Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 03:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe
-
Size
453KB
-
MD5
753e78eb26b54a8d471d347345294786
-
SHA1
020f2bb342784d9937dc914f976f96cc763c3117
-
SHA256
d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559
-
SHA512
ba519fa5e6c919f1672e8f6032fdb9376647bc21fef68abade486b7ea93acf47e0600d86a41c44c400286c78222d2cd42872630f65428957a83ad95f254c2ea9
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/1660-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-149-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1620-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-193-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-212-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2148-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-233-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1716-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-293-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1836-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-364-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/3024-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-390-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2968-411-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/884-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-449-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-505-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1616-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-513-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-527-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/812-541-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2708-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-645-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-670-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1868-683-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2420-715-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2820-729-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1216-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-792-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1660 fxrxllx.exe 2388 ddvpd.exe 2128 ddvvd.exe 2220 nbtntb.exe 2996 vjpdj.exe 2748 xrffxlr.exe 2196 btnbnt.exe 3024 1jdjv.exe 2752 llflrlx.exe 2564 jjjjj.exe 2584 lfxxlfr.exe 2252 5bbbtb.exe 1120 fxrxxfl.exe 860 xlfrffr.exe 1620 vvvjp.exe 2420 ffrxrxl.exe 1432 djdpd.exe 1728 fxrxflr.exe 1704 nhtbhb.exe 2824 5bnbhh.exe 2548 lrrfrrf.exe 2604 tbhttn.exe 2148 7vjjv.exe 336 xrfrllx.exe 1716 5bttbt.exe 1600 fxfrflx.exe 2860 jjjpv.exe 2412 lffllfr.exe 992 hbhnbh.exe 2132 xfrflff.exe 1640 fxllrrf.exe 1836 tnhhhb.exe 2052 xllxffr.exe 2788 ttbbhn.exe 864 3vddj.exe 2220 rfxffrf.exe 2952 hhnthn.exe 2704 nnhhnn.exe 2612 vvddj.exe 2544 fxxxllr.exe 3024 xrrrxrr.exe 2556 nbntbb.exe 2520 jvjdj.exe 2968 3xlflfx.exe 2628 9rfllll.exe 2356 tttbnt.exe 884 3pvvp.exe 2324 7vvdj.exe 1744 7xrllxl.exe 2484 bthntt.exe 1244 vpdjp.exe 1232 pjdjj.exe 1896 rrrlffr.exe 1728 hnhhnt.exe 1196 btbhnn.exe 1216 jdpvj.exe 2732 lfrlxxf.exe 2928 rlrrrlr.exe 920 9thhbt.exe 2876 7jvvv.exe 2148 pdppv.exe 1616 rrllxfl.exe 2152 thbbhn.exe 1908 7vpvd.exe -
