Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 23:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe
-
Size
453KB
-
MD5
609243d0265cb44a1f60cd626c2e9a2a
-
SHA1
83540096107387538742e106c70cedfd56628020
-
SHA256
771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b
-
SHA512
aad8916dff5c098dc8dbaf6fcf3941289356e98bee407e77656091b3ec9c0230d78def59e049acd912d6564529bf6f812c4f196425345a3e7ff94d7b64d20671
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeGM3:q7Tc2NYHUrAwfMp3CDGM3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1588-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-137-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2940-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-174-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2100-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-302-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1284-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-441-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/1992-448-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/752-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-500-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-547-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2968-617-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2608-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-639-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1008-659-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-665-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2056-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1284 hbbbnn.exe 2448 dpddv.exe 2464 bbhtnb.exe 2768 thttbb.exe 2752 lfxxfrf.exe 2796 hnnhbt.exe 2928 djpjd.exe 2724 3bbbtn.exe 2656 dpddv.exe 2336 rxxxlrx.exe 604 rlffrxf.exe 1648 htbbth.exe 1616 vvjjp.exe 2680 xlxrrlr.exe 2940 pdjdd.exe 2052 9lxxxrr.exe 844 rlxxllr.exe 1408 3dppv.exe 2100 7lrrllr.exe 3028 jjvpj.exe 1288 dvpjv.exe 1196 xrlfrrx.exe 752 bthhnn.exe 1944 jdpvj.exe 928 llffrlx.exe 1740 rlxxrrf.exe 2512 1tnttb.exe 3040 vjvvv.exe 108 5btttt.exe 2172 7lrrrlr.exe 1600 bnbbhb.exe 1284 lxxxfff.exe 2716 nhbtbt.exe 2844 vvdjv.exe 1832 rffxxrf.exe 3008 tntbtn.exe 2772 dvdjp.exe 2916 3pjjj.exe 1056 rlllxlx.exe 1048 rlflrrf.exe 2624 tthhnn.exe 2436 5vjdd.exe 2804 9vjjj.exe 604 xlflrrr.exe 2164 tnhbnn.exe 832 hthhhh.exe 2184 pjppp.exe 2972 ppjjj.exe 2952 3rllrrr.exe 2864 nhttbt.exe 1892 1bnttt.exe 2412 vvjpv.exe 1992 rrfxxxl.exe 1488 tbtnhh.exe 388 tnbthh.exe 528 jvddj.exe 1040 fxrxffl.exe 948 rfxrrrf.exe 2484 hhttbh.exe 752 jpvvd.exe 828 xxlrxfl.exe 408 xxrrxxl.exe 2152 thtbhb.exe 1964 9vddd.exe -
resource yara_rule behavioral1/memory/1588-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-185-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3028-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-315-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2844-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-572-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-667-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflrrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1284 1588 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 1588 wrote to memory of 1284 1588 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 1588 wrote to memory of 1284 1588 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 1588 wrote to memory of 1284 1588 771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe 30 PID 1284 wrote to memory of 2448 