Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 21:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe
-
Size
456KB
-
MD5
547daad7af969af1acbeee22159442f0
-
SHA1
d427988b5631732a6b8f44c606fb95f9ced4a6dc
-
SHA256
4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834
-
SHA512
4fbbbee74ea0a08727627a12e1d3babd76cf97ff896359d0842f25ff9c80efdc1d7aa6d92b6c453afeb2aaf5c26fef62acb212b6f0d55795fd57876b597ea9c5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbelm:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-33-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2164-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-103-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/668-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1444-169-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1200-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-198-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2420-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-275-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2904-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-395-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1316-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-427-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-441-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2944-448-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-543-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-642-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2780-658-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2456-663-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2408-779-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1692-792-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1300-1003-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-1035-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1284 dddjj.exe 2388 tnntbh.exe 2164 dvppv.exe 2896 nththn.exe 2788 pjddj.exe 2644 1fxxlrx.exe 2928 dppvv.exe 1992 xfrxlff.exe 2688 bttbbb.exe 1804 frlxlfl.exe 668 lllxlrx.exe 1092 bbthnt.exe 2976 3lflrxl.exe 776 hhtnhb.exe 2712 jjdjj.exe 1680 7btbnn.exe 1444 5pjpd.exe 1200 xxlxllx.exe 2060 nbbbhn.exe 1160 ddpvp.exe 2420 xrrxxfr.exe 912 7bnhbh.exe 2288 jdjpv.exe 1544 flxxlrl.exe 2264 nhtthh.exe 2560 dvpdp.exe 2320 xxllllr.exe 572 hbhnth.exe 760 9hhnth.exe 832 ffxxrrf.exe 1612 xxlxlrx.exe 2724 dvddj.exe 1120 pjvjv.exe 2480 ntthnt.exe 2736 hbtnbh.exe 2904 jdvdj.exe 2948 lffrxfx.exe 2788 9xlrxfl.exe 2156 5ttthn.exe 2676 bbtthn.exe 2812 jdvdp.exe 2716 ddvdp.exe 1984 xrfxrxx.exe 2456 frrxxrl.exe 1804 5hhtbh.exe 1316 3ddjd.exe 1536 ppjvv.exe 2960 nnhhbb.exe 2976 bnbttb.exe 2944 dpjpd.exe 1880 llxllrf.exe 2968 tnbbnt.exe 3020 5vjjv.exe 1776 vjvdj.exe 2352 9ffrflr.exe 2436 bnhntb.exe 1332 vpppv.exe 2416 frflrrf.exe 1840 1frlxxr.exe 1652 bbhbbt.exe 1988 3jvjp.exe 2288 rrrlrxf.exe 1320 lxlrxrl.exe 1692 nhbbnh.exe -
resource yara_rule behavioral1/memory/2612-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-573-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-869-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-901-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-944-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-983-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-1003-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-1043-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2612 wrote to memory of 1284 2612 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 30 PID 2612 wrote to memory of 1284 2612 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 30 PID 2612 wrote