resource yara_rule behavioral1/memory/1660-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-149-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1620-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-411-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/884-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-449-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1616-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-534-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-631-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2808-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-670-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1868-683-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2420-715-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2820-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-729-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1216-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-792-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1660 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2112 wrote to memory of 1660 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2112 wrote to memory of 1660 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 2112 wrote to memory of 1660 2112 d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe 30 PID 1660 wrote to memory of 2388 1660 fxrxllx.exe 31 PID 1660 wrote to memory of 2388 1660 fxrxllx.exe 31 PID 1660 wrote to memory of 2388 1660 fxrxllx.exe 31 PID 1660 wrote to memory of 2388 1660 fxrxllx.exe 31 PID 2388 wrote to memory of 2128 2388 ddvpd.exe 32 PID 2388 wrote to memory of 2128 2388 ddvpd.exe 32 PID 2388 wrote to memory of 2128 2388 ddvpd.exe 32 PID 2388 wrote to memory of 2128 2388 ddvpd.exe 32 PID 2128 wrote to memory of 2220 2128 ddvvd.exe 33 PID 2128 wrote to memory of 2220 2128 ddvvd.exe 33 PID 2128 wrote to memory of 2220 2128 ddvvd.exe 33 PID 2128 wrote to memory of 2220 2128 ddvvd.exe 33 PID 2220 wrote to memory of 2996 2220 nbtntb.exe 34 PID 2220 wrote to memory of 2996 2220 nbtntb.exe 34 PID 2220 wrote to memory of 2996 2220 nbtntb.exe 34 PID 2220 wrote to memory of 2996 2220 nbtntb.exe 34 PID 2996 wrote to memory of 2748 2996 vjpdj.exe 35 PID 2996 wrote to memory of 2748 2996 vjpdj.exe 35 PID 2996 wrote to memory of 2748 2996 vjpdj.exe 35 PID 2996 wrote to memory of 2748 2996 vjpdj.exe 35 PID 2748 wrote to memory of 2196 2748 xrffxlr.exe 36 PID 2748 wrote to memory of 2196 2748 xrffxlr.exe 36 PID 2748 wrote to memory of 2196 2748 xrffxlr.exe 36 PID 2748 wrote to memory of 2196 2748 xrffxlr.exe 36 PID 2196 wrote to memory of 3024 2196 btnbnt.exe 37 PID 2196 wrote to memory of 3024 2196 btnbnt.exe 37 PID 2196 wrote to memory of 3024 2196 btnbnt.exe 37 PID 2196 wrote to memory of 3024 2196 btnbnt.exe 37 PID 3024 wrote to memory of 2752 3024 1jdjv.exe 38 PID 3024 wrote to memory of 2752 3024 1jdjv.exe 38 PID 3024 wrote to memory of 2752 3024 1jdjv.exe 38 PID 3024 wrote to memory of 2752 3024 1jdjv.exe 38 PID 2752 wrote to memory of 2564 2752 llflrlx.exe 39 PID 2752 wrote to memory of 2564 2752 llflrlx.exe 39 PID 2752 wrote to memory of 2564 2752 llflrlx.exe 39 PID 2752 wrote to memory of 2564 2752 llflrlx.exe 39 PID 2564 wrote to memory of 2584 2564 jjjjj.exe 40 PID 2564 wrote to memory of 2584 2564 jjjjj.exe 40 PID 2564 wrote to memory of 2584 2564 jjjjj.exe 40 PID 2564 wrote to memory of 2584 2564 jjjjj.exe 40 PID 2584 wrote to memory of 2252 2584 lfxxlfr.exe 41 PID 2584 wrote to memory of 2252 2584 lfxxlfr.exe 41 PID 2584 wrote to memory of 2252 2584 lfxxlfr.exe 41 PID 2584 wrote to memory of 2252 2584 lfxxlfr.exe 41 PID 2252 wrote to memory of 1120 2252 5bbbtb.exe 42 PID 2252 wrote to memory of 1120 2252 5bbbtb.exe 42 PID 2252 wrote to memory of 1120 2252 5bbbtb.exe 42 PID 2252 wrote to memory of 1120 2252 5bbbtb.exe 42 PID 1120 wrote to memory of 860 1120 fxrxxfl.exe 43 PID 1120 wrote to memory of 860 1120 fxrxxfl.exe 43 PID 1120 wrote to memory of 860 1120 fxrxxfl.exe 43 PID 1120 wrote to memory of 860 1120 fxrxxfl.exe 43 PID 860 wrote to memory of 1620 860 xlfrffr.exe 44 PID 860 wrote to memory of 1620 860 xlfrffr.exe 44 PID 860 wrote to memory of 1620 860 xlfrffr.exe 44 PID 860 wrote to memory of 1620 860 xlfrffr.exe 44 PID 1620 wrote to memory of 2420 1620 vvvjp.exe 45 PID 1620 wrote to memory of 2420 1620 vvvjp.exe 45 PID 1620 wrote to memory of 2420 1620 vvvjp.exe 45 PID 1620 wrote to memory of 2420 1620 vvvjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe"C:\Users\Admin\AppData\Local\Temp\d805e4a1b0a00bc755b5221f54d1e1b0a3d352bcbb987b833cff1f618d787559.