Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe
-
Size
455KB
-
MD5
8f8367eb6e0f3fd7051e27964763922f
-
SHA1
d229e4415faf775692855e73f67a5ff04e404a7e
-
SHA256
042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa
-
SHA512
6908d66c0d46fda11cf4da8b36e31cd16467cbcc99fddd0265b38205ffb7c0c031a2aa5dc048d515714d9a73e6eb34612505a6e1417c0c8219f3ecfad54c1eb7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-39-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/316-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2724-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-120-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1472-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1472-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1472-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1760-139-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1760-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-180-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-217-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-380-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1052-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-639-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1052-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-835-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2860-872-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-974-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-1158-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1308 1lfffxf.exe 2964 tnhnbt.exe 316 lrlrfrr.exe 2208 pdpjp.exe 2804 jvjjp.exe 2724 rrlrxrl.exe 2560 lfrrffr.exe 2848 5lxrrxf.exe 2600 lfffllx.exe 2768 1dvdj.exe 2216 rllrxxl.exe 1472 xrffllx.exe 1760 hbnthn.exe 1288 fffllfr.exe 2500 htnntt.exe 1268 rfxxffx.exe 2788 lflrflr.exe 1220 7ttnhb.exe 2904 fxlrffl.exe 2268 pvdvd.exe 2164 3fflrlx.exe 2060 lfrrffl.exe 2580 3pjjp.exe 1360 7xrxrrf.exe 3048 pjdjp.exe 1564 xxxrffl.exe 1120 vpjpj.exe 1984 ttnnbb.exe 2160 7pddp.exe 1588 ddjjp.exe 2364 9hbbtt.exe 2556 7pdjv.exe 2784 nhtbhn.exe 2880 7vjjp.exe 2824 xrllrrl.exe 2752 9frrrxf.exe 2604 3ntthb.exe 2884 dvjvj.exe 2344 7rrlrrx.exe 2596 9lffffr.exe 2800 hthttt.exe 2600 3pvvv.exe 2176 pdpvj.exe 844 1rfxxrx.exe 2564 ttthnt.exe 1052 nbbbhb.exe 2900 jjvvp.exe 2496 fxrxxxf.exe 2668 1xrlxxf.exe 548 nhhthb.exe 1896 jjvvp.exe 1044 dvpvd.exe 1780 xrlrffx.exe 2948 3thnnt.exe 2236 ttnbhh.exe 2932 vvpdj.exe 2228 rfrxllr.exe 2456 hhntnn.exe 1036 hbtbbh.exe 3004 9djdd.exe 956 7rfxflr.exe 1804 rrlxxfr.exe 1736 9nbbhh.exe 1496 5pdjp.exe -
resource yara_rule behavioral1/memory/2684-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-48-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2804-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-359-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2596-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-438-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1896-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1136-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-780-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-843-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-1058-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 1308 2684 042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe 30 PID 2684 wrote to memory of 1308 2684 042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe 30 PID 2684 wrote to memory of 1308 2684 042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe 30 PID 2684 wrote to memory of 1308 2684 042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe 30 PID 1308 wrote to memory of 2964 1308 1lfffxf.exe 31 PID 1308 wrote to memory of 2964 1308 1lfffxf.exe 31 PID 1308 wrote to memory of 2964 1308 1lfffxf.exe 31 PID 1308 wrote to memory of 2964 1308 1lfffxf.exe 31 PID 2964 wrote to memory of 316 2964 tnhnbt.exe 32 PID 2964 wrote to memory of 316 2964 tnhnbt.exe 32 PID 2964 wrote to memory of 316 2964 tnhnbt.exe 32 PID 2964 wrote to memory of 316 2964 tnhnbt.exe 