Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe
-
Size
454KB
-
MD5
2293fabcca4b10c39d073bb5f83f895c
-
SHA1
d4752c6d7144ddff46dd6f2a5340d343b7693fa7
-
SHA256
41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616
-
SHA512
553c9e29f7ffc65c4742f947f5127033f3d2f2006c3ee4622e89acb3bdc4b402342020940146b56e02fab0d1a7b6ad5924c2234f8a72c19f5276a5b4ff5948cf
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2096-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-94-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-203-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-222-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2308-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-300-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1552-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-417-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1312-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-453-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1968-507-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2920-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2324-683-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-761-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/788-788-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2292-808-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2532 rlxlrrx.exe 2536 hhbbbb.exe 2224 7pddp.exe 2472 lfxxffr.exe 2820 1jpjd.exe 2084 7bnnnt.exe 2804 tnbbtt.exe 2628 rrlflfr.exe 2608 3bhhhn.exe 2728 tnnhhh.exe 3068 7rffxxf.exe 1520 tthhnb.exe 1956 pvddp.exe 1144 fffllll.exe 896 bbtbhn.exe 1364 jdpjj.exe 1780 xfxfrrx.exe 2912 xllrfff.exe 1900 btnbtb.exe 2400 xrffllr.exe 2960 btnnnh.exe 2924 dvjjp.exe 444 rlxfllx.exe 2896 tbtntb.exe 2308 9pjjv.exe 2288 3lxxxxl.exe 2056 5nhntt.exe 556 9vpvj.exe 2436 7xfllll.exe 1808 pdppv.exe 2516 fflxrrx.exe 3016 pjddv.exe 1512 frllrrx.exe 2532 frxfxfx.exe 1552 1xxflxl.exe 2348 nhhnbh.exe 1772 7jjvp.exe 2808 flrrllx.exe 2992 lrffrlr.exe 2840 ntnthn.exe 2256 dpjjj.exe 2780 9flxflf.exe 2628 rlxrflr.exe 2660 hbtbhh.exe 2604 vvppd.exe 2656 xrfrxrx.exe 2160 rfflxfl.exe 1260 htnntt.exe 1520 vvjvd.exe 1956 1pddj.exe 1312 1rxffxf.exe 1736 bhnnhh.exe 1688 dvdjv.exe 1980 jvjvv.exe 3052 lfxxfll.exe 1984 tnttnb.exe 2496 dvppv.exe 1724 3rffflr.exe 1824 5lxrflx.exe 2200 tnbhnn.exe 2584 jdpvd.exe 1968 dvpvd.exe 1716 1rflllx.exe 1440 tnbhnn.exe -
resource yara_rule behavioral1/memory/2096-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1552-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-328-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2992-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-355-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2660-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-590-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-604-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2920-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-647-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2324-683-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-854-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ffflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2532 2096 41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe 30 PID 2096 wrote to memory of 2532 2096 41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe 30 PID 2096 wrote to memory of 2532 2096 41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe 30 PID 2096 wrote to memory of 2532 2096 41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe 30 PID 2532 