Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 14:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe
-
Size
453KB
-
MD5
23e4e611d58dfe5eae01444970e258c0
-
SHA1
a56beb086813dd27225c32863dc4fd56d06376c6
-
SHA256
caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638
-
SHA512
55f92a72f96142df2de84c3229786a0f028b9cfe54d6429e5c45944c22c3232fb92ccb41c406e8b922052a31ae0b23b31e3b8a86886350a8430a8e7dc64d59f2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbee:q7Tc2NYHUrAwfMp3CDe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-69-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2648-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-149-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/768-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-273-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1432-285-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-293-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2052-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-429-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2220-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-481-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2260-592-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-637-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1816-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-780-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-814-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-812-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-909-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-978-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-985-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/864-1028-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1628-1084-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2904-1104-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 nnhhth.exe 2316 hbntnt.exe 2116 htnnbb.exe 2312 tnbbnn.exe 2852 7bthtt.exe 2724 jjddp.exe 2808 5thhnt.exe 2648 lfxflrl.exe 2888 vppvj.exe 2684 rrrxflx.exe 2456 htbbhh.exe 1660 xrrfxfr.exe 1088 7jpjp.exe 860 lfflxfr.exe 768 tnhnbh.exe 264 7xrrxxl.exe 1048 tnhnbh.exe 1068 rrflrrf.exe 576 7lrxfxx.exe 1672 pjdjv.exe 2108 xrffrrr.exe 1884 pdjpp.exe 840 xfxffrx.exe 1728 llfxlrl.exe 1752 3hhbht.exe 1392 xffrxxl.exe 2444 9fxxflr.exe 1504 1dpdv.exe 2132 xrxlrrr.exe 1880 7jvdv.exe 1432 9flrffx.exe 2940 9jvvj.exe 2052 xfflrfr.exe 2268 pvjvd.exe 2304 rlllfrf.exe 2760 frlrxfl.exe 2960 tnbthn.exe 2952 pjddj.exe 2724 3jvdj.exe 2896 xxllrrl.exe 556 hhbnnh.exe 2732 1btbhh.exe 2640 vppdp.exe 3024 7fxxffl.exe 2696 1ntttb.exe 2592 btntbh.exe 536 ddddv.exe 2436 fxfxllr.exe 1088 rrlrflx.exe 2004 ttnhbn.exe 2448 pvvdd.exe 1492 9dvvj.exe 1688 fxrxflx.exe 780 ttbntt.exe 1784 jvpjp.exe 2680 dvvdj.exe 2504 7fxlfrf.exe 2220 1ttbnt.exe 2864 hbttbn.exe 2272 vvppv.exe 2412 5rxrxfl.exe 316 9rflrrf.exe 468 hnbbnt.exe 568 djjjp.exe -
resource yara_rule behavioral1/memory/2384-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-530-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2260-592-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-851-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-935-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-978-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-992-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-1104-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2784-1143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-1377-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2532 2384 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 30 PID 