Analysis
-
max time kernel
107s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe
-
Size
454KB
-
MD5
ae56846ea334b9da4d29e64ee3657f20
-
SHA1
48bfb42c918fdb0c8073474603dd1b0c5c0a4c3d
-
SHA256
22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62e
-
SHA512
ac3113845ceb49d1c8e4ba69362b5ab49590677f0186dd1ac74aa4ab8ee2a753f39c528171b8f41e67112426745d3b1bede6f21f28d218619558a670c2703dc2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1916-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1164-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-92-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2656-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2772-327-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-371-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/492-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-575-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-683-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-690-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-786-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-803-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1576-816-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2684-847-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2732-915-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-948-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-1001-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-1015-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1576-1095-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1764-1104-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3056-1125-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 xrlrffr.exe 2824 9bntnt.exe 3016 ddppv.exe 2772 ppjpd.exe 2668 pvdvd.exe 2764 bbhtnb.exe 2968 bbbhtb.exe 2656 1pvdj.exe 2604 fffrflx.exe 2936 3lrxlxl.exe 1684 7hnhtb.exe 2736 jvpvp.exe 2052 vvddv.exe 1344 rlllxrf.exe 492 bthtbh.exe 1164 7jvdp.exe 532 vpdjv.exe 376 hhtbtt.exe 3064 vpjjj.exe 1308 fxxlxfr.exe 2236 xfflxfr.exe 448 nhbhtb.exe 2980 ppjvd.exe 1036 thtbnt.exe 1740 pjjjp.exe 1756 llxxflr.exe 1908 7bnnbb.exe 2948 jdvdp.exe 2960 9lfrffr.exe 1496 bbtbnt.exe 1976 vpjjv.exe 1940 pjjpd.exe 1596 xxrrlxl.exe 2996 nbthbn.exe 3036 pddpd.exe 1424 vdvvd.exe 2792 frlxllr.exe 2772 hthtnb.exe 2696 jjvvd.exe 2836 ffxxlxf.exe 2316 nhhtnb.exe 2632 rrlxrxf.exe 2620 3nntnh.exe 2608 btnnth.exe 2008 pjvjv.exe 2932 bnhhtb.exe 1556 bnbbnn.exe 2736 xrffxxf.exe 1012 7nntbn.exe 1900 nnhtnb.exe 1204 dvpvj.exe 492 jvppv.exe 2720 fxlrflf.exe 1960 3hntbn.exe 2400 1bttbn.exe 952 jdpjp.exe 2880 rlxflll.exe 1308 nnhnbh.exe 1092 bnbhnn.exe 1692 jjjpd.exe 972 lfrflrx.exe 1288 hbnttt.exe 2244 ttnbhn.exe 1036 pjdpj.exe -
resource yara_rule behavioral1/memory/1916-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/376-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-327-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2696-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/492-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-488-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1512-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-690-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-821-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2732-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-916-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-929-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-1076-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-1142-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1732 1916 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 