Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe
-
Size
454KB
-
MD5
316a06cf5af6ea8c9e4cb1dfb9beeb56
-
SHA1
616ad28bd80881541984301f98ed8b02a96cca70
-
SHA256
0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1
-
SHA512
35cc946b503c3e42be9536ddac577eaa8d636a5b27e2a981c07c7b61e0567680981567b76a2ea5cecaaf3a473e5e3cf890dc2c26ff6f8be7c92cc54338fa9778
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1W/:q7Tc2NYHUrAwfMp3CD1W/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2656-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-51-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/644-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-147-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-519-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2360-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-658-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1224-702-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/804-741-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-845-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-867-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-893-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1520-981-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-1042-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2096-1084-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2204 rxxlxfx.exe 2812 btnntb.exe 2572 3fflxlr.exe 2800 pvjdj.exe 2780 frxxrrr.exe 2576 nnhnth.exe 2184 nnnnbb.exe 644 xxrxlxl.exe 2552 btntnt.exe 2884 vddjv.exe 2904 lrxxrlf.exe 1056 dpjvd.exe 2304 1rrxfxl.exe 1060 vvvpd.exe 1932 rffxrlr.exe 2632 7vvdj.exe 3068 xrlllxl.exe 2544 hhttbb.exe 2924 9lllflx.exe 2412 rlrlfrr.exe 860 nhbbbt.exe 2372 pjvdv.exe 1676 llfllrl.exe 788 7thhtb.exe 2216 lxlffff.exe 1268 5btnhh.exe 3016 dpvvj.exe 1700 3tthnt.exe 1660 ddvdp.exe 2024 hbtthh.exe 1588 jjddd.exe 2176 1fflffl.exe 2788 rrrrxlr.exe 2980 tbbnnh.exe 2688 ddjjv.exe 2692 llxflxx.exe 2900 fflllfx.exe 2620 7tnthh.exe 2596 pvvdp.exe 2684 fxrxllr.exe 2276 tbthbb.exe 1992 vjvjj.exe 644 rrrrflx.exe 1756 bbbntt.exe 2848 7jvvv.exe 2932 dvdjp.exe 1796 frfxffr.exe 1904 ttbntb.exe 1948 dpvdj.exe 2316 lfrrfrf.exe 1592 bbtbnt.exe 1340 pjdjv.exe 1936 xrlrrxr.exe 320 nhbhnn.exe 1596 7vddv.exe 3036 pjvdj.exe 2104 ffrfrfl.exe 2420 bbhtnb.exe 1124 ddvjj.exe 968 rrlxfrl.exe 860 bnbtbt.exe 2188 vvpvj.exe 932 1rlxlrf.exe 2540 tnbhnn.exe -
resource yara_rule behavioral1/memory/2656-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/968-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-826-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-867-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-981-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/996-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-1081-0x0000000000230000-0x000000000025A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3llxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2204 2656 0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe 31 PID 2656 wrote to memory of 2204 2656 0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe 31 PID 2656 wrote to memory of 2204 2656 0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe 31 PID 2656 wrote to memory of 2204 2656 0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe 31 PID 2204 wrote to memory of 2812 2204 rxxlxfx.exe 32 PID 2204 wrote to memory of 2812 2204 rxxlxfx.exe 32 PID 2204 wrote to memory of 2812 2204 rxxlxfx.exe 32 PID 2204 wrote to memory of 2812 2204 