1284 hbbbnn.exe 31 PID 1284 wrote to memory of 2448 1284 hbbbnn.exe 31 PID 1284 wrote to memory of 2448 1284 hbbbnn.exe 31 PID 1284 wrote to memory of 2448 1284 hbbbnn.exe 31 PID 2448 wrote to memory of 2464 2448 dpddv.exe 32 PID 2448 wrote to memory of 2464 2448 dpddv.exe 32 PID 2448 wrote to memory of 2464 2448 dpddv.exe 32 PID 2448 wrote to memory of 2464 2448 dpddv.exe 32 PID 2464 wrote to memory of 2768 2464 bbhtnb.exe 33 PID 2464 wrote to memory of 2768 2464 bbhtnb.exe 33 PID 2464 wrote to memory of 2768 2464 bbhtnb.exe 33 PID 2464 wrote to memory of 2768 2464 bbhtnb.exe 33 PID 2768 wrote to memory of 2752 2768 thttbb.exe 34 PID 2768 wrote to memory of 2752 2768 thttbb.exe 34 PID 2768 wrote to memory of 2752 2768 thttbb.exe 34 PID 2768 wrote to memory of 2752 2768 thttbb.exe 34 PID 2752 wrote to memory of 2796 2752 lfxxfrf.exe 35 PID 2752 wrote to memory of 2796 2752 lfxxfrf.exe 35 PID 2752 wrote to memory of 2796 2752 lfxxfrf.exe 35 PID 2752 wrote to memory of 2796 2752 lfxxfrf.exe 35 PID 2796 wrote to memory of 2928 2796 hnnhbt.exe 36 PID 2796 wrote to memory of 2928 2796 hnnhbt.exe 36 PID 2796 wrote to memory of 2928 2796 hnnhbt.exe 36 PID 2796 wrote to memory of 2928 2796 hnnhbt.exe 36 PID 2928 wrote to memory of 2724 2928 djpjd.exe 37 PID 2928 wrote to memory of 2724 2928 djpjd.exe 37 PID 2928 wrote to memory of 2724 2928 djpjd.exe 37 PID 2928 wrote to memory of 2724 2928 djpjd.exe 37 PID 2724 wrote to memory of 2656 2724 3bbbtn.exe 38 PID 2724 wrote to memory of 2656 2724 3bbbtn.exe 38 PID 2724 wrote to memory of 2656 2724 3bbbtn.exe 38 PID 2724 wrote to memory of 2656 2724 3bbbtn.exe 38 PID 2656 wrote to memory of 2336 2656 dpddv.exe 39 PID 2656 wrote to memory of 2336 2656 dpddv.exe 39 PID 2656 wrote to memory of 2336 2656 dpddv.exe 39 PID 2656 wrote to memory of 2336 2656 dpddv.exe 39 PID 2336 wrote to memory of 604 2336 rxxxlrx.exe 40 PID 2336 wrote to memory of 604 2336 rxxxlrx.exe 40 PID 2336 wrote to memory of 604 2336 rxxxlrx.exe 40 PID 2336 wrote to memory of 604 2336 rxxxlrx.exe 40 PID 604 wrote to memory of 1648 604 rlffrxf.exe 41 PID 604 wrote to memory of 1648 604 rlffrxf.exe 41 PID 604 wrote to memory of 1648 604 rlffrxf.exe 41 PID 604 wrote to memory of 1648 604 rlffrxf.exe 41 PID 1648 wrote to memory of 1616 1648 htbbth.exe 42 PID 1648 wrote to memory of 1616 1648 htbbth.exe 42 PID 1648 wrote to memory of 1616 1648 htbbth.exe 42 PID 1648 wrote to memory of 1616 1648 htbbth.exe 42 PID 1616 wrote to memory of 2680 1616 vvjjp.exe 43 PID 1616 wrote to memory of 2680 1616 vvjjp.exe 43 PID 1616 wrote to memory of 2680 1616 vvjjp.exe 43 PID 1616 wrote to memory of 2680 1616 vvjjp.exe 43 PID 2680 wrote to memory of 2940 2680 xlxrrlr.exe 44 PID 2680 wrote to memory of 2940 2680 xlxrrlr.exe 44 PID 2680 wrote to memory of 2940 2680 xlxrrlr.exe 44 PID 2680 wrote to memory of 2940 2680 xlxrrlr.exe 44 PID 2940 wrote to memory of 2052 2940 pdjdd.exe 45 PID 2940 wrote to memory of 2052 2940 pdjdd.exe 45 PID 2940 wrote to memory of 2052 2940 pdjdd.exe 45 PID 2940 wrote to memory of 2052 2940 pdjdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe"C:\Users\Admin\AppData\Local\Temp\771e1385d3e9502ccc994521dedf78ed420673ca4a17bdf2941e0e8ffa61900b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\hbbbnn.exec:\hbbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\dpddv.exec:\dpddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\bbhtnb.exec:\bbhtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\thttbb.exec:\thttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\lfxxfrf.exec:\lfxxfrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\hnnhbt.exec:\hnnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\djpjd.exec:\djpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3bbbtn.exec:\3bbbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\dpddv.exec:\dpddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\rxxxlrx.exec:\rxxxlrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\rlffrxf.exec:\rlffrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\htbbth.exec:\htbbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vvjjp.exec:\vvjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\pdjdd.exec:\pdjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\9lxxxrr.exec:\9lxxxrr.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2052 -
\??\c:\rlxxllr.exec:\rlxxllr.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:844 -
\??\c:\3dppv.exec:\3dppv.exe19⤵
- Executes dropped EXE
PID:1408 -
\??\c:\7lrrllr.exec:\7lrrllr.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jjvpj.exec:\jjvpj.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dvpjv.exec:\dvpjv.exe22⤵
- Executes dropped EXE
PID:1288 -
\??\c:\xrlfrrx.exec:\xrlfrrx.exe23⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bthhnn.exec:\bthhnn.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\jdpvj.exec:\jdpvj.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\llffrlx.exec:\llffrlx.exe26⤵
- Executes dropped EXE
PID:928 -
\??\c:\rlxxrrf.exec:\rlxxrrf.exe27⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1tnttb.exec:\1tnttb.exe28⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjvvv.exec:\vjvvv.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5btttt.exec:\5btttt.exe30⤵
- Executes dropped EXE
PID:108 -
\??\c:\7lrrrlr.exec:\7lrrrlr.exe31⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bnbbhb.exec:\bnbbhb.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lxxxfff.exec:\lxxxfff.exe33⤵
- Executes dropped EXE
PID:1284 -
\??\c:\nhbtbt.exec:\nhbtbt.exe34⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vvdjv.exec:\vvdjv.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rffxxrf.exec:\rffxxrf.exe36⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tntbtn.exec:\tntbtn.exe37⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dvdjp.exec:\dvdjp.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\3pjjj.exec:\3pjjj.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rlllxlx.exec:\rlllxlx.exe40⤵
- Executes dropped EXE
PID:1056 -
\??\c:\rlflrrf.exec:\rlflrrf.exe41⤵
- Executes dropped EXE
PID:1048 -
\??\c:\tthhnn.exec:\tthhnn.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5vjdd.exec:\5vjdd.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\9vjjj.exec:\9vjjj.exe44⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xlflrrr.exec:\xlflrrr.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\tnhbnn.exec:\tnhbnn.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\hthhhh.exec:\hthhhh.exe47⤵
- Executes dropped EXE
PID:832 -
\??\c:\pjppp.exec:\pjppp.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ppjjj.exec:\ppjjj.exe49⤵
- Executes dropped EXE
PID:2972 -
\??\c:\3rllrrr.exec:\3rllrrr.exe50⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nhttbt.exec:\nhttbt.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\1bnttt.exec:\1bnttt.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vvjpv.exec:\vvjpv.exe53⤵
- Executes dropped EXE
