Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe
-
Size
456KB
-
MD5
21af0bafd2e85431ac6ee58bbf1d20c0
-
SHA1
2fa4bf2b41e3c434275e3e4daf2df1ce372bd384
-
SHA256
de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799
-
SHA512
1cc543b215f5f845f47ae76e4e3f77a5738bccf11f783d3fb5e0ffde1c6f1a17a5448913f89242d4235ae2f2505d30b8d423f93622d28cb078aa244386f13e9e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRV:q7Tc2NYHUrAwfMp3CDRV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/300-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-186-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/468-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/468-201-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/768-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-219-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2108-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-250-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2492-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-308-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1288-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-328-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2668-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-511-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-526-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-580-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2272-646-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-701-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2136-738-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-769-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2324 rfllrlr.exe 2488 vpjpd.exe 1804 nnnbhn.exe 320 vvjvj.exe 2800 nhhnhn.exe 2992 1pjvv.exe 2856 bhnhtb.exe 2272 rrflrxr.exe 2548 djjjp.exe 1696 ffxlrxr.exe 2172 tnbnnt.exe 1816 lfxfrrf.exe 2872 jvpvv.exe 2532 hbbnhn.exe 1552 jjdpv.exe 2776 nbnntb.exe 2880 ddvdp.exe 2740 fflfxfr.exe 2160 dddpv.exe 2112 lrrlfrl.exe 468 bhtthb.exe 768 5dppd.exe 2108 lrfrrxx.exe 904 rrlfxff.exe 2304 dpdjv.exe 1096 xfxlrxr.exe 372 dvvjp.exe 1704 rrlrlrl.exe 2492 3pjvp.exe 1824 1hhtnb.exe 2628 jpjvj.exe 2480 rrlxlxl.exe 2256 jvpvd.exe 2328 lrlrlrf.exe 1288 nnbnbh.exe 2168 1pjvd.exe 2692 fxxfllf.exe 320 hnhnbb.exe 2668 hhbtht.exe 2704 3ppdp.exe 2836 lffrxlr.exe 2708 7hbbnb.exe 1360 3ppjv.exe 2576 pjjpd.exe 2620 xxlrfrl.exe 2276 7htnbb.exe 316 3dvjv.exe 1756 jvpvj.exe 1488 flfflxl.exe 1456 hbthtt.exe 2752 nnhnbn.exe 552 vvpdp.exe 2760 lllfxlf.exe 2900 nnhntb.exe 1076 hhhtnb.exe 1612 vpjjv.exe 2724 rlxxflr.exe 2584 thttbb.exe 2212 9nnttb.exe 304 pjvdj.exe 1184 5rlrxlx.exe 1352 hbtbnh.exe 1720 nnhbtt.exe 896 9vjdp.exe -
resource yara_rule behavioral1/memory/300-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-187-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/768-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-511-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2504-526-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2504-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-646-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-738-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-1019-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-1131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-1138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-1157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-1164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-1219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-1256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-1305-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 