Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 13:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe
-
Size
452KB
-
MD5
8e8808c2d771557dc8659462242b2f51
-
SHA1
e71c1397686aea58de2bcac3a7a8751b417b5549
-
SHA256
79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9
-
SHA512
8f2a9b7fb69589d66c95e3b061bafcae0aa2391e8dcc188e17eead506e5b1c9ee28c4c92410975af16e37829bee0962bc59b03be5cd1474674fc0ce831ffb227
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbec:q7Tc2NYHUrAwfMp3CDc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 52 IoCs
resource yara_rule behavioral1/memory/2072-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-48-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-67-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-95-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2364-132-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-150-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-216-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/740-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-300-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2828-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-317-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2800-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-396-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1996-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-423-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2000-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-488-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2404-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-538-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-699-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1148-767-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-786-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2344-793-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-1060-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2376-1075-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-1100-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2552-1170-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1680-1203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-1243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1732 lllxrrx.exe 2516 fxlllrx.exe 2356 xxxfxfx.exe 2776 vpjvd.exe 2676 rlxxxfr.exe 2832 9hhnhh.exe 2680 jdppv.exe 2540 hbnnnn.exe 2620 thbhnn.exe 2248 lxffrrf.exe 1816 nbtbht.exe 1620 lflrflr.exe 2364 rffrrrf.exe 1728 pdvvd.exe 1524 pjdjv.exe 2000 vdppp.exe 2720 rrxffxr.exe 2372 nnbhnt.exe 2396 flffrlr.exe 2880 tnbbnn.exe 2120 jvdvv.exe 2872 7rxxffr.exe 740 nbtttt.exe 1468 xrxrllr.exe 1552 ttnthn.exe 1712 9xxflrr.exe 1876 3fxlrll.exe 752 jvvpj.exe 984 3xfxxrr.exe 316 thbhnn.exe 2388 pvvpp.exe 1652 xlfrrfx.exe 2284 hhtnhh.exe 2828 vvdvv.exe 2636 1lfxlrl.exe 2800 1rlrxxl.exe 2852 3nhnhh.exe 2548 3hbhbh.exe 2632 dvpvd.exe 2712 rlxlllx.exe 2808 lrfrxrf.exe 2544 3nnnnn.exe 2928 9bbbht.exe 2592 rfrfxxl.exe 2432 3htbnn.exe 1216 7jdjj.exe 1656 1djjp.exe 1996 7xfxxxx.exe 2368 3llflrx.exe 640 nnhbth.exe 1476 dvpvp.exe 2000 9dpvd.exe 768 lxrlrxf.exe 2720 9frxfxf.exe 952 btnbtb.exe 2196 jvjjp.exe 2380 xrlllrf.exe 2880 hthhhb.exe 2096 7ntntt.exe 2352 1vjpd.exe 1636 7lxxrrx.exe 3032 rllxffr.exe 1340 hbbbbb.exe 2404 jvpvd.exe -