rxxlxfx.exe 32 PID 2812 wrote to memory of 2572 2812 btnntb.exe 33 PID 2812 wrote to memory of 2572 2812 btnntb.exe 33 PID 2812 wrote to memory of 2572 2812 btnntb.exe 33 PID 2812 wrote to memory of 2572 2812 btnntb.exe 33 PID 2572 wrote to memory of 2800 2572 3fflxlr.exe 34 PID 2572 wrote to memory of 2800 2572 3fflxlr.exe 34 PID 2572 wrote to memory of 2800 2572 3fflxlr.exe 34 PID 2572 wrote to memory of 2800 2572 3fflxlr.exe 34 PID 2800 wrote to memory of 2780 2800 pvjdj.exe 35 PID 2800 wrote to memory of 2780 2800 pvjdj.exe 35 PID 2800 wrote to memory of 2780 2800 pvjdj.exe 35 PID 2800 wrote to memory of 2780 2800 pvjdj.exe 35 PID 2780 wrote to memory of 2576 2780 frxxrrr.exe 36 PID 2780 wrote to memory of 2576 2780 frxxrrr.exe 36 PID 2780 wrote to memory of 2576 2780 frxxrrr.exe 36 PID 2780 wrote to memory of 2576 2780 frxxrrr.exe 36 PID 2576 wrote to memory of 2184 2576 nnhnth.exe 37 PID 2576 wrote to memory of 2184 2576 nnhnth.exe 37 PID 2576 wrote to memory of 2184 2576 nnhnth.exe 37 PID 2576 wrote to memory of 2184 2576 nnhnth.exe 37 PID 2184 wrote to memory of 644 2184 nnnnbb.exe 38 PID 2184 wrote to memory of 644 2184 nnnnbb.exe 38 PID 2184 wrote to memory of 644 2184 nnnnbb.exe 38 PID 2184 wrote to memory of 644 2184 nnnnbb.exe 38 PID 644 wrote to memory of 2552 644 xxrxlxl.exe 39 PID 644 wrote to memory of 2552 644 xxrxlxl.exe 39 PID 644 wrote to memory of 2552 644 xxrxlxl.exe 39 PID 644 wrote to memory of 2552 644 xxrxlxl.exe 39 PID 2552 wrote to memory of 2884 2552 btntnt.exe 40 PID 2552 wrote to memory of 2884 2552 btntnt.exe 40 PID 2552 wrote to memory of 2884 2552 btntnt.exe 40 PID 2552 wrote to memory of 2884 2552 btntnt.exe 40 PID 2884 wrote to memory of 2904 2884 vddjv.exe 41 PID 2884 wrote to memory of 2904 2884 vddjv.exe 41 PID 2884 wrote to memory of 2904 2884 vddjv.exe 41 PID 2884 wrote to memory of 2904 2884 vddjv.exe 41 PID 2904 wrote to memory of 1056 2904 lrxxrlf.exe 42 PID 2904 wrote to memory of 1056 2904 lrxxrlf.exe 42 PID 2904 wrote to memory of 1056 2904 lrxxrlf.exe 42 PID 2904 wrote to memory of 1056 2904 lrxxrlf.exe 42 PID 1056 wrote to memory of 2304 1056 dpjvd.exe 43 PID 1056 wrote to memory of 2304 1056 dpjvd.exe 43 PID 1056 wrote to memory of 2304 1056 dpjvd.exe 43 PID 1056 wrote to memory of 2304 1056 dpjvd.exe 43 PID 2304 wrote to memory of 1060 2304 1rrxfxl.exe 44 PID 2304 wrote to memory of 1060 2304 1rrxfxl.exe 44 PID 2304 wrote to memory of 1060 2304 1rrxfxl.exe 44 PID 2304 wrote to memory of 1060 2304 1rrxfxl.exe 44 PID 1060 wrote to memory of 1932 1060 vvvpd.exe 45 PID 1060 wrote to memory of 1932 1060 vvvpd.exe 45 PID 1060 wrote to memory of 1932 1060 vvvpd.exe 45 PID 1060 wrote to memory of 1932 1060 vvvpd.exe 45 PID 1932 wrote to memory of 2632 1932 rffxrlr.exe 46 PID 1932 wrote to memory of 2632 1932 rffxrlr.exe 46 PID 1932 wrote to memory of 2632 1932 rffxrlr.exe 46 PID 1932 wrote to memory of 2632 1932 rffxrlr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe"C:\Users\Admin\AppData\Local\Temp\0172c3039fe7e4d5492198ed756fc06213b4c1629347d494c2b247cd23faa6f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\rxxlxfx.exec:\rxxlxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\btnntb.exec:\btnntb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\3fflxlr.exec:\3fflxlr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pvjdj.exec:\pvjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\frxxrrr.exec:\frxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\nnhnth.exec:\nnhnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\nnnnbb.exec:\nnnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\xxrxlxl.exec:\xxrxlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
