Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe
-
Size
456KB
-
MD5
54228cbbc3980dffb6e84088304dcb71
-
SHA1
a685aee5b17f9b104ce5ae05e7ce48e919ae7c0e
-
SHA256
324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7
-
SHA512
dc2180444b8f0bbe729439294a544b26845c40727785c8bf32e03b114396fdaacbc737062dc98230c0b531832cfe8236100f8aff1cfc33a0e31a7314248add77
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRV:q7Tc2NYHUrAwfMp3CDRV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-111-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1648-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-158-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1764-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-205-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-223-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2160-231-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1628-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1620-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-301-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2452-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-455-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-487-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-557-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2172-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-579-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2668-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-644-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2936-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/388-753-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-778-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-819-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2024-830-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-831-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-884-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/664-961-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-975-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2372 5fllrrr.exe 2476 1tbhtn.exe 2388 dvjjp.exe 1332 llffffl.exe 2892 xlxrrrx.exe 2744 7xlfxxf.exe 2968 xlfflff.exe 2784 xrlrlrl.exe 2624 5xlrxxf.exe 2224 ddvjv.exe 604 rlllxxl.exe 1648 bbbhbb.exe 2460 pdpvv.exe 2340 3htthn.exe 2940 hbtnhh.exe 2204 3bttbh.exe 1220 9vjjj.exe 1764 bhhtth.exe 2096 jvdvd.exe 2592 vpppv.exe 320 frllrxf.exe 1628 7tntbt.exe 828 vjddj.exe 2160 llllfxl.exe 1620 9bttbh.exe 3004 ppddj.exe 2008 tnbhhh.exe 2276 jvppv.exe 1936 fxlflrf.exe 1500 3thhtb.exe 1032 9dppd.exe 1776 rfxfrrf.exe 2452 tbbhtb.exe 3000 ffffrxf.exe 2716 nhhnbb.exe 2896 9dvdd.exe 2488 pvddp.exe 2892 3fxxlrf.exe 2852 bnbbbh.exe 2640 5vjjp.exe 2240 9frxllr.exe 2660 5xlllrx.exe 2784 hhhtnt.exe 2436 pjvvv.exe 2224 jdvdv.exe 1404 xrllrrl.exe 2168 hhhbhn.exe 1008 7pjvd.exe 2164 fxlxffl.exe 2340 xxxxlrf.exe 2872 hhbnth.exe 2940 bbbbnt.exe 844 ddvvd.exe 1408 rlflxfx.exe 1428 rfffllx.exe 1424 thttnh.exe 2096 3jdjp.exe 772 pjjjp.exe 2092 frlrrxl.exe 1084 btbhnn.exe 1628 tnhhnt.exe 768 5ddjp.exe 1188 rrrxrxl.exe 2160 xlfflrx.exe -
