Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 14:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe
-
Size
454KB
-
MD5
c9d3965df90b4c888df8b5734ea6ce00
-
SHA1
96936dffa2ef1666baf13f541f3ab69b09a78b61
-
SHA256
dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57a
-
SHA512
20729f9f5e4c48e3b73c31c8117a826bde95465dd48d29aa5dfac0fa59f75bc788e6977c9d0b029151531ca76f17ede045c17d488b3168e3388e726ea372173f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1r:q7Tc2NYHUrAwfMp3CD1r
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2268-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-97-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2172-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-99-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1776-116-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1644-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-186-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1720-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1840-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-534-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-563-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2672-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-674-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2408-805-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1588-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-1000-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/904-1033-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-1100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1184-1155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2156-1164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 xxxlrrl.exe 2804 bbthtt.exe 2204 5tntbn.exe 2264 ppvdd.exe 2764 1lxxxxf.exe 2560 dvjpd.exe 1624 3llxrrf.exe 1896 btnttt.exe 2404 hbhnhn.exe 2172 llrllfl.exe 2140 fxrxffr.exe 1776 llflxfx.exe 1644 hbttbb.exe 2788 dpdjp.exe 1380 xxrxfrl.exe 2244 jjjdp.exe 2044 ddpvj.exe 1980 hbtbtt.exe 772 jdpjp.exe 1676 9xrlxfl.exe 1300 nhbbhn.exe 1088 nnhnbt.exe 1720 pppdj.exe 352 9rxxffl.exe 2068 ddddd.exe 764 jdvdj.exe 1312 vvppv.exe 2640 ppjvd.exe 2532 bbntth.exe 1928 pjddp.exe 1264 hhbhtb.exe 2648 nthnbh.exe 2700 flflxxl.exe 2820 9btntt.exe 1588 ddvjj.exe 2768 1fxllrx.exe 2656 7bbhnt.exe 2728 nbtnnt.exe 1952 7vjpd.exe 2620 lfffrrx.exe 2608 5hbntb.exe 1480 tbnbhh.exe 2984 vdvdj.exe 2456 rlxfrrx.exe 2072 tnbhnn.exe 1840 pdpvd.exe 2140 9fxfrrx.exe 1776 fxllrrl.exe 2248 1nhhnn.exe 2100 7vpdd.exe 2644 5jjjp.exe 2412 xfxxllr.exe 2136 5hhntb.exe 1944 btbbhb.exe 2000 vvppd.exe 532 llflllx.exe 2180 nhtbhn.exe 2088 djvvd.exe 1468 vvppp.exe 1300 1xrrrxl.exe 1240 7hnttb.exe 1956 5vpvj.exe 1760 jdvvp.exe 1692 rrxfllx.exe -
resource yara_rule behavioral1/memory/2268-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-97-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2172-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1840-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-674-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/1932-702-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-1033-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-1211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-1250-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2268 2648 dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe 30 PID 2648 wrote to memory of 2268 2648 dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe 30 PID 2648 wrote to memory of 2268 2648 dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe 30 PID 2648 wrote to memory of 2268 2648 dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe 30 PID 2268 wrote to memory of 2804 2268 xxxlrrl.exe 31 PID 2268 wrote to memory of 2804 2268 xxxlrrl.exe 31 PID 2268 wrote to memory of 2804 2268 xxxlrrl.exe 31 PID 2268 wrote to memory of 2804 2268 xxxlrrl.exe 31 PID 2804 wrote to memory of 2204 2804 bbthtt.exe 32 PID 2804 wrote to memory of 2204 2804 bbthtt.exe 32 PID 2804 wrote to memory of 2204 2804 bbthtt.exe 32 PID 2804 wrote to memory of 2204 2804 bbthtt.exe 32 PID 2204 wrote to memory of 2264 2204 5tntbn.exe 33 PID 2204 wrote to memory of 2264 2204 5tntbn.exe 33 PID 2204 wrote to memory of 2264 2204 5tntbn.exe 33 PID 2204 wrote to memory of 2264 2204 5tntbn.exe 33 PID 2264 wrote to memory of 2764 2264 ppvdd.exe 34 PID 2264 wrote to memory of 2764 2264 ppvdd.exe 34 PID 2264 wrote to memory of 2764 2264 ppvdd.exe 34 PID 2264 wrote to memory of 2764 2264 ppvdd.exe 34 PID 2764 wrote to memory of 2560 2764 1lxxxxf.exe 35 PID 2764 wrote to memory of 2560 2764 1lxxxxf.exe 35 PID 2764 wrote to memory of 2560 2764 1lxxxxf.exe 35 PID 2764 wrote to memory of 2560 2764 1lxxxxf.exe 35 PID 2560 wrote to memory of 1624 2560 dvjpd.exe 36 PID 2560 wrote to memory of 1624 2560 dvjpd.exe 36 PID 2560 wrote to memory of 1624 2560 dvjpd.exe 36 PID 2560 wrote to memory of 1624 2560 dvjpd.exe 36 PID 1624 wrote to memory of 1896 1624 3llxrrf.exe 37 PID 1624 wrote to memory of 1896 1624 3llxrrf.exe 37 PID 1624 wrote to memory of 1896 1624 3llxrrf.exe 37 PID 1624 wrote to memory of 1896 1624 3llxrrf.exe 37 PID 1896 wrote to memory of 2404 1896 btnttt.exe 38 PID 1896 wrote to memory of 2404 1896 btnttt.exe 38 PID 1896 wrote to memory of 2404 1896 btnttt.exe 38 PID 1896 wrote to memory of 2404 1896 btnttt.exe 38 PID 2404 wrote to memory of 2172 2404 hbhnhn.exe 39 PID 2404 wrote to memory of 2172 2404 hbhnhn.exe 39 PID 2404 wrote to memory of 2172 2404 hbhnhn.exe 39 PID 2404 wrote to memory of 2172 2404 hbhnhn.exe 39 PID 2172 wrote to memory of 2140 2172 llrllfl.exe 40 PID 2172 wrote to memory of 2140 2172 llrllfl.exe 40 PID 2172 wrote to memory of 2140 2172 llrllfl.exe 40 PID 2172 wrote to memory of 2140 2172 llrllfl.exe 40 PID 2140 wrote to memory of 1776 2140 fxrxffr.exe 41 PID 2140 wrote to memory of 1776 2140 fxrxffr.exe 41 PID 2140 wrote to memory of 1776 2140 fxrxffr.exe 41 PID 2140 wrote to memory of 1776 2140 fxrxffr.exe 41 PID 1776 wrote to memory of 1644 1776 llflxfx.exe 42 PID 1776 wrote to memory of 1644 1776 llflxfx.exe 42 PID 1776 wrote to memory of 1644 1776 llflxfx.exe 42 PID 1776 wrote to memory of 1644 1776 llflxfx.exe 42 PID 1644 wrote to memory of 2788 1644 hbttbb.exe 43 PID 1644 wrote to memory of 2788 1644 hbttbb.exe 43 PID 1644 wrote to memory of 2788 1644 hbttbb.exe 43 PID 1644 wrote to memory of 2788 1644 hbttbb.exe 43 PID 2788 wrote to memory of 1380 2788 dpdjp.exe 44 PID 2788 wrote to memory of 1380 2788 dpdjp.exe 44 PID 2788 wrote to memory of 1380 2788 dpdjp.exe 44 PID 2788 wrote to memory of 1380 2788 dpdjp.exe 44 PID 1380 wrote to memory of 2244 1380 xxrxfrl.exe 45 PID 1380 wrote to memory of 2244 1380 xxrxfrl.exe 45 PID 1380 wrote to memory of 2244 1380 xxrxfrl.exe 45 PID 1380 wrote to memory of 2244 1380 xxrxfrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe"C:\Users\Admin\AppData\Local\Temp\dca971f940705ea91d951ab55621960dd6fa5f64050f353e1f19e438741fe57aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xxxlrrl.exec:\xxxlrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\bbthtt.exec:\bbthtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\5tntbn.exec:\5tntbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\ppvdd.exec:\ppvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\1lxxxxf.exec:\1lxxxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dvjpd.exec:\dvjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3llxrrf.exec:\3llxrrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\btnttt.exec:\btnttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\hbhnhn.exec:\hbhnhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\llrllfl.exec:\llrllfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\fxrxffr.exec:\fxrxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\llflxfx.exec:\llflxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\hbttbb.exec:\hbttbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\dpdjp.exec:\dpdjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\xxrxfrl.exec:\xxrxfrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\jjjdp.exec:\jjjdp.exe17⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ddpvj.exec:\ddpvj.exe18⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbtbtt.exec:\hbtbtt.exe19⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jdpjp.exec:\jdpjp.exe20⤵
- Executes dropped EXE
PID:772 -
\??\c:\9xrlxfl.exec:\9xrlxfl.exe21⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nhbbhn.exec:\nhbbhn.exe22⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nnhnbt.exec:\nnhnbt.exe23⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pppdj.exec:\pppdj.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9rxxffl.exec:\9rxxffl.exe25⤵
- Executes dropped EXE
PID:352 -
\??\c:\ddddd.exec:\ddddd.exe26⤵
- Executes dropped EXE
PID:2068 -
\??\c:\jdvdj.exec:\jdvdj.exe27⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvppv.exec:\vvppv.exe28⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ppjvd.exec:\ppjvd.exe29⤵
- Executes dropped EXE
PID:2640 -
\??\c:\bbntth.exec:\bbntth.exe30⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pjddp.exec:\pjddp.exe31⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hhbhtb.exec:\hhbhtb.exe32⤵
- Executes dropped EXE
PID:1264 -
\??\c:\nthnbh.exec:\nthnbh.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\flflxxl.exec:\flflxxl.exe34⤵
- Executes dropped EXE
PID:2700 -
\??\c:\9btntt.exec:\9btntt.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ddvjj.exec:\ddvjj.exe36⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1fxllrx.exec:\1fxllrx.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7bbhnt.exec:\7bbhnt.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbtnnt.exec:\nbtnnt.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7vjpd.exec:\7vjpd.exe40⤵
- Executes dropped EXE
PID:1952 -
\??\c:\lfffrrx.exec:\lfffrrx.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\5hbntb.exec:\5hbntb.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tbnbhh.exec:\tbnbhh.exe43⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vdvdj.exec:\vdvdj.exe44⤵
- Executes dropped EXE
PID:2984 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\tnbhnn.exec:\tnbhnn.exe46⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pdpvd.exec:\pdpvd.exe47⤵
- Executes dropped EXE
PID:1840 -
\??\c:\9fxfrrx.exec:\9fxfrrx.exe48⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxllrrl.exec:\fxllrrl.exe49⤵
- Executes dropped EXE
PID:1776 -
\??\c:\1nhhnn.exec:\1nhhnn.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7vpdd.exec:\7vpdd.exe51⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5jjjp.exec:\5jjjp.exe52⤵
- Executes dropped EXE
PID:2644 -