300 wrote to memory of 2324 300 de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe 32 PID 300 wrote to memory of 2324 300 de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe 32 PID 300 wrote to memory of 2324 300 de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe 32 PID 300 wrote to memory of 2324 300 de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe 32 PID 2324 wrote to memory of 2488 2324 rfllrlr.exe 33 PID 2324 wrote to memory of 2488 2324 rfllrlr.exe 33 PID 2324 wrote to memory of 2488 2324 rfllrlr.exe 33 PID 2324 wrote to memory of 2488 2324 rfllrlr.exe 33 PID 2488 wrote to memory of 1804 2488 vpjpd.exe 34 PID 2488 wrote to memory of 1804 2488 vpjpd.exe 34 PID 2488 wrote to memory of 1804 2488 vpjpd.exe 34 PID 2488 wrote to memory of 1804 2488 vpjpd.exe 34 PID 1804 wrote to memory of 320 1804 nnnbhn.exe 35 PID 1804 wrote to memory of 320 1804 nnnbhn.exe 35 PID 1804 wrote to memory of 320 1804 nnnbhn.exe 35 PID 1804 wrote to memory of 320 1804 nnnbhn.exe 35 PID 320 wrote to memory of 2800 320 vvjvj.exe 36 PID 320 wrote to memory of 2800 320 vvjvj.exe 36 PID 320 wrote to memory of 2800 320 vvjvj.exe 36 PID 320 wrote to memory of 2800 320 vvjvj.exe 36 PID 2800 wrote to memory of 2992 2800 nhhnhn.exe 37 PID 2800 wrote to memory of 2992 2800 nhhnhn.exe 37 PID 2800 wrote to memory of 2992 2800 nhhnhn.exe 37 PID 2800 wrote to memory of 2992 2800 nhhnhn.exe 37 PID 2992 wrote to memory of 2856 2992 1pjvv.exe 38 PID 2992 wrote to memory of 2856 2992 1pjvv.exe 38 PID 2992 wrote to memory of 2856 2992 1pjvv.exe 38 PID 2992 wrote to memory of 2856 2992 1pjvv.exe 38 PID 2856 wrote to memory of 2272 2856 bhnhtb.exe 39 PID 2856 wrote to memory of 2272 2856 bhnhtb.exe 39 PID 2856 wrote to memory of 2272 2856 bhnhtb.exe 39 PID 2856 wrote to memory of 2272 2856 bhnhtb.exe 39 PID 2272 wrote to memory of 2548 2272 rrflrxr.exe 40 PID 2272 wrote to memory of 2548 2272 rrflrxr.exe 40 PID 2272 wrote to memory of 2548 2272 rrflrxr.exe 40 PID 2272 wrote to memory of 2548 2272 rrflrxr.exe 40 PID 2548 wrote to memory of 1696 2548 djjjp.exe 41 PID 2548 wrote to memory of 1696 2548 djjjp.exe 41 PID 2548 wrote to memory of 1696 2548 djjjp.exe 41 PID 2548 wrote to memory of 1696 2548 djjjp.exe 41 PID 1696 wrote to memory of 2172 1696 ffxlrxr.exe 42 PID 1696 wrote to memory of 2172 1696 ffxlrxr.exe 42 PID 1696 wrote to memory of 2172 1696 ffxlrxr.exe 42 PID 1696 wrote to memory of 2172 1696 ffxlrxr.exe 42 PID 2172 wrote to memory of 1816 2172 tnbnnt.exe 43 PID 2172 wrote to memory of 1816 2172 tnbnnt.exe 43 PID 2172 wrote to memory of 1816 2172 tnbnnt.exe 43 PID 2172 wrote to memory of 1816 2172 tnbnnt.exe 43 PID 1816 wrote to memory of 2872 1816 lfxfrrf.exe 44 PID 1816 wrote to memory of 2872 1816 lfxfrrf.exe 44 PID 1816 wrote to memory of 2872 1816 lfxfrrf.exe 44 PID 1816 wrote to memory of 2872 1816 lfxfrrf.exe 44 PID 2872 wrote to memory of 2532 2872 jvpvv.exe 45 PID 2872 wrote to memory of 2532 2872 jvpvv.exe 45 PID 2872 wrote to memory of 2532 2872 jvpvv.exe 45 PID 2872 wrote to memory of 2532 2872 jvpvv.exe 45 PID 2532 wrote to memory of 1552 2532 hbbnhn.exe 46 PID 2532 wrote to memory of 1552 2532 hbbnhn.exe 46 PID 2532 wrote to memory of 1552 2532 hbbnhn.exe 46 PID 2532 wrote to memory of 1552 2532 hbbnhn.exe 46 PID 1552 wrote to memory of 2776 1552 jjdpv.exe 47 PID 1552 wrote to memory of 2776 1552 jjdpv.exe 47 PID 1552 wrote to memory of 2776 1552 jjdpv.exe 47 PID 1552 wrote to memory of 2776 1552 jjdpv.