Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 12:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe
-
Size
453KB
-
MD5
1f18a39f64c405302d33862feb183041
-
SHA1
e921b71888ca626c810b7875287a99ff6416e1d5
-
SHA256
a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b
-
SHA512
364ed5da6860bfd6d46a9de40574de77c999796455bf06f3420bb92795cfdcd0e5b10ceb4856105d0d09e68fd872013e55be4601b1f33dce5318ebf1c0ffbb4e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeH:q7Tc2NYHUrAwfMp3CDH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-93-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1924-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-116-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2712-115-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1520-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-169-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2412-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-389-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1724-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-495-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1216-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-718-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1096-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-788-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2952-924-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 hbnnbb.exe 2880 tnttbb.exe 2796 rxxfrfr.exe 2848 5vpdv.exe 2744 3lrrxxx.exe 2572 hnhbnb.exe 2768 llflxfr.exe 1680 1vjvp.exe 988 3lxxllr.exe 1924 5btbhb.exe 2712 9dvdj.exe 2436 rrlrxfl.exe 1712 jdpjv.exe 1520 ththtt.exe 1964 dvvjd.exe 1864 ffxrxfx.exe 1648 3bntbh.exe 1076 pvpvd.exe 1540 7hhttt.exe 3020 vpjvp.exe 2412 7tnntn.exe 3012 fxxrflf.exe 1552 lfxfrrr.exe 1276 vvppd.exe 3016 rfrxxfr.exe 2020 1tnnbb.exe 944 vvjpv.exe 2988 rrlrlxr.exe 2348 pjjjp.exe 2080 3frxlrf.exe 2844 5ttthn.exe 2904 rfxxrxl.exe 2652 hhhhhn.exe 2212 bbtbtb.exe 1588 xxfxrfr.exe 3036 btnthn.exe 2560 pjdjp.exe 2848 rrlxrxl.exe 2696 rlxfxfl.exe 2596 1bhhtb.exe 2952 vpjjv.exe 536 3lfxxfl.exe 716 xlffxxl.exe 776 btnbhn.exe 988 ddvjv.exe 2592 7frrflr.exe 2704 lfrxrlx.exe 2712 5nntbh.exe 2012 5djjj.exe 1724 llfxlrx.exe 2364 rfrflxx.exe 2288 1tntbb.exe 1708 jvpvp.exe 2148 lrxflxr.exe 1796 rrlxlrx.exe 1652 tnhntb.exe 2508 5vjpj.exe 2832 9rxrrxx.exe 3068 rlxfrrx.exe 2188 tnbhnt.exe 1344 ddvjd.exe 1852 flffllx.exe 1216 lfxfrrf.exe 2260 btnbbb.exe -
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-788-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1352-825-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2284-937-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2664 2236 a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe 30 PID 2236 wrote to memory of 2664 2236 a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe 30 PID 2236 wrote to memory of 2664 2236 a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe 30 PID 2236 wrote to memory of 2664 2236 a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe 30 PID 2664 wrote to memory of 2880 2664 hbnnbb.exe 31 PID 2664 wrote to memory of 2880 2664 hbnnbb.exe 31 PID 2664 wrote to memory of 2880 2664 hbnnbb.exe 31 PID 2664 wrote to memory of 2880 2664 hbnnbb.exe 31 PID 2880 wrote to memory of 2796 2880 tnttbb.exe 32 PID 2880 wrote to memory of 2796 2880 tnttbb.exe 32 PID 2880 wrote to memory of 2796 2880 tnttbb.exe 32 