Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 22:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe
-
Size
456KB
-
MD5
9e997de85bc422a882fb6acd44f5d572
-
SHA1
6820f45ba36948050e8925359b4743c1ffdc64e0
-
SHA256
457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4
-
SHA512
ac96ba1f7e3633bfb38e597819b9e74bdedb66bc0ad07b1d067995fde25f459bf89ae3605a819e125c9d2e07503c574d715e21c54f3d59c40812e6490ad46d29
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRIG:q7Tc2NYHUrAwfMp3CDRT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2600-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-311-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2908-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/340-1074-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/3044-1358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-1263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2136-969-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-709-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-640-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-534-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2008-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-304-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1516-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2344-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1816 llxfrxl.exe 2084 pddjd.exe 2164 lfxlxrx.exe 2884 9xlfflr.exe 2752 bttthn.exe 3032 dvvpp.exe 3012 rllxlrf.exe 2692 hthtnh.exe 2668 vdvvp.exe 2012 fxlrflf.exe 768 llrflxl.exe 1168 3bhtnt.exe 2956 vdppp.exe 1496 7xrrxxf.exe 588 jdvvj.exe 2964 flxlrrx.exe 264 nbbbbb.exe 864 vjvdj.exe 2344 lfrxflr.exe 2372 lxrrxfl.exe 2740 thbbnn.exe 1944 rlxfxfr.exe 1936 nbbtnn.exe 1828 5ththh.exe 1564 1lrlffr.exe 856 3llxlrf.exe 2980 7bbttt.exe 1824 fxrfxrf.exe 2564 5ffflrx.exe 1952 thnnbh.exe 1516 vjvdd.exe 2176 xfxxllr.exe 2724 rlrrlfr.exe 2080 tnbhnt.exe 2016 9pjpv.exe 2084 xrllxfr.exe 2908 nnthtt.exe 2852 jpjdp.exe 1796 vpdpp.exe 2112 llxflrf.exe 3012 tbtbtb.exe 2872 nhbhtb.exe 1804 pjjpd.exe 1164 lfxflrf.exe 1608 rrllxff.exe 2952 nnthhb.exe 2780 vpjjp.exe 2000 xxxxxlf.exe 1792 7xlrfxr.exe 2896 tnthnt.exe 2992 3btbnn.exe 2124 vjdjv.exe 2928 9lrrffl.exe 1676 fxrxrrf.exe 2120 tthntb.exe 2416 hbnhtn.exe 2540 pjddp.exe 2364 xxrfrrf.exe 1956 xfflxlf.exe 1992 nhtbnt.exe 952 nthnhh.exe 900 jdjjj.exe 2240 xrrfrxf.exe 2184 httbhh.exe -
resource yara_rule behavioral1/memory/2600-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-840-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-1001-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-1358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-797-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-19-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1816 2600 457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe 30 PID 2600 wrote to memory of 1816 2600 457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe 30 PID 2600 wrote to memory of 1816 2600 457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe 30 PID 2600 wrote to memory of 1816 2600 457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe 30 PID 1816 wrote to memory of 2084 1816 llxfrxl.exe 65 PID 1816 wrote to memory of 2084 1816 llxfrxl.exe 65 PID 1816 wrote to memory of 2084 1816 llxfrxl.exe 65 PID 1816 wrote to memory of 2084 1816 llxfrxl.exe 65 PID 2084 wrote to memory of 2164 2084 pddjd.exe 32 PID 2084 wrote to memory