Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe
-
Size
454KB
-
MD5
3f9db2758417d115184a015cf636bfb0
-
SHA1
3748df36dc4ed5695609e5bd13c8ccb7ac26968a
-
SHA256
99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cb
-
SHA512
0aae71b06b9fe2db48441fd7a7366973928b63fce86f53d918ebdfff0d23b238ce353ccaa7a4dcd9a168ae8d7af4e65dd26c9b3d89ec6ab00c89f38139f6da2d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1G:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2352-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-24-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2760-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-82-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2384-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-208-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/404-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-242-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/316-247-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-287-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-299-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2292-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-388-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1836-395-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2592-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-411-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1568-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-477-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3028-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-505-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/404-512-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/952-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-520-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1716-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-524-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/852-537-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-602-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2708-634-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-675-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-696-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-746-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-785-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2124-822-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-978-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2544 3djdd.exe 2152 fflrflf.exe 2220 htnbhn.exe 2760 fxrfllf.exe 2280 tthnbt.exe 2924 pdjjj.exe 2588 llxfffx.exe 2764 hbthtt.exe 2384 7lxffxr.exe 2576 pjdpd.exe 2988 ffxflxr.exe 3016 jddjv.exe 1740 tthttb.exe 2360 hhbnbn.exe 864 bbthtn.exe 2872 jjpjp.exe 1360 nhhbbh.exe 2896 lfxlflx.exe 592 rrxrrlf.exe 1088 7dvdj.exe 776 5nbhhn.exe 2168 3vjjp.exe 404 rrrfrfx.exe 1512 bbtbnh.exe 1636 7djpj.exe 316 1dvdd.exe 1648 nnnhbt.exe 2260 lrrrfxl.exe 3052 pdpdp.exe 616 xxfxlxx.exe 2640 3vppj.exe 2968 rxxfrrl.exe 2352 pvdpp.exe 1496 1fflrxl.exe 2540 hnbnht.exe 1856 5btbhn.exe 2292 vdjpp.exe 2264 lllrxrl.exe 3008 nttthb.exe 2784 5jdjj.exe 2704 xrrxlrf.exe 2912 hbtnbn.exe 1836 jjdpv.exe 2620 3rrfxlx.exe 2752 tbtbhh.exe 2384 vppvd.exe 2592 3jdpd.exe 2996 lflxfrr.exe 2036 bbbnbt.exe 1624 1jvdp.exe 1568 xxlxrxf.exe 1832 hhthnb.exe 1404 dvppd.exe 1992 7flfxfx.exe 1684 hbntth.exe 2868 dvvpp.exe 2088 xxrrffx.exe 988 nhtbhn.exe 2052 tbbbht.exe 3028 5jjdj.exe 2412 lxlxrfr.exe 1576 7nnbnn.exe 404 7bbhht.exe 952 rxxlffr.exe -