31 PID 1916 wrote to memory of 1732 1916 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 31 PID 1916 wrote to memory of 1732 1916 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 31 PID 1916 wrote to memory of 1732 1916 22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe 31 PID 1732 wrote to memory of 2824 1732 xrlrffr.exe 32 PID 1732 wrote to memory of 2824 1732 xrlrffr.exe 32 PID 1732 wrote to memory of 2824 1732 xrlrffr.exe 32 PID 1732 wrote to memory of 2824 1732 xrlrffr.exe 32 PID 2824 wrote to memory of 3016 2824 9bntnt.exe 33 PID 2824 wrote to memory of 3016 2824 9bntnt.exe 33 PID 2824 wrote to memory of 3016 2824 9bntnt.exe 33 PID 2824 wrote to memory of 3016 2824 9bntnt.exe 33 PID 3016 wrote to memory of 2772 3016 ddppv.exe 68 PID 3016 wrote to memory of 2772 3016 ddppv.exe 68 PID 3016 wrote to memory of 2772 3016 ddppv.exe 68 PID 3016 wrote to memory of 2772 3016 ddppv.exe 68 PID 2772 wrote to memory of 2668 2772 ppjpd.exe 35 PID 2772 wrote to memory of 2668 2772 ppjpd.exe 35 PID 2772 wrote to memory of 2668 2772 ppjpd.exe 35 PID 2772 wrote to memory of 2668 2772 ppjpd.exe 35 PID 2668 wrote to memory of 2764 2668 pvdvd.exe 36 PID 2668 wrote to memory of 2764 2668 pvdvd.exe 36 PID 2668 wrote to memory of 2764 2668 pvdvd.exe 36 PID 2668 wrote to memory of 2764 2668 pvdvd.exe 36 PID 2764 wrote to memory of 2968 2764 bbhtnb.exe 37 PID 2764 wrote to memory of 2968 2764 bbhtnb.exe 37 PID 2764 wrote to memory of 2968 2764 bbhtnb.exe 37 PID 2764 wrote to memory of 2968 2764 bbhtnb.exe 37 PID 2968 wrote to memory of 2656 2968 bbbhtb.exe 38 PID 2968 wrote to memory of 2656 2968 bbbhtb.exe 38 PID 2968 wrote to memory of 2656 2968 bbbhtb.exe 38 PID 2968 wrote to memory of 2656 2968 bbbhtb.exe 38 PID 2656 wrote to memory of 2604 2656 1pvdj.exe 39 PID 2656 wrote to memory of 2604 2656 1pvdj.exe 39 PID 2656 wrote to memory of 2604 2656 1pvdj.exe 39 PID 2656 wrote to memory of 2604 2656 1pvdj.exe 39 PID 2604 wrote to memory of 2936 2604 fffrflx.exe 40 PID 2604 wrote to memory of 2936 2604 fffrflx.exe 40 PID 2604 wrote to memory of 2936 2604 fffrflx.exe 40 PID 2604 wrote to memory of 2936 2604 fffrflx.exe 40 PID 2936 wrote to memory of 1684 2936 3lrxlxl.exe 41 PID 2936 wrote to memory of 1684 2936 3lrxlxl.exe 41 PID 2936 wrote to memory of 1684 2936 3lrxlxl.exe 41 PID 2936 wrote to memory of 1684 2936 3lrxlxl.exe 41 PID 1684 wrote to memory of 2736 1684 7hnhtb.exe 42 PID 1684 wrote to memory of 2736 1684 7hnhtb.exe 42 PID 1684 wrote to memory of 2736 1684 7hnhtb.exe 42 PID 1684 wrote to memory of 2736 1684 7hnhtb.exe 42 PID 2736 wrote to memory of 2052 2736 jvpvp.exe 43 PID 2736 wrote to memory of 2052 2736 jvpvp.exe 43 PID 2736 wrote to memory of 2052 2736 jvpvp.exe 43 PID 2736 wrote to memory of 2052 2736 jvpvp.exe 43 PID 2052 wrote to memory of 1344 2052 vvddv.exe 44 PID 2052 wrote to memory of 1344 2052 vvddv.exe 44 PID 2052 wrote to memory of 1344 2052 vvddv.exe 44 PID 2052 wrote to memory of 1344 2052 vvddv.exe 44 PID 1344 wrote to memory of 492 1344 rlllxrf.exe 45 PID 1344 wrote to memory of 492 1344 rlllxrf.exe 45 PID 1344 wrote to memory of 492 1344 rlllxrf.exe 45 PID 1344 wrote to memory of 492 1344 rlllxrf.exe 45 PID 492 wrote to memory of 1164 492 bthtbh.exe 46 PID 492 wrote to memory of 1164 492 bthtbh.exe 46 PID 492 wrote to memory of 1164 492 bthtbh.exe 46 PID 492 wrote to memory of 1164 492 