of 2164 2084 pddjd.exe 32 PID 2084 wrote to memory of 2164 2084 pddjd.exe 32 PID 2084 wrote to memory of 2164 2084 pddjd.exe 32 PID 2164 wrote to memory of 2884 2164 lfxlxrx.exe 33 PID 2164 wrote to memory of 2884 2164 lfxlxrx.exe 33 PID 2164 wrote to memory of 2884 2164 lfxlxrx.exe 33 PID 2164 wrote to memory of 2884 2164 lfxlxrx.exe 33 PID 2884 wrote to memory of 2752 2884 9xlfflr.exe 34 PID 2884 wrote to memory of 2752 2884 9xlfflr.exe 34 PID 2884 wrote to memory of 2752 2884 9xlfflr.exe 34 PID 2884 wrote to memory of 2752 2884 9xlfflr.exe 34 PID 2752 wrote to memory of 3032 2752 bttthn.exe 107 PID 2752 wrote to memory of 3032 2752 bttthn.exe 107 PID 2752 wrote to memory of 3032 2752 bttthn.exe 107 PID 2752 wrote to memory of 3032 2752 bttthn.exe 107 PID 3032 wrote to memory of 3012 3032 dvvpp.exe 36 PID 3032 wrote to memory of 3012 3032 dvvpp.exe 36 PID 3032 wrote to memory of 3012 3032 dvvpp.exe 36 PID 3032 wrote to memory of 3012 3032 dvvpp.exe 36 PID 3012 wrote to memory of 2692 3012 rllxlrf.exe 196 PID 3012 wrote to memory of 2692 3012 rllxlrf.exe 196 PID 3012 wrote to memory of 2692 3012 rllxlrf.exe 196 PID 3012 wrote to memory of 2692 3012 rllxlrf.exe 196 PID 2692 wrote to memory of 2668 2692 hthtnh.exe 38 PID 2692 wrote to memory of 2668 2692 hthtnh.exe 38 PID 2692 wrote to memory of 2668 2692 hthtnh.exe 38 PID 2692 wrote to memory of 2668 2692 hthtnh.exe 38 PID 2668 wrote to memory of 2012 2668 vdvvp.exe 39 PID 2668 wrote to memory of 2012 2668 vdvvp.exe 39 PID 2668 wrote to memory of 2012 2668 vdvvp.exe 39 PID 2668 wrote to memory of 2012 2668 vdvvp.exe 39 PID 2012 wrote to memory of 768 2012 fxlrflf.exe 113 PID 2012 wrote to memory of 768 2012 fxlrflf.exe 113 PID 2012 wrote to memory of 768 2012 fxlrflf.exe 113 PID 2012 wrote to memory of 768 2012 fxlrflf.exe 113 PID 768 wrote to memory of 1168 768 llrflxl.exe 41 PID 768 wrote to memory of 1168 768 llrflxl.exe 41 PID 768 wrote to memory of 1168 768 llrflxl.exe 41 PID 768 wrote to memory of 1168 768 llrflxl.exe 41 PID 1168 wrote to memory of 2956 1168 3bhtnt.exe 42 PID 1168 wrote to memory of 2956 1168 3bhtnt.exe 42 PID 1168 wrote to memory of 2956 1168 3bhtnt.exe 42 PID 1168 wrote to memory of 2956 1168 3bhtnt.exe 42 PID 2956 wrote to memory of 1496 2956 vdppp.exe 43 PID 2956 wrote to memory of 1496 2956 vdppp.exe 43 PID 2956 wrote to memory of 1496 2956 vdppp.exe 43 PID 2956 wrote to memory of 1496 2956 vdppp.exe 43 PID 1496 wrote to memory of 588 1496 7xrrxxf.exe 44 PID 1496 wrote to memory of 588 1496 7xrrxxf.exe 44 PID 1496 wrote to memory of 588 1496 7xrrxxf.exe 44 PID 1496 wrote to memory of 588 1496 7xrrxxf.exe 44 PID 588 wrote to memory of 2964 588 jdvvj.exe 45 PID 588 wrote to memory of 2964 588 jdvvj.exe 45 PID 588 wrote to memory of 2964 588 jdvvj.exe 45 PID 588 wrote to memory of 2964 588 jdvvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe"C:\Users\Admin\AppData\Local\Temp\457de13af9918e8e0006744d8b91c4c6072d31698d95878ec6936ce32e4a58c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\llxfrxl.exec:\llxfrxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\pddjd.exec:\pddjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\lfxlxrx.exec:\lfxlxrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\9xlfflr.exec:\9xlfflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\bttthn.exec:\bttthn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dvvpp.exec:\dvvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