PID 2880 wrote to memory of 2796 2880 tnttbb.exe 32 PID 2796 wrote to memory of 2848 2796 rxxfrfr.exe 33 PID 2796 wrote to memory of 2848 2796 rxxfrfr.exe 33 PID 2796 wrote to memory of 2848 2796 rxxfrfr.exe 33 PID 2796 wrote to memory of 2848 2796 rxxfrfr.exe 33 PID 2848 wrote to memory of 2744 2848 5vpdv.exe 34 PID 2848 wrote to memory of 2744 2848 5vpdv.exe 34 PID 2848 wrote to memory of 2744 2848 5vpdv.exe 34 PID 2848 wrote to memory of 2744 2848 5vpdv.exe 34 PID 2744 wrote to memory of 2572 2744 3lrrxxx.exe 35 PID 2744 wrote to memory of 2572 2744 3lrrxxx.exe 35 PID 2744 wrote to memory of 2572 2744 3lrrxxx.exe 35 PID 2744 wrote to memory of 2572 2744 3lrrxxx.exe 35 PID 2572 wrote to memory of 2768 2572 hnhbnb.exe 36 PID 2572 wrote to memory of 2768 2572 hnhbnb.exe 36 PID 2572 wrote to memory of 2768 2572 hnhbnb.exe 36 PID 2572 wrote to memory of 2768 2572 hnhbnb.exe 36 PID 2768 wrote to memory of 1680 2768 llflxfr.exe 37 PID 2768 wrote to memory of 1680 2768 llflxfr.exe 37 PID 2768 wrote to memory of 1680 2768 llflxfr.exe 37 PID 2768 wrote to memory of 1680 2768 llflxfr.exe 37 PID 1680 wrote to memory of 988 1680 1vjvp.exe 38 PID 1680 wrote to memory of 988 1680 1vjvp.exe 38 PID 1680 wrote to memory of 988 1680 1vjvp.exe 38 PID 1680 wrote to memory of 988 1680 1vjvp.exe 38 PID 988 wrote to memory of 1924 988 3lxxllr.exe 39 PID 988 wrote to memory of 1924 988 3lxxllr.exe 39 PID 988 wrote to memory of 1924 988 3lxxllr.exe 39 PID 988 wrote to memory of 1924 988 3lxxllr.exe 39 PID 1924 wrote to memory of 2712 1924 5btbhb.exe 40 PID 1924 wrote to memory of 2712 1924 5btbhb.exe 40 PID 1924 wrote to memory of 2712 1924 5btbhb.exe 40 PID 1924 wrote to memory of 2712 1924 5btbhb.exe 40 PID 2712 wrote to memory of 2436 2712 9dvdj.exe 41 PID 2712 wrote to memory of 2436 2712 9dvdj.exe 41 PID 2712 wrote to memory of 2436 2712 9dvdj.exe 41 PID 2712 wrote to memory of 2436 2712 9dvdj.exe 41 PID 2436 wrote to memory of 1712 2436 rrlrxfl.exe 42 PID 2436 wrote to memory of 1712 2436 rrlrxfl.exe 42 PID 2436 wrote to memory of 1712 2436 rrlrxfl.exe 42 PID 2436 wrote to memory of 1712 2436 rrlrxfl.exe 42 PID 1712 wrote to memory of 1520 1712 jdpjv.exe 43 PID 1712 wrote to memory of 1520 1712 jdpjv.exe 43 PID 1712 wrote to memory of 1520 1712 jdpjv.exe 43 PID 1712 wrote to memory of 1520 1712 jdpjv.exe 43 PID 1520 wrote to memory of 1964 1520 ththtt.exe 44 PID 1520 wrote to memory of 1964 1520 ththtt.exe 44 PID 1520 wrote to memory of 1964 1520 ththtt.exe 44 PID 1520 wrote to memory of 1964 1520 ththtt.exe 44 PID 1964 wrote to memory of 1864 1964 dvvjd.exe 45 PID 1964 wrote to memory of 1864 1964 dvvjd.exe 45 PID 1964 wrote to memory of 1864 1964 dvvjd.exe 45 PID 1964 wrote to memory of 1864 1964 dvvjd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe"C:\Users\Admin\AppData\Local\Temp\a5c2a7b7be35856bb3d20aa8c5b915b5a65a4c79a26c3bb7edf7deca5c74d54b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\hbnnbb.exec:\hbnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\tnttbb.exec:\tnttbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rxxfrfr.exec:\rxxfrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\5vpdv.exec:\5vpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\3lrrxxx.exec:\3lrrxxx.