to memory of 1284 2612 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 30 PID 2612 wrote to memory of 1284 2612 4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe 30 PID 1284 wrote to memory of 2388 1284 dddjj.exe 31 PID 1284 wrote to memory of 2388 1284 dddjj.exe 31 PID 1284 wrote to memory of 2388 1284 dddjj.exe 31 PID 1284 wrote to memory of 2388 1284 dddjj.exe 31 PID 2388 wrote to memory of 2164 2388 tnntbh.exe 32 PID 2388 wrote to memory of 2164 2388 tnntbh.exe 32 PID 2388 wrote to memory of 2164 2388 tnntbh.exe 32 PID 2388 wrote to memory of 2164 2388 tnntbh.exe 32 PID 2164 wrote to memory of 2896 2164 dvppv.exe 33 PID 2164 wrote to memory of 2896 2164 dvppv.exe 33 PID 2164 wrote to memory of 2896 2164 dvppv.exe 33 PID 2164 wrote to memory of 2896 2164 dvppv.exe 33 PID 2896 wrote to memory of 2788 2896 nththn.exe 34 PID 2896 wrote to memory of 2788 2896 nththn.exe 34 PID 2896 wrote to memory of 2788 2896 nththn.exe 34 PID 2896 wrote to memory of 2788 2896 nththn.exe 34 PID 2788 wrote to memory of 2644 2788 pjddj.exe 35 PID 2788 wrote to memory of 2644 2788 pjddj.exe 35 PID 2788 wrote to memory of 2644 2788 pjddj.exe 35 PID 2788 wrote to memory of 2644 2788 pjddj.exe 35 PID 2644 wrote to memory of 2928 2644 1fxxlrx.exe 36 PID 2644 wrote to memory of 2928 2644 1fxxlrx.exe 36 PID 2644 wrote to memory of 2928 2644 1fxxlrx.exe 36 PID 2644 wrote to memory of 2928 2644 1fxxlrx.exe 36 PID 2928 wrote to memory of 1992 2928 dppvv.exe 37 PID 2928 wrote to memory of 1992 2928 dppvv.exe 37 PID 2928 wrote to memory of 1992 2928 dppvv.exe 37 PID 2928 wrote to memory of 1992 2928 dppvv.exe 37 PID 1992 wrote to memory of 2688 1992 xfrxlff.exe 38 PID 1992 wrote to memory of 2688 1992 xfrxlff.exe 38 PID 1992 wrote to memory of 2688 1992 xfrxlff.exe 38 PID 1992 wrote to memory of 2688 1992 xfrxlff.exe 38 PID 2688 wrote to memory of 1804 2688 bttbbb.exe 39 PID 2688 wrote to memory of 1804 2688 bttbbb.exe 39 PID 2688 wrote to memory of 1804 2688 bttbbb.exe 39 PID 2688 wrote to memory of 1804 2688 bttbbb.exe 39 PID 1804 wrote to memory of 668 1804 frlxlfl.exe 40 PID 1804 wrote to memory of 668 1804 frlxlfl.exe 40 PID 1804 wrote to memory of 668 1804 frlxlfl.exe 40 PID 1804 wrote to memory of 668 1804 frlxlfl.exe 40 PID 668 wrote to memory of 1092 668 lllxlrx.exe 41 PID 668 wrote to memory of 1092 668 lllxlrx.exe 41 PID 668 wrote to memory of 1092 668 lllxlrx.exe 41 PID 668 wrote to memory of 1092 668 lllxlrx.exe 41 PID 1092 wrote to memory of 2976 1092 bbthnt.exe 42 PID 1092 wrote to memory of 2976 1092 bbthnt.exe 42 PID 1092 wrote to memory of 2976 1092 bbthnt.exe 42 PID 1092 wrote to memory of 2976 1092 bbthnt.exe 42 PID 2976 wrote to memory of 776 2976 3lflrxl.exe 43 PID 2976 wrote to memory of 776 2976 3lflrxl.exe 43 PID 2976 wrote to memory of 776 2976 3lflrxl.exe 43 PID 2976 wrote to memory of 776 2976 3lflrxl.exe 43 PID 776 wrote to memory of 2712 776 hhtnhb.exe 44 PID 776 wrote to memory of 2712 776 hhtnhb.exe 44 PID 776 wrote to memory of 2712 776 hhtnhb.exe 44 PID 776 wrote to memory of 2712 776 hhtnhb.exe 44 PID 2712 wrote to memory of 1680 2712 jjdjj.exe 45 PID 2712 wrote to memory of 1680 2712 jjdjj.exe 45 PID 2712 wrote to memory of 1680 2712 jjdjj.exe 45 PID 2712 wrote to memory of 1680 2712 jjdjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe"C:\Users\Admin\AppData\Local\Temp\4f8a068ee18452636a46d0664588af2ab27499d8265bb48f3e71a7163af2b834N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\dddjj.exec:\dddjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\tnntbh.exec:\tnntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvppv.exec:\dvppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\nththn.exec:\nththn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pjddj.exec:\pjddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1fxxlrx.exec:\1fxxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\dppvv.exec:\dppvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xfrxlff.exec:\xfrxlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bttbbb.exec:\bttbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\frlxlfl.exec:\frlxlfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\lllxlrx.exec:\lllxlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\bbthnt.exec:\bbthnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\3lflrxl.exec:\3lflrxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hhtnhb.exec:\hhtnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\jjdjj.exec:\jjdjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\7btbnn.exec:\7btbnn.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5pjpd.exec:\5pjpd.exe18⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xxlxllx.exec:\xxlxllx.exe19⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nbbbhn.exec:\nbbbhn.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddpvp.exec:\ddpvp.exe21⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xrrxxfr.exec:\xrrxxfr.exe22⤵
- Executes dropped EXE
PID:2420 -
\??\c:\7bnhbh.exec:\7bnhbh.exe23⤵
- Executes dropped EXE
PID:912 -
\??\c:\jdjpv.exec:\jdjpv.exe24⤵
- Executes dropped EXE
PID:2288 -
\??\c:\flxxlrl.exec:\flxxlrl.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhtthh.exec:\nhtthh.exe26⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dvpdp.exec:\dvpdp.exe27⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xxllllr.exec:\xxllllr.exe28⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hbhnth.exec:\hbhnth.exe29⤵
- Executes dropped EXE
PID:572 -
\??\c:\9hhnth.exec:\9hhnth.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\ffxxrrf.exec:\ffxxrrf.exe31⤵
- Executes dropped EXE
PID:832 -
\??\c:\xxlxlrx.exec:\xxlxlrx.exe32⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvddj.exec:\dvddj.exe33⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjvjv.exec:\pjvjv.exe34⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ntthnt.exec:\ntthnt.exe35⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hbtnbh.exec:\hbtnbh.exe36⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jdvdj.exec:\jdvdj.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lffrxfx.exec:\lffrxfx.exe38⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9xlrxfl.exec:\9xlrxfl.exe39⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5ttthn.exec:\5ttthn.exe40⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bbtthn.exec:\bbtthn.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jdvdp.exec:\jdvdp.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ddvdp.exec:\ddvdp.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe44⤵
- Executes dropped EXE
PID:1984 -
\??\c:\frrxxrl.exec:\frrxxrl.exe45⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5hhtbh.exec:\5hhtbh.exe46⤵
- Executes dropped EXE
PID:1804 -
\??\c:\3ddjd.exec:\3ddjd.exe47⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ppjvv.exec:\ppjvv.exe48⤵
- Executes dropped EXE
PID:1536 -
\??\c:\nnhhbb.exec:\nnhhbb.exe49⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bnbttb.exec:\bnbttb.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dpjpd.exec:\dpjpd.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\llxllrf.exec:\llxllrf.exe52⤵
- Executes dropped EXE
PID:1880 -