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe"C:\Users\Admin\AppData\Local\Temp\de0f55352a8725a046b2a2c5a2a0fd0d67d86dac61f85f07e0a23ad56ec3b799N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\rfllrlr.exec:\rfllrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\vpjpd.exec:\vpjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\nnnbhn.exec:\nnnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vvjvj.exec:\vvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\nhhnhn.exec:\nhhnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1pjvv.exec:\1pjvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\bhnhtb.exec:\bhnhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rrflrxr.exec:\rrflrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\djjjp.exec:\djjjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\tnbnnt.exec:\tnbnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jvpvv.exec:\jvpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\hbbnhn.exec:\hbbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jjdpv.exec:\jjdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\nbnntb.exec:\nbnntb.exe17⤵
- Executes dropped EXE
PID:2776 -
\??\c:\ddvdp.exec:\ddvdp.exe18⤵
- Executes dropped EXE
PID:2880 -
\??\c:\fflfxfr.exec:\fflfxfr.exe19⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dddpv.exec:\dddpv.exe20⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lrrlfrl.exec:\lrrlfrl.exe21⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bhtthb.exec:\bhtthb.exe22⤵
- Executes dropped EXE
PID:468 -
\??\c:\5dppd.exec:\5dppd.exe23⤵
- Executes dropped EXE
PID:768 -
\??\c:\lrfrrxx.exec:\lrfrrxx.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rrlfxff.exec:\rrlfxff.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\dpdjv.exec:\dpdjv.exe26⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xfxlrxr.exec:\xfxlrxr.exe27⤵
- Executes dropped EXE
PID:1096 -
\??\c:\dvvjp.exec:\dvvjp.exe28⤵
- Executes dropped EXE
PID:372 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe29⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3pjvp.exec:\3pjvp.exe30⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1hhtnb.exec:\1hhtnb.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jpjvj.exec:\jpjvj.exe32⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe33⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jvpvd.exec:\jvpvd.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328 -
\??\c:\nnbnbh.exec:\nnbnbh.exe36⤵
- Executes dropped EXE
PID:1288 -
\??\c:\1pjvd.exec:\1pjvd.exe37⤵
- Executes dropped EXE
PID:2168 -
\??\c:\fxxfllf.exec:\fxxfllf.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hnhnbb.exec:\hnhnbb.exe39⤵
- Executes dropped EXE
PID:320 -
\??\c:\hhbtht.exec:\hhbtht.exe40⤵
- Executes dropped EXE
PID:2668 -
\??\c:\3ppdp.exec:\3ppdp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\lffrxlr.exec:\lffrxlr.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7hbbnb.exec:\7hbbnb.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3ppjv.exec:\3ppjv.exe44⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pjjpd.exec:\pjjpd.exe45⤵
- Executes dropped EXE
PID:2576 -
\??\c:\xxlrfrl.exec:\xxlrfrl.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7htnbb.exec:\7htnbb.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\3dvjv.exec:\3dvjv.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\jvpvj.exec:\jvpvj.exe49⤵
- Executes dropped EXE
PID:1756 -
\??\c:\flfflxl.exec:\flfflxl.exe50⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hbthtt.exec:\hbthtt.exe51⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nnhnbn.exec:\nnhnbn.exe52⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vvpdp.exec:\vvpdp.exe53⤵
