Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 13:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe
-
Size
454KB
-
MD5
7c63140b443573a20d178d86a2245dd0
-
SHA1
ffae22655d5dc93fd3ac0a9ff8c5ee7ed58ea7c7
-
SHA256
0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c
-
SHA512
a56556bfe785d562f31c35c71b4bf3bda55d7b7c549b35d6c1de6a4afcbac38569b92e0582977f5d4280d8783db31dfb8978af3b1c8be6db477647d6c7dcac51
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1860-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-24-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/3044-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/2836-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-102-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/808-113-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1092-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-151-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2036-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-400-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1824-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-398-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/280-444-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2460-458-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1348-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-487-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3036-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-555-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/888-556-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-628-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-747-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-803-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-873-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 dvvdp.exe 3044 frllffl.exe 2604 nbtbhh.exe 2748 xxlflxx.exe 2144 jpvjv.exe 2836 vjvpp.exe 2700 1bnbnt.exe 2516 llfrfxf.exe 2972 1pjdv.exe 1256 lrxrlff.exe 808 jdvpv.exe 1092 hhbnbh.exe 2736 llrflfx.exe 2816 ntnbtb.exe 1932 1rfrlrx.exe 2036 xflxffl.exe 1812 5thntb.exe 1764 fxflrxf.exe 1080 btbtnt.exe 1820 llrxrxl.exe 2004 nhbnnt.exe 2468 vjppv.exe 3052 3nhnbh.exe 772 jdpjj.exe 684 rfxxffx.exe 1632 bbthtb.exe 1576 lflxllf.exe 1168 9bthtt.exe 720 fxlxlrl.exe 2164 tbntnn.exe 1940 9vppp.exe 1512 5xrxflx.exe 2928 bnhhtb.exe 1736 ddvjp.exe 2592 nbbnnb.exe 2332 jvpjp.exe 3044 rfllfxl.exe 2728 bbhnht.exe 2720 3hnnth.exe 2744 7ppvv.exe 2740 fxrlflx.exe 2664 htbthn.exe 2556 pvjdd.exe 2500 lxxrxlr.exe 2976 3nnhnt.exe 1680 vvpjj.exe 1824 xrfflrx.exe 704 hbtbnn.exe 280 hbthnt.exe 1092 9djjv.exe 2736 rlrfrxr.exe 2864 nhbhtt.exe 2336 vvjvj.exe 2460 jdvjj.exe 1348 3rlxfxl.exe 1636 9nhtbn.exe 1876 pdpvd.exe 664 lllrflr.exe 1540 1rlrflx.exe 1980 hbhbnt.exe 2184 7pdjv.exe 2680 xxrlfrl.exe 2480 httbht.exe 3036 dvjdd.exe -
resource yara_rule behavioral1/memory/1860-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-102-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1092-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/476-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-803-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-873-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 2276 1860 0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe 28 PID 1860 wrote to memory of 2276 1860 0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe 28 PID 1860 wrote to memory of 2276 1860 0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe 28 PID 1860 wrote to memory of 2276 1860 0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe 28 PID 2276 wrote to memory of 3044 2276 dvvdp.exe 29 PID 2276 wrote to memory of 3044 2276 dvvdp.exe 29 PID 2276 wrote to memory of 3044 2276 dvvdp.exe 29 PID 2276 wrote to memory of 3044 2276 dvvdp.exe 29 PID 3044 wrote to memory of 2604 3044 frllffl.exe 30 PID 3044 wrote to memory of 2604 3044 frllffl.exe 30 PID 3044 wrote to memory of 2604 3044 frllffl.exe 30 PID 3044 wrote to memory of 2604 3044 frllffl.exe 30 PID 2604 wrote to memory of 2748 2604 nbtbhh.exe 31 PID 2604 wrote to memory of 2748 2604 nbtbhh.exe 31 PID 2604 wrote to memory of 2748 2604 nbtbhh.exe 31 PID 2604 wrote to memory of 2748 2604 nbtbhh.exe 31 PID 2748 wrote to memory of 2144 2748 xxlflxx.exe 32 PID 2748 wrote to memory of 2144 2748 xxlflxx.exe 32 PID 2748 wrote to memory of 2144 2748 xxlflxx.exe 32 PID 2748 wrote to memory of 2144 2748 xxlflxx.exe 32 PID 2144 wrote to memory of 2836 2144 jpvjv.exe 33 PID 2144 wrote to memory of 2836 2144 jpvjv.exe 33 PID 2144 wrote to memory of 2836 2144 jpvjv.exe 33 PID 2144 wrote to memory of 2836 2144 jpvjv.exe 33 PID 2836 wrote to memory of 2700 2836 vjvpp.exe 34 PID 2836 wrote to memory of 2700 2836 vjvpp.exe 34 PID 2836 wrote to memory of 2700 2836 vjvpp.exe 34 PID 2836 wrote to memory of 2700 2836 vjvpp.exe 34 PID 2700 wrote to memory of 2516 2700 1bnbnt.exe 35 PID 2700 wrote to memory of 2516 2700 1bnbnt.exe 35 PID 2700 wrote to memory of 2516 2700 1bnbnt.exe 35 PID 2700 wrote to memory of 2516 2700 1bnbnt.exe 35 PID 2516 wrote to memory of 2972 2516 llfrfxf.exe 36 PID 2516 wrote to memory of 2972 2516 llfrfxf.exe 36 PID 2516 wrote to memory of 2972 2516 llfrfxf.exe 36 PID 2516 wrote to memory of 2972 2516 llfrfxf.exe 36 PID 2972 wrote to memory of 1256 2972 1pjdv.exe 37 PID 2972 wrote to memory of 1256 2972 1pjdv.exe 37 PID 2972 wrote to memory of 1256 2972 1pjdv.exe 37 PID 2972 wrote to memory of 1256 2972 1pjdv.exe 37 PID 1256 wrote to memory of 808 1256 lrxrlff.exe 38 PID 1256 wrote to memory of 808 1256 lrxrlff.exe 38 PID 1256 wrote to memory of 808 1256 lrxrlff.exe 38 PID 1256 wrote to memory of 808 1256 lrxrlff.exe 38 PID 808 wrote to memory of 1092 808 jdvpv.exe 39 PID 808 wrote to memory of 1092 808 jdvpv.exe 39 PID 808 wrote to memory of 1092 808 jdvpv.exe 39 PID 808 wrote to memory of 1092 808 jdvpv.exe 39 PID 1092 wrote to memory of 2736 1092 hhbnbh.exe 40 PID 1092 wrote to memory of 2736 1092 hhbnbh.exe 40 PID 1092 wrote to memory of 2736 1092 hhbnbh.exe 40 PID 1092 wrote to memory of 2736 1092 hhbnbh.exe 40 PID 2736 wrote to memory of 2816 2736 llrflfx.exe 41 PID 2736 wrote to memory of 2816 2736 llrflfx.exe 41 PID 2736 wrote to memory of 2816 2736 llrflfx.exe 41 PID 2736 wrote to memory of 2816 2736 llrflfx.exe 41 PID 2816 wrote to memory of 1932 2816 ntnbtb.exe 42 PID 2816 wrote to memory of 1932 2816 ntnbtb.exe 42 PID 2816 wrote to memory of 1932 2816 ntnbtb.exe 42 PID 2816 wrote to memory of 1932 2816 ntnbtb.exe 42 PID 1932 wrote to memory of 2036 1932 1rfrlrx.exe 43 PID 1932 wrote to memory of 2036 1932 1rfrlrx.exe 43 PID 1932 wrote to memory of 2036 1932 1rfrlrx.exe 43 PID 1932 wrote to memory of 2036 1932 1rfrlrx.