resource yara_rule behavioral1/memory/2072-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-130-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2000-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-661-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-767-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-831-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-1120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-1203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-1210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-1243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-1286-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 1732 2072 79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe 31 PID 2072 wrote to memory of 1732 2072 79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe 31 PID 2072 wrote to memory of 1732 2072 79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe 31 PID 2072 wrote to memory of 1732 2072 79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe 31 PID 1732 wrote to memory of 2516 1732 lllxrrx.exe 32 PID 1732 wrote to memory of 2516 1732 lllxrrx.exe 32 PID 1732 wrote to memory of 2516 1732 lllxrrx.exe 32 PID 1732 wrote to memory of 2516 1732 lllxrrx.exe 32 PID 2516 wrote to memory of 2356 2516 fxlllrx.exe 33 PID 2516 wrote to memory of 2356 2516 fxlllrx.exe 33 PID 2516 wrote to memory of 2356 2516 fxlllrx.exe 33 PID 2516 wrote to memory of 2356 2516 fxlllrx.exe 33 PID 2356 wrote to memory of 2776 2356 xxxfxfx.exe 34 PID 2356 wrote to memory of 2776 2356 xxxfxfx.exe 34 PID 2356 wrote to memory of 2776 2356 xxxfxfx.exe 34 PID 2356 wrote to memory of 2776 2356 xxxfxfx.exe 34 PID 2776 wrote to memory of 2676 2776 vpjvd.exe 35 PID 2776 wrote to memory of 2676 2776 vpjvd.exe 35 PID 2776 wrote to memory of 2676 2776 vpjvd.exe 35 PID 2776 wrote to memory of 2676 2776 vpjvd.exe 35 PID 2676 wrote to memory of 2832 2676 rlxxxfr.exe 36 PID 2676 wrote to memory of 2832 2676 rlxxxfr.exe 36 PID 2676 wrote to memory of 2832 2676 rlxxxfr.exe 36 PID 2676 wrote to memory of 2832 2676 rlxxxfr.exe 36 PID 2832 wrote to memory of 2680 2832 9hhnhh.exe 37 PID 2832 wrote to memory of 2680 2832 9hhnhh.exe 37 PID 2832 wrote to memory of 2680 2832 9hhnhh.exe 37 PID 2832 wrote to memory of 2680 2832 9hhnhh.exe 37 PID 2680 wrote to memory of 2540 2680 jdppv.exe 38 PID 2680 wrote to memory of 2540 2680 jdppv.exe 38 PID 2680 wrote to memory of 2540 2680 jdppv.exe 38 PID 2680 wrote to memory of 2540 2680 jdppv.exe 38 PID 2540 wrote to memory of 2620 2540 hbnnnn.exe 39 PID 2540 wrote to memory of 2620 2540 hbnnnn.exe 39 PID 2540 wrote to memory of 2620 2540 hbnnnn.exe 39 PID 2540 wrote to memory of 2620 2540 hbnnnn.exe 39 PID 2620 wrote to memory of 2248 2620 thbhnn.exe 40 PID 2620 wrote to memory of 2248 2620 thbhnn.exe 40 PID 2620 wrote to memory of 2248 2620 thbhnn.exe 40 PID 2620 wrote to memory of 2248 2620 thbhnn.exe 40 PID 2248 wrote to memory of 1816 2248 lxffrrf.exe 41 PID 2248 wrote to memory of 1816 2248 lxffrrf.exe 41 PID 2248 wrote to memory of 1816 2248 lxffrrf.exe 41 PID 2248 wrote to memory of 1816 2248 lxffrrf.exe 41 PID 1816 wrote to memory of 1620 1816 nbtbht.exe 42 PID 1816 wrote to memory of 1620 1816 nbtbht.exe 42 PID 1816 wrote to memory of 1620 1816 nbtbht.exe 42 PID 1816 wrote to memory of 1620 1816 nbtbht.exe 42 PID 1620 wrote to memory of 2364 1620 lflrflr.exe 43 PID 1620 wrote to memory of 2364 1620 lflrflr.exe 43 PID 1620 wrote to memory of 2364 1620 lflrflr.exe 43 PID 1620 wrote to memory of 2364 1620 lflrflr.exe 43 PID 2364 wrote to memory of 1728 2364 rffrrrf.exe 44 PID 2364 wrote to memory of 1728 2364 rffrrrf.exe 44 PID 2364 wrote to memory of 1728 2364 rffrrrf.exe 44 PID 2364 wrote to memory of 1728 2364 rffrrrf.exe 44 PID 1728 wrote to memory of 1524 1728 pdvvd.exe 45 PID 1728 wrote to memory of 1524 1728 pdvvd.exe 45 PID 1728 wrote to memory of 1524 1728 pdvvd.exe 45 PID 1728 wrote to memory of 1524 1728 pdvvd.exe 45 PID 1524 wrote to memory of 2000 1524 pjdjv.exe 46 PID 1524 wrote to memory of 2000 1524 pjdjv.exe 46 PID 1524 wrote to memory of 2000 1524 pjdjv.exe 