Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe
-
Size
453KB
-
MD5
251605947aa55248a351d79ce6d554af
-
SHA1
2f8af7b407d9be61f8e76313b87ecdf5c0615622
-
SHA256
56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b
-
SHA512
2d95d3e701fd8e8257a9792d66de9e56ed18668a1e4adfb1b7f1d104359db8b4ebaccc4eaab52f472b3a75b967a18498112a1ba7c9b5de82fba496a33ce2cc0b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/1928-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1912-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-211-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/676-296-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1192-293-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2544-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-354-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-482-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1744-489-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2432-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-530-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2784-604-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2724-611-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2628-655-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-682-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-689-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/924-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-824-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-911-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2360 bntbhn.exe 3056 jpjvd.exe 804 vvjvv.exe 2684 ttbnnh.exe 2816 vdjjp.exe 2700 fxxxrrf.exe 2864 rrxxxlr.exe 2240 xxrfxff.exe 2576 xrlrlxl.exe 2744 ffrxxxl.exe 2204 xfxlfrx.exe 2028 bhbnbn.exe 1680 bbhbbt.exe 1876 vvjjd.exe 2000 vvpvj.exe 1724 ffxrlrr.exe 288 9jdjp.exe 2908 5lxrlrl.exe 2964 tbhbbb.exe 2416 dvjvv.exe 1204 fxffffr.exe 1080 1rfxflf.exe 1912 hbttbh.exe 1616 lflrrlf.exe 1796 fxxfrfr.exe 1380 nnbhhb.exe 1468 lrxxflx.exe 676 3lrlrxx.exe 2436 9lxxrlx.exe 1764 1hhnth.exe 1192 rflllll.exe 2544 hnthtb.exe 1568 hththn.exe 2504 1jdvd.exe 2236 xrlxfrf.exe 2724 5tbbhb.exe 2872 pjjvv.exe 2692 3ppdp.exe 2700 nttthh.exe 2600 bbbhnn.exe 2788 xlxxxrr.exe 2608 xxlrrxr.exe 2648 tbhtnt.exe 2744 jdpjv.exe 2564 3fflrxf.exe 2764 5llxrff.exe 2020 tnntnb.exe 2324 jpjpp.exe 236 llfrrxl.exe 1872 hhntht.exe 2004 pvvjp.exe 1348 jppdv.exe 2916 lfflxrl.exe 2812 nntbtb.exe 2268 vvvvj.exe 2256 5xrxlxl.exe 2416 rrrrxfx.exe 1068 tbhtnn.exe 1744 jdppv.exe 2148 rrfxfrr.exe 624 thbbth.exe 924 7jvvv.exe 1616 xfrrrll.exe 2432 xffrlxx.exe -
resource yara_rule behavioral1/memory/1928-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-114-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2028-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/676-265-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1380-276-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2436-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-334-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2872-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-354-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2600-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-482-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2432-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-530-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2196-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-604-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2724-611-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2984-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-682-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/924-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-912-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-956-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-1048-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2360 