Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 16:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe
-
Size
454KB
-
MD5
4e21d029356b399fa22cd904a4e29610
-
SHA1
0d65c73eccaa801edd021ff193218ba2a7cf215c
-
SHA256
a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d
-
SHA512
26fdd0137f32215d91bdede26ac18cba6b4d5e4a44f3de2688161892d5084baf1b6ce2b4b0b1501eb8903d091ee968b3568e1767c54c5a25e5411e4359559422
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2600-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-22-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2708-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2992-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-60-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-308-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2884-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-365-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-423-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-445-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-472-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1000-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-575-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3060-608-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2676-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-670-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-677-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-693-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2600 lrlxlrl.exe 2708 htnhtn.exe 2636 vdjdv.exe 336 nnnbtb.exe 2992 jvvdd.exe 2508 5hbtnb.exe 2580 5ppdv.exe 2984 bbtnbh.exe 2756 hhbthn.exe 2844 djjdv.exe 1532 5lxlflf.exe 1660 bbnhth.exe 1964 ffflrff.exe 2016 hnhtht.exe 1684 dddvj.exe 1776 rxrxrfr.exe 2128 7jdjv.exe 1944 xxfxrxr.exe 2720 7jvdv.exe 2904 djdvp.exe 2424 djvvd.exe 1420 5xrlrff.exe 2204 hbnthn.exe 1352 1jvpv.exe 956 tttbnb.exe 1792 fxxlxfr.exe 2360 7vjdv.exe 1976 jvvvd.exe 2924 jvpvd.exe 1512 pppvj.exe 2980 tbhtbh.exe 2744 vpjpj.exe 2100 hbtbhn.exe 2376 ddpvd.exe 2632 jpjvd.exe 2884 5rfflrx.exe 2796 1thbbh.exe 2520 jjpdj.exe 808 3xrxxfr.exe 2404 llfrlrf.exe 2388 nnnbtb.exe 2596 vjddd.exe 2836 fffrflx.exe 2944 3hnthh.exe 268 vvvdv.exe 1656 dppdj.exe 2252 rrlrrrf.exe 480 bthttt.exe 2476 nnnnhn.exe 2016 pjdvp.exe 1452 lfxrffl.exe 1812 bbtbnh.exe 2148 dvvdj.exe 1796 3rrxrrf.exe 3044 hhnhbn.exe 2900 9pvdp.exe 3024 rlxfxlr.exe 2116 rrxxrxl.exe 1580 3nhnbt.exe 1504 jvjpd.exe 1360 xrffffr.exe 308 tthbbn.exe 1856 nnhnbn.exe 1000 jjpdv.exe -
resource yara_rule behavioral1/memory/2600-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-372-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2016-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-445-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1796-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-518-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1928-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-575-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2676-622-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1744-630-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-720-0x00000000003C0000-0x00000000003EA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2600 2688 a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe 30 PID 2688 wrote to memory of 2600 2688 a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe 30 PID 2688 wrote to memory of 2600 2688 a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe 30 PID 2688 wrote to memory of 2600 