46 PID 1524 wrote to memory of 2000 1524 pjdjv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe"C:\Users\Admin\AppData\Local\Temp\79c3da8d8c01febe465e0fe0d4da474b9d5e1516850f54ca6e9a03bfcbe77ed9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lllxrrx.exec:\lllxrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\fxlllrx.exec:\fxlllrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xxxfxfx.exec:\xxxfxfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\vpjvd.exec:\vpjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rlxxxfr.exec:\rlxxxfr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9hhnhh.exec:\9hhnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\jdppv.exec:\jdppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hbnnnn.exec:\hbnnnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\thbhnn.exec:\thbhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lxffrrf.exec:\lxffrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\nbtbht.exec:\nbtbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\lflrflr.exec:\lflrflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rffrrrf.exec:\rffrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\pdvvd.exec:\pdvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\pjdjv.exec:\pjdjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\vdppp.exec:\vdppp.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrxffxr.exec:\rrxffxr.exe18⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nnbhnt.exec:\nnbhnt.exe19⤵
- Executes dropped EXE
PID:2372 -
\??\c:\flffrlr.exec:\flffrlr.exe20⤵
- Executes dropped EXE
PID:2396 -
\??\c:\tnbbnn.exec:\tnbbnn.exe21⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jvdvv.exec:\jvdvv.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7rxxffr.exec:\7rxxffr.exe23⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nbtttt.exec:\nbtttt.exe24⤵
- Executes dropped EXE
PID:740 -
\??\c:\xrxrllr.exec:\xrxrllr.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\ttnthn.exec:\ttnthn.exe26⤵
- Executes dropped EXE
PID:1552 -
\??\c:\9xxflrr.exec:\9xxflrr.exe27⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3fxlrll.exec:\3fxlrll.exe28⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jvvpj.exec:\jvvpj.exe29⤵
- Executes dropped EXE
PID:752 -
\??\c:\3xfxxrr.exec:\3xfxxrr.exe30⤵
- Executes dropped EXE
PID:984 -
\??\c:\thbhnn.exec:\thbhnn.exe31⤵
- Executes dropped EXE
PID:316 -
\??\c:\pvvpp.exec:\pvvpp.exe32⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xlfrrfx.exec:\xlfrrfx.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hhtnhh.exec:\hhtnhh.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:2828 -
\??\c:\1lfxlrl.exec:\1lfxlrl.exe36⤵
- Executes dropped EXE
PID:2636 -
\??\c:\1rlrxxl.exec:\1rlrxxl.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3nhnhh.exec:\3nhnhh.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3hbhbh.exec:\3hbhbh.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvpvd.exec:\dvpvd.exe40⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlxlllx.exec:\rlxlllx.exe41⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lrfrxrf.exec:\lrfrxrf.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3nnnnn.exec:\3nnnnn.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9bbbht.exec:\9bbbht.exe44⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rfrfxxl.exec:\rfrfxxl.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3htbnn.exec:\3htbnn.exe46⤵
- Executes dropped EXE
PID:2432 -
\??\c:\7jdjj.exec:\7jdjj.exe47⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1djjp.exec:\1djjp.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\7xfxxxx.exec:\7xfxxxx.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3llflrx.exec:\3llflrx.exe50⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nnhbth.exec:\nnhbth.exe51⤵