rllxlrf.exec:\rllxlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\hthtnh.exec:\hthtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vdvvp.exec:\vdvvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\fxlrflf.exec:\fxlrflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\llrflxl.exec:\llrflxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\3bhtnt.exec:\3bhtnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\vdppp.exec:\vdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\7xrrxxf.exec:\7xrrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\jdvvj.exec:\jdvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:588 -
\??\c:\flxlrrx.exec:\flxlrrx.exe17⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nbbbbb.exec:\nbbbbb.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\vjvdj.exec:\vjvdj.exe19⤵
- Executes dropped EXE
PID:864 -
\??\c:\lfrxflr.exec:\lfrxflr.exe20⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lxrrxfl.exec:\lxrrxfl.exe21⤵
- Executes dropped EXE
PID:2372 -
\??\c:\thbbnn.exec:\thbbnn.exe22⤵
- Executes dropped EXE
PID:2740 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe23⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nbbtnn.exec:\nbbtnn.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5ththh.exec:\5ththh.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\1lrlffr.exec:\1lrlffr.exe26⤵
- Executes dropped EXE
PID:1564 -
\??\c:\3llxlrf.exec:\3llxlrf.exe27⤵
- Executes dropped EXE
PID:856 -
\??\c:\7bbttt.exec:\7bbttt.exe28⤵
- Executes dropped EXE
PID:2980 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe29⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5ffflrx.exec:\5ffflrx.exe30⤵
- Executes dropped EXE
PID:2564 -
\??\c:\thnnbh.exec:\thnnbh.exe31⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vjvdd.exec:\vjvdd.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xfxxllr.exec:\xfxxllr.exe33⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlrrlfr.exec:\rlrrlfr.exe34⤵
- Executes dropped EXE
PID:2724 -
\??\c:\tnbhnt.exec:\tnbhnt.exe35⤵
- Executes dropped EXE
PID:2080 -
\??\c:\9pjpv.exec:\9pjpv.exe36⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xrllxfr.exec:\xrllxfr.exe37⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nnthtt.exec:\nnthtt.exe38⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jpjdp.exec:\jpjdp.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vpdpp.exec:\vpdpp.exe40⤵
- Executes dropped EXE
PID:1796 -
\??\c:\llxflrf.exec:\llxflrf.exe41⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tbtbtb.exec:\tbtbtb.exe42⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhbhtb.exec:\nhbhtb.exe43⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pjjpd.exec:\pjjpd.exe44⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lfxflrf.exec:\lfxflrf.exe45⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rrllxff.exec:\rrllxff.exe46⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nnthhb.exec:\nnthhb.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vpjjp.exec:\vpjjp.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xxxxxlf.exec:\xxxxxlf.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7xlrfxr.exec:\7xlrfxr.exe50⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tnthnt.exec:\tnthnt.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\3btbnn.exec:\3btbnn.exe52⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vjdjv.exec:\vjdjv.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9lrrffl.exec:\9lrrffl.exe54⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tthntb.exec:\tthntb.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\hbnhtn.exec:\hbnhtn.exe57⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pjddp.exec:\pjddp.exe58⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxrfrrf.exec:\xxrfrrf.exe59⤵
