.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe35⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lfxlrrx.exec:\lfxlrrx.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\htnnhb.exec:\htnnhb.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7djjj.exec:\7djjj.exe38⤵
- Executes dropped EXE
PID:2816 -
\??\c:\3xrrxfr.exec:\3xrrxfr.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bhnhtt.exec:\bhnhtt.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pdvvd.exec:\pdvvd.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vdpdv.exec:\vdpdv.exe42⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rxfxfrl.exec:\rxfxfrl.exe43⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7lffxxf.exec:\7lffxxf.exe44⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tnbnnn.exec:\tnbnnn.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9jpvp.exec:\9jpvp.exe46⤵
- Executes dropped EXE
PID:1804 -
\??\c:\7pjjp.exec:\7pjjp.exe47⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3ddjp.exec:\3ddjp.exe48⤵
- Executes dropped EXE
PID:676 -
\??\c:\fllrrrf.exec:\fllrrrf.exe49⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1bnnnt.exec:\1bnnnt.exe50⤵
- Executes dropped EXE
PID:976 -
\??\c:\hbthnt.exec:\hbthnt.exe51⤵
- Executes dropped EXE
PID:300 -
\??\c:\7jjpv.exec:\7jjpv.exe52⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dvpvj.exec:\dvpvj.exe53⤵
- Executes dropped EXE
PID:1128 -
\??\c:\llxfffl.exec:\llxfffl.exe54⤵
- Executes dropped EXE
PID:1552 -
\??\c:\5lflrxr.exec:\5lflrxr.exe55⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbnbbn.exec:\hbnbbn.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\3jddj.exec:\3jddj.exe57⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjpvj.exec:\jjpvj.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\rfrrxrf.exec:\rfrrxrf.exe59⤵
- Executes dropped EXE
PID:1344 -
\??\c:\rlxflrr.exec:\rlxflrr.exe60⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7btbbb.exec:\7btbbb.exe61⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nnhthn.exec:\nnhthn.exe62⤵
- Executes dropped EXE
PID:2080 -
\??\c:\vvvdj.exec:\vvvdj.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ffxlrrl.exec:\ffxlrrl.exe64⤵
- Executes dropped EXE
PID:544 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe65⤵
- Executes dropped EXE
PID:2856 -
\??\c:\htbhtb.exec:\htbhtb.exe66⤵PID:2804
-
\??\c:\5jjpd.exec:\5jjpd.exe67⤵PID:792
-
\??\c:\vvdpv.exec:\vvdpv.exe68⤵PID:2796
-
\??\c:\xllllrf.exec:\xllllrf.exe69⤵PID:1028
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe70⤵PID:3020
-
\??\c:\tnhbnt.exec:\tnhbnt.exe71⤵PID:884
-
\??\c:\pdvpp.exec:\pdvpp.exe72⤵PID:764
-
\??\c:\dpdvv.exec:\dpdvv.exe73⤵PID:3060
-
\??\c:\lxxfrxf.exec:\lxxfrxf.exe74⤵PID:1324
-
\??\c:\nhbnnn.exec:\nhbnnn.exe75⤵PID:2428
-
\??\c:\bntttt.exec:\bntttt.exe76⤵PID:2312
-
\??\c:\dvjjv.exec:\dvjjv.exe77⤵PID:2824
-
\??\c:\rfffflr.exec:\rfffflr.exe78⤵PID:2072
-
\??\c:\xfrlxxf.exec:\xfrlxxf.exe79⤵PID:2828
-
\??\c:\bthhtt.exec:\bthhtt.exe80⤵PID:1588
-
\??\c:\7btnnn.exec:\7btnnn.exe81⤵PID:2772
-
\??\c:\ppdpp.exec:\ppdpp.exe82⤵PID:2892
-
\??\c:\frfflrf.exec:\frfflrf.exe83⤵PID:2620
-
\??\c:\1hhtbn.exec:\1hhtbn.exe84⤵PID:2964
-
\??\c:\dvppv.exec:\dvppv.exe85⤵PID:2836
-
\??\c:\5djjj.exec:\5djjj.exe86⤵PID:2244
-
\??\c:\tnnnnt.exec:\tnnnnt.exe87⤵PID:1280
-
\??\c:\jvjpj.exec:\jvjpj.exe88⤵PID:2688
-
\??\c:\rxlfllr.exec:\rxlfllr.exe89⤵PID:2752
-
\??\c:\hthhnh.exec:\hthhnh.exe90⤵PID:2940
-
\??\c:\1pdjp.exec:\1pdjp.exe91⤵PID:1096
-
\??\c:\vjddd.exec:\vjddd.exe92⤵PID:976
-
\??\c:\tnbbnt.exec:\tnbbnt.exe93⤵PID:2956
-
\??\c:\httttt.exec:\httttt.exe94⤵PID:1304
-
\??\c:\dvjvv.exec:\dvjvv.exe95⤵PID:1684
-
\??\c:\9frxllr.exec:\9frxllr.exe96⤵PID:2936
-
\??\c:\nhhtbh.exec:\nhhtbh.exe97⤵PID:2128
-
\??\c:\jppjd.exec:\jppjd.exe98⤵PID:448
-
\??\c:\9thhbh.exec:\9thhbh.exe99⤵PID:3040
-
\??\c:\tttnhb.exec:\tttnhb.exe100⤵PID:628
-
\??\c:\1flxrrr.exec:\1flxrrr.exe101⤵PID:1592
-
\??\c:\hbntbt.exec:\hbntbt.exe102⤵PID:800
-
\??\c:\nnnbtt.exec:\nnnbtt.exe103⤵PID:1680
-
\??\c:\7nnhnt.exec:\7nnhnt.exe104⤵PID:780
-
\??\c:\lfrxlfr.exec:\lfrxlfr.exe105⤵PID:1036
-
\??\c:\thntbh.exec:\thntbh.exe106⤵PID:2448
-
\??\c:\ddppv.exec:\ddppv.exe107⤵PID:2524
-
\??\c:\3lfxxfl.exec:\3lfxxfl.exe108⤵PID:1620
-
\??\c:\tnntbt.exec:\tnntbt.exe109⤵PID:1052
-
\??\c:\5ntbtt.exec:\5ntbtt.exe110⤵PID:2568
-
\??\c:\vjppv.exec:\vjppv.exe111⤵PID:2548
-
\??\c:\fxrfllx.exec:\fxrfllx.exe112⤵PID:1056
-
\??\c:\xrllflf.exec:\xrllflf.exe113⤵PID:2308
-
\??\c:\bthnbb.exec:\bthnbb.exe114⤵PID:1516
-
\??\c:\3vpjj.exec:\3vpjj.exe115⤵PID:2280
-
\??\c:\9ddpp.exec:\9ddpp.exe116⤵PID:2088
-
\??\c:\rrfflrx.exec:\rrfflrx.exe117⤵PID:2428
-
\??\c:\bnhnnh.exec:\bnhnnh.exe118⤵PID:2312
-
\??\c:\bbthtb.exec:\bbthtb.exe119⤵PID:2824
-
\??\c:\9pjpv.exec:\9pjpv.exe120⤵PID:2072
-
\??\c:\7rrrlxl.exec:\7rrrlxl.exe121⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-