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hnhbnb.exec:\hnhbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\llflxfr.exec:\llflxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1vjvp.exec:\1vjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\3lxxllr.exec:\3lxxllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\5btbhb.exec:\5btbhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\9dvdj.exec:\9dvdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rrlrxfl.exec:\rrlrxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jdpjv.exec:\jdpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\ththtt.exec:\ththtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\dvvjd.exec:\dvvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ffxrxfx.exec:\ffxrxfx.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3bntbh.exec:\3bntbh.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pvpvd.exec:\pvpvd.exe19⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7hhttt.exec:\7hhttt.exe20⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpjvp.exec:\vpjvp.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7tnntn.exec:\7tnntn.exe22⤵
- Executes dropped EXE
PID:2412 -
\??\c:\fxxrflf.exec:\fxxrflf.exe23⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lfxfrrr.exec:\lfxfrrr.exe24⤵
- Executes dropped EXE
PID:1552 -
\??\c:\vvppd.exec:\vvppd.exe25⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rfrxxfr.exec:\rfrxxfr.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\1tnnbb.exec:\1tnnbb.exe27⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vvjpv.exec:\vvjpv.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pjjjp.exec:\pjjjp.exe30⤵
- Executes dropped EXE
PID:2348 -
\??\c:\3frxlrf.exec:\3frxlrf.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\5ttthn.exec:\5ttthn.exe32⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rfxxrxl.exec:\rfxxrxl.exe33⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hhhhhn.exec:\hhhhhn.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bbtbtb.exec:\bbtbtb.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxfxrfr.exec:\xxfxrfr.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\btnthn.exec:\btnthn.exe37⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pjdjp.exec:\pjdjp.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rlxfxfl.exec:\rlxfxfl.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1bhhtb.exec:\1bhhtb.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpjjv.exec:\vpjjv.exe42⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3lfxxfl.exec:\3lfxxfl.exe43⤵
- Executes dropped EXE
PID:536 -
\??\c:\xlffxxl.exec:\xlffxxl.exe44⤵
- Executes dropped EXE
PID:716 -
\??\c:\btnbhn.exec:\btnbhn.exe45⤵
- Executes dropped EXE
PID:776 -
\??\c:\ddvjv.exec:\ddvjv.exe46⤵
- Executes dropped EXE
PID:988 -
\??\c:\7frrflr.exec:\7frrflr.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lfrxrlx.exec:\lfrxrlx.exe48⤵
- Executes dropped EXE
PID:2704 -
\??\c:\5nntbh.exec:\5nntbh.exe49⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5djjj.exec:\5djjj.exe50⤵
- Executes dropped EXE
PID:2012 -
\??\c:\llfxlrx.exec:\llfxlrx.exe51⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rfrflxx.exec:\rfrflxx.exe52⤵
- Executes dropped EXE
PID:2364 -
\??\c:\1tntbb.exec:\1tntbb.exe53⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jvpvp.exec:\jvpvp.exe54⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrxflxr.exec:\lrxflxr.exe55⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rrlxlrx.exec:\rrlxlrx.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tnhntb.exec:\tnhntb.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\5vjpj.exec:\5vjpj.exe58⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9rxrrxx.exec:\9rxrrxx.exe59⤵