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-147-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2204-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-455-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-819-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2024-830-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-870-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2672-962-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2372 1732 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 1732 wrote to memory of 2372 1732 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 1732 wrote to memory of 2372 1732 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 1732 wrote to memory of 2372 1732 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 2372 wrote to memory of 2476 2372 5fllrrr.exe 31 PID 2372 wrote to memory of 2476 2372 5fllrrr.exe 31 PID 2372 wrote to memory of 2476 2372 5fllrrr.exe 31 PID 2372 wrote to memory of 2476 2372 5fllrrr.exe 31 PID 2476 wrote to memory of 2388 2476 1tbhtn.exe 32 PID 2476 wrote to memory of 2388 2476 1tbhtn.exe 32 PID 2476 wrote to memory of 2388 2476 1tbhtn.exe 32 PID 2476 wrote to memory of 2388 2476 1tbhtn.exe 32 PID 2388 wrote to memory of 1332 2388 dvjjp.exe 33 PID 2388 wrote to memory of 1332 2388 dvjjp.exe 33 PID 2388 wrote to memory of 1332 2388 dvjjp.exe 33 PID 2388 wrote to memory of 1332 2388 dvjjp.exe 33 PID 1332 wrote to memory of 2892 1332 llffffl.exe 34 PID 1332 wrote to memory of 2892 1332 llffffl.exe 34 PID 1332 wrote to memory of 2892 1332 llffffl.exe 34 PID 1332 wrote to memory of 2892 1332 llffffl.exe 34 PID 2892 wrote to memory of 2744 2892 xlxrrrx.exe 35 PID 2892 wrote to memory of 2744 2892 xlxrrrx.exe 35 PID 2892 wrote to memory of 2744 2892 xlxrrrx.exe 35 PID 2892 wrote to memory of 2744 2892 xlxrrrx.exe 35 PID 2744 wrote to memory of 2968 2744 7xlfxxf.exe 36 PID 2744 wrote to memory of 2968 2744 7xlfxxf.exe 36 PID 2744 wrote to memory of 2968 2744 7xlfxxf.exe 36 PID 2744 wrote to memory of 2968 2744 7xlfxxf.exe 36 PID 2968 wrote to memory of 2784 2968 xlfflff.exe 37 PID 2968 wrote to memory of 2784 2968 xlfflff.exe 37 PID 2968 wrote to memory of 2784 2968 xlfflff.exe 37 PID 2968 wrote to memory of 2784 2968 xlfflff.exe 37 PID 2784 wrote to memory of 2624 2784 xrlrlrl.exe 38 PID 2784 wrote to memory of 2624 2784 xrlrlrl.exe 38 PID 2784 wrote to memory of 2624 2784 xrlrlrl.exe 38 PID 2784 wrote to memory of 2624 2784 xrlrlrl.exe 38 PID 2624 wrote to memory of 2224 2624 5xlrxxf.exe 39 PID 2624 wrote to memory of 2224 2624 5xlrxxf.exe 39 PID 2624 wrote to memory of 2224 2624 5xlrxxf.exe 39 PID 2624 wrote to memory of 2224 2624 5xlrxxf.exe 39 PID 2224 wrote to memory of 604 2224 ddvjv.exe 40 PID 2224 wrote to memory of 604 2224 ddvjv.exe 40 PID 2224 wrote to memory of 604 2224 ddvjv.exe 40 PID 2224 wrote to memory of 604 2224 ddvjv.exe 40 PID 604 wrote to memory of 1648 604 rlllxxl.exe 41 PID 604 wrote to memory of 1648 604 rlllxxl.exe 41 PID 604 wrote to memory of 1648 604 rlllxxl.exe 41 PID 604 wrote to memory of 1648 604 rlllxxl.exe 41 PID 1648 wrote to memory of 2460 1648 bbbhbb.exe 42 PID 1648 wrote to memory of 2460 1648 bbbhbb.exe 42 PID 1648 wrote to memory of 2460 1648 bbbhbb.exe 42 PID 1648 wrote to memory of 2460 1648 bbbhbb.exe 42 PID 2460 wrote to memory of 2340 2460 pdpvv.exe 43 PID 2460 wrote to memory of 2340 2460 pdpvv.exe 43 PID 2460 wrote to memory of 2340 2460 pdpvv.exe 43 PID 2460 wrote to memory of 2340 2460 pdpvv.exe 43 PID 2340 wrote to memory of 2940 2340 3htthn.exe 44 PID 2340 wrote to memory of 2940 2340 3htthn.exe 44 PID 2340 wrote to memory of 2940 2340 3htthn.exe 44 PID 2340 wrote to memory of 2940 2340 3htthn.exe 44 PID 2940 wrote to memory of 2204 2940 hbtnhh.exe 45 PID 2940 wrote to memory of 2204 2940 hbtnhh.exe 45 PID 2940 wrote to memory of 2204 2940 hbtnhh.exe 45 PID 2940 wrote to memory of 2204 2940 hbtnhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe"C:\Users\Admin\AppData\Local\Temp\324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\5fllrrr.exec:\5fllrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1tbhtn.exec:\1tbhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\dvjjp.exec:\dvjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\llffffl.exec:\llffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\7xlfxxf.exec:\7xlfxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xlfflff.exec:\xlfflff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\5xlrxxf.exec:\5xlrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ddvjv.exec:\ddvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\rlllxxl.exec:\rlllxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\bbbhbb.exec:\bbbhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\pdpvv.exec:\pdpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\3htthn.exec:\3htthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\hbtnhh.exec:\hbtnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\3bttbh.exec:\3bttbh.exe17⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9vjjj.exec:\9vjjj.exe18⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bhhtth.exec:\bhhtth.exe19⤵
- Executes dropped EXE
PID:1764 -
\??\c:\jvdvd.exec:\jvdvd.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vpppv.exec:\vpppv.exe21⤵
- Executes dropped EXE
PID:2592 -
\??\c:\frllrxf.exec:\frllrxf.exe22⤵
- Executes dropped EXE
PID:320 -
\??\c:\7tntbt.exec:\7tntbt.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vjddj.exec:\vjddj.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\llllfxl.exec:\llllfxl.exe25⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9bttbh.exec:\9bttbh.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ppddj.exec:\ppddj.exe27⤵
- Executes dropped EXE
PID:3004 -
\??\c:\tnbhhh.exec:\tnbhhh.exe28⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jvppv.exec:\jvppv.exe29⤵
- Executes dropped EXE
PID:2276 -
\??\c:\fxlflrf.exec:\fxlflrf.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\3thhtb.exec:\3thhtb.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9dppd.exec:\9dppd.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rfxfrrf.exec:\rfxfrrf.exe33⤵
- Executes dropped EXE
PID:1776 -
\??\c:\tbbhtb.exec:\tbbhtb.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\ffffrxf.exec:\ffffrxf.exe35⤵
- Executes dropped EXE
PID:3000 -
\??\c:\nhhnbb.exec:\nhhnbb.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9dvdd.exec:\9dvdd.exe37⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pvddp.exec:\pvddp.exe38⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3fxxlrf.exec:\3fxxlrf.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bnbbbh.exec:\bnbbbh.exe40⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5vjjp.exec:\5vjjp.exe41⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9frxllr.exec:\9frxllr.exe42⤵
- Executes dropped EXE
PID:2240 -
\??\c:\5xlllrx.exec:\5xlllrx.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hhhtnt.exec:\hhhtnt.exe44⤵
- Executes dropped EXE
PID:2784 -
\??\c:\pjvvv.exec:\pjvvv.exe45⤵
- Executes dropped EXE
PID:2436 -
\??\c:\jdvdv.exec:\jdvdv.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrllrrl.exec:\xrllrrl.exe47⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hhhbhn.exec:\hhhbhn.exe48⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7pjvd.exec:\7pjvd.exe49⤵
- Executes dropped EXE
PID:1008 -
\??\c:\fxlxffl.exec:\fxlxffl.exe50⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe51⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hhbnth.exec:\hhbnth.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bbbbnt.exec:\bbbbnt.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddvvd.exec:\ddvvd.exe54⤵