32 PID 316 wrote to memory of 2208 316 lrlrfrr.exe 33 PID 316 wrote to memory of 2208 316 lrlrfrr.exe 33 PID 316 wrote to memory of 2208 316 lrlrfrr.exe 33 PID 316 wrote to memory of 2208 316 lrlrfrr.exe 33 PID 2208 wrote to memory of 2804 2208 pdpjp.exe 34 PID 2208 wrote to memory of 2804 2208 pdpjp.exe 34 PID 2208 wrote to memory of 2804 2208 pdpjp.exe 34 PID 2208 wrote to memory of 2804 2208 pdpjp.exe 34 PID 2804 wrote to memory of 2724 2804 jvjjp.exe 35 PID 2804 wrote to memory of 2724 2804 jvjjp.exe 35 PID 2804 wrote to memory of 2724 2804 jvjjp.exe 35 PID 2804 wrote to memory of 2724 2804 jvjjp.exe 35 PID 2724 wrote to memory of 2560 2724 rrlrxrl.exe 36 PID 2724 wrote to memory of 2560 2724 rrlrxrl.exe 36 PID 2724 wrote to memory of 2560 2724 rrlrxrl.exe 36 PID 2724 wrote to memory of 2560 2724 rrlrxrl.exe 36 PID 2560 wrote to memory of 2848 2560 lfrrffr.exe 37 PID 2560 wrote to memory of 2848 2560 lfrrffr.exe 37 PID 2560 wrote to memory of 2848 2560 lfrrffr.exe 37 PID 2560 wrote to memory of 2848 2560 lfrrffr.exe 37 PID 2848 wrote to memory of 2600 2848 5lxrrxf.exe 38 PID 2848 wrote to memory of 2600 2848 5lxrrxf.exe 38 PID 2848 wrote to memory of 2600 2848 5lxrrxf.exe 38 PID 2848 wrote to memory of 2600 2848 5lxrrxf.exe 38 PID 2600 wrote to memory of 2768 2600 lfffllx.exe 39 PID 2600 wrote to memory of 2768 2600 lfffllx.exe 39 PID 2600 wrote to memory of 2768 2600 lfffllx.exe 39 PID 2600 wrote to memory of 2768 2600 lfffllx.exe 39 PID 2768 wrote to memory of 2216 2768 1dvdj.exe 40 PID 2768 wrote to memory of 2216 2768 1dvdj.exe 40 PID 2768 wrote to memory of 2216 2768 1dvdj.exe 40 PID 2768 wrote to memory of 2216 2768 1dvdj.exe 40 PID 2216 wrote to memory of 1472 2216 rllrxxl.exe 41 PID 2216 wrote to memory of 1472 2216 rllrxxl.exe 41 PID 2216 wrote to memory of 1472 2216 rllrxxl.exe 41 PID 2216 wrote to memory of 1472 2216 rllrxxl.exe 41 PID 1472 wrote to memory of 1760 1472 xrffllx.exe 42 PID 1472 wrote to memory of 1760 1472 xrffllx.exe 42 PID 1472 wrote to memory of 1760 1472 xrffllx.exe 42 PID 1472 wrote to memory of 1760 1472 xrffllx.exe 42 PID 1760 wrote to memory of 1288 1760 hbnthn.exe 43 PID 1760 wrote to memory of 1288 1760 hbnthn.exe 43 PID 1760 wrote to memory of 1288 1760 hbnthn.exe 43 PID 1760 wrote to memory of 1288 1760 hbnthn.exe 43 PID 1288 wrote to memory of 2500 1288 fffllfr.exe 44 PID 1288 wrote to memory of 2500 1288 fffllfr.exe 44 PID 1288 wrote to memory of 2500 1288 fffllfr.exe 44 PID 1288 wrote to memory of 2500 1288 fffllfr.exe 44 PID 2500 wrote to memory of 1268 2500 htnntt.exe 45 PID 2500 wrote to memory of 1268 2500 htnntt.exe 45 PID 2500 wrote to memory of 1268 2500 htnntt.exe 45 PID 2500 wrote to memory of 1268 2500 htnntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe"C:\Users\Admin\AppData\Local\Temp\042d2195a71da5649cc38582820dd3d9f52df9f388673e62e20ae786040ceffa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\1lfffxf.exec:\1lfffxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\tnhnbt.exec:\tnhnbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\lrlrfrr.exec:\lrlrfrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\pdpjp.exec:\pdpjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\jvjjp.exec:\jvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rrlrxrl.exec:\rrlrxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\lfrrffr.exec:\lfrrffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5lxrrxf.exec:\5lxrrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lfffllx.exec:\lfffllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\1dvdj.exec:\1dvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\rllrxxl.exec:\rllrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xrffllx.exec:\xrffllx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\hbnthn.exec:\hbnthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\fffllfr.exec:\fffllfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\htnntt.exec:\htnntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\rfxxffx.exec:\rfxxffx.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\lflrflr.exec:\lflrflr.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788 -