1928 56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe 31 PID 1928 wrote to memory of 2360 1928 56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe 31 PID 1928 wrote to memory of 2360 1928 56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe 31 PID 1928 wrote to memory of 2360 1928 56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe 31 PID 2360 wrote to memory of 3056 2360 bntbhn.exe 32 PID 2360 wrote to memory of 3056 2360 bntbhn.exe 32 PID 2360 wrote to memory of 3056 2360 bntbhn.exe 32 PID 2360 wrote to memory of 3056 2360 bntbhn.exe 32 PID 3056 wrote to memory of 804 3056 jpjvd.exe 33 PID 3056 wrote to memory of 804 3056 jpjvd.exe 33 PID 3056 wrote to memory of 804 3056 jpjvd.exe 33 PID 3056 wrote to memory of 804 3056 jpjvd.exe 33 PID 804 wrote to memory of 2684 804 vvjvv.exe 34 PID 804 wrote to memory of 2684 804 vvjvv.exe 34 PID 804 wrote to memory of 2684 804 vvjvv.exe 34 PID 804 wrote to memory of 2684 804 vvjvv.exe 34 PID 2684 wrote to memory of 2816 2684 ttbnnh.exe 35 PID 2684 wrote to memory of 2816 2684 ttbnnh.exe 35 PID 2684 wrote to memory of 2816 2684 ttbnnh.exe 35 PID 2684 wrote to memory of 2816 2684 ttbnnh.exe 35 PID 2816 wrote to memory of 2700 2816 vdjjp.exe 36 PID 2816 wrote to memory of 2700 2816 vdjjp.exe 36 PID 2816 wrote to memory of 2700 2816 vdjjp.exe 36 PID 2816 wrote to memory of 2700 2816 vdjjp.exe 36 PID 2700 wrote to memory of 2864 2700 fxxxrrf.exe 37 PID 2700 wrote to memory of 2864 2700 fxxxrrf.exe 37 PID 2700 wrote to memory of 2864 2700 fxxxrrf.exe 37 PID 2700 wrote to memory of 2864 2700 fxxxrrf.exe 37 PID 2864 wrote to memory of 2240 2864 rrxxxlr.exe 38 PID 2864 wrote to memory of 2240 2864 rrxxxlr.exe 38 PID 2864 wrote to memory of 2240 2864 rrxxxlr.exe 38 PID 2864 wrote to memory of 2240 2864 rrxxxlr.exe 38 PID 2240 wrote to memory of 2576 2240 xxrfxff.exe 39 PID 2240 wrote to memory of 2576 2240 xxrfxff.exe 39 PID 2240 wrote to memory of 2576 2240 xxrfxff.exe 39 PID 2240 wrote to memory of 2576 2240 xxrfxff.exe 39 PID 2576 wrote to memory of 2744 2576 xrlrlxl.exe 40 PID 2576 wrote to memory of 2744 2576 xrlrlxl.exe 40 PID 2576 wrote to memory of 2744 2576 xrlrlxl.exe 40 PID 2576 wrote to memory of 2744 2576 xrlrlxl.exe 40 PID 2744 wrote to memory of 2204 2744 ffrxxxl.exe 41 PID 2744 wrote to memory of 2204 2744 ffrxxxl.exe 41 PID 2744 wrote to memory of 2204 2744 ffrxxxl.exe 41 PID 2744 wrote to memory of 2204 2744 ffrxxxl.exe 41 PID 2204 wrote to memory of 2028 2204 xfxlfrx.exe 42 PID 2204 wrote to memory of 2028 2204 xfxlfrx.exe 42 PID 2204 wrote to memory of 2028 2204 xfxlfrx.exe 42 PID 2204 wrote to memory of 2028 2204 xfxlfrx.exe 42 PID 2028 wrote to memory of 1680 2028 bhbnbn.exe 43 PID 2028 wrote to memory of 1680 2028 bhbnbn.exe 43 PID 2028 wrote to memory of 1680 2028 bhbnbn.exe 43 PID 2028 wrote to memory of 1680 2028 bhbnbn.exe 43 PID 1680 wrote to memory of 1876 1680 bbhbbt.exe 44 PID 1680 wrote to memory of 1876 1680 bbhbbt.exe 44 PID 1680 wrote to memory of 1876 1680 bbhbbt.exe 44 PID 1680 wrote to memory of 1876 1680 bbhbbt.exe 44 PID 1876 wrote to memory of 2000 1876 vvjjd.exe 45 PID 1876 wrote to memory of 2000 1876 vvjjd.exe 45 PID 1876 wrote to memory of 2000 1876 vvjjd.exe 45 PID 1876 wrote to memory of 2000 1876 vvjjd.exe 45 PID 2000 wrote to memory of 1724 2000 vvpvj.exe 46 PID 2000 wrote to memory of 1724 2000 vvpvj.exe 46 PID 2000 wrote to memory of 1724 2000 vvpvj.exe 46 PID 2000 wrote to memory