wrote to memory of 2536 2532 rlxlrrx.exe 31 PID 2532 wrote to memory of 2536 2532 rlxlrrx.exe 31 PID 2532 wrote to memory of 2536 2532 rlxlrrx.exe 31 PID 2532 wrote to memory of 2536 2532 rlxlrrx.exe 31 PID 2536 wrote to memory of 2224 2536 hhbbbb.exe 32 PID 2536 wrote to memory of 2224 2536 hhbbbb.exe 32 PID 2536 wrote to memory of 2224 2536 hhbbbb.exe 32 PID 2536 wrote to memory of 2224 2536 hhbbbb.exe 32 PID 2224 wrote to memory of 2472 2224 7pddp.exe 33 PID 2224 wrote to memory of 2472 2224 7pddp.exe 33 PID 2224 wrote to memory of 2472 2224 7pddp.exe 33 PID 2224 wrote to memory of 2472 2224 7pddp.exe 33 PID 2472 wrote to memory of 2820 2472 lfxxffr.exe 34 PID 2472 wrote to memory of 2820 2472 lfxxffr.exe 34 PID 2472 wrote to memory of 2820 2472 lfxxffr.exe 34 PID 2472 wrote to memory of 2820 2472 lfxxffr.exe 34 PID 2820 wrote to memory of 2084 2820 1jpjd.exe 35 PID 2820 wrote to memory of 2084 2820 1jpjd.exe 35 PID 2820 wrote to memory of 2084 2820 1jpjd.exe 35 PID 2820 wrote to memory of 2084 2820 1jpjd.exe 35 PID 2084 wrote to memory of 2804 2084 7bnnnt.exe 36 PID 2084 wrote to memory of 2804 2084 7bnnnt.exe 36 PID 2084 wrote to memory of 2804 2084 7bnnnt.exe 36 PID 2084 wrote to memory of 2804 2084 7bnnnt.exe 36 PID 2804 wrote to memory of 2628 2804 tnbbtt.exe 37 PID 2804 wrote to memory of 2628 2804 tnbbtt.exe 37 PID 2804 wrote to memory of 2628 2804 tnbbtt.exe 37 PID 2804 wrote to memory of 2628 2804 tnbbtt.exe 37 PID 2628 wrote to memory of 2608 2628 rrlflfr.exe 38 PID 2628 wrote to memory of 2608 2628 rrlflfr.exe 38 PID 2628 wrote to memory of 2608 2628 rrlflfr.exe 38 PID 2628 wrote to memory of 2608 2628 rrlflfr.exe 38 PID 2608 wrote to memory of 2728 2608 3bhhhn.exe 39 PID 2608 wrote to memory of 2728 2608 3bhhhn.exe 39 PID 2608 wrote to memory of 2728 2608 3bhhhn.exe 39 PID 2608 wrote to memory of 2728 2608 3bhhhn.exe 39 PID 2728 wrote to memory of 3068 2728 tnnhhh.exe 40 PID 2728 wrote to memory of 3068 2728 tnnhhh.exe 40 PID 2728 wrote to memory of 3068 2728 tnnhhh.exe 40 PID 2728 wrote to memory of 3068 2728 tnnhhh.exe 40 PID 3068 wrote to memory of 1520 3068 7rffxxf.exe 41 PID 3068 wrote to memory of 1520 3068 7rffxxf.exe 41 PID 3068 wrote to memory of 1520 3068 7rffxxf.exe 41 PID 3068 wrote to memory of 1520 3068 7rffxxf.exe 41 PID 1520 wrote to memory of 1956 1520 tthhnb.exe 42 PID 1520 wrote to memory of 1956 1520 tthhnb.exe 42 PID 1520 wrote to memory of 1956 1520 tthhnb.exe 42 PID 1520 wrote to memory of 1956 1520 tthhnb.exe 42 PID 1956 wrote to memory of 1144 1956 pvddp.exe 43 PID 1956 wrote to memory of 1144 1956 pvddp.exe 43 PID 1956 wrote to memory of 1144 1956 pvddp.exe 43 PID 1956 wrote to memory of 1144 1956 pvddp.exe 43 PID 1144 wrote to memory of 896 1144 fffllll.exe 44 PID 1144 wrote to memory of 896 1144 fffllll.exe 44 PID 1144 wrote to memory of 896 1144 fffllll.exe 44 PID 1144 wrote to memory of 896 1144 fffllll.exe 44 PID 896 wrote to memory of 1364 896 bbtbhn.exe 45 PID 896 wrote to memory of 1364 896 bbtbhn.exe 45 PID 896 wrote to memory of 1364 896 bbtbhn.exe 45 PID 896 wrote to memory of 1364 896 bbtbhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe"C:\Users\Admin\AppData\Local\Temp\41cd1ec5c24a09a59c02c247230f72ba08076663d779d6ab6814d79ac3d3c616.