2384 wrote to memory of 2532 2384 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 30 PID 2384 wrote to memory of 2532 2384 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 30 PID 2384 wrote to memory of 2532 2384 caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe 30 PID 2532 wrote to memory of 2316 2532 nnhhth.exe 31 PID 2532 wrote to memory of 2316 2532 nnhhth.exe 31 PID 2532 wrote to memory of 2316 2532 nnhhth.exe 31 PID 2532 wrote to memory of 2316 2532 nnhhth.exe 31 PID 2316 wrote to memory of 2116 2316 hbntnt.exe 32 PID 2316 wrote to memory of 2116 2316 hbntnt.exe 32 PID 2316 wrote to memory of 2116 2316 hbntnt.exe 32 PID 2316 wrote to memory of 2116 2316 hbntnt.exe 32 PID 2116 wrote to memory of 2312 2116 htnnbb.exe 33 PID 2116 wrote to memory of 2312 2116 htnnbb.exe 33 PID 2116 wrote to memory of 2312 2116 htnnbb.exe 33 PID 2116 wrote to memory of 2312 2116 htnnbb.exe 33 PID 2312 wrote to memory of 2852 2312 tnbbnn.exe 34 PID 2312 wrote to memory of 2852 2312 tnbbnn.exe 34 PID 2312 wrote to memory of 2852 2312 tnbbnn.exe 34 PID 2312 wrote to memory of 2852 2312 tnbbnn.exe 34 PID 2852 wrote to memory of 2724 2852 7bthtt.exe 35 PID 2852 wrote to memory of 2724 2852 7bthtt.exe 35 PID 2852 wrote to memory of 2724 2852 7bthtt.exe 35 PID 2852 wrote to memory of 2724 2852 7bthtt.exe 35 PID 2724 wrote to memory of 2808 2724 jjddp.exe 36 PID 2724 wrote to memory of 2808 2724 jjddp.exe 36 PID 2724 wrote to memory of 2808 2724 jjddp.exe 36 PID 2724 wrote to memory of 2808 2724 jjddp.exe 36 PID 2808 wrote to memory of 2648 2808 5thhnt.exe 37 PID 2808 wrote to memory of 2648 2808 5thhnt.exe 37 PID 2808 wrote to memory of 2648 2808 5thhnt.exe 37 PID 2808 wrote to memory of 2648 2808 5thhnt.exe 37 PID 2648 wrote to memory of 2888 2648 lfxflrl.exe 38 PID 2648 wrote to memory of 2888 2648 lfxflrl.exe 38 PID 2648 wrote to memory of 2888 2648 lfxflrl.exe 38 PID 2648 wrote to memory of 2888 2648 lfxflrl.exe 38 PID 2888 wrote to memory of 2684 2888 vppvj.exe 39 PID 2888 wrote to memory of 2684 2888 vppvj.exe 39 PID 2888 wrote to memory of 2684 2888 vppvj.exe 39 PID 2888 wrote to memory of 2684 2888 vppvj.exe 39 PID 2684 wrote to memory of 2456 2684 rrrxflx.exe 40 PID 2684 wrote to memory of 2456 2684 rrrxflx.exe 40 PID 2684 wrote to memory of 2456 2684 rrrxflx.exe 40 PID 2684 wrote to memory of 2456 2684 rrrxflx.exe 40 PID 2456 wrote to memory of 1660 2456 htbbhh.exe 41 PID 2456 wrote to memory of 1660 2456 htbbhh.exe 41 PID 2456 wrote to memory of 1660 2456 htbbhh.exe 41 PID 2456 wrote to memory of 1660 2456 htbbhh.exe 41 PID 1660 wrote to memory of 1088 1660 xrrfxfr.exe 42 PID 1660 wrote to memory of 1088 1660 xrrfxfr.exe 42 PID 1660 wrote to memory of 1088 1660 xrrfxfr.exe 42 PID 1660 wrote to memory of 1088 1660 xrrfxfr.exe 42 PID 1088 wrote to memory of 860 1088 7jpjp.exe 43 PID 1088 wrote to memory of 860 1088 7jpjp.exe 43 PID 1088 wrote to memory of 860 1088 7jpjp.exe 43 PID 1088 wrote to memory of 860 1088 7jpjp.exe 43 PID 860 wrote to memory of 768 860 lfflxfr.exe 44 PID 860 wrote to memory of 768 860 lfflxfr.exe 44 PID 860 wrote to memory of 768 860 lfflxfr.exe 44 PID 860 wrote to memory of 768 860 lfflxfr.exe 44 PID 768 wrote to memory of 264 768 tnhnbh.exe 45 PID 768 wrote to memory of 264 768 tnhnbh.exe 45 PID 768 wrote to memory of 264 768 tnhnbh.exe 45 PID 768 wrote to memory of 264 768 tnhnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe"C:\Users\Admin\AppData\Local\Temp\caf77961755daebf3d53db473d7f81ec0817fdc5398690b69ca2528dd704f638N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\nnhhth.exec:\nnhhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\hbntnt.exec:\hbntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\htnnbb.exec:\htnnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\tnbbnn.exec:\tnbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\7bthtt.exec:\7bthtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jjddp.exec:\jjddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5thhnt.exec:\5thhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\lfxflrl.exec:\lfxflrl.