of 1724 2000 vvpvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe"C:\Users\Admin\AppData\Local\Temp\56cdee8d858e0c4345dc6fb295bea32b2439009247ec43a9339f13424b0e639b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bntbhn.exec:\bntbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jpjvd.exec:\jpjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vvjvv.exec:\vvjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\ttbnnh.exec:\ttbnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\vdjjp.exec:\vdjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rrxxxlr.exec:\rrxxxlr.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xxrfxff.exec:\xxrfxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\xrlrlxl.exec:\xrlrlxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ffrxxxl.exec:\ffrxxxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xfxlfrx.exec:\xfxlfrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\bhbnbn.exec:\bhbnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\bbhbbt.exec:\bbhbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\vvjjd.exec:\vvjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\vvpvj.exec:\vvpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\ffxrlrr.exec:\ffxrlrr.exe17⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9jdjp.exec:\9jdjp.exe18⤵
- Executes dropped EXE
PID:288 -
\??\c:\5lxrlrl.exec:\5lxrlrl.exe19⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tbhbbb.exec:\tbhbbb.exe20⤵
- Executes dropped EXE
PID:2964 -
\??\c:\dvjvv.exec:\dvjvv.exe21⤵
- Executes dropped EXE
PID:2416 -
\??\c:\fxffffr.exec:\fxffffr.exe22⤵
- Executes dropped EXE
PID:1204 -
\??\c:\1rfxflf.exec:\1rfxflf.exe23⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hbttbh.exec:\hbttbh.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lflrrlf.exec:\lflrrlf.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxxfrfr.exec:\fxxfrfr.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\nnbhhb.exec:\nnbhhb.exe27⤵
- Executes dropped EXE
PID:1380 -
\??\c:\lrxxflx.exec:\lrxxflx.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\3lrlrxx.exec:\3lrlrxx.exe29⤵
- Executes dropped EXE
PID:676 -
\??\c:\9lxxrlx.exec:\9lxxrlx.exe30⤵
- Executes dropped EXE
PID:2436 -
\??\c:\1hhnth.exec:\1hhnth.exe31⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rflllll.exec:\rflllll.exe32⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hnthtb.exec:\hnthtb.exe33⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hththn.exec:\hththn.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1jdvd.exec:\1jdvd.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrlxfrf.exec:\xrlxfrf.exe36⤵
- Executes dropped EXE
PID:2236 -
\??\c:\5tbbhb.exec:\5tbbhb.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjjvv.exec:\pjjvv.exe38⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3ppdp.exec:\3ppdp.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nttthh.exec:\nttthh.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbbhnn.exec:\bbbhnn.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xlxxxrr.exec:\xlxxxrr.exe42⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xxlrrxr.exec:\xxlrrxr.exe43⤵
- Executes dropped EXE
PID:2608 -
\??\c:\tbhtnt.exec:\tbhtnt.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\jdpjv.exec:\jdpjv.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\3fflrxf.exec:\3fflrxf.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5llxrff.exec:\5llxrff.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tnntnb.exec:\tnntnb.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\jpjpp.exec:\jpjpp.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\llfrrxl.exec:\llfrrxl.exe50⤵