resource yara_rule behavioral1/memory/2352-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/404-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-225-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1636-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-247-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1648-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-323-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2292-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-388-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2592-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-477-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/3028-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-537-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1644-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-602-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2708-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-785-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2124-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-903-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3008-910-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-978-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/836-1015-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-1040-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-1065-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrxrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2544 2352 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 30 PID 2352 wrote to memory of 2544 2352 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 30 PID 2352 wrote to memory of 2544 2352 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 30 PID 2352 wrote to memory of 2544 2352 99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe 30 PID 2544 wrote to memory of 2152 2544 3djdd.exe 31 PID 2544 wrote to memory of 2152 2544 3djdd.exe 31 PID 2544 wrote to memory of 2152 2544 3djdd.exe 31 PID 2544 wrote to memory of 2152 2544 3djdd.exe 31 PID 2152 wrote to memory of 2220 2152 fflrflf.exe 32 PID 2152 wrote to memory of 2220 2152 fflrflf.exe 32 PID 2152 wrote to memory of 2220 2152 fflrflf.exe 32 PID 2152 wrote to memory of 2220 2152 fflrflf.exe 32 PID 2220 wrote to memory of 2760 2220 htnbhn.exe 33 PID 2220 wrote to memory of 2760 2220 htnbhn.exe 33 PID 2220 wrote to memory of 2760 2220 htnbhn.exe 33 PID 2220 wrote to memory of 2760 2220 htnbhn.exe 33 PID 2760 wrote to memory of 2280 2760 fxrfllf.exe 34 PID 2760 wrote to memory of 2280 2760 fxrfllf.exe 34 PID 2760 wrote to memory of 2280 2760 fxrfllf.exe 34 PID 2760 wrote to memory of 2280 2760 fxrfllf.exe 34 PID 2280 wrote to memory of 2924 2280 tthnbt.exe 35 PID 2280 wrote to memory of 2924 2280 tthnbt.exe 35 PID 2280 wrote to memory of 2924 2280 tthnbt.exe 35 PID 2280 wrote to memory of 2924 2280 tthnbt.exe 35 PID 2924 wrote to memory of 2588 2924 pdjjj.exe 36 PID 2924 wrote to memory of 2588 2924 pdjjj.exe 36 PID 2924 wrote to memory of 2588 2924 pdjjj.exe 36 PID 2924 wrote to memory of 2588 2924 pdjjj.exe 36 PID 2588 wrote to memory of 2764 2588 llxfffx.exe 37 PID 2588 wrote to memory of 2764 2588 llxfffx.exe 37 PID 2588 wrote to memory of 2764 2588 llxfffx.exe 37 PID 2588 wrote to memory of 2764 2588 llxfffx.exe 37 PID 2764 wrote to memory of 2384 2764 hbthtt.exe 38 PID 2764 wrote to memory of 2384 2764 hbthtt.exe 38 PID 2764 wrote to memory of 2384 2764 hbthtt.exe 38 PID 2764 wrote to memory of 2384 2764 hbthtt.exe 38 PID 2384 wrote to memory of 2576 2384 7lxffxr.exe 39 PID 2384 wrote to memory of 2576 2384 7lxffxr.exe 39 PID 2384 wrote to memory of 2576 2384 7lxffxr.exe 39 PID 2384 wrote to memory of 2576 2384 7lxffxr.exe 39 PID 2576 wrote to memory of 2988 2576 pjdpd.exe 40 PID 2576 wrote to memory of 2988 2576 pjdpd.exe 40 PID 2576 wrote to memory of 2988 2576 pjdpd.exe 40 PID 2576 wrote to memory of 2988 2576 pjdpd.exe 40 PID 2988 wrote to memory of 3016 2988 ffxflxr.exe 41 PID 2988 wrote to memory of 3016 2988 ffxflxr.exe 41 PID 2988 wrote to memory of 3016 2988 ffxflxr.exe 41 PID 2988 wrote to memory of 3016 2988 ffxflxr.exe 41 PID 3016 wrote to memory of 1740 3016 jddjv.exe 42 PID 3016 wrote to memory of 1740 3016 jddjv.exe 42 PID 3016 wrote to memory of 1740 3016 jddjv.exe 42 PID 3016 wrote to memory of 1740 3016 jddjv.exe 42 PID 1740 wrote to memory of 2360 1740 tthttb.exe 43 PID 1740 wrote to memory of 2360 1740 tthttb.exe 43 PID 1740 wrote to memory of 2360 1740 tthttb.exe 