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\fxrxllx.exec:\fxrxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ddvpd.exec:\ddvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\ddvvd.exec:\ddvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\nbtntb.exec:\nbtntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\vjpdj.exec:\vjpdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xrffxlr.exec:\xrffxlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\btnbnt.exec:\btnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1jdjv.exec:\1jdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llflrlx.exec:\llflrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jjjjj.exec:\jjjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\lfxxlfr.exec:\lfxxlfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\5bbbtb.exec:\5bbbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\xlfrffr.exec:\xlfrffr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\vvvjp.exec:\vvvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe17⤵
- Executes dropped EXE
PID:2420 -
\??\c:\djdpd.exec:\djdpd.exe18⤵
- Executes dropped EXE
PID:1432 -
\??\c:\fxrxflr.exec:\fxrxflr.exe19⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nhtbhb.exec:\nhtbhb.exe20⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5bnbhh.exec:\5bnbhh.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\lrrfrrf.exec:\lrrfrrf.exe22⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tbhttn.exec:\tbhttn.exe23⤵
- Executes dropped EXE
PID:2604 -
\??\c:\7vjjv.exec:\7vjjv.exe24⤵
- Executes dropped EXE
PID:2148 -
\??\c:\xrfrllx.exec:\xrfrllx.exe25⤵
- Executes dropped EXE
PID:336 -
\??\c:\5bttbt.exec:\5bttbt.exe26⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fxfrflx.exec:\fxfrflx.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\jjjpv.exec:\jjjpv.exe28⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lffllfr.exec:\lffllfr.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbhnbh.exec:\hbhnbh.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:992 -
\??\c:\xfrflff.exec:\xfrflff.exe31⤵
- Executes dropped EXE
PID:2132 -
\??\c:\fxllrrf.exec:\fxllrrf.exe32⤵
- Executes dropped EXE
PID:1640 -
\??\c:\tnhhhb.exec:\tnhhhb.exe33⤵
- Executes dropped EXE
PID:1836 -
\??\c:\xllxffr.exec:\xllxffr.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ttbbhn.exec:\ttbbhn.exe35⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3vddj.exec:\3vddj.exe36⤵
- Executes dropped EXE
PID:864 -
\??\c:\rfxffrf.exec:\rfxffrf.exe37⤵
- Executes dropped EXE
PID:2220 -
\??\c:\hhnthn.exec:\hhnthn.exe38⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nnhhnn.exec:\nnhhnn.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\vvddj.exec:\vvddj.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\fxxxllr.exec:\fxxxllr.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrrrxrr.exec:\xrrrxrr.exe42⤵
- Executes dropped EXE
PID:3024 -
\??\c:\nbntbb.exec:\nbntbb.exe43⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jvjdj.exec:\jvjdj.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3xlflfx.exec:\3xlflfx.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9rfllll.exec:\9rfllll.exe46⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tttbnt.exec:\tttbnt.exe47⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3pvvp.exec:\3pvvp.exe48⤵
- Executes dropped EXE
PID:884 -