\??\c:\btntnt.exec:\btntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\vddjv.exec:\vddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\lrxxrlf.exec:\lrxxrlf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\dpjvd.exec:\dpjvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\1rrxfxl.exec:\1rrxfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\vvvpd.exec:\vvvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\rffxrlr.exec:\rffxrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\7vvdj.exec:\7vvdj.exe17⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xrlllxl.exec:\xrlllxl.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3068 -
\??\c:\hhttbb.exec:\hhttbb.exe19⤵
- Executes dropped EXE
PID:2544 -
\??\c:\9lllflx.exec:\9lllflx.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlrlfrr.exec:\rlrlfrr.exe21⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nhbbbt.exec:\nhbbbt.exe22⤵
- Executes dropped EXE
PID:860 -
\??\c:\pjvdv.exec:\pjvdv.exe23⤵
- Executes dropped EXE
PID:2372 -
\??\c:\llfllrl.exec:\llfllrl.exe24⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7thhtb.exec:\7thhtb.exe25⤵
- Executes dropped EXE
PID:788 -
\??\c:\lxlffff.exec:\lxlffff.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5btnhh.exec:\5btnhh.exe27⤵
- Executes dropped EXE
PID:1268 -
\??\c:\dpvvj.exec:\dpvvj.exe28⤵
- Executes dropped EXE
PID:3016 -
\??\c:\3tthnt.exec:\3tthnt.exe29⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ddvdp.exec:\ddvdp.exe30⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hbtthh.exec:\hbtthh.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jjddd.exec:\jjddd.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1fflffl.exec:\1fflffl.exe33⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rrrrxlr.exec:\rrrrxlr.exe34⤵
- Executes dropped EXE
PID:2788 -
\??\c:\tbbnnh.exec:\tbbnnh.exe35⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ddjjv.exec:\ddjjv.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llxflxx.exec:\llxflxx.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fflllfx.exec:\fflllfx.exe38⤵
- Executes dropped EXE
PID:2900 -
\??\c:\7tnthh.exec:\7tnthh.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pvvdp.exec:\pvvdp.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fxrxllr.exec:\fxrxllr.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\tbthbb.exec:\tbthbb.exe42⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vjvjj.exec:\vjvjj.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992 -
\??\c:\rrrrflx.exec:\rrrrflx.exe44⤵
- Executes dropped EXE
PID:644 -
\??\c:\bbbntt.exec:\bbbntt.exe45⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7jvvv.exec:\7jvvv.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\dvdjp.exec:\dvdjp.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\frfxffr.exec:\frfxffr.exe48⤵
- Executes dropped EXE
PID:1796 -
\??\c:\ttbntb.exec:\ttbntb.exe49⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dpvdj.exec:\dpvdj.exe50⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe51⤵
- Executes dropped EXE
PID:2316 -
\??\c:\bbtbnt.exec:\bbtbnt.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pjdjv.exec:\pjdjv.exe53⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrlrrxr.exec:\xrlrrxr.exe54⤵
- Executes dropped EXE
PID:1936 -