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\vppvj.exec:\vppvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rrrxflx.exec:\rrrxflx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\htbbhh.exec:\htbbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\xrrfxfr.exec:\xrrfxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\7jpjp.exec:\7jpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\lfflxfr.exec:\lfflxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\tnhnbh.exec:\tnhnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\7xrrxxl.exec:\7xrrxxl.exe17⤵
- Executes dropped EXE
PID:264 -
\??\c:\tnhnbh.exec:\tnhnbh.exe18⤵
- Executes dropped EXE
PID:1048 -
\??\c:\rrflrrf.exec:\rrflrrf.exe19⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7lrxfxx.exec:\7lrxfxx.exe20⤵
- Executes dropped EXE
PID:576 -
\??\c:\pjdjv.exec:\pjdjv.exe21⤵
- Executes dropped EXE
PID:1672 -
\??\c:\xrffrrr.exec:\xrffrrr.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pdjpp.exec:\pdjpp.exe23⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xfxffrx.exec:\xfxffrx.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\llfxlrl.exec:\llfxlrl.exe25⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3hhbht.exec:\3hhbht.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\xffrxxl.exec:\xffrxxl.exe27⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9fxxflr.exec:\9fxxflr.exe28⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1dpdv.exec:\1dpdv.exe29⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrxlrrr.exec:\xrxlrrr.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7jvdv.exec:\7jvdv.exe31⤵
- Executes dropped EXE
PID:1880 -
\??\c:\9flrffx.exec:\9flrffx.exe32⤵
- Executes dropped EXE
PID:1432 -
\??\c:\9jvvj.exec:\9jvvj.exe33⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xfflrfr.exec:\xfflrfr.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pvjvd.exec:\pvjvd.exe35⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rlllfrf.exec:\rlllfrf.exe36⤵
- Executes dropped EXE
PID:2304 -
\??\c:\frlrxfl.exec:\frlrxfl.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\tnbthn.exec:\tnbthn.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pjddj.exec:\pjddj.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3jvdj.exec:\3jvdj.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxllrrl.exec:\xxllrrl.exe41⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hhbnnh.exec:\hhbnnh.exe42⤵
- Executes dropped EXE
PID:556 -
\??\c:\1btbhh.exec:\1btbhh.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vppdp.exec:\vppdp.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7fxxffl.exec:\7fxxffl.exe45⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1ntttb.exec:\1ntttb.exe46⤵
- Executes dropped EXE
PID:2696 -
\??\c:\btntbh.exec:\btntbh.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ddddv.exec:\ddddv.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\fxfxllr.exec:\fxfxllr.exe49⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rrlrflx.exec:\rrlrflx.exe50⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ttnhbn.exec:\ttnhbn.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pvvdd.exec:\pvvdd.exe52⤵