- Executes dropped EXE
PID:640 -
\??\c:\dvpvp.exec:\dvpvp.exe52⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9dpvd.exec:\9dpvd.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lxrlrxf.exec:\lxrlrxf.exe54⤵
- Executes dropped EXE
PID:768 -
\??\c:\9frxfxf.exec:\9frxfxf.exe55⤵
- Executes dropped EXE
PID:2720 -
\??\c:\btnbtb.exec:\btnbtb.exe56⤵
- Executes dropped EXE
PID:952 -
\??\c:\jvjjp.exec:\jvjjp.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xrlllrf.exec:\xrlllrf.exe58⤵
- Executes dropped EXE
PID:2380 -
\??\c:\hthhhb.exec:\hthhhb.exe59⤵
- Executes dropped EXE
PID:2880 -
\??\c:\7ntntt.exec:\7ntntt.exe60⤵
- Executes dropped EXE
PID:2096 -
\??\c:\1vjpd.exec:\1vjpd.exe61⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7lxxrrx.exec:\7lxxrrx.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rllxffr.exec:\rllxffr.exe63⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hbbbbb.exec:\hbbbbb.exe64⤵
- Executes dropped EXE
PID:1340 -
\??\c:\jvpvd.exec:\jvpvd.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xlllrrf.exec:\xlllrrf.exe66⤵PID:1232
-
\??\c:\1llxrll.exec:\1llxrll.exe67⤵PID:2068
-
\??\c:\nhhntt.exec:\nhhntt.exe68⤵PID:2504
-
\??\c:\7pdpj.exec:\7pdpj.exe69⤵PID:1876
-
\??\c:\9rrrlrr.exec:\9rrrlrr.exe70⤵PID:752
-
\??\c:\5fflrff.exec:\5fflrff.exe71⤵PID:1976
-
\??\c:\nbhbnh.exec:\nbhbnh.exe72⤵PID:876
-
\??\c:\vjddj.exec:\vjddj.exe73⤵PID:316
-
\??\c:\ddppp.exec:\ddppp.exe74⤵PID:2132
-
\??\c:\rfrrxxl.exec:\rfrrxxl.exe75⤵PID:2628
-
\??\c:\tnhntb.exec:\tnhntb.exe76⤵PID:2840
-
\??\c:\3vvpp.exec:\3vvpp.exe77⤵PID:2624
-
\??\c:\dpjjj.exec:\dpjjj.exe78⤵PID:2356
-
\??\c:\xxrrxxl.exec:\xxrrxxl.exe79⤵PID:2692
-
\??\c:\nnhthh.exec:\nnhthh.exe80⤵PID:2660
-
\??\c:\bnhnbb.exec:\bnhnbb.exe81⤵PID:2788
-
\??\c:\7djpp.exec:\7djpp.exe82⤵PID:2676
-
\??\c:\rlrxxlx.exec:\rlrxxlx.exe83⤵PID:2316
-
\??\c:\rlfflxf.exec:\rlfflxf.exe84⤵PID:2672
-
\??\c:\nhthnb.exec:\nhthnb.exe85⤵PID:2680
-
\??\c:\pvvpd.exec:\pvvpd.exe86⤵PID:2540
-
\??\c:\dpvvv.exec:\dpvvv.exe87⤵PID:2336
-
\??\c:\lrrxflr.exec:\lrrxflr.exe88⤵PID:1356
-
\??\c:\rlxxfff.exec:\rlxxfff.exe89⤵PID:1372
-
\??\c:\hhttnn.exec:\hhttnn.exe90⤵PID:2008
-
\??\c:\ppvdd.exec:\ppvdd.exe91⤵PID:2060
-
\??\c:\rllxlrf.exec:\rllxlrf.exe92⤵PID:1816
-
\??\c:\frlxrfl.exec:\frlxrfl.exe93⤵
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\hbhhnn.exec:\hbhhnn.exe94⤵PID:1088
-
\??\c:\dddvp.exec:\dddvp.exe95⤵PID:1992
-
\??\c:\jjvpj.exec:\jjvpj.exe96⤵PID:976
-
\??\c:\btbbth.exec:\btbbth.exe97⤵PID:2400
-
\??\c:\pdvvj.exec:\pdvvj.exe98⤵PID:2204
-
\??\c:\jpjdv.exec:\jpjdv.exe99⤵PID:2720
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe100⤵PID:2416
-
\??\c:\rlflxxr.exec:\rlflxxr.exe101⤵PID:2196
-
\??\c:\nhntbh.exec:\nhntbh.exe102⤵PID:2348
-
\??\c:\vdvdp.exec:\vdvdp.exe103⤵PID:2880
-
\??\c:\dvjjv.exec:\dvjjv.exe104⤵PID:2096
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe105⤵PID:2352
-
\??\c:\llfllrf.exec:\llfllrf.exe106⤵PID:888
-
\??\c:\ttnthh.exec:\ttnthh.exe107⤵PID:1148
-
\??\c:\vvpdj.exec:\vvpdj.exe108⤵PID:1820
-
\??\c:\vjjjp.exec:\vjjjp.exe109⤵PID:624
-
\??\c:\lxrrffl.exec:\lxrrffl.exe110⤵PID:2344
-
\??\c:\9nbbhh.exec:\9nbbhh.exe111⤵PID:2068
-
\??\c:\nhtthn.exec:\nhtthn.exe112⤵PID:2504
-
\??\c:\pdpvp.exec:\pdpvp.exe113⤵PID:1496
-
\??\c:\9rrxrrx.exec:\9rrxrrx.exe114⤵PID:2168
-
\??\c:\9fflxxf.exec:\9fflxxf.exe115⤵PID:300
-
\??\c:\bthtbh.exec:\bthtbh.exe116⤵PID:2452
-
\??\c:\dpvpd.exec:\dpvpd.exe117⤵PID:2128
-
\??\c:\jvjdv.exec:\jvjdv.exe118⤵PID:1608
-
\??\c:\llfflrf.exec:\llfflrf.exe119⤵PID:1732
-
\??\c:\hhttht.exec:\hhttht.exe120⤵PID:3036
-
\??\c:\thbtbb.exec:\thbtbb.exe121⤵PID:1760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-