Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 23:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe
-
Size
454KB
-
MD5
506a76aabbd407934eb7ab27ca0b2b7d
-
SHA1
b43b634c899290c7c85f1c024e04b8f5adccb5b2
-
SHA256
6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7
-
SHA512
2fd2fb66a04762337e98de2bcc6082f3209c9ce31503c8a9c4d1fc378797a465db42f200fdf43cc1154b81f4382cfa7bb40b99b5692e124442b79f3d7dd2f4bb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2180-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-80-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1332-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-180-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2380-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-306-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2832-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-416-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/536-450-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-465-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-601-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-627-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2932-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-756-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 1lrrrxx.exe 2804 7frlxrf.exe 2656 pjvvd.exe 2208 hnhtnt.exe 2836 5pjjd.exe 2604 rflllfx.exe 2328 thtbnn.exe 1332 ttntht.exe 2120 1nbhbn.exe 2908 nhhhbh.exe 2344 hbhnnn.exe 2112 xllflfx.exe 2904 nbtbhn.exe 2952 rrrxlrl.exe 3048 ntntnh.exe 1328 xrfrfll.exe 484 htbbhh.exe 2324 xxlxrfx.exe 2380 ttntth.exe 3016 5xlxfrf.exe 2456 tbnnbb.exe 3024 lllfrfx.exe 2512 5bbnbn.exe 580 3btbnt.exe 2436 jjdpj.exe 2028 lllrfrx.exe 992 tnnbtb.exe 1616 llfxlxf.exe 1612 fxrfllx.exe 2852 ffffrrx.exe 1796 pvvjv.exe 1580 xfflxxr.exe 2972 bbthnn.exe 2844 ffrrlrx.exe 2832 3rlrlrf.exe 2704 bhhnbb.exe 2544 pjjdv.exe 2572 jddpp.exe 3052 llxlrfr.exe 2604 bnnhtb.exe 1776 ddvvp.exe 2044 lfxlxfx.exe 940 ttnthb.exe 3000 nhtbtb.exe 2160 pvjvp.exe 2580 rrrxrlf.exe 2856 tttbth.exe 2112 pjdpj.exe 2528 5pddv.exe 2812 rflxfrl.exe 2376 btnnbh.exe 2600 jdpvp.exe 1972 xfxfxlx.exe 536 tnhnth.exe 2504 nhhhbt.exe 564 jvddj.exe 2480 fxlfxfl.exe 2232 hbtnnn.exe 952 9jppd.exe 1508 fxrrflr.exe 1760 7bnnbb.exe 1944 dvjjp.exe 1956 dvddp.exe 2276 xrffllx.exe -
resource yara_rule behavioral1/memory/2180-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-54-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2836-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-627-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1772-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-784-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2972 2180 6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe 30 PID 2180 wrote to memory of 2972 2180 6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe 30 PID 2180 wrote to memory of 2972 2180 6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe 30 PID 2180 wrote to memory of 2972 2180 6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe 30 PID 2972 wrote to memory of 2804 2972 1lrrrxx.exe 31 PID 2972 wrote to memory of 2804 2972 1lrrrxx.exe 31 PID 2972 wrote to memory of 2804 2972 1lrrrxx.exe 31 PID 2972 wrote to memory of 2804 2972 1lrrrxx.exe 31 PID 2804 wrote to memory of 2656 2804 7frlxrf.exe 32 PID 2804 wrote to memory of 2656 2804 7frlxrf.exe 32 PID 2804 wrote