2688 a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe 30 PID 2600 wrote to memory of 2708 2600 lrlxlrl.exe 31 PID 2600 wrote to memory of 2708 2600 lrlxlrl.exe 31 PID 2600 wrote to memory of 2708 2600 lrlxlrl.exe 31 PID 2600 wrote to memory of 2708 2600 lrlxlrl.exe 31 PID 2708 wrote to memory of 2636 2708 htnhtn.exe 32 PID 2708 wrote to memory of 2636 2708 htnhtn.exe 32 PID 2708 wrote to memory of 2636 2708 htnhtn.exe 32 PID 2708 wrote to memory of 2636 2708 htnhtn.exe 32 PID 2636 wrote to memory of 336 2636 vdjdv.exe 33 PID 2636 wrote to memory of 336 2636 vdjdv.exe 33 PID 2636 wrote to memory of 336 2636 vdjdv.exe 33 PID 2636 wrote to memory of 336 2636 vdjdv.exe 33 PID 336 wrote to memory of 2992 336 nnnbtb.exe 34 PID 336 wrote to memory of 2992 336 nnnbtb.exe 34 PID 336 wrote to memory of 2992 336 nnnbtb.exe 34 PID 336 wrote to memory of 2992 336 nnnbtb.exe 34 PID 2992 wrote to memory of 2508 2992 jvvdd.exe 35 PID 2992 wrote to memory of 2508 2992 jvvdd.exe 35 PID 2992 wrote to memory of 2508 2992 jvvdd.exe 35 PID 2992 wrote to memory of 2508 2992 jvvdd.exe 35 PID 2508 wrote to memory of 2580 2508 5hbtnb.exe 36 PID 2508 wrote to memory of 2580 2508 5hbtnb.exe 36 PID 2508 wrote to memory of 2580 2508 5hbtnb.exe 36 PID 2508 wrote to memory of 2580 2508 5hbtnb.exe 36 PID 2580 wrote to memory of 2984 2580 5ppdv.exe 37 PID 2580 wrote to memory of 2984 2580 5ppdv.exe 37 PID 2580 wrote to memory of 2984 2580 5ppdv.exe 37 PID 2580 wrote to memory of 2984 2580 5ppdv.exe 37 PID 2984 wrote to memory of 2756 2984 bbtnbh.exe 38 PID 2984 wrote to memory of 2756 2984 bbtnbh.exe 38 PID 2984 wrote to memory of 2756 2984 bbtnbh.exe 38 PID 2984 wrote to memory of 2756 2984 bbtnbh.exe 38 PID 2756 wrote to memory of 2844 2756 hhbthn.exe 39 PID 2756 wrote to memory of 2844 2756 hhbthn.exe 39 PID 2756 wrote to memory of 2844 2756 hhbthn.exe 39 PID 2756 wrote to memory of 2844 2756 hhbthn.exe 39 PID 2844 wrote to memory of 1532 2844 djjdv.exe 40 PID 2844 wrote to memory of 1532 2844 djjdv.exe 40 PID 2844 wrote to memory of 1532 2844 djjdv.exe 40 PID 2844 wrote to memory of 1532 2844 djjdv.exe 40 PID 1532 wrote to memory of 1660 1532 5lxlflf.exe 41 PID 1532 wrote to memory of 1660 1532 5lxlflf.exe 41 PID 1532 wrote to memory of 1660 1532 5lxlflf.exe 41 PID 1532 wrote to memory of 1660 1532 5lxlflf.exe 41 PID 1660 wrote to memory of 1964 1660 bbnhth.exe 42 PID 1660 wrote to memory of 1964 1660 bbnhth.exe 42 PID 1660 wrote to memory of 1964 1660 bbnhth.exe 42 PID 1660 wrote to memory of 1964 1660 bbnhth.exe 42 PID 1964 wrote to memory of 2016 1964 ffflrff.exe 43 PID 1964 wrote to memory of 2016 1964 ffflrff.exe 43 PID 1964 wrote to memory of 2016 1964 ffflrff.exe 43 PID 1964 wrote to memory of 2016 1964 ffflrff.exe 43 PID 2016 wrote to memory of 1684 2016 hnhtht.exe 44 PID 2016 wrote to memory of 1684 2016 hnhtht.exe 44 PID 2016 wrote to memory of 1684 2016 hnhtht.exe 44 PID 2016 wrote to memory of 1684 2016 hnhtht.exe 44 PID 1684 wrote to memory of 1776 1684 dddvj.exe 45 PID 1684 wrote to memory of 1776 1684 dddvj.exe 45 PID 1684 wrote to memory of 1776 1684 dddvj.exe 45 PID 1684 wrote to memory of 1776 1684 dddvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe"C:\Users\Admin\AppData\Local\Temp\a6002e2f352e90c52e62ac38daa0be23d4ed9b9cc53a4f3a769c413eee56932d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lrlxlrl.exec:\lrlxlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\htnhtn.exec:\htnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vdjdv.exec:\vdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\nnnbtb.exec:\nnnbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\jvvdd.exec:\jvvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5hbtnb.exec:\5hbtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\5ppdv.exec:\5ppdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bbtnbh.exec:\bbtnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\hhbthn.exec:\hhbthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\djjdv.exec:\djjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5lxlflf.exec:\5lxlflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\bbnhth.exec:\bbnhth.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ffflrff.exec:\ffflrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\hnhtht.exec:\hnhtht.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dddvj.exec:\dddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rxrxrfr.exec:\rxrxrfr.exe17⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7jdjv.exec:\7jdjv.exe18⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe19⤵
- Executes dropped EXE
PID:1944 -
\??\c:\7jvdv.exec:\7jvdv.exe20⤵
- Executes dropped EXE
PID:2720 -
\??\c:\djdvp.exec:\djdvp.exe21⤵
- Executes dropped EXE
PID:2904 -
\??\c:\djvvd.exec:\djvvd.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\5xrlrff.exec:\5xrlrff.exe23⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hbnthn.exec:\hbnthn.exe24⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1jvpv.exec:\1jvpv.exe25⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tttbnb.exec:\tttbnb.exe26⤵
- Executes dropped EXE
PID:956 -
\??\c:\fxxlxfr.exec:\fxxlxfr.exe27⤵
- Executes dropped EXE
PID:1792 -
\??\c:\7vjdv.exec:\7vjdv.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jvvvd.exec:\jvvvd.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jvpvd.exec:\jvpvd.exe30⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pppvj.exec:\pppvj.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\tbhtbh.exec:\tbhtbh.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vpjpj.exec:\vpjpj.exe33⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hbtbhn.exec:\hbtbhn.exe34⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ddpvd.exec:\ddpvd.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jpjvd.exec:\jpjvd.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5rfflrx.exec:\5rfflrx.exe37⤵
- Executes dropped EXE
PID:2884 -
\??\c:\1thbbh.exec:\1thbbh.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jjpdj.exec:\jjpdj.exe39⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3xrxxfr.exec:\3xrxxfr.exe40⤵
- Executes dropped EXE
PID:808 -
\??\c:\llfrlrf.exec:\llfrlrf.exe41⤵
- Executes dropped EXE
PID:2404 -
\??\c:\nnnbtb.exec:\nnnbtb.exe42⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vjddd.exec:\vjddd.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fffrflx.exec:\fffrflx.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\3hnthh.exec:\3hnthh.exe45⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vvvdv.exec:\vvvdv.exe46⤵
- Executes dropped EXE
PID:268 -
\??\c:\dppdj.exec:\dppdj.exe47⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rrlrrrf.exec:\rrlrrrf.exe48⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bthttt.exec:\bthttt.exe49⤵
- Executes dropped EXE
PID:480 -
\??\c:\nnnnhn.exec:\nnnnhn.exe50⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pjdvp.exec:\pjdvp.exe51⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lfxrffl.exec:\lfxrffl.exe52⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbtbnh.exec:\bbtbnh.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812 -