\??\c:\nhbhnn.exec:\nhbhnn.exe55⤵
- Executes dropped EXE
PID:320 -
\??\c:\7vddv.exec:\7vddv.exe56⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjvdj.exec:\pjvdj.exe57⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ffrfrfl.exec:\ffrfrfl.exe58⤵
- Executes dropped EXE
PID:2104 -
\??\c:\bbhtnb.exec:\bbhtnb.exe59⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ddvjj.exec:\ddvjj.exe60⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rrlxfrl.exec:\rrlxfrl.exe61⤵
- Executes dropped EXE
PID:968 -
\??\c:\bnbtbt.exec:\bnbtbt.exe62⤵
- Executes dropped EXE
PID:860 -
\??\c:\vvpvj.exec:\vvpvj.exe63⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1rlxlrf.exec:\1rlxlrf.exe64⤵
- Executes dropped EXE
PID:932 -
\??\c:\tnbhnn.exec:\tnbhnn.exe65⤵
- Executes dropped EXE
PID:2540 -
\??\c:\ntthhh.exec:\ntthhh.exe66⤵PID:1740
-
\??\c:\3ppdp.exec:\3ppdp.exe67⤵PID:1844
-
\??\c:\xxxfflr.exec:\xxxfflr.exe68⤵PID:2452
-
\??\c:\1thntb.exec:\1thntb.exe69⤵
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\1vvvp.exec:\1vvvp.exe70⤵PID:1700
-
\??\c:\ffxlffl.exec:\ffxlffl.exe71⤵PID:2016
-
\??\c:\btnbth.exec:\btnbth.exe72⤵PID:1964
-
\??\c:\1jjpd.exec:\1jjpd.exe73⤵PID:2344
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe74⤵PID:2708
-
\??\c:\lrlrxlf.exec:\lrlrxlf.exe75⤵PID:1532
-
\??\c:\3ntbtb.exec:\3ntbtb.exe76⤵PID:2776
-
\??\c:\ppjdj.exec:\ppjdj.exe77⤵PID:2768
-
\??\c:\lfflrxf.exec:\lfflrxf.exe78⤵PID:2696
-
\??\c:\hhbnbb.exec:\hhbnbb.exe79⤵
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\ddpdp.exec:\ddpdp.exe80⤵PID:2832
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe81⤵PID:2568
-
\??\c:\nhhhtt.exec:\nhhhtt.exe82⤵PID:948
-
\??\c:\7pjpv.exec:\7pjpv.exe83⤵PID:2684
-
\??\c:\dvpdj.exec:\dvpdj.exe84⤵PID:2184
-
\??\c:\rfrlrll.exec:\rfrlrll.exe85⤵PID:1120
-
\??\c:\bnnnhh.exec:\bnnnhh.exe86⤵PID:1228
-
\??\c:\pjdjv.exec:\pjdjv.exe87⤵PID:2880
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe88⤵PID:2872
-
\??\c:\3tbntn.exec:\3tbntn.exe89⤵PID:1420
-
\??\c:\bnntbn.exec:\bnntbn.exe90⤵PID:1956
-
\??\c:\5ddpp.exec:\5ddpp.exe91⤵PID:2948
-
\??\c:\frrllrx.exec:\frrllrx.exe92⤵PID:760
-
\??\c:\hhhthn.exec:\hhhthn.exe93⤵PID:2008
-
\??\c:\dvjvp.exec:\dvjvp.exe94⤵PID:780
-
\??\c:\fxrllfr.exec:\fxrllfr.exe95⤵PID:1924
-
\??\c:\llrfxfx.exec:\llrfxfx.exe96⤵PID:1224
-
\??\c:\hnbtbn.exec:\hnbtbn.exe97⤵PID:1624
-
\??\c:\dppvd.exec:\dppvd.exe98⤵PID:3068
-
\??\c:\rxfxfrf.exec:\rxfxfrf.exe99⤵PID:2548
-
\??\c:\htbhhb.exec:\htbhhb.exe100⤵PID:1988
-
\??\c:\ttntbn.exec:\ttntbn.exe101⤵PID:2080
-
\??\c:\5vjpd.exec:\5vjpd.exe102⤵PID:804
-
\??\c:\frxfffr.exec:\frxfffr.exe103⤵PID:1136
-
\??\c:\nhhnhh.exec:\nhhnhh.exe104⤵PID:1848
-
\??\c:\ddpjv.exec:\ddpjv.exe105⤵PID:972
-
\??\c:\xxllrxl.exec:\xxllrxl.exe106⤵PID:2180
-
\??\c:\1dvjp.exec:\1dvjp.exe107⤵PID:2108
-
\??\c:\xxxllfx.exec:\xxxllfx.exe108⤵PID:1492
-
\??\c:\htbtht.exec:\htbtht.exe109⤵PID:1004
-
\??\c:\7dvjv.exec:\7dvjv.exe110⤵PID:1928
-
\??\c:\lrfrxlf.exec:\lrfrxlf.exe111⤵PID:1528
-
\??\c:\nhbbtt.exec:\nhbbtt.exe112⤵PID:2496
-
\??\c:\pjdjd.exec:\pjdjd.exe113⤵PID:2096
-
\??\c:\vvvjd.exec:\vvvjd.exe114⤵PID:2952
-
\??\c:\xrllxxl.exec:\xrllxxl.exe115⤵PID:892
-
\??\c:\hhbbbb.exec:\hhbbbb.exe116⤵PID:2772
-
\??\c:\dvjjj.exec:\dvjjj.exe117⤵PID:1540
-
\??\c:\lxxflrx.exec:\lxxflrx.exe118⤵PID:2816
-
\??\c:\7nthbb.exec:\7nthbb.exe119⤵PID:2680
-
\??\c:\jdppv.exec:\jdppv.exe120⤵PID:2796
-
\??\c:\xfrfxfr.exec:\xfrfxfr.exe121⤵PID:2600
-
\??\c:\lfxxflr.exec:\lfxxflr.exe122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-