- Executes dropped EXE
PID:552 -
\??\c:\lllfxlf.exec:\lllfxlf.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnhntb.exec:\nnhntb.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhhtnb.exec:\hhhtnb.exe56⤵
- Executes dropped EXE
PID:1076 -
\??\c:\vpjjv.exec:\vpjjv.exe57⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rlxxflr.exec:\rlxxflr.exe58⤵
- Executes dropped EXE
PID:2724 -
\??\c:\thttbb.exec:\thttbb.exe59⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9nnttb.exec:\9nnttb.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pjvdj.exec:\pjvdj.exe61⤵
- Executes dropped EXE
PID:304 -
\??\c:\5rlrxlx.exec:\5rlrxlx.exe62⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hbtbnh.exec:\hbtbnh.exe63⤵
- Executes dropped EXE
PID:1352 -
\??\c:\nnhbtt.exec:\nnhbtt.exe64⤵
- Executes dropped EXE
PID:1720 -
\??\c:\9vjdp.exec:\9vjdp.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\rxxrfrx.exec:\rxxrfrx.exe66⤵PID:1916
-
\??\c:\nhtbnt.exec:\nhtbnt.exe67⤵PID:2044
-
\??\c:\jjjvv.exec:\jjjvv.exe68⤵PID:2504
-
\??\c:\1lfrrxl.exec:\1lfrrxl.exe69⤵PID:2296
-
\??\c:\ntntbb.exec:\ntntbb.exe70⤵PID:2984
-
\??\c:\vpddj.exec:\vpddj.exe71⤵PID:1020
-
\??\c:\pjddp.exec:\pjddp.exe72⤵PID:1944
-
\??\c:\xfxrfrx.exec:\xfxrfrx.exe73⤵PID:872
-
\??\c:\ttnbhh.exec:\ttnbhh.exe74⤵PID:1900
-
\??\c:\vvpdj.exec:\vvpdj.exe75⤵PID:1608
-
\??\c:\vvpdj.exec:\vvpdj.exe76⤵PID:1600
-
\??\c:\rxrllll.exec:\rxrllll.exe77⤵PID:2236
-
\??\c:\tttbnn.exec:\tttbnn.exe78⤵PID:2980
-
\??\c:\nhhthn.exec:\nhhthn.exe79⤵PID:644
-
\??\c:\5dvdj.exec:\5dvdj.exe80⤵PID:2224
-
\??\c:\lfrfllr.exec:\lfrfllr.exe81⤵PID:2684
-
\??\c:\xflfrxf.exec:\xflfrxf.exe82⤵PID:2652
-
\??\c:\3btnbh.exec:\3btnbh.exe83⤵PID:2696
-
\??\c:\vvpvj.exec:\vvpvj.exe84⤵PID:2660
-
\??\c:\lffrxlx.exec:\lffrxlx.exe85⤵PID:2992
-
\??\c:\llrfxfx.exec:\llrfxfx.exe86⤵PID:2568
-
\??\c:\ntnhbb.exec:\ntnhbb.exe87⤵PID:2600
-
\??\c:\9pdjv.exec:\9pdjv.exe88⤵PID:2272
-
\??\c:\1pjvp.exec:\1pjvp.exe89⤵PID:2548
-
\??\c:\rrfrflx.exec:\rrfrflx.exe90⤵PID:2852
-
\??\c:\nnnhbh.exec:\nnnhbh.exe91⤵PID:1696
-
\??\c:\1pvdj.exec:\1pvdj.exe92⤵PID:1108
-
\??\c:\vdvpd.exec:\vdvpd.exe93⤵PID:2876
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe94⤵PID:808
-
\??\c:\7ttthn.exec:\7ttthn.exe95⤵PID:108
-
\??\c:\nhbhtb.exec:\nhbhtb.exe96⤵PID:832
-
\??\c:\vpvdp.exec:\vpvdp.exe97⤵PID:2032
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe98⤵PID:2252
-
\??\c:\nhthhn.exec:\nhthhn.exe99⤵PID:1252
-
\??\c:\hbnbhh.exec:\hbnbhh.exe100⤵PID:2960
-
\??\c:\jpjvj.exec:\jpjvj.exe101⤵PID:2924
-
\??\c:\rrlrxrf.exec:\rrlrxrf.exe102⤵PID:2384
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe103⤵PID:2136
-
\??\c:\hbnntt.exec:\hbnntt.exe104⤵PID:1920
-
\??\c:\vdjpd.exec:\vdjpd.exe105⤵PID:944
-
\??\c:\lxxlfll.exec:\lxxlfll.exe106⤵PID:2404
-
\??\c:\hhtbnn.exec:\hhtbnn.exe107⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\7ppdd.exec:\7ppdd.exe108⤵PID:1272
-
\??\c:\7rlxfrx.exec:\7rlxfrx.exe109⤵PID:940
-
\??\c:\tbhtth.exec:\tbhtth.exe110⤵PID:2720
-
\??\c:\vvjpd.exec:\vvjpd.exe111⤵PID:3004
-
\??\c:\rlflfrx.exec:\rlflfrx.exe112⤵PID:2044
-
\??\c:\hbthtb.exec:\hbthtb.exe113⤵PID:2420
-
\??\c:\jpdjd.exec:\jpdjd.exe114⤵PID:2296
-
\??\c:\llfrxfr.exec:\llfrxfr.exe115⤵PID:1704
-
\??\c:\tbtnth.exec:\tbtnth.exe116⤵PID:1020
-
\??\c:\djjjv.exec:\djjjv.exe117⤵PID:1204
-
\??\c:\5vjpd.exec:\5vjpd.exe118⤵PID:872
-
\??\c:\rrlxllf.exec:\rrlxllf.exe119⤵PID:1604
-
\??\c:\bttbnb.exec:\bttbnb.exe120⤵PID:1504
-
\??\c:\1hbhbb.exec:\1hbhbb.exe121⤵PID:584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-