bthtbh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe"C:\Users\Admin\AppData\Local\Temp\22a4cacbdfac7f39519c8c22c63a1221567378952e8694a306e0a952f53cc62eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\xrlrffr.exec:\xrlrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\9bntnt.exec:\9bntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ddppv.exec:\ddppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\ppjpd.exec:\ppjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pvdvd.exec:\pvdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bbhtnb.exec:\bbhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\bbbhtb.exec:\bbbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1pvdj.exec:\1pvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\fffrflx.exec:\fffrflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\3lrxlxl.exec:\3lrxlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\7hnhtb.exec:\7hnhtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\jvpvp.exec:\jvpvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vvddv.exec:\vvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rlllxrf.exec:\rlllxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\bthtbh.exec:\bthtbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:492 -
\??\c:\7jvdp.exec:\7jvdp.exe17⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vpdjv.exec:\vpdjv.exe18⤵
- Executes dropped EXE
PID:532 -
\??\c:\hhtbtt.exec:\hhtbtt.exe19⤵
- Executes dropped EXE
PID:376 -
\??\c:\vpjjj.exec:\vpjjj.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe21⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xfflxfr.exec:\xfflxfr.exe22⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nhbhtb.exec:\nhbhtb.exe23⤵
- Executes dropped EXE
PID:448 -
\??\c:\ppjvd.exec:\ppjvd.exe24⤵
- Executes dropped EXE
PID:2980 -
\??\c:\thtbnt.exec:\thtbnt.exe25⤵
- Executes dropped EXE
PID:1036 -
\??\c:\pjjjp.exec:\pjjjp.exe26⤵
- Executes dropped EXE
PID:1740 -
\??\c:\llxxflr.exec:\llxxflr.exe27⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7bnnbb.exec:\7bnnbb.exe28⤵
- Executes dropped EXE
PID:1908 -
\??\c:\jdvdp.exec:\jdvdp.exe29⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9lfrffr.exec:\9lfrffr.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bbtbnt.exec:\bbtbnt.exe31⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vpjjv.exec:\vpjjv.exe32⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjjpd.exec:\pjjpd.exe33⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xxrrlxl.exec:\xxrrlxl.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\nbthbn.exec:\nbthbn.exe35⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pddpd.exec:\pddpd.exe36⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vdvvd.exec:\vdvvd.exe37⤵
- Executes dropped EXE
PID:1424 -
\??\c:\frlxllr.exec:\frlxllr.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hthtnb.exec:\hthtnb.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jjvvd.exec:\jjvvd.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\ffxxlxf.exec:\ffxxlxf.exe41⤵
- Executes dropped EXE
PID:2836 -
\??\c:\nhhtnb.exec:\nhhtnb.exe42⤵
- Executes dropped EXE
PID:2316 -
\??\c:\rrlxrxf.exec:\rrlxrxf.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\3nntnh.exec:\3nntnh.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\btnnth.exec:\btnnth.exe45⤵
- Executes dropped EXE
PID:2608 -
\??\c:\pjvjv.exec:\pjvjv.exe46⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bnhhtb.exec:\bnhhtb.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bnbbnn.exec:\bnbbnn.exe48⤵
- Executes dropped EXE
PID:1556 -
\??\c:\xrffxxf.exec:\xrffxxf.exe49⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7nntbn.exec:\7nntbn.exe50⤵
- Executes dropped EXE
PID:1012 -
\??\c:\nnhtnb.exec:\nnhtnb.exe51⤵
- Executes dropped EXE
PID:1900 -