- Executes dropped EXE
PID:2832 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe60⤵
- Executes dropped EXE
PID:3068 -
\??\c:\tnbhnt.exec:\tnbhnt.exe61⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ddvjd.exec:\ddvjd.exe62⤵
- Executes dropped EXE
PID:1344 -
\??\c:\flffllx.exec:\flffllx.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe64⤵
- Executes dropped EXE
PID:1216 -
\??\c:\btnbbb.exec:\btnbbb.exe65⤵
- Executes dropped EXE
PID:2260 -
\??\c:\3vpvd.exec:\3vpvd.exe66⤵PID:3048
-
\??\c:\jdjjp.exec:\jdjjp.exe67⤵PID:1980
-
\??\c:\llxrxxl.exec:\llxrxxl.exe68⤵PID:956
-
\??\c:\hbbbbh.exec:\hbbbbh.exe69⤵PID:1352
-
\??\c:\tnbttb.exec:\tnbttb.exe70⤵PID:2252
-
\??\c:\3jvdd.exec:\3jvdd.exe71⤵PID:2108
-
\??\c:\5xrflrl.exec:\5xrflrl.exe72⤵PID:1704
-
\??\c:\fflfllr.exec:\fflfllr.exe73⤵PID:2080
-
\??\c:\tnbnbh.exec:\tnbnbh.exe74⤵PID:2236
-
\??\c:\jjvdj.exec:\jjvdj.exe75⤵PID:3032
-
\??\c:\9vjdv.exec:\9vjdv.exe76⤵PID:1164
-
\??\c:\rrllrrx.exec:\rrllrrx.exe77⤵PID:2880
-
\??\c:\5nhhhn.exec:\5nhhhn.exe78⤵PID:1596
-
\??\c:\nbnnnt.exec:\nbnnnt.exe79⤵PID:2812
-
\??\c:\dddvj.exec:\dddvj.exe80⤵PID:2660
-
\??\c:\9rxrffl.exec:\9rxrffl.exe81⤵PID:2560
-
\??\c:\tnnthh.exec:\tnnthh.exe82⤵
- System Location Discovery: System Language Discovery
PID:2540 -
\??\c:\dvjpv.exec:\dvjpv.exe83⤵PID:2576
-
\??\c:\9ppjj.exec:\9ppjj.exe84⤵PID:2940
-
\??\c:\xrrlxfr.exec:\xrrlxfr.exe85⤵PID:692
-
\??\c:\bbthnb.exec:\bbthnb.exe86⤵PID:984
-
\??\c:\tnttbb.exec:\tnttbb.exe87⤵PID:1120
-
\??\c:\3pjjv.exec:\3pjjv.exe88⤵PID:2804
-
\??\c:\7rrlrxl.exec:\7rrlrxl.exe89⤵PID:2808
-
\??\c:\ttthth.exec:\ttthth.exe90⤵PID:2384
-
\??\c:\thnnnb.exec:\thnnnb.exe91⤵PID:2436
-
\??\c:\9dppj.exec:\9dppj.exe92⤵PID:1700
-
\??\c:\3ffrffr.exec:\3ffrffr.exe93⤵PID:316
-
\??\c:\xxfrxxl.exec:\xxfrxxl.exe94⤵PID:1520
-
\??\c:\3htbhn.exec:\3htbhn.exe95⤵PID:1820
-
\??\c:\jjvjj.exec:\jjvjj.exe96⤵PID:2380
-
\??\c:\pjjvd.exec:\pjjvd.exe97⤵PID:1928
-
\??\c:\3xrlxfx.exec:\3xrlxfx.exe98⤵PID:1088
-
\??\c:\5thnbb.exec:\5thnbb.exe99⤵PID:2504
-
\??\c:\bbnnbb.exec:\bbnnbb.exe100⤵PID:2896
-
\??\c:\jdvpv.exec:\jdvpv.exe101⤵PID:2320
-
\??\c:\rrflffr.exec:\rrflffr.exe102⤵
- System Location Discovery: System Language Discovery
PID:1096 -
\??\c:\llffllx.exec:\llffllx.exe103⤵PID:2180
-
\??\c:\htnntt.exec:\htnntt.exe104⤵PID:2408
-
\??\c:\vppvd.exec:\vppvd.exe105⤵PID:1396
-
\??\c:\3vpvv.exec:\3vpvv.exe106⤵PID:1112
-
\??\c:\xxrxffl.exec:\xxrxffl.exe107⤵PID:1012
-
\??\c:\thtthh.exec:\thtthh.exe108⤵PID:2044
-
\??\c:\3thtnt.exec:\3thtnt.exe109⤵PID:1464
-
\??\c:\1dvdp.exec:\1dvdp.exe110⤵
- System Location Discovery: System Language Discovery
PID:2116 -
\??\c:\1pjjv.exec:\1pjjv.exe111⤵PID:2420
-
\??\c:\5xffffl.exec:\5xffffl.exe112⤵PID:1352
-
\??\c:\nhhhtb.exec:\nhhhtb.exe113⤵PID:2252
-
\??\c:\vpddj.exec:\vpddj.exe114⤵
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\pdvdj.exec:\pdvdj.exe115⤵PID:1704
-
\??\c:\7rfllrr.exec:\7rfllrr.exe116⤵PID:2936
-
\??\c:\nhtttb.exec:\nhtttb.exe117⤵PID:2668
-
\??\c:\nbnnhh.exec:\nbnnhh.exe118⤵PID:2732
-
\??\c:\vjvvd.exec:\vjvvd.exe119⤵PID:2648
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe120⤵PID:2776
-
\??\c:\lxfflrf.exec:\lxfflrf.exe121⤵PID:2716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-