to memory of 2656 2804 7frlxrf.exe 32 PID 2804 wrote to memory of 2656 2804 7frlxrf.exe 32 PID 2656 wrote to memory of 2208 2656 pjvvd.exe 33 PID 2656 wrote to memory of 2208 2656 pjvvd.exe 33 PID 2656 wrote to memory of 2208 2656 pjvvd.exe 33 PID 2656 wrote to memory of 2208 2656 pjvvd.exe 33 PID 2208 wrote to memory of 2836 2208 hnhtnt.exe 34 PID 2208 wrote to memory of 2836 2208 hnhtnt.exe 34 PID 2208 wrote to memory of 2836 2208 hnhtnt.exe 34 PID 2208 wrote to memory of 2836 2208 hnhtnt.exe 34 PID 2836 wrote to memory of 2604 2836 5pjjd.exe 35 PID 2836 wrote to memory of 2604 2836 5pjjd.exe 35 PID 2836 wrote to memory of 2604 2836 5pjjd.exe 35 PID 2836 wrote to memory of 2604 2836 5pjjd.exe 35 PID 2604 wrote to memory of 2328 2604 rflllfx.exe 36 PID 2604 wrote to memory of 2328 2604 rflllfx.exe 36 PID 2604 wrote to memory of 2328 2604 rflllfx.exe 36 PID 2604 wrote to memory of 2328 2604 rflllfx.exe 36 PID 2328 wrote to memory of 1332 2328 thtbnn.exe 37 PID 2328 wrote to memory of 1332 2328 thtbnn.exe 37 PID 2328 wrote to memory of 1332 2328 thtbnn.exe 37 PID 2328 wrote to memory of 1332 2328 thtbnn.exe 37 PID 1332 wrote to memory of 2120 1332 ttntht.exe 38 PID 1332 wrote to memory of 2120 1332 ttntht.exe 38 PID 1332 wrote to memory of 2120 1332 ttntht.exe 38 PID 1332 wrote to memory of 2120 1332 ttntht.exe 38 PID 2120 wrote to memory of 2908 2120 1nbhbn.exe 39 PID 2120 wrote to memory of 2908 2120 1nbhbn.exe 39 PID 2120 wrote to memory of 2908 2120 1nbhbn.exe 39 PID 2120 wrote to memory of 2908 2120 1nbhbn.exe 39 PID 2908 wrote to memory of 2344 2908 nhhhbh.exe 40 PID 2908 wrote to memory of 2344 2908 nhhhbh.exe 40 PID 2908 wrote to memory of 2344 2908 nhhhbh.exe 40 PID 2908 wrote to memory of 2344 2908 nhhhbh.exe 40 PID 2344 wrote to memory of 2112 2344 hbhnnn.exe 41 PID 2344 wrote to memory of 2112 2344 hbhnnn.exe 41 PID 2344 wrote to memory of 2112 2344 hbhnnn.exe 41 PID 2344 wrote to memory of 2112 2344 hbhnnn.exe 41 PID 2112 wrote to memory of 2904 2112 xllflfx.exe 42 PID 2112 wrote to memory of 2904 2112 xllflfx.exe 42 PID 2112 wrote to memory of 2904 2112 xllflfx.exe 42 PID 2112 wrote to memory of 2904 2112 xllflfx.exe 42 PID 2904 wrote to memory of 2952 2904 nbtbhn.exe 43 PID 2904 wrote to memory of 2952 2904 nbtbhn.exe 43 PID 2904 wrote to memory of 2952 2904 nbtbhn.exe 43 PID 2904 wrote to memory of 2952 2904 nbtbhn.exe 43 PID 2952 wrote to memory of 3048 2952 rrrxlrl.exe 44 PID 2952 wrote to memory of 3048 2952 rrrxlrl.exe 44 PID 2952 wrote to memory of 3048 2952 rrrxlrl.exe 44 PID 2952 wrote to memory of 3048 2952 rrrxlrl.exe 44 PID 3048 wrote to memory of 1328 3048 ntntnh.exe 45 PID 3048 wrote to memory of 1328 3048 ntntnh.exe 45 PID 3048 wrote to memory of 1328 3048 ntntnh.exe 45 PID 3048 wrote to memory of 1328 3048 ntntnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe"C:\Users\Admin\AppData\Local\Temp\6296460d8ef96ebfb44bc6c2937014133c5f3af5cce015897ab2846d3cc0a6a7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\7frlxrf.exec:\7frlxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\pjvvd.exec:\pjvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\hnhtnt.exec:\hnhtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\5pjjd.exec:\5pjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rflllfx.exec:\rflllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\thtbnn.exec:\thtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ttntht.exec:\ttntht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\1nbhbn.exec:\1nbhbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\nhhhbh.exec:\nhhhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\hbhnnn.exec:\hbhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\xllflfx.exec:\xllflfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\nbtbhn.exec:\nbtbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rrrxlrl.exec:\rrrxlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ntntnh.exec:\ntntnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xrfrfll.exec:\xrfrfll.exe17⤵
- Executes dropped EXE
PID:1328 -
\??\c:\htbbhh.exec:\htbbhh.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\xxlxrfx.exec:\xxlxrfx.exe19⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ttntth.exec:\ttntth.exe20⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5xlxfrf.exec:\5xlxfrf.exe21⤵
- Executes dropped EXE
PID:3016 -
\??\c:\tbnnbb.exec:\tbnnbb.exe22⤵
- Executes dropped EXE
PID:2456 -
\??\c:\lllfrfx.exec:\lllfrfx.exe23⤵
- Executes dropped EXE
PID:3024 -
\??\c:\5bbnbn.exec:\5bbnbn.exe24⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3btbnt.exec:\3btbnt.exe25⤵
- Executes dropped EXE
PID:580 -
\??\c:\jjdpj.exec:\jjdpj.exe26⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lllrfrx.exec:\lllrfrx.exe27⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tnnbtb.exec:\tnnbtb.exe28⤵
- Executes dropped EXE
PID:992 -
\??\c:\llfxlxf.exec:\llfxlxf.exe29⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxrfllx.exec:\fxrfllx.exe30⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ffffrrx.exec:\ffffrrx.exe31⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pvvjv.exec:\pvvjv.exe32⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xfflxxr.exec:\xfflxxr.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bbthnn.exec:\bbthnn.exe34⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ffrrlrx.exec:\ffrrlrx.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3rlrlrf.exec:\3rlrlrf.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bhhnbb.exec:\bhhnbb.exe37⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pjjdv.exec:\pjjdv.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jddpp.exec:\jddpp.exe39⤵
- Executes dropped EXE
PID:2572 -
\??\c:\llxlrfr.exec:\llxlrfr.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bnnhtb.exec:\bnnhtb.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\ddvvp.exec:\ddvvp.exe42⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe43⤵
- Executes dropped EXE
PID:2044 -
\??\c:\ttnthb.exec:\ttnthb.exe44⤵
- Executes dropped EXE
PID:940 -
\??\c:\nhtbtb.exec:\nhtbtb.exe45⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pvjvp.exec:\pvjvp.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rrrxrlf.exec:\rrrxrlf.exe47⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tttbth.exec:\tttbth.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pjdpj.exec:\pjdpj.exe49⤵
- Executes dropped EXE
PID:2112 -
\??\c:\5pddv.exec:\5pddv.exe50⤵
- Executes dropped EXE
PID:2528 -
\??\c:\rflxfrl.exec:\rflxfrl.exe51⤵
- Executes dropped EXE
PID:2812 -
\??\c:\btnnbh.exec:\btnnbh.exe52⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jdpvp.exec:\jdpvp.exe53⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xfxfxlx.exec:\xfxfxlx.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tnhnth.exec:\tnhnth.exe55⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhhhbt.exec:\nhhhbt.exe56⤵