\??\c:\7vvdj.exec:\7vvdj.exe49⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7xrllxl.exec:\7xrllxl.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bthntt.exec:\bthntt.exe51⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vpdjp.exec:\vpdjp.exe52⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pjdjj.exec:\pjdjj.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\rrrlffr.exec:\rrrlffr.exe54⤵
- Executes dropped EXE
PID:1896 -
\??\c:\hnhhnt.exec:\hnhhnt.exe55⤵
- Executes dropped EXE
PID:1728 -
\??\c:\btbhnn.exec:\btbhnn.exe56⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jdpvj.exec:\jdpvj.exe57⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lfrlxxf.exec:\lfrlxxf.exe58⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe59⤵
- Executes dropped EXE
PID:2928 -
\??\c:\9thhbt.exec:\9thhbt.exe60⤵
- Executes dropped EXE
PID:920 -
\??\c:\7jvvv.exec:\7jvvv.exe61⤵
- Executes dropped EXE
PID:2876 -
\??\c:\pdppv.exec:\pdppv.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rrllxfl.exec:\rrllxfl.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\thbbhn.exec:\thbbhn.exe64⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7vpvd.exec:\7vpvd.exe65⤵
- Executes dropped EXE
PID:1908 -
\??\c:\pdppv.exec:\pdppv.exe66⤵PID:3048
-
\??\c:\rlllffl.exec:\rlllffl.exe67⤵PID:796
-
\??\c:\nbnbhh.exec:\nbnbhh.exe68⤵PID:812
-
\??\c:\9ppvj.exec:\9ppvj.exe69⤵PID:2424
-
\??\c:\dpdjp.exec:\dpdjp.exe70⤵PID:1492
-
\??\c:\rlflfrx.exec:\rlflfrx.exe71⤵PID:1520
-
\??\c:\nbnntn.exec:\nbnntn.exe72⤵PID:2848
-
\??\c:\nhhtbh.exec:\nhhtbh.exe73⤵PID:2124
-
\??\c:\9rllrlr.exec:\9rllrlr.exe74⤵PID:2064
-
\??\c:\lfxxxlr.exec:\lfxxxlr.exe75⤵PID:2100
-
\??\c:\tnbhtb.exec:\tnbhtb.exe76⤵PID:1884
-
\??\c:\dvjjp.exec:\dvjjp.exe77⤵PID:2708
-
\??\c:\1jvdj.exec:\1jvdj.exe78⤵PID:3068
-
\??\c:\flflfxl.exec:\flflfxl.exe79⤵PID:2748
-
\??\c:\9nhnhn.exec:\9nhnhn.exe80⤵PID:2780
-
\??\c:\jvjjp.exec:\jvjjp.exe81⤵PID:2784
-
\??\c:\5rrlllr.exec:\5rrlllr.exe82⤵PID:2808
-
\??\c:\xlfrffl.exec:\xlfrffl.exe83⤵PID:2524
-
\??\c:\htbbbt.exec:\htbbbt.exe84⤵PID:2540
-
\??\c:\vjvpv.exec:\vjvpv.exe85⤵PID:2228
-
\??\c:\jvjjj.exec:\jvjjj.exe86⤵PID:3028
-
\??\c:\lrffffl.exec:\lrffffl.exe87⤵PID:2584
-
\??\c:\hhbhnh.exec:\hhbhnh.exe88⤵PID:2356
-
\??\c:\nbhbht.exec:\nbhbht.exe89⤵PID:1868
-
\??\c:\jdjjp.exec:\jdjjp.exe90⤵PID:1664
-
\??\c:\rffxffr.exec:\rffxffr.exe91⤵PID:2320
-
\??\c:\rlfxxrx.exec:\rlfxxrx.exe92⤵PID:1336
-
\??\c:\hbhtnb.exec:\hbhtnb.exe93⤵PID:1244
-
\??\c:\dvdvv.exec:\dvdvv.exe94⤵PID:2420
-
\??\c:\3rffrxf.exec:\3rffrxf.exe95⤵PID:1344
-
\??\c:\flrrxrx.exec:\flrrxrx.exe96⤵PID:2820
-
\??\c:\9nttnn.exec:\9nttnn.exe97⤵PID:1196
-
\??\c:\vjvjv.exec:\vjvjv.exe98⤵PID:1216
-
\??\c:\1jvvd.exec:\1jvvd.exe99⤵PID:1424
-
\??\c:\1xrfxfl.exec:\1xrfxfl.exe100⤵PID:2692
-
\??\c:\7nnthn.exec:\7nnthn.exe101⤵PID:2164
-
\??\c:\tbtnhn.exec:\tbtnhn.exe102⤵PID:1696
-
\??\c:\dvpjd.exec:\dvpjd.exe103⤵PID:1712
-
\??\c:\7fflxxf.exec:\7fflxxf.exe104⤵PID:996
-
\??\c:\9rrrxxf.exec:\9rrrxxf.exe105⤵PID:1692
-
\??\c:\nnhbhn.exec:\nnhbhn.exe106⤵PID:1716
-
\??\c:\pppvj.exec:\pppvj.exe107⤵PID:3032
-
\??\c:\fxrxfrf.exec:\fxrxfrf.exe108⤵PID:2860
-
\??\c:\fxxrflr.exec:\fxxrflr.exe109⤵PID:900
-
\??\c:\nhnthh.exec:\nhnthh.exe110⤵PID:896
-
\??\c:\1vjpp.exec:\1vjpp.exe111⤵PID:2336
-
\??\c:\pjdjd.exec:\pjdjd.exe112⤵PID:1640
-
\??\c:\rrlflrf.exec:\rrlflrf.exe113⤵PID:1676
-
\??\c:\ntbnnn.exec:\ntbnnn.exe114⤵PID:2124
-
\??\c:\tnhhtt.exec:\tnhhtt.exe115⤵PID:2128
-
\??\c:\pjdjd.exec:\pjdjd.exe116⤵PID:3000
-
\??\c:\xrfffrx.exec:\xrfffrx.exe117⤵PID:2864
-
\??\c:\flflflx.exec:\flflflx.exe118⤵PID:2708
-
\??\c:\hhnbbh.exec:\hhnbbh.exe119⤵PID:2856
-
\??\c:\tthhnt.exec:\tthhnt.exe120⤵PID:2760
-
\??\c:\jdjdd.exec:\jdjdd.exe121⤵PID:2796
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-