43 PID 1740 wrote to memory of 2360 1740 tthttb.exe 43 PID 2360 wrote to memory of 864 2360 hhbnbn.exe 44 PID 2360 wrote to memory of 864 2360 hhbnbn.exe 44 PID 2360 wrote to memory of 864 2360 hhbnbn.exe 44 PID 2360 wrote to memory of 864 2360 hhbnbn.exe 44 PID 864 wrote to memory of 2872 864 bbthtn.exe 45 PID 864 wrote to memory of 2872 864 bbthtn.exe 45 PID 864 wrote to memory of 2872 864 bbthtn.exe 45 PID 864 wrote to memory of 2872 864 bbthtn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe"C:\Users\Admin\AppData\Local\Temp\99789fa90795f61c8551febe7dde6d5aa377724b5e27ff6bd54aff0081eb40cbN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\3djdd.exec:\3djdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\fflrflf.exec:\fflrflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\htnbhn.exec:\htnbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\fxrfllf.exec:\fxrfllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\tthnbt.exec:\tthnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\pdjjj.exec:\pdjjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\llxfffx.exec:\llxfffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\hbthtt.exec:\hbthtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\7lxffxr.exec:\7lxffxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\pjdpd.exec:\pjdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\ffxflxr.exec:\ffxflxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jddjv.exec:\jddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\tthttb.exec:\tthttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\hhbnbn.exec:\hhbnbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\bbthtn.exec:\bbthtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\jjpjp.exec:\jjpjp.exe17⤵
- Executes dropped EXE
PID:2872 -
\??\c:\nhhbbh.exec:\nhhbbh.exe18⤵
- Executes dropped EXE
PID:1360 -
\??\c:\lfxlflx.exec:\lfxlflx.exe19⤵
- Executes dropped EXE
PID:2896 -
\??\c:\rrxrrlf.exec:\rrxrrlf.exe20⤵
- Executes dropped EXE
PID:592 -
\??\c:\7dvdj.exec:\7dvdj.exe21⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5nbhhn.exec:\5nbhhn.exe22⤵
- Executes dropped EXE
PID:776 -
\??\c:\3vjjp.exec:\3vjjp.exe23⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rrrfrfx.exec:\rrrfrfx.exe24⤵
- Executes dropped EXE
PID:404 -
\??\c:\bbtbnh.exec:\bbtbnh.exe25⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7djpj.exec:\7djpj.exe26⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1dvdd.exec:\1dvdd.exe27⤵
- Executes dropped EXE
PID:316 -
\??\c:\nnnhbt.exec:\nnnhbt.exe28⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lrrrfxl.exec:\lrrrfxl.exe29⤵
- Executes dropped EXE
PID:2260 -
\??\c:\pdpdp.exec:\pdpdp.exe30⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xxfxlxx.exec:\xxfxlxx.exe31⤵
- Executes dropped EXE
PID:616 -
\??\c:\3vppj.exec:\3vppj.exe32⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rxxfrrl.exec:\rxxfrrl.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\pvdpp.exec:\pvdpp.exe34⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1fflrxl.exec:\1fflrxl.exe35⤵
- Executes dropped EXE
PID:1496 -
\??\c:\hnbnht.exec:\hnbnht.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5btbhn.exec:\5btbhn.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vdjpp.exec:\vdjpp.exe38⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lllrxrl.exec:\lllrxrl.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2264 -
\??\c:\nttthb.exec:\nttthb.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5jdjj.exec:\5jdjj.exe41⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe42⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hbtnbn.exec:\hbtnbn.exe43⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jjdpv.exec:\jjdpv.exe44⤵
- Executes dropped EXE
PID:1836 -