- Executes dropped EXE
PID:2364 -
\??\c:\xfflxlf.exec:\xfflxlf.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nhtbnt.exec:\nhtbnt.exe61⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nthnhh.exec:\nthnhh.exe62⤵
- Executes dropped EXE
PID:952 -
\??\c:\jdjjj.exec:\jdjjj.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\xrrfrxf.exec:\xrrfrxf.exe64⤵
- Executes dropped EXE
PID:2240 -
\??\c:\httbhh.exec:\httbhh.exe65⤵
- Executes dropped EXE
PID:2184 -
\??\c:\btbnbn.exec:\btbnbn.exe66⤵PID:2980
-
\??\c:\ppjpd.exec:\ppjpd.exe67⤵PID:608
-
\??\c:\jjddp.exec:\jjddp.exe68⤵PID:2008
-
\??\c:\3lflxlf.exec:\3lflxlf.exe69⤵PID:3040
-
\??\c:\lfrrrlf.exec:\lfrrrlf.exe70⤵PID:2292
-
\??\c:\1ntnnh.exec:\1ntnnh.exe71⤵PID:2600
-
\??\c:\nhtthh.exec:\nhtthh.exe72⤵PID:2532
-
\??\c:\vjpjd.exec:\vjpjd.exe73⤵PID:332
-
\??\c:\lfrlxfl.exec:\lfrlxfl.exe74⤵PID:2500
-
\??\c:\xrfrflx.exec:\xrfrflx.exe75⤵PID:2904
-
\??\c:\btnnhb.exec:\btnnhb.exe76⤵PID:2884
-
\??\c:\pdppd.exec:\pdppd.exe77⤵PID:2804
-
\??\c:\3dppv.exec:\3dppv.exe78⤵PID:2224
-
\??\c:\flflxxf.exec:\flflxxf.exe79⤵PID:3032
-
\??\c:\bhttbb.exec:\bhttbb.exe80⤵PID:2276
-
\??\c:\5hhhnn.exec:\5hhhnn.exe81⤵PID:2652
-
\??\c:\vdjdv.exec:\vdjdv.exe82⤵PID:2736
-
\??\c:\9lxrflr.exec:\9lxrflr.exe83⤵PID:2456
-
\??\c:\1frrxrx.exec:\1frrxrx.exe84⤵PID:1804
-
\??\c:\nhttbb.exec:\nhttbb.exe85⤵PID:768
-
\??\c:\htnthn.exec:\htnthn.exe86⤵PID:3000
-
\??\c:\5djjp.exec:\5djjp.exe87⤵PID:2840
-
\??\c:\rlxxflr.exec:\rlxxflr.exe88⤵PID:344
-
\??\c:\lfllxlr.exec:\lfllxlr.exe89⤵PID:2956
-
\??\c:\bbtthh.exec:\bbtthh.exe90⤵PID:2820
-
\??\c:\tnhnnb.exec:\tnhnnb.exe91⤵PID:2968
-
\??\c:\pdpjj.exec:\pdpjj.exe92⤵PID:536
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe93⤵PID:2984
-
\??\c:\frlrrrf.exec:\frlrrrf.exe94⤵PID:264
-
\??\c:\thbhtn.exec:\thbhtn.exe95⤵PID:1948
-
\??\c:\djvpp.exec:\djvpp.exe96⤵PID:2260
-
\??\c:\vpdpv.exec:\vpdpv.exe97⤵PID:2648
-
\??\c:\5rffxrr.exec:\5rffxrr.exe98⤵PID:3060
-
\??\c:\3rrrlrf.exec:\3rrrlrf.exe99⤵PID:2740
-
\??\c:\1bhhtt.exec:\1bhhtt.exe100⤵PID:1876
-
\??\c:\dpvdv.exec:\dpvdv.exe101⤵
- System Location Discovery: System Language Discovery
PID:2392 -
\??\c:\dvjdd.exec:\dvjdd.exe102⤵PID:1936
-
\??\c:\1xfflrx.exec:\1xfflrx.exe103⤵PID:1828
-
\??\c:\fxllrxx.exec:\fxllrxx.exe104⤵PID:1788
-
\??\c:\3nhhhb.exec:\3nhhhb.exe105⤵PID:856
-
\??\c:\hbtbnt.exec:\hbtbnt.exe106⤵PID:2328
-
\??\c:\dvjdj.exec:\dvjdj.exe107⤵PID:556
-
\??\c:\rrlxllx.exec:\rrlxllx.exe108⤵PID:304
-
\??\c:\lfxflrx.exec:\lfxflrx.exe109⤵PID:608
-
\??\c:\nbnbhb.exec:\nbnbhb.exe110⤵PID:2008
-
\??\c:\1nhhtb.exec:\1nhhtb.exe111⤵PID:3040
-
\??\c:\ppdjd.exec:\ppdjd.exe112⤵PID:2292
-
\??\c:\ppjvd.exec:\ppjvd.exe113⤵PID:340
-
\??\c:\ffrrxrr.exec:\ffrrxrr.exe114⤵PID:1960
-
\??\c:\lxrrlrx.exec:\lxrrlrx.exe115⤵PID:1692
-
\??\c:\tthnbn.exec:\tthnbn.exe116⤵PID:1556
-
\??\c:\jpjpd.exec:\jpjpd.exe117⤵PID:2892
-
\??\c:\pjjvd.exec:\pjjvd.exe118⤵PID:2908
-
\??\c:\1lxxxfl.exec:\1lxxxfl.exe119⤵PID:2040
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe120⤵PID:2088
-
\??\c:\bbthtb.exec:\bbthtb.exe121⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-