- Executes dropped EXE
PID:2448 -
\??\c:\9dvvj.exec:\9dvvj.exe53⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxrxflx.exec:\fxrxflx.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ttbntt.exec:\ttbntt.exe55⤵
- Executes dropped EXE
PID:780 -
\??\c:\jvpjp.exec:\jvpjp.exe56⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvvdj.exec:\dvvdj.exe57⤵
- Executes dropped EXE
PID:2680 -
\??\c:\7fxlfrf.exec:\7fxlfrf.exe58⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1ttbnt.exec:\1ttbnt.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hbttbn.exec:\hbttbn.exe60⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vvppv.exec:\vvppv.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5rxrxfl.exec:\5rxrxfl.exe62⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9rflrrf.exec:\9rflrrf.exe63⤵
- Executes dropped EXE
PID:316 -
\??\c:\hnbbnt.exec:\hnbbnt.exe64⤵
- Executes dropped EXE
PID:468 -
\??\c:\djjjp.exec:\djjjp.exe65⤵
- Executes dropped EXE
PID:568 -
\??\c:\7jpjj.exec:\7jpjj.exe66⤵PID:2324
-
\??\c:\fxlxxxf.exec:\fxlxxxf.exe67⤵PID:2320
-
\??\c:\1thntb.exec:\1thntb.exe68⤵PID:2444
-
\??\c:\hhhtbn.exec:\hhhtbn.exe69⤵PID:2596
-
\??\c:\jddjv.exec:\jddjv.exe70⤵PID:2528
-
\??\c:\frrrxff.exec:\frrrxff.exe71⤵PID:888
-
\??\c:\bhhnbh.exec:\bhhnbh.exe72⤵PID:2308
-
\??\c:\5nbhhh.exec:\5nbhhh.exe73⤵PID:2072
-
\??\c:\vpdjd.exec:\vpdjd.exe74⤵PID:2392
-
\??\c:\xrlfrxl.exec:\xrlfrxl.exe75⤵PID:2940
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe76⤵PID:2292
-
\??\c:\btnntn.exec:\btnntn.exe77⤵PID:2300
-
\??\c:\pjdjv.exec:\pjdjv.exe78⤵PID:2360
-
\??\c:\dvpvd.exec:\dvpvd.exe79⤵PID:2260
-
\??\c:\llfxlrf.exec:\llfxlrf.exe80⤵PID:2828
-
\??\c:\hhhhhn.exec:\hhhhhn.exe81⤵PID:2872
-
\??\c:\5dddp.exec:\5dddp.exe82⤵PID:2880
-
\??\c:\jjvpv.exec:\jjvpv.exe83⤵PID:2512
-
\??\c:\3llrxxl.exec:\3llrxxl.exe84⤵PID:2788
-
\??\c:\nttnbn.exec:\nttnbn.exe85⤵PID:2620
-
\??\c:\vvjdv.exec:\vvjdv.exe86⤵PID:2888
-
\??\c:\dvdpp.exec:\dvdpp.exe87⤵PID:2332
-
\??\c:\ffxfrfx.exec:\ffxfrfx.exe88⤵PID:1232
-
\??\c:\1hbtth.exec:\1hbtth.exe89⤵PID:1816
-
\??\c:\vpvjd.exec:\vpvjd.exe90⤵
- System Location Discovery: System Language Discovery
PID:676 -
\??\c:\xrlxflr.exec:\xrlxflr.exe91⤵PID:2372
-
\??\c:\rxrflrx.exec:\rxrflrx.exe92⤵PID:1460
-
\??\c:\btthbn.exec:\btthbn.exe93⤵PID:1864
-
\??\c:\nnhthn.exec:\nnhthn.exe94⤵PID:1692
-
\??\c:\9ddjv.exec:\9ddjv.exe95⤵PID:2432
-
\??\c:\xflxxfr.exec:\xflxxfr.exe96⤵PID:1940
-
\??\c:\tbntbh.exec:\tbntbh.exe97⤵PID:1508
-
\??\c:\nnhthh.exec:\nnhthh.exe98⤵PID:596
-
\??\c:\pdjvd.exec:\pdjvd.exe99⤵PID:2136
-
\??\c:\fflflll.exec:\fflflll.exe100⤵PID:2056
-
\??\c:\thbnnn.exec:\thbnnn.exe101⤵PID:2188
-
\??\c:\pjjvj.exec:\pjjvj.exe102⤵PID:2140
-
\??\c:\1pjpp.exec:\1pjpp.exe103⤵PID:1640
-
\??\c:\rrffllx.exec:\rrffllx.exe104⤵PID:1560
-
\??\c:\9hhnbh.exec:\9hhnbh.exe105⤵PID:2012
-
\??\c:\jddjv.exec:\jddjv.exe106⤵PID:2008
-
\??\c:\7jpjv.exec:\7jpjv.exe107⤵PID:2096
-
\??\c:\9flrxlf.exec:\9flrxlf.exe108⤵PID:2152
-
\??\c:\hbtnbb.exec:\hbtnbb.exe109⤵PID:1952
-
\??\c:\pddjv.exec:\pddjv.exe110⤵PID:2388
-
\??\c:\ddvdp.exec:\ddvdp.exe111⤵PID:844
-
\??\c:\xlrffrr.exec:\xlrffrr.exe112⤵PID:2540
-
\??\c:\tnbbhh.exec:\tnbbhh.exe113⤵PID:1028
-
\??\c:\vjvvp.exec:\vjvvp.exe114⤵PID:888
-
\??\c:\lfxxffr.exec:\lfxxffr.exe115⤵PID:2308
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe116⤵PID:2112
-
\??\c:\ttnbhh.exec:\ttnbhh.exe117⤵PID:2996
-
\??\c:\jdvjv.exec:\jdvjv.exe118⤵PID:2276
-
\??\c:\nhtntb.exec:\nhtntb.exe119⤵PID:2344
-
\??\c:\vpjvd.exec:\vpjvd.exe120⤵PID:2284
-
\??\c:\rlrxrrx.exec:\rlrxrrx.exe121⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-