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\rlxlrrx.exec:\rlxlrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\hhbbbb.exec:\hhbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7pddp.exec:\7pddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\lfxxffr.exec:\lfxxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\1jpjd.exec:\1jpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\7bnnnt.exec:\7bnnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\tnbbtt.exec:\tnbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rrlflfr.exec:\rrlflfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3bhhhn.exec:\3bhhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnnhhh.exec:\tnnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\7rffxxf.exec:\7rffxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\tthhnb.exec:\tthhnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\pvddp.exec:\pvddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\fffllll.exec:\fffllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\bbtbhn.exec:\bbtbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\jdpjj.exec:\jdpjj.exe17⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xfxfrrx.exec:\xfxfrrx.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xllrfff.exec:\xllrfff.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\btnbtb.exec:\btnbtb.exe20⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrffllr.exec:\xrffllr.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\btnnnh.exec:\btnnnh.exe22⤵
- Executes dropped EXE
PID:2960 -
\??\c:\dvjjp.exec:\dvjjp.exe23⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rlxfllx.exec:\rlxfllx.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\tbtntb.exec:\tbtntb.exe25⤵
- Executes dropped EXE
PID:2896 -
\??\c:\9pjjv.exec:\9pjjv.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3lxxxxl.exec:\3lxxxxl.exe27⤵
- Executes dropped EXE
PID:2288 -
\??\c:\5nhntt.exec:\5nhntt.exe28⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9vpvj.exec:\9vpvj.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\7xfllll.exec:\7xfllll.exe30⤵
- Executes dropped EXE
PID:2436 -
\??\c:\pdppv.exec:\pdppv.exe31⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fflxrrx.exec:\fflxrrx.exe32⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjddv.exec:\pjddv.exe33⤵
- Executes dropped EXE
PID:3016 -
\??\c:\frllrrx.exec:\frllrrx.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\frxfxfx.exec:\frxfxfx.exe35⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1xxflxl.exec:\1xxflxl.exe36⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhhnbh.exec:\nhhnbh.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\7jjvp.exec:\7jjvp.exe38⤵
- Executes dropped EXE
PID:1772 -
\??\c:\flrrllx.exec:\flrrllx.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lrffrlr.exec:\lrffrlr.exe40⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ntnthn.exec:\ntnthn.exe41⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpjjj.exec:\dpjjj.exe42⤵
- Executes dropped EXE
PID:2256 -
\??\c:\9flxflf.exec:\9flxflf.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rlxrflr.exec:\rlxrflr.exe44⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hbtbhh.exec:\hbtbhh.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vvppd.exec:\vvppd.exe46⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xrfrxrx.exec:\xrfrxrx.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rfflxfl.exec:\rfflxfl.exe48⤵
- Executes dropped EXE
PID:2160 -
\??\c:\htnntt.exec:\htnntt.exe49⤵
- Executes dropped EXE
PID:1260 -
\??\c:\vvjvd.exec:\vvjvd.exe50⤵
- Executes dropped EXE
PID:1520 -