- Executes dropped EXE
PID:2504 -
\??\c:\jvddj.exec:\jvddj.exe57⤵
- Executes dropped EXE
PID:564 -
\??\c:\fxlfxfl.exec:\fxlfxfl.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hbtnnn.exec:\hbtnnn.exe59⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9jppd.exec:\9jppd.exe60⤵
- Executes dropped EXE
PID:952 -
\??\c:\fxrrflr.exec:\fxrrflr.exe61⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7bnnbb.exec:\7bnnbb.exe62⤵
- Executes dropped EXE
PID:1760 -
\??\c:\dvjjp.exec:\dvjjp.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\dvddp.exec:\dvddp.exe64⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xrffllx.exec:\xrffllx.exe65⤵
- Executes dropped EXE
PID:2276 -
\??\c:\tnbbhb.exec:\tnbbhb.exe66⤵PID:1468
-
\??\c:\htbhtt.exec:\htbhtt.exe67⤵PID:2412
-
\??\c:\ppdvd.exec:\ppdvd.exe68⤵PID:372
-
\??\c:\xlxrrll.exec:\xlxrrll.exe69⤵PID:700
-
\??\c:\9thhnn.exec:\9thhnn.exe70⤵PID:2960
-
\??\c:\9vdpp.exec:\9vdpp.exe71⤵PID:1612
-
\??\c:\5dpvd.exec:\5dpvd.exe72⤵PID:2852
-
\??\c:\lrffrfl.exec:\lrffrfl.exe73⤵PID:1692
-
\??\c:\nbnnnh.exec:\nbnnnh.exe74⤵PID:2736
-
\??\c:\3pjpv.exec:\3pjpv.exe75⤵PID:2968
-
\??\c:\jvjjp.exec:\jvjjp.exe76⤵PID:2784
-
\??\c:\9fllllr.exec:\9fllllr.exe77⤵PID:2676
-
\??\c:\nntnnt.exec:\nntnnt.exe78⤵PID:888
-
\??\c:\vpjpv.exec:\vpjpv.exe79⤵PID:2560
-
\??\c:\frlflrr.exec:\frlflrr.exe80⤵PID:2708
-
\??\c:\7nthnn.exec:\7nthnn.exe81⤵PID:2612
-
\??\c:\jdpvp.exec:\jdpvp.exe82⤵PID:1128
-
\??\c:\fflxrrl.exec:\fflxrrl.exe83⤵PID:1772
-
\??\c:\tbnhbn.exec:\tbnhbn.exe84⤵PID:1964
-
\??\c:\djdjp.exec:\djdjp.exe85⤵PID:2992
-
\??\c:\jdpvd.exec:\jdpvd.exe86⤵PID:2980
-
\??\c:\lfrlllr.exec:\lfrlllr.exe87⤵PID:2796
-
\??\c:\5htbhn.exec:\5htbhn.exe88⤵PID:2872
-
\??\c:\jdpvj.exec:\jdpvj.exe89⤵PID:2932
-
\??\c:\fxfxfxl.exec:\fxfxfxl.exe90⤵PID:3040
-
\??\c:\rfxfllx.exec:\rfxfllx.exe91⤵PID:2820
-
\??\c:\3bnnbh.exec:\3bnnbh.exe92⤵PID:2816
-
\??\c:\pjvpj.exec:\pjvpj.exe93⤵PID:2408
-
\??\c:\rlflrrl.exec:\rlflrrl.exe94⤵PID:2864
-
\??\c:\xrflxff.exec:\xrflxff.exe95⤵PID:976
-
\??\c:\3hnttt.exec:\3hnttt.exe96⤵PID:1972
-
\??\c:\9djpd.exec:\9djpd.exe97⤵PID:2132
-
\??\c:\xfxxxxl.exec:\xfxxxxl.exe98⤵PID:2504
-
\??\c:\hhhnnb.exec:\hhhnnb.exe99⤵PID:564
-
\??\c:\btthtb.exec:\btthtb.exe100⤵PID:2012
-
\??\c:\dpvvp.exec:\dpvvp.exe101⤵PID:1844
-
\??\c:\rxlllll.exec:\rxlllll.exe102⤵PID:2456
-
\??\c:\hbbntn.exec:\hbbntn.exe103⤵PID:2036
-
\??\c:\1thnbb.exec:\1thnbb.exe104⤵PID:2452
-
\??\c:\dpjjp.exec:\dpjjp.exe105⤵PID:2516
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe106⤵PID:2312
-
\??\c:\9hhhbh.exec:\9hhhbh.exe107⤵PID:2276
-
\??\c:\rlxxlfr.exec:\rlxxlfr.exe108⤵PID:300
-
\??\c:\nnbnth.exec:\nnbnth.exe109⤵PID:3004
-
\??\c:\vpvdj.exec:\vpvdj.exe110⤵PID:1040
-
\??\c:\flxfflr.exec:\flxfflr.exe111⤵PID:700
-
\??\c:\fxlfxrr.exec:\fxlfxrr.exe112⤵PID:2960
-
\??\c:\hnhnhn.exec:\hnhnhn.exe113⤵PID:1612
-
\??\c:\djjvd.exec:\djjvd.exe114⤵PID:2444
-
\??\c:\1lxfrxf.exec:\1lxfrxf.exe115⤵PID:2668
-
\??\c:\7ffrlxl.exec:\7ffrlxl.exe116⤵PID:320
-
\??\c:\hbhthh.exec:\hbhthh.exe117⤵PID:2548
-
\??\c:\1jjjv.exec:\1jjjv.exe118⤵PID:2564
-
\??\c:\pdddj.exec:\pdddj.exe119⤵PID:2208
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe120⤵PID:2652
-
\??\c:\hbbhbb.exec:\hbbhbb.exe121⤵PID:2544
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-