- Executes dropped EXE
PID:844 -
\??\c:\rlflxfx.exec:\rlflxfx.exe55⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rfffllx.exec:\rfffllx.exe56⤵
- Executes dropped EXE
PID:1428 -
\??\c:\thttnh.exec:\thttnh.exe57⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3jdjp.exec:\3jdjp.exe58⤵
- Executes dropped EXE
PID:2096 -
\??\c:\pjjjp.exec:\pjjjp.exe59⤵
- Executes dropped EXE
PID:772 -
\??\c:\frlrrxl.exec:\frlrrxl.exe60⤵
- Executes dropped EXE
PID:2092 -
\??\c:\btbhnn.exec:\btbhnn.exe61⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tnhhnt.exec:\tnhhnt.exe62⤵
- Executes dropped EXE
PID:1628 -
\??\c:\5ddjp.exec:\5ddjp.exe63⤵
- Executes dropped EXE
PID:768 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe64⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xlfflrx.exec:\xlfflrx.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5tnntt.exec:\5tnntt.exe66⤵PID:2264
-
\??\c:\pjvdp.exec:\pjvdp.exe67⤵PID:2272
-
\??\c:\jjdjp.exec:\jjdjp.exe68⤵PID:2152
-
\??\c:\5llrrxr.exec:\5llrrxr.exe69⤵PID:1756
-
\??\c:\ttbntn.exec:\ttbntn.exe70⤵PID:1820
-
\??\c:\3bnnhb.exec:\3bnnhb.exe71⤵PID:2424
-
\??\c:\ppjpv.exec:\ppjpv.exe72⤵PID:2548
-
\??\c:\rfrxfff.exec:\rfrxfff.exe73⤵PID:2172
-
\??\c:\9htthb.exec:\9htthb.exe74⤵PID:2416
-
\??\c:\nbtbhb.exec:\nbtbhb.exe75⤵PID:1732
-
\??\c:\jvjjj.exec:\jvjjj.exe76⤵PID:2492
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe77⤵PID:372
-
\??\c:\lxllrrf.exec:\lxllrrf.exe78⤵PID:2256
-
\??\c:\thnhnh.exec:\thnhnh.exe79⤵PID:2756
-
\??\c:\vjjpv.exec:\vjjpv.exe80⤵PID:2884
-
\??\c:\dvvvp.exec:\dvvvp.exe81⤵PID:2916
-
\??\c:\lfxxflx.exec:\lfxxflx.exe82⤵PID:2744
-
\??\c:\3tbbtt.exec:\3tbbtt.exe83⤵PID:2728
-
\??\c:\3jjvj.exec:\3jjvj.exe84⤵PID:2668
-
\??\c:\5jddp.exec:\5jddp.exe85⤵PID:2644
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe86⤵PID:2296
-
\??\c:\ttbbhh.exec:\ttbbhh.exe87⤵PID:2664
-
\??\c:\3dpvv.exec:\3dpvv.exe88⤵PID:2856
-
\??\c:\ppjpp.exec:\ppjpp.exe89⤵PID:1684
-
\??\c:\rlxxlrf.exec:\rlxxlrf.exe90⤵PID:832
-
\??\c:\1bnhnh.exec:\1bnhnh.exe91⤵PID:664
-
\??\c:\tnhhtn.exec:\tnhhtn.exe92⤵PID:2936
-
\??\c:\djpvd.exec:\djpvd.exe93⤵PID:2164
-
\??\c:\lfxfrxf.exec:\lfxfrxf.exe94⤵PID:2340
-
\??\c:\xlrrxxx.exec:\xlrrxxx.exe95⤵PID:2872
-
\??\c:\hbtthn.exec:\hbtthn.exe96⤵PID:2940
-
\??\c:\7dpjd.exec:\7dpjd.exe97⤵PID:844
-
\??\c:\5vppj.exec:\5vppj.exe98⤵PID:1708
-
\??\c:\lrlxxrr.exec:\lrlxxrr.exe99⤵PID:1428
-
\??\c:\1bhnnn.exec:\1bhnnn.exe100⤵PID:2112
-
\??\c:\htbhhb.exec:\htbhhb.exe101⤵PID:2596
-
\??\c:\dpddd.exec:\dpddd.exe102⤵
- System Location Discovery: System Language Discovery
PID:388 -
\??\c:\xfrfxfr.exec:\xfrfxfr.exe103⤵PID:2092
-
\??\c:\tnhntb.exec:\tnhntb.exe104⤵PID:752
-
\??\c:\tnbbtt.exec:\tnbbtt.exe105⤵PID:1088
-
\??\c:\1jdpv.exec:\1jdpv.exe106⤵PID:768
-
\??\c:\lfrrffl.exec:\lfrrffl.exe107⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\lxxrrrx.exec:\lxxrrrx.exe108⤵PID:2576
-
\??\c:\tnhnnb.exec:\tnhnnb.exe109⤵PID:2264
-
\??\c:\5pjdd.exec:\5pjdd.exe110⤵PID:2272
-
\??\c:\vpvvv.exec:\vpvvv.exe111⤵PID:1752
-
\??\c:\llfflrr.exec:\llfflrr.exe112⤵PID:3048
-
\??\c:\thtttt.exec:\thtttt.exe113⤵PID:2536
-
\??\c:\pdvjp.exec:\pdvjp.exe114⤵PID:2024
-
\??\c:\jdvpv.exec:\jdvpv.exe115⤵PID:888
-
\??\c:\rfxflxl.exec:\rfxflxl.exe116⤵PID:2372
-
\??\c:\hththh.exec:\hththh.exe117⤵PID:1776
-
\??\c:\ppppd.exec:\ppppd.exe118⤵PID:1732
-
\??\c:\7jjjp.exec:\7jjjp.exe119⤵PID:2740
-
\??\c:\rrllxlf.exec:\rrllxlf.exe120⤵PID:1604
-
\??\c:\9bnttt.exec:\9bnttt.exe121⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-