- Executes dropped EXE
PID:236 -
\??\c:\hhntht.exec:\hhntht.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pvvjp.exec:\pvvjp.exe52⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jppdv.exec:\jppdv.exe53⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lfflxrl.exec:\lfflxrl.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nntbtb.exec:\nntbtb.exe55⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vvvvj.exec:\vvvvj.exe56⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5xrxlxl.exec:\5xrxlxl.exe57⤵
- Executes dropped EXE
PID:2256 -
\??\c:\rrrrxfx.exec:\rrrrxfx.exe58⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tbhtnn.exec:\tbhtnn.exe59⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jdppv.exec:\jdppv.exe60⤵
- Executes dropped EXE
PID:1744 -
\??\c:\rrfxfrr.exec:\rrfxfrr.exe61⤵
- Executes dropped EXE
PID:2148 -
\??\c:\thbbth.exec:\thbbth.exe62⤵
- Executes dropped EXE
PID:624 -
\??\c:\7jvvv.exec:\7jvvv.exe63⤵
- Executes dropped EXE
PID:924 -
\??\c:\xfrrrll.exec:\xfrrrll.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xffrlxx.exec:\xffrlxx.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\nntnbh.exec:\nntnbh.exe66⤵PID:3028
-
\??\c:\dpvjp.exec:\dpvjp.exe67⤵PID:1468
-
\??\c:\rxrxxrr.exec:\rxrxxrr.exe68⤵PID:336
-
\??\c:\hbthbb.exec:\hbthbb.exe69⤵PID:884
-
\??\c:\jdvdp.exec:\jdvdp.exe70⤵PID:2436
-
\??\c:\lfxllxr.exec:\lfxllxr.exe71⤵PID:2196
-
\??\c:\3htbth.exec:\3htbth.exe72⤵PID:2968
-
\??\c:\jpdpp.exec:\jpdpp.exe73⤵PID:1192
-
\??\c:\ddpjp.exec:\ddpjp.exe74⤵PID:2064
-
\??\c:\llflxxl.exec:\llflxxl.exe75⤵PID:1864
-
\??\c:\bnbnbn.exec:\bnbnbn.exe76⤵PID:108
-
\??\c:\vpjpd.exec:\vpjpd.exe77⤵PID:2060
-
\??\c:\xrffrrr.exec:\xrffrrr.exe78⤵PID:2784
-
\??\c:\flflxfx.exec:\flflxfx.exe79⤵PID:2724
-
\??\c:\tnhntb.exec:\tnhntb.exe80⤵PID:2984
-
\??\c:\jjvpj.exec:\jjvpj.exe81⤵PID:2936
-
\??\c:\xfxlxxr.exec:\xfxlxxr.exe82⤵PID:2604
-
\??\c:\1btnbn.exec:\1btnbn.exe83⤵PID:2624
-
\??\c:\nnbnhn.exec:\nnbnhn.exe84⤵PID:2588
-
\??\c:\1vpdd.exec:\1vpdd.exe85⤵PID:3064
-
\??\c:\xxxrrrf.exec:\xxxrrrf.exe86⤵PID:2628
-
\??\c:\ttnhhn.exec:\ttnhhn.exe87⤵PID:1916
-
\??\c:\dvvdj.exec:\dvvdj.exe88⤵PID:2100
-
\??\c:\jpvjd.exec:\jpvjd.exe89⤵PID:2068
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe90⤵PID:1632
-
\??\c:\tnhnbt.exec:\tnhnbt.exe91⤵PID:1680
-
\??\c:\jdjvd.exec:\jdjvd.exe92⤵PID:1884
-
\??\c:\rxxrfrf.exec:\rxxrfrf.exe93⤵PID:1940
-
\??\c:\bbbnht.exec:\bbbnht.exe94⤵PID:1980
-
\??\c:\9bnnhn.exec:\9bnnhn.exe95⤵PID:1152
-
\??\c:\jjvpv.exec:\jjvpv.exe96⤵PID:2840
-
\??\c:\rxrfxfr.exec:\rxrfxfr.exe97⤵PID:2920
-
\??\c:\hhbtht.exec:\hhbtht.exe98⤵PID:2928
-
\??\c:\jjjjp.exec:\jjjjp.exe99⤵PID:2220
-
\??\c:\dvpvj.exec:\dvpvj.exe100⤵PID:684
-
\??\c:\xxxllrf.exec:\xxxllrf.exe101⤵PID:2224
-
\??\c:\7bbbnb.exec:\7bbbnb.exe102⤵PID:2296
-
\??\c:\pjppv.exec:\pjppv.exe103⤵PID:2192
-
\??\c:\jvvdj.exec:\jvvdj.exe104⤵PID:2400
-
\??\c:\9lfllxf.exec:\9lfllxf.exe105⤵PID:1524
-
\??\c:\btbhth.exec:\btbhth.exe106⤵PID:924
-
\??\c:\pppvj.exec:\pppvj.exe107⤵PID:2156
-
\??\c:\ppjdp.exec:\ppjdp.exe108⤵PID:2432
-
\??\c:\lllxrxr.exec:\lllxrxr.exe109⤵PID:2108
-
\??\c:\ntnhtb.exec:\ntnhtb.exe110⤵PID:872
-
\??\c:\btnbbt.exec:\btnbbt.exe111⤵PID:616
-
\??\c:\ddvdj.exec:\ddvdj.exe112⤵PID:1732
-
\??\c:\fxrfrxl.exec:\fxrfrxl.exe113⤵PID:2140
-
\??\c:\hhbnnt.exec:\hhbnnt.exe114⤵PID:740
-
\??\c:\pdpjj.exec:\pdpjj.exe115⤵PID:2332
-
\??\c:\dvpdv.exec:\dvpdv.exe116⤵PID:2360
-
\??\c:\rlffxfx.exec:\rlffxfx.exe117⤵PID:1688
-
\??\c:\ttnthn.exec:\ttnthn.exe118⤵PID:2768
-
\??\c:\jvvjv.exec:\jvvjv.exe119⤵PID:2320
-
\??\c:\lllrxfl.exec:\lllrxfl.exe120⤵PID:2704
-
\??\c:\3rlrxfr.exec:\3rlrxfr.exe121⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-