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe"C:\Users\Admin\AppData\Local\Temp\0d48ff702ffb59321bb76741d6b48e0770925dfd07fff2d68f37427d9ef5906c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\dvvdp.exec:\dvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\frllffl.exec:\frllffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\nbtbhh.exec:\nbtbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\xxlflxx.exec:\xxlflxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\jpvjv.exec:\jpvjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\vjvpp.exec:\vjvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\1bnbnt.exec:\1bnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\llfrfxf.exec:\llfrfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\1pjdv.exec:\1pjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\lrxrlff.exec:\lrxrlff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\jdvpv.exec:\jdvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\hhbnbh.exec:\hhbnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\llrflfx.exec:\llrflfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\ntnbtb.exec:\ntnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\1rfrlrx.exec:\1rfrlrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\xflxffl.exec:\xflxffl.exe17⤵
- Executes dropped EXE
PID:2036 -
\??\c:\5thntb.exec:\5thntb.exe18⤵
- Executes dropped EXE
PID:1812 -
\??\c:\fxflrxf.exec:\fxflrxf.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btbtnt.exec:\btbtnt.exe20⤵
- Executes dropped EXE
PID:1080 -
\??\c:\llrxrxl.exec:\llrxrxl.exe21⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nhbnnt.exec:\nhbnnt.exe22⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vjppv.exec:\vjppv.exe23⤵
- Executes dropped EXE
PID:2468 -
\??\c:\3nhnbh.exec:\3nhnbh.exe24⤵
- Executes dropped EXE
PID:3052 -
\??\c:\jdpjj.exec:\jdpjj.exe25⤵
- Executes dropped EXE
PID:772 -
\??\c:\rfxxffx.exec:\rfxxffx.exe26⤵
- Executes dropped EXE
PID:684 -
\??\c:\bbthtb.exec:\bbthtb.exe27⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lflxllf.exec:\lflxllf.exe28⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9bthtt.exec:\9bthtt.exe29⤵
- Executes dropped EXE
PID:1168 -
\??\c:\fxlxlrl.exec:\fxlxlrl.exe30⤵
- Executes dropped EXE
PID:720 -
\??\c:\tbntnn.exec:\tbntnn.exe31⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9vppp.exec:\9vppp.exe32⤵
- Executes dropped EXE
PID:1940 -
\??\c:\5xrxflx.exec:\5xrxflx.exe33⤵
- Executes dropped EXE
PID:1512 -
\??\c:\bnhhtb.exec:\bnhhtb.exe34⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ddvjp.exec:\ddvjp.exe35⤵
- Executes dropped EXE
PID:1736 -
\??\c:\nbbnnb.exec:\nbbnnb.exe36⤵
- Executes dropped EXE
PID:2592 -
\??\c:\jvpjp.exec:\jvpjp.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rfllfxl.exec:\rfllfxl.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\bbhnht.exec:\bbhnht.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3hnnth.exec:\3hnnth.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7ppvv.exec:\7ppvv.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\fxrlflx.exec:\fxrlflx.exe42⤵
- Executes dropped EXE
PID:2740 -
\??\c:\htbthn.exec:\htbthn.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pvjdd.exec:\pvjdd.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lxxrxlr.exec:\lxxrxlr.exe45⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3nnhnt.exec:\3nnhnt.exe46⤵
- Executes dropped EXE
PID:2976 -
\??\c:\vvpjj.exec:\vvpjj.exe47⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xrfflrx.exec:\xrfflrx.exe48⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hbtbnn.exec:\hbtbnn.exe49⤵
- Executes dropped EXE
PID:704 -
\??\c:\hbthnt.exec:\hbthnt.exe50⤵
- Executes dropped EXE
PID:280 -