\??\c:\dvvdj.exec:\dvvdj.exe54⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3rrxrrf.exec:\3rrxrrf.exe55⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhnhbn.exec:\hhnhbn.exe56⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9pvdp.exec:\9pvdp.exe57⤵
- Executes dropped EXE
PID:2900 -
\??\c:\rlxfxlr.exec:\rlxfxlr.exe58⤵
- Executes dropped EXE
PID:3024 -
\??\c:\rrxxrxl.exec:\rrxxrxl.exe59⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3nhnbt.exec:\3nhnbt.exe60⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvjpd.exec:\jvjpd.exe61⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrffffr.exec:\xrffffr.exe62⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tthbbn.exec:\tthbbn.exe63⤵
- Executes dropped EXE
PID:308 -
\??\c:\nnhnbn.exec:\nnhnbn.exe64⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jjpdv.exec:\jjpdv.exe65⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rrrxlrf.exec:\rrrxlrf.exe66⤵PID:2436
-
\??\c:\btbbtb.exec:\btbbtb.exe67⤵PID:1844
-
\??\c:\djdvv.exec:\djdvv.exe68⤵PID:1928
-
\??\c:\5llxlrf.exec:\5llxlrf.exe69⤵PID:1976
-
\??\c:\9nhhhn.exec:\9nhhhn.exe70⤵PID:1004
-
\??\c:\1bhbnn.exec:\1bhbnn.exe71⤵PID:2872
-
\??\c:\dvjjj.exec:\dvjjj.exe72⤵PID:2652
-
\??\c:\fxrrrxl.exec:\fxrrrxl.exe73⤵PID:2732
-
\??\c:\bbthtt.exec:\bbthtt.exe74⤵PID:2716
-
\??\c:\1hbhht.exec:\1hbhht.exe75⤵PID:3060
-
\??\c:\dvpvv.exec:\dvpvv.exe76⤵PID:2536
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe77⤵PID:2724
-
\??\c:\nbttbb.exec:\nbttbb.exe78⤵PID:2748
-
\??\c:\tnntnt.exec:\tnntnt.exe79⤵PID:2008
-
\??\c:\jpdvd.exec:\jpdvd.exe80⤵PID:2676
-
\??\c:\llffxlf.exec:\llffxlf.exe81⤵PID:808
-
\??\c:\tttnnn.exec:\tttnnn.exe82⤵PID:1744
-
\??\c:\hbnthh.exec:\hbnthh.exe83⤵PID:2800
-
\??\c:\vpdvj.exec:\vpdvj.exe84⤵PID:2856
-
\??\c:\7rlrfrx.exec:\7rlrfrx.exe85⤵PID:2852
-
\??\c:\htnnbb.exec:\htnnbb.exe86⤵PID:1532
-
\??\c:\hhbhtb.exec:\hhbhtb.exe87⤵PID:1692
-
\??\c:\vpjjj.exec:\vpjjj.exe88⤵PID:1660
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe89⤵PID:2400
-
\??\c:\httthh.exec:\httthh.exe90⤵PID:596
-
\??\c:\tnhhnt.exec:\tnhhnt.exe91⤵PID:1272
-
\??\c:\ddvpd.exec:\ddvpd.exe92⤵PID:1456
-
\??\c:\frlrllx.exec:\frlrllx.exe93⤵PID:2108
-
\??\c:\3btnnn.exec:\3btnnn.exe94⤵PID:2848
-
\??\c:\9hnnbb.exec:\9hnnbb.exe95⤵PID:2144
-
\??\c:\dpvpj.exec:\dpvpj.exe96⤵PID:2232
-
\??\c:\ffxfrxr.exec:\ffxfrxr.exe97⤵PID:2240
-
\??\c:\xrflrxf.exec:\xrflrxf.exe98⤵PID:2112
-
\??\c:\tnbtbh.exec:\tnbtbh.exe99⤵PID:3032
-
\??\c:\pjjvp.exec:\pjjvp.exe100⤵PID:1704
-
\??\c:\lfxrflf.exec:\lfxrflf.exe101⤵PID:1816
-
\??\c:\fxrxxrf.exec:\fxrxxrf.exe102⤵PID:1852
-
\??\c:\nnbbnn.exec:\nnbbnn.exe103⤵PID:752
-
\??\c:\dddjv.exec:\dddjv.exe104⤵PID:1856
-
\??\c:\1xrrfxf.exec:\1xrrfxf.exe105⤵PID:2264
-
\??\c:\3xrrrfx.exec:\3xrrrfx.exe106⤵PID:1932
-
\??\c:\1tttbb.exec:\1tttbb.exe107⤵PID:1980
-
\??\c:\3pvdp.exec:\3pvdp.exe108⤵PID:612
-
\??\c:\dvjjd.exec:\dvjjd.exe109⤵PID:884
-
\??\c:\ffxflrx.exec:\ffxflrx.exe110⤵PID:2120
-
\??\c:\rrrffrr.exec:\rrrffrr.exe111⤵PID:3036
-
\??\c:\nttnbt.exec:\nttnbt.exe112⤵PID:2700
-
\??\c:\3vvdv.exec:\3vvdv.exe113⤵PID:1600
-
\??\c:\5fxllrl.exec:\5fxllrl.exe114⤵PID:1780
-
\??\c:\llflxxl.exec:\llflxxl.exe115⤵PID:2660
-
\??\c:\3tntnb.exec:\3tntnb.exe116⤵PID:2632
-
\??\c:\pvpjd.exec:\pvpjd.exe117⤵PID:2440
-
\??\c:\xllfxll.exec:\xllfxll.exe118⤵PID:2504
-
\??\c:\hbbhtt.exec:\hbbhtt.exe119⤵PID:2628
-
\??\c:\3jjjp.exec:\3jjjp.exe120⤵PID:2968
-
\??\c:\lfxfrfr.exec:\lfxfrfr.exe121⤵PID:704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-