\??\c:\dvpvj.exec:\dvpvj.exe52⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jvppv.exec:\jvppv.exe53⤵
- Executes dropped EXE
PID:492 -
\??\c:\fxlrflf.exec:\fxlrflf.exe54⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3hntbn.exec:\3hntbn.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1bttbn.exec:\1bttbn.exe56⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jdpjp.exec:\jdpjp.exe57⤵
- Executes dropped EXE
PID:952 -
\??\c:\rlxflll.exec:\rlxflll.exe58⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nnhnbh.exec:\nnhnbh.exe59⤵
- Executes dropped EXE
PID:1308 -
\??\c:\bnbhnn.exec:\bnbhnn.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jjjpd.exec:\jjjpd.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lfrflrx.exec:\lfrflrx.exe62⤵
- Executes dropped EXE
PID:972 -
\??\c:\hbnttt.exec:\hbnttt.exe63⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ttnbhn.exec:\ttnbhn.exe64⤵
- Executes dropped EXE
PID:2244 -
\??\c:\pjdpj.exec:\pjdpj.exe65⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7rllxlr.exec:\7rllxlr.exe66⤵PID:2292
-
\??\c:\bbbhtb.exec:\bbbhtb.exe67⤵PID:2296
-
\??\c:\hhnbth.exec:\hhnbth.exe68⤵PID:1512
-
\??\c:\vjvdp.exec:\vjvdp.exe69⤵
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\5lfflrx.exec:\5lfflrx.exe70⤵PID:2904
-
\??\c:\xlffllx.exec:\xlffllx.exe71⤵PID:2468
-
\??\c:\1tnhth.exec:\1tnhth.exe72⤵PID:1872
-
\??\c:\7dpvv.exec:\7dpvv.exe73⤵PID:296
-
\??\c:\pjddd.exec:\pjddd.exe74⤵PID:2284
-
\??\c:\rlflffl.exec:\rlflffl.exe75⤵PID:1652
-
\??\c:\1fxrxxl.exec:\1fxrxxl.exe76⤵PID:2200
-
\??\c:\5nthtn.exec:\5nthtn.exe77⤵PID:2112
-
\??\c:\jppvj.exec:\jppvj.exe78⤵PID:2628
-
\??\c:\9fxlxlx.exec:\9fxlxlx.exe79⤵PID:2800
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe80⤵PID:2672
-
\??\c:\1hbhht.exec:\1hbhht.exe81⤵PID:2852
-
\??\c:\jdvdj.exec:\jdvdj.exe82⤵PID:2668
-
\??\c:\3jjjp.exec:\3jjjp.exe83⤵PID:2808
-
\??\c:\1xlxfrl.exec:\1xlxfrl.exe84⤵PID:2716
-
\??\c:\xrrxxxx.exec:\xrrxxxx.exe85⤵PID:2316
-
\??\c:\hhbtnb.exec:\hhbtnb.exe86⤵PID:2924
-
\??\c:\ppdpv.exec:\ppdpv.exe87⤵PID:2336
-
\??\c:\9jpdp.exec:\9jpdp.exe88⤵PID:2608
-
\??\c:\rlxflfr.exec:\rlxflfr.exe89⤵PID:1648
-
\??\c:\xfflxfl.exec:\xfflxfl.exe90⤵PID:2932
-
\??\c:\5hbnhh.exec:\5hbnhh.exe91⤵PID:1676
-
\??\c:\vpjpd.exec:\vpjpd.exe92⤵PID:1088
-
\??\c:\1vpvj.exec:\1vpvj.exe93⤵PID:2272
-
\??\c:\1frxxfl.exec:\1frxxfl.exe94⤵PID:1344
-
\??\c:\hbbhth.exec:\hbbhth.exe95⤵PID:2600
-
\??\c:\pvpdj.exec:\pvpdj.exe96⤵PID:2004
-
\??\c:\tttbhn.exec:\tttbhn.exe97⤵PID:2760
-
\??\c:\hbnnhh.exec:\hbnnhh.exe98⤵PID:1960
-
\??\c:\5vpvp.exec:\5vpvp.exe99⤵PID:2396
-
\??\c:\xrflrxl.exec:\xrflrxl.exe100⤵PID:952
-
\??\c:\5bnntb.exec:\5bnntb.exe101⤵PID:2352
-
\??\c:\jdvvd.exec:\jdvvd.exe102⤵PID:2236
-
\??\c:\9xrfrfl.exec:\9xrfrfl.exe103⤵PID:1128
-
\??\c:\flrxffl.exec:\flrxffl.exe104⤵PID:1896
-
\??\c:\9hhbnn.exec:\9hhbnn.exe105⤵PID:824
-
\??\c:\jjjvj.exec:\jjjvj.exe106⤵PID:1536
-
\??\c:\dvdjd.exec:\dvdjd.exe107⤵PID:2244
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe108⤵PID:1036
-
\??\c:\tbtbnb.exec:\tbtbnb.exe109⤵PID:2136
-
\??\c:\bbntbb.exec:\bbntbb.exe110⤵PID:2296
-
\??\c:\vpjjp.exec:\vpjjp.exe111⤵PID:1028
-
\??\c:\3xrfrxl.exec:\3xrfrxl.exe112⤵PID:1712
-
\??\c:\1fflrrl.exec:\1fflrrl.exe113⤵PID:2904
-
\??\c:\nnhnhn.exec:\nnhnhn.exe114⤵PID:2468
-
\??\c:\1vvdj.exec:\1vvdj.exe115⤵PID:1576
-
\??\c:\1xfrfrl.exec:\1xfrfrl.exe116⤵PID:1940
-
\??\c:\xrfffff.exec:\xrfffff.exe117⤵PID:868
-
\??\c:\hbbhnt.exec:\hbbhnt.exe118⤵PID:2824
-
\??\c:\djpdp.exec:\djpdp.exe119⤵PID:2684
-
\??\c:\dvpvj.exec:\dvpvj.exe120⤵PID:2776
-
\??\c:\rrlrflf.exec:\rrlrflf.exe121⤵PID:2356
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-