\??\c:\xfxxllr.exec:\xfxxllr.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\5hhntb.exec:\5hhntb.exe54⤵
- Executes dropped EXE
PID:2136 -
\??\c:\btbbhb.exec:\btbbhb.exe55⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vvppd.exec:\vvppd.exe56⤵
- Executes dropped EXE
PID:2000 -
\??\c:\llflllx.exec:\llflllx.exe57⤵
- Executes dropped EXE
PID:532 -
\??\c:\nhtbhn.exec:\nhtbhn.exe58⤵
- Executes dropped EXE
PID:2180 -
\??\c:\djvvd.exec:\djvvd.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vvppp.exec:\vvppp.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\1xrrrxl.exec:\1xrrrxl.exe61⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7hnttb.exec:\7hnttb.exe62⤵
- Executes dropped EXE
PID:1240 -
\??\c:\5vpvj.exec:\5vpvj.exe63⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jdvvp.exec:\jdvvp.exe64⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rrxfllx.exec:\rrxfllx.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nntbhn.exec:\nntbhn.exe66⤵PID:912
-
\??\c:\ppjvd.exec:\ppjvd.exe67⤵PID:2488
-
\??\c:\rfrxfff.exec:\rfrxfff.exe68⤵PID:2332
-
\??\c:\rlfflrr.exec:\rlfflrr.exe69⤵PID:3020
-
\??\c:\tnbbhb.exec:\tnbbhb.exe70⤵PID:2932
-
\??\c:\7jvdp.exec:\7jvdp.exe71⤵PID:1532
-
\??\c:\7lxxxxl.exec:\7lxxxxl.exe72⤵PID:1928
-
\??\c:\nnhthh.exec:\nnhthh.exe73⤵PID:2660
-
\??\c:\3tthbh.exec:\3tthbh.exe74⤵PID:2752
-
\??\c:\dvjpd.exec:\dvjpd.exe75⤵PID:2776
-
\??\c:\ffxxllx.exec:\ffxxllx.exe76⤵PID:1584
-
\??\c:\1thhhn.exec:\1thhhn.exe77⤵PID:2672
-
\??\c:\pppvd.exec:\pppvd.exe78⤵PID:2580
-
\??\c:\9llrffr.exec:\9llrffr.exe79⤵PID:2264
-
\??\c:\xfffxlx.exec:\xfffxlx.exe80⤵PID:2764
-
\??\c:\5nbbbb.exec:\5nbbbb.exe81⤵PID:2556
-
\??\c:\3jjdj.exec:\3jjdj.exe82⤵PID:2968
-
\??\c:\jdvdj.exec:\jdvdj.exe83⤵PID:2992
-
\??\c:\fflxffr.exec:\fflxffr.exe84⤵PID:608
-
\??\c:\fxflrxf.exec:\fxflrxf.exe85⤵PID:2404
-
\??\c:\5tnntb.exec:\5tnntb.exe86⤵PID:1500
-
\??\c:\7ppvj.exec:\7ppvj.exe87⤵PID:2452
-
\??\c:\9xlrxxf.exec:\9xlrxxf.exe88⤵PID:2460
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe89⤵PID:2848
-
\??\c:\1htnnn.exec:\1htnnn.exe90⤵PID:1628
-
\??\c:\dvvdj.exec:\dvvdj.exe91⤵PID:2528
-
\??\c:\vpddj.exec:\vpddj.exe92⤵PID:2544
-
\??\c:\xxllxxx.exec:\xxllxxx.exe93⤵PID:2596
-
\??\c:\3bnbhh.exec:\3bnbhh.exe94⤵PID:2424
-
\??\c:\thtnbt.exec:\thtnbt.exe95⤵PID:2444
-
\??\c:\pdjpv.exec:\pdjpv.exe96⤵PID:1932
-
\??\c:\ppjvp.exec:\ppjvp.exe97⤵PID:2000
-
\??\c:\fllxxrf.exec:\fllxxrf.exe98⤵PID:1908
-
\??\c:\bbbtbb.exec:\bbbtbb.exe99⤵PID:2180
-
\??\c:\7pdpv.exec:\7pdpv.exe100⤵PID:2388
-
\??\c:\9pjpv.exec:\9pjpv.exe101⤵PID:964
-
\??\c:\xrfffff.exec:\xrfffff.exe102⤵PID:236
-
\??\c:\1nhtbh.exec:\1nhtbh.exe103⤵PID:1752
-
\??\c:\tbthtt.exec:\tbthtt.exe104⤵PID:1528
-
\??\c:\pjvdj.exec:\pjvdj.exe105⤵PID:1652
-
\??\c:\3llffff.exec:\3llffff.exe106⤵PID:1716
-
\??\c:\tthhnt.exec:\tthhnt.exe107⤵PID:844
-
\??\c:\tnbnth.exec:\tnbnth.exe108⤵PID:2020
-
\??\c:\jpvpd.exec:\jpvpd.exe109⤵PID:1312
-
\??\c:\rfllfff.exec:\rfllfff.exe110⤵PID:2936
-
\??\c:\ffxxlrf.exec:\ffxxlrf.exe111⤵PID:2408
-
\??\c:\hhbbtt.exec:\hhbbtt.exe112⤵PID:2360
-
\??\c:\1pjjj.exec:\1pjjj.exe113⤵PID:1264
-
\??\c:\5llxlff.exec:\5llxlff.exe114⤵PID:2268
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe115⤵PID:2780
-
\??\c:\btntbh.exec:\btntbh.exe116⤵
- System Location Discovery: System Language Discovery
PID:2564 -
\??\c:\vjdvd.exec:\vjdvd.exe117⤵PID:2776
-
\??\c:\1jvjj.exec:\1jvjj.exe118⤵PID:1588
-
\??\c:\5lxxfff.exec:\5lxxfff.exe119⤵PID:2740
-
\??\c:\bnhhbt.exec:\bnhhbt.exe120⤵PID:2724
-
\??\c:\1vdjp.exec:\1vdjp.exe121⤵PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-