PID:2412 -
\??\c:\rrfxxxl.exec:\rrfxxxl.exe54⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tbtnhh.exec:\tbtnhh.exe55⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tnbthh.exec:\tnbthh.exe56⤵
- Executes dropped EXE
PID:388 -
\??\c:\jvddj.exec:\jvddj.exe57⤵
- Executes dropped EXE
PID:528 -
\??\c:\fxrxffl.exec:\fxrxffl.exe58⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rfxrrrf.exec:\rfxrrrf.exe59⤵
- Executes dropped EXE
PID:948 -
\??\c:\hhttbh.exec:\hhttbh.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jpvvd.exec:\jpvvd.exe61⤵
- Executes dropped EXE
PID:752 -
\??\c:\xxlrxfl.exec:\xxlrxfl.exe62⤵
- Executes dropped EXE
PID:828 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe63⤵
- Executes dropped EXE
PID:408 -
\??\c:\thtbhb.exec:\thtbhb.exe64⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9vddd.exec:\9vddd.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7jpdp.exec:\7jpdp.exe66⤵PID:2512
-
\??\c:\rxrfrrl.exec:\rxrfrrl.exe67⤵PID:2288
-
\??\c:\bbthnh.exec:\bbthnh.exe68⤵PID:1656
-
\??\c:\btnnbt.exec:\btnnbt.exe69⤵PID:1500
-
\??\c:\jjdjp.exec:\jjdjp.exe70⤵PID:1612
-
\??\c:\7llffll.exec:\7llffll.exe71⤵PID:2524
-
\??\c:\httbbt.exec:\httbbt.exe72⤵PID:2280
-
\??\c:\9nbtbn.exec:\9nbtbn.exe73⤵PID:656
-
\??\c:\9pjpv.exec:\9pjpv.exe74⤵PID:2716
-
\??\c:\5fxlllx.exec:\5fxlllx.exe75⤵PID:1332
-
\??\c:\xrrrfxl.exec:\xrrrfxl.exe76⤵PID:2744
-
\??\c:\tthntt.exec:\tthntt.exe77⤵PID:2648
-
\??\c:\jvpvv.exec:\jvpvv.exe78⤵PID:2956
-
\??\c:\jjpjp.exec:\jjpjp.exe79⤵PID:2968
-
\??\c:\5lrrrrx.exec:\5lrrrrx.exe80⤵PID:2608
-
\??\c:\3hbbhh.exec:\3hbbhh.exe81⤵PID:1048
-
\??\c:\nhtttb.exec:\nhtttb.exe82⤵PID:2624
-
\??\c:\djdvv.exec:\djdvv.exe83⤵PID:1100
-
\??\c:\lxllrrx.exec:\lxllrrx.exe84⤵PID:2296
-
\??\c:\fxxxllf.exec:\fxxxllf.exe85⤵PID:1008
-
\??\c:\hhhhtt.exec:\hhhhtt.exe86⤵PID:1472
-
\??\c:\jddjj.exec:\jddjj.exe87⤵PID:2056
-
\??\c:\9jvjv.exec:\9jvjv.exe88⤵PID:2184
-
\??\c:\7lfxffr.exec:\7lfxffr.exe89⤵PID:2972
-
\??\c:\7xlrffl.exec:\7xlrffl.exe90⤵PID:2996
-
\??\c:\hhnhht.exec:\hhnhht.exe91⤵PID:2864
-
\??\c:\3pddd.exec:\3pddd.exe92⤵PID:1892
-
\??\c:\5vppp.exec:\5vppp.exe93⤵PID:1408
-
\??\c:\ffxfflr.exec:\ffxfflr.exe94⤵PID:1708
-
\??\c:\nnbbbt.exec:\nnbbbt.exe95⤵PID:2148
-
\??\c:\nhtbhn.exec:\nhtbhn.exe96⤵PID:2360
-
\??\c:\jvjjj.exec:\jvjjj.exe97⤵PID:1968
-
\??\c:\fxxxxxl.exec:\fxxxxxl.exe98⤵PID:444
-
\??\c:\ffffffl.exec:\ffffffl.exe99⤵PID:1140
-
\??\c:\hbntbt.exec:\hbntbt.exe100⤵PID:848
-
\??\c:\nhnthb.exec:\nhnthb.exe101⤵PID:1504
-
\??\c:\vvpdd.exec:\vvpdd.exe102⤵PID:1752
-
\??\c:\9xxrffr.exec:\9xxrffr.exe103⤵PID:2552
-
\??\c:\rlfflfr.exec:\rlfflfr.exe104⤵PID:2276
-
\??\c:\3ttttt.exec:\3ttttt.exe105⤵PID:1320
-
\??\c:\vjddp.exec:\vjddp.exe106⤵PID:1820
-
\??\c:\jdvvv.exec:\jdvvv.exe107⤵PID:1760
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe108⤵PID:1776
-
\??\c:\thtthh.exec:\thtthh.exe109⤵PID:1608
-
\??\c:\hhbbbt.exec:\hhbbbt.exe110⤵PID:1720
-
\??\c:\1ppvd.exec:\1ppvd.exe111⤵PID:2500
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe112⤵PID:2280
-
\??\c:\frlrrrf.exec:\frlrrrf.exe113⤵PID:2920
-
\??\c:\bbnhhh.exec:\bbnhhh.exe114⤵PID:2896
-
\??\c:\7jvdv.exec:\7jvdv.exe115⤵PID:2768
-
\??\c:\9dvjj.exec:\9dvjj.exe116⤵PID:2744
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe117⤵PID:2648
-
\??\c:\1nbhhn.exec:\1nbhhn.exe118⤵PID:2616
-
\??\c:\pvvjp.exec:\pvvjp.exe119⤵PID:1056
-
\??\c:\1jpdd.exec:\1jpdd.exe120⤵PID:2468
-
\??\c:\ffflrlx.exec:\ffflrlx.exe121⤵PID:2336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-