\??\c:\3rrfxlx.exec:\3rrfxlx.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\tbtbhh.exec:\tbtbhh.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vppvd.exec:\vppvd.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\3jdpd.exec:\3jdpd.exe48⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lflxfrr.exec:\lflxfrr.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bbbnbt.exec:\bbbnbt.exe50⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1jvdp.exec:\1jvdp.exe51⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xxlxrxf.exec:\xxlxrxf.exe52⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hhthnb.exec:\hhthnb.exe53⤵
- Executes dropped EXE
PID:1832 -
\??\c:\dvppd.exec:\dvppd.exe54⤵
- Executes dropped EXE
PID:1404 -
\??\c:\7flfxfx.exec:\7flfxfx.exe55⤵
- Executes dropped EXE
PID:1992 -
\??\c:\hbntth.exec:\hbntth.exe56⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dvvpp.exec:\dvvpp.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\xxrrffx.exec:\xxrrffx.exe58⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nhtbhn.exec:\nhtbhn.exe59⤵
- Executes dropped EXE
PID:988 -
\??\c:\tbbbht.exec:\tbbbht.exe60⤵
- Executes dropped EXE
PID:2052 -
\??\c:\5jjdj.exec:\5jjdj.exe61⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxlxrfr.exec:\lxlxrfr.exe62⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7nnbnn.exec:\7nnbnn.exe63⤵
- Executes dropped EXE
PID:1576 -
\??\c:\7bbhht.exec:\7bbhht.exe64⤵
- Executes dropped EXE
PID:404 -
\??\c:\rxxlffr.exec:\rxxlffr.exe65⤵
- Executes dropped EXE
PID:952 -
\??\c:\7xfrlxl.exec:\7xfrlxl.exe66⤵PID:1716
-
\??\c:\thhbbt.exec:\thhbbt.exe67⤵PID:1840
-
\??\c:\dvppp.exec:\dvppp.exe68⤵PID:852
-
\??\c:\9rflxfx.exec:\9rflxfx.exe69⤵PID:1648
-
\??\c:\1nbbhh.exec:\1nbbhh.exe70⤵PID:1644
-
\??\c:\tttttb.exec:\tttttb.exe71⤵
- System Location Discovery: System Language Discovery
PID:2132 -
\??\c:\vvvdj.exec:\vvvdj.exe72⤵PID:576
-
\??\c:\1frfllx.exec:\1frfllx.exe73⤵PID:2952
-
\??\c:\hhtthb.exec:\hhtthb.exe74⤵PID:2056
-
\??\c:\jdvvd.exec:\jdvvd.exe75⤵PID:2272
-
\??\c:\rrxlrfr.exec:\rrxlrfr.exe76⤵PID:1640
-
\??\c:\xllrlll.exec:\xllrlll.exe77⤵PID:2544
-
\??\c:\hbhhnb.exec:\hbhhnb.exe78⤵PID:2408
-
\??\c:\vvvjv.exec:\vvvjv.exe79⤵PID:2500
-
\??\c:\1xxlllf.exec:\1xxlllf.exe80⤵PID:2456
-
\??\c:\xxxfxfr.exec:\xxxfxfr.exe81⤵PID:2520
-
\??\c:\nntthb.exec:\nntthb.exe82⤵PID:2708
-
\??\c:\3djpd.exec:\3djpd.exe83⤵PID:2836
-
\??\c:\1fxrlrf.exec:\1fxrlrf.exe84⤵PID:2916
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe85⤵PID:2688
-
\??\c:\bbhbnb.exec:\bbhbnb.exe86⤵PID:2912
-
\??\c:\9vdjj.exec:\9vdjj.exe87⤵PID:2616
-
\??\c:\5lxfxrf.exec:\5lxfxrf.exe88⤵PID:2620
-
\??\c:\htttnt.exec:\htttnt.exe89⤵PID:2752
-
\??\c:\1jjdp.exec:\1jjdp.exe90⤵PID:2992
-
\??\c:\jpvjd.exec:\jpvjd.exe91⤵PID:1888
-
\??\c:\rrlfrxx.exec:\rrlfrxx.exe92⤵PID:1860
-
\??\c:\bntbbh.exec:\bntbbh.exe93⤵PID:1420
-
\??\c:\5ppvv.exec:\5ppvv.exe94⤵PID:1720
-
\??\c:\fffrflf.exec:\fffrflf.exe95⤵PID:1620
-
\??\c:\3rlfxrr.exec:\3rlfxrr.exe96⤵PID:864
-
\??\c:\nbhhnh.exec:\nbhhnh.exe97⤵PID:1080
-
\??\c:\vddjv.exec:\vddjv.exe98⤵PID:1816
-
\??\c:\dpjjj.exec:\dpjjj.exe99⤵PID:1360
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe100⤵PID:1684
-
\??\c:\bhtbth.exec:\bhtbth.exe101⤵PID:2868
-
\??\c:\jpvpp.exec:\jpvpp.exe102⤵PID:2972
-
\??\c:\nhnthn.exec:\nhnthn.exe103⤵PID:988
-
\??\c:\vvdvp.exec:\vvdvp.exe104⤵PID:2052
-
\??\c:\lllxlrl.exec:\lllxlrl.exe105⤵PID:1724
-
\??\c:\bhhnnb.exec:\bhhnnb.exe106⤵PID:916
-
\??\c:\vpppj.exec:\vpppj.exe107⤵PID:1212
-
\??\c:\fffxfxx.exec:\fffxfxx.exe108⤵PID:1304
-
\??\c:\tttbth.exec:\tttbth.exe109⤵PID:1112
-
\??\c:\tbhbtt.exec:\tbhbtt.exe110⤵PID:1600
-
\??\c:\jdjjd.exec:\jdjjd.exe111⤵PID:1476
-
\??\c:\5xxrxlf.exec:\5xxrxlf.exe112⤵PID:2124
-
\??\c:\nbnhnn.exec:\nbnhnn.exe113⤵PID:2936
-
\??\c:\pjjvp.exec:\pjjvp.exe114⤵PID:2260
-
\??\c:\ppdpv.exec:\ppdpv.exe115⤵PID:1644
-
\??\c:\xfxlflx.exec:\xfxlflx.exe116⤵PID:2132
-
\??\c:\bnhbbt.exec:\bnhbbt.exe117⤵PID:704
-
\??\c:\vppdp.exec:\vppdp.exe118⤵PID:2952
-
\??\c:\3xxxxfr.exec:\3xxxxfr.exe119⤵PID:1524
-
\??\c:\hhhhth.exec:\hhhhth.exe120⤵PID:2072
-
\??\c:\nhhnhb.exec:\nhhnhb.exe121⤵PID:1892
-
\??\c:\vdvpd.exec:\vdvpd.exe122⤵PID:2164
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-