\??\c:\7ttnhb.exec:\7ttnhb.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1220 -
\??\c:\fxlrffl.exec:\fxlrffl.exe20⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pvdvd.exec:\pvdvd.exe21⤵
- Executes dropped EXE
PID:2268 -
\??\c:\3fflrlx.exec:\3fflrlx.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lfrrffl.exec:\lfrrffl.exe23⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3pjjp.exec:\3pjjp.exe24⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7xrxrrf.exec:\7xrxrrf.exe25⤵
- Executes dropped EXE
PID:1360 -
\??\c:\pjdjp.exec:\pjdjp.exe26⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xxxrffl.exec:\xxxrffl.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vpjpj.exec:\vpjpj.exe28⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ttnnbb.exec:\ttnnbb.exe29⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7pddp.exec:\7pddp.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\ddjjp.exec:\ddjjp.exe31⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9hbbtt.exec:\9hbbtt.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\7pdjv.exec:\7pdjv.exe33⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nhtbhn.exec:\nhtbhn.exe34⤵
- Executes dropped EXE
PID:2784 -
\??\c:\7vjjp.exec:\7vjjp.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrllrrl.exec:\xrllrrl.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\9frrrxf.exec:\9frrrxf.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3ntthb.exec:\3ntthb.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvjvj.exec:\dvjvj.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\7rrlrrx.exec:\7rrlrrx.exe40⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9lffffr.exec:\9lffffr.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\hthttt.exec:\hthttt.exe42⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3pvvv.exec:\3pvvv.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pdpvj.exec:\pdpvj.exe44⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1rfxxrx.exec:\1rfxxrx.exe45⤵
- Executes dropped EXE
PID:844 -
\??\c:\ttthnt.exec:\ttthnt.exe46⤵
- Executes dropped EXE
PID:2564 -
\??\c:\nbbbhb.exec:\nbbbhb.exe47⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jjvvp.exec:\jjvvp.exe48⤵
- Executes dropped EXE
PID:2900 -
\??\c:\fxrxxxf.exec:\fxrxxxf.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1xrlxxf.exec:\1xrlxxf.exe50⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nhhthb.exec:\nhhthb.exe51⤵
- Executes dropped EXE
PID:548 -
\??\c:\jjvvp.exec:\jjvvp.exe52⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dvpvd.exec:\dvpvd.exe53⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrlrffx.exec:\xrlrffx.exe54⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3thnnt.exec:\3thnnt.exe55⤵
- Executes dropped EXE
PID:2948 -
\??\c:\ttnbhh.exec:\ttnbhh.exe56⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vvpdj.exec:\vvpdj.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rfrxllr.exec:\rfrxllr.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hhntnn.exec:\hhntnn.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hbtbbh.exec:\hbtbbh.exe60⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9djdd.exec:\9djdd.exe61⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7rfxflr.exec:\7rfxflr.exe62⤵
- Executes dropped EXE
PID:956 -
\??\c:\rrlxxfr.exec:\rrlxxfr.exe63⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9nbbhh.exec:\9nbbhh.exe64⤵
- Executes dropped EXE
PID:1736 -
\??\c:\5pdjp.exec:\5pdjp.exe65⤵
- Executes dropped EXE
PID:1496 -
\??\c:\pdpvj.exec:\pdpvj.exe66⤵PID:3016
-
\??\c:\9rfffxx.exec:\9rfffxx.exe67⤵PID:1284
-
\??\c:\tnbhtb.exec:\tnbhtb.exe68⤵PID:776
-
\??\c:\tnnntn.exec:\tnnntn.exe69⤵PID:3024
-
\??\c:\djvdd.exec:\djvdd.exe70⤵PID:1560
-
\??\c:\llflxxf.exec:\llflxxf.exe71⤵PID:1696
-
\??\c:\3fxxffl.exec:\3fxxffl.exe72⤵PID:2568
-
\??\c:\nnhthh.exec:\nnhthh.exe73⤵PID:2312
-
\