\??\c:\tnbbnt.exec:\tnbbnt.exe53⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5vjjv.exec:\5vjjv.exe54⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vjvdj.exec:\vjvdj.exe55⤵
- Executes dropped EXE
PID:1776 -
\??\c:\9ffrflr.exec:\9ffrflr.exe56⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bnhntb.exec:\bnhntb.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpppv.exec:\vpppv.exe58⤵
- Executes dropped EXE
PID:1332 -
\??\c:\frflrrf.exec:\frflrrf.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\1frlxxr.exec:\1frlxxr.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\bbhbbt.exec:\bbhbbt.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\3jvjp.exec:\3jvjp.exe62⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rrrlrxf.exec:\rrrlrxf.exe63⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxlrxrl.exec:\lxlrxrl.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\nhbbnh.exec:\nhbbnh.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\jpdjp.exec:\jpdjp.exe66⤵PID:1800
-
\??\c:\llxfrfl.exec:\llxfrfl.exe67⤵PID:2560
-
\??\c:\7httnn.exec:\7httnn.exe68⤵PID:1876
-
\??\c:\jddjv.exec:\jddjv.exe69⤵PID:2076
-
\??\c:\9frllrx.exec:\9frllrx.exe70⤵PID:1520
-
\??\c:\hbtntn.exec:\hbtntn.exe71⤵PID:3068
-
\??\c:\vdjdp.exec:\vdjdp.exe72⤵PID:832
-
\??\c:\rfrlxlx.exec:\rfrlxlx.exe73⤵PID:2488
-
\??\c:\5rfxxxx.exec:\5rfxxxx.exe74⤵PID:1100
-
\??\c:\nhbtbb.exec:\nhbtbb.exe75⤵PID:2728
-
\??\c:\pdppv.exec:\pdppv.exe76⤵PID:2784
-
\??\c:\rlfxllx.exec:\rlfxllx.exe77⤵PID:340
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe78⤵PID:2900
-
\??\c:\btnbtb.exec:\btnbtb.exe79⤵PID:2440
-
\??\c:\ddvdj.exec:\ddvdj.exe80⤵PID:2776
-
\??\c:\3vdvd.exec:\3vdvd.exe81⤵PID:2840
-
\??\c:\1frflrx.exec:\1frflrx.exe82⤵PID:2836
-
\??\c:\3bnbnn.exec:\3bnbnn.exe83⤵PID:2936
-
\??\c:\5vdpv.exec:\5vdpv.exe84⤵PID:2780
-
\??\c:\xlxxllr.exec:\xlxxllr.exe85⤵PID:2812
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe86⤵PID:2376
-
\??\c:\7bbtth.exec:\7bbtth.exe87⤵PID:556
-
\??\c:\dvjdp.exec:\dvjdp.exe88⤵PID:2456
-
\??\c:\5frxrrf.exec:\5frxrrf.exe89⤵PID:668
-
\??\c:\bbhtht.exec:\bbhtht.exe90⤵PID:1016
-
\??\c:\dpdpv.exec:\dpdpv.exe91⤵PID:2932
-
\??\c:\vdvvv.exec:\vdvvv.exe92⤵PID:2024
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe93⤵PID:2940
-
\??\c:\rlrrffr.exec:\rlrrffr.exe94⤵PID:888
-
\??\c:\hhhbbt.exec:\hhhbbt.exe95⤵PID:1792
-
\??\c:\dvjvj.exec:\dvjvj.exe96⤵PID:1576
-
\??\c:\xxxxxlf.exec:\xxxxxlf.exe97⤵PID:1444
-
\??\c:\frlfxxr.exec:\frlfxxr.exe98⤵PID:1948
-
\??\c:\nhttnt.exec:\nhttnt.exe99⤵PID:2260
-
\??\c:\7pdpj.exec:\7pdpj.exe100⤵PID:2128
-
\??\c:\vpvvv.exec:\vpvvv.exe101⤵PID:2136
-
\??\c:\lxfrxxr.exec:\lxfrxxr.exe102⤵
- System Location Discovery: System Language Discovery
PID:636 -
\??\c:\bnbtbh.exec:\bnbtbh.exe103⤵PID:2416
-
\??\c:\bbnnhh.exec:\bbnnhh.exe104⤵PID:2740
-
\??\c:\pjjjj.exec:\pjjjj.exe105⤵PID:2620
-
\??\c:\rlflrxl.exec:\rlflrxl.exe106⤵PID:344
-
\??\c:\3hnntb.exec:\3hnntb.exe107⤵
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\bthhnh.exec:\bthhnh.exe108⤵PID:2184
-
\??\c:\vpjdp.exec:\vpjdp.exe109⤵PID:1692
-
\??\c:\xlxfllx.exec:\xlxfllx.exe110⤵PID:1756
-
\??\c:\tnbbtb.exec:\tnbbtb.exe111⤵PID:2236
-
\??\c:\jvdvp.exec:\jvdvp.exe112⤵PID:3052
-
\??\c:\9xflxxx.exec:\9xflxxx.exe113⤵PID:892
-
\??\c:\rfrrflx.exec:\rfrrflx.exe114⤵PID:1520
-
\??\c:\thbbnt.exec:\thbbnt.exe115⤵PID:1620
-
\??\c:\3tbbnt.exec:\3tbbnt.exe116⤵PID:2084
-
\??\c:\vjjjj.exec:\vjjjj.exe117⤵PID:1284
-
\??\c:\xrllrxr.exec:\xrllrxr.exe118⤵PID:1100
-
\??\c:\9lllflx.exec:\9lllflx.exe119⤵PID:1120
-
\??\c:\tnnbnh.exec:\tnnbnh.exe120⤵PID:2784
-
\??\c:\jjjjp.exec:\jjjjp.exe121⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-