\??\c:\9djjv.exec:\9djjv.exe51⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rlrfrxr.exec:\rlrfrxr.exe52⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nhbhtt.exec:\nhbhtt.exe53⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vvjvj.exec:\vvjvj.exe54⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdvjj.exec:\jdvjj.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\3rlxfxl.exec:\3rlxfxl.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\9nhtbn.exec:\9nhtbn.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\pdpvd.exec:\pdpvd.exe58⤵
- Executes dropped EXE
PID:1876 -
\??\c:\lllrflr.exec:\lllrflr.exe59⤵
- Executes dropped EXE
PID:664 -
\??\c:\1rlrflx.exec:\1rlrflx.exe60⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hbhbnt.exec:\hbhbnt.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\7pdjv.exec:\7pdjv.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xxrlfrl.exec:\xxrlfrl.exe63⤵
- Executes dropped EXE
PID:2680 -
\??\c:\httbht.exec:\httbht.exe64⤵
- Executes dropped EXE
PID:2480 -
\??\c:\dvjdd.exec:\dvjdd.exe65⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rlxfrfr.exec:\rlxfrfr.exe66⤵PID:1700
-
\??\c:\tbbhbh.exec:\tbbhbh.exe67⤵PID:1640
-
\??\c:\vpppd.exec:\vpppd.exe68⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\rlxfrxl.exec:\rlxfrxl.exe69⤵PID:1788
-
\??\c:\5nttht.exec:\5nttht.exe70⤵PID:888
-
\??\c:\3tbbhh.exec:\3tbbhh.exe71⤵PID:916
-
\??\c:\vpddj.exec:\vpddj.exe72⤵PID:2180
-
\??\c:\dvjjv.exec:\dvjjv.exe73⤵PID:1000
-
\??\c:\fxrxflr.exec:\fxrxflr.exe74⤵PID:2884
-
\??\c:\1ththn.exec:\1ththn.exe75⤵PID:2772
-
\??\c:\tnhhnn.exec:\tnhhnn.exe76⤵PID:1516
-
\??\c:\vvpjp.exec:\vvpjp.exe77⤵PID:2928
-
\??\c:\fxrfflf.exec:\fxrfflf.exe78⤵PID:1732
-
\??\c:\tbnntn.exec:\tbnntn.exe79⤵PID:2196
-
\??\c:\pjjvj.exec:\pjjvj.exe80⤵PID:2128
-
\??\c:\rfffllr.exec:\rfffllr.exe81⤵PID:2760
-
\??\c:\nhtnbn.exec:\nhtnbn.exe82⤵PID:2508
-
\??\c:\nnnhtt.exec:\nnnhtt.exe83⤵PID:2628
-
\??\c:\ddjpj.exec:\ddjpj.exe84⤵PID:2960
-
\??\c:\9lrffxx.exec:\9lrffxx.exe85⤵PID:2536
-
\??\c:\hbntnt.exec:\hbntnt.exe86⤵PID:2548
-
\??\c:\9vddv.exec:\9vddv.exe87⤵PID:2532
-
\??\c:\9jvjj.exec:\9jvjj.exe88⤵PID:2620
-
\??\c:\xllrlrx.exec:\xllrlrx.exe89⤵PID:628
-
\??\c:\bhbbth.exec:\bhbbth.exe90⤵PID:2988
-
\??\c:\jvvjd.exec:\jvvjd.exe91⤵PID:896
-
\??\c:\fflfrll.exec:\fflfrll.exe92⤵PID:476
-
\??\c:\nhtnhh.exec:\nhtnhh.exe93⤵PID:1500
-
\??\c:\pjjjv.exec:\pjjjv.exe94⤵PID:1488
-
\??\c:\pjdjj.exec:\pjdjj.exe95⤵PID:2796
-
\??\c:\7xxfrfl.exec:\7xxfrfl.exe96⤵PID:2832
-
\??\c:\5htbbb.exec:\5htbbb.exe97⤵
- System Location Discovery: System Language Discovery
PID:2588 -
\??\c:\dpdvd.exec:\dpdvd.exe98⤵PID:2476
-
\??\c:\pddpd.exec:\pddpd.exe99⤵PID:2336
-
\??\c:\1xlrrrf.exec:\1xlrrrf.exe100⤵PID:1752
-
\??\c:\nnhbhh.exec:\nnhbhh.exe101⤵PID:1804
-
\??\c:\vvpvv.exec:\vvpvv.exe102⤵PID:1572
-
\??\c:\9pvvv.exec:\9pvvv.exe103⤵PID:2404
-
\??\c:\ffrxrlf.exec:\ffrxrlf.exe104⤵
- System Location Discovery: System Language Discovery
PID:1988 -
\??\c:\9htntb.exec:\9htntb.exe105⤵PID:1820
-
\??\c:\vdvvd.exec:\vdvvd.exe106⤵PID:2236
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe107⤵PID:2992
-
\??\c:\tbnbhn.exec:\tbnbhn.exe108⤵PID:1796
-
\??\c:\7pddd.exec:\7pddd.exe109⤵PID:2428
-
\??\c:\fxfrflx.exec:\fxfrflx.exe110⤵PID:1724
-
\??\c:\tnbbhn.exec:\tnbbhn.exe111⤵PID:684
-
\??\c:\7jvpv.exec:\7jvpv.exe112⤵PID:1708
-
\??\c:\lxxxfrr.exec:\lxxxfrr.exe113⤵PID:2092
-
\??\c:\hbthtn.exec:\hbthtn.exe114⤵PID:928
-
\??\c:\9hhbnt.exec:\9hhbnt.exe115⤵PID:1788
-
\??\c:\jdvdv.exec:\jdvdv.exe116⤵PID:2132
-
\??\c:\rlfflll.exec:\rlfflll.exe117⤵PID:1168
-
\??\c:\xxfrfxf.exec:\xxfrfxf.exe118⤵PID:2180
-
\??\c:\ntnntt.exec:\ntnntt.exe119⤵PID:904
-
\??\c:\pdjpd.exec:\pdjpd.exe120⤵PID:2084
-
\??\c:\xfllrff.exec:\xfllrff.exe121⤵PID:768
-
\??\c:\bbntnh.exec:\bbntnh.exe122⤵PID:1512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-