\??\c:\1pddj.exec:\1pddj.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1rxffxf.exec:\1rxffxf.exe52⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bhnnhh.exec:\bhnnhh.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvdjv.exec:\dvdjv.exe54⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jvjvv.exec:\jvjvv.exe55⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lfxxfll.exec:\lfxxfll.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3052 -
\??\c:\tnttnb.exec:\tnttnb.exe57⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvppv.exec:\dvppv.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3rffflr.exec:\3rffflr.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5lxrflx.exec:\5lxrflx.exe60⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tnbhnn.exec:\tnbhnn.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdpvd.exec:\jdpvd.exe62⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dvpvd.exec:\dvpvd.exe63⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1rflllx.exec:\1rflllx.exe64⤵
- Executes dropped EXE
PID:1716 -
\??\c:\tnbhnn.exec:\tnbhnn.exe65⤵
- Executes dropped EXE
PID:1440 -
\??\c:\hththh.exec:\hththh.exe66⤵PID:2328
-
\??\c:\pjvjj.exec:\pjvjj.exe67⤵PID:2460
-
\??\c:\dpvpv.exec:\dpvpv.exe68⤵PID:2304
-
\??\c:\9fflllr.exec:\9fflllr.exe69⤵PID:1892
-
\??\c:\bthnbh.exec:\bthnbh.exe70⤵PID:2236
-
\??\c:\1hthhh.exec:\1hthhh.exe71⤵PID:2436
-
\??\c:\jjvvj.exec:\jjvvj.exe72⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\lrxrrll.exec:\lrxrrll.exe73⤵PID:1436
-
\??\c:\rlxxffl.exec:\rlxxffl.exe74⤵PID:2096
-
\??\c:\hbnhbb.exec:\hbnhbb.exe75⤵PID:3016
-
\??\c:\3nbntb.exec:\3nbntb.exe76⤵PID:1992
-
\??\c:\jdpdj.exec:\jdpdj.exe77⤵PID:2412
-
\??\c:\rrffxxf.exec:\rrffxxf.exe78⤵PID:2700
-
\??\c:\bnbbnh.exec:\bnbbnh.exe79⤵PID:2920
-
\??\c:\thtbnh.exec:\thtbnh.exe80⤵PID:2824
-
\??\c:\9jdjv.exec:\9jdjv.exe81⤵PID:2816
-
\??\c:\7jdjv.exec:\7jdjv.exe82⤵PID:2976
-
\??\c:\rlxrlfl.exec:\rlxrlfl.exe83⤵PID:2872
-
\??\c:\btnhnh.exec:\btnhnh.exe84⤵PID:2804
-
\??\c:\jdjjp.exec:\jdjjp.exe85⤵PID:2644
-
\??\c:\1frlrlx.exec:\1frlrlx.exe86⤵PID:1372
-
\??\c:\3lrxrxx.exec:\3lrxrxx.exe87⤵PID:1208
-
\??\c:\htbttb.exec:\htbttb.exe88⤵PID:2216
-
\??\c:\5dvdv.exec:\5dvdv.exe89⤵PID:1732
-
\??\c:\9vjvv.exec:\9vjvv.exe90⤵PID:664
-
\??\c:\3lrrfff.exec:\3lrrfff.exe91⤵PID:2324
-
\??\c:\hbtthn.exec:\hbtthn.exe92⤵PID:1632
-
\??\c:\3thhnt.exec:\3thhnt.exe93⤵PID:1144
-
\??\c:\1vvjd.exec:\1vvjd.exe94⤵PID:2044
-
\??\c:\lxlrxfr.exec:\lxlrxfr.exe95⤵PID:1072
-
\??\c:\lxfrfxx.exec:\lxfrfxx.exe96⤵PID:1584
-
\??\c:\nhtbbb.exec:\nhtbbb.exe97⤵PID:1228
-
\??\c:\nhbhhn.exec:\nhbhhn.exe98⤵PID:2708
-
\??\c:\flxfrrx.exec:\flxfrrx.exe99⤵PID:1500
-
\??\c:\rrfflrr.exec:\rrfflrr.exe100⤵PID:2704
-
\??\c:\3hnntt.exec:\3hnntt.exe101⤵PID:2240
-
\??\c:\5ppvd.exec:\5ppvd.exe102⤵PID:1404
-
\??\c:\ppdjv.exec:\ppdjv.exe103⤵PID:788
-
\??\c:\rlffllr.exec:\rlffllr.exe104⤵PID:408
-
\??\c:\ttbtbt.exec:\ttbtbt.exe105⤵PID:444
-
\??\c:\bhtntn.exec:\bhtntn.exe106⤵PID:1656
-
\??\c:\vdvjd.exec:\vdvjd.exe107⤵PID:632
-
\??\c:\lxfllxf.exec:\lxfllxf.exe108⤵PID:1440
-
\??\c:\frfrxrx.exec:\frfrxrx.exe109⤵PID:2292
-
\??\c:\7tnnnt.exec:\7tnnnt.exe110⤵PID:2460
-
\??\c:\5ddpj.exec:\5ddpj.exe111⤵PID:1448
-
\??\c:\vvvjd.exec:\vvvjd.exe112⤵PID:1712
-
\??\c:\5ffflff.exec:\5ffflff.exe113⤵
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\tnhnhn.exec:\tnhnhn.exe114⤵PID:2436
-
\??\c:\htnttt.exec:\htnttt.exe115⤵PID:2516
-
\??\c:\dvddv.exec:\dvddv.exe116⤵PID:2380
-
\??\c:\xrrxllr.exec:\xrrxllr.exe117⤵PID:2356
-
\??\c:\7fxrrrf.exec:\7fxrrrf.exe118⤵PID:1512
-
\??\c:\tbhtnt.exec:\tbhtnt.exe119⤵PID:1944
-
\??\c:\vpvvd.exec:\vpvvd.exe120⤵PID:1912
-
\??\c:\9lrrllx.exec:\9lrrllx.exe121⤵PID:2212
-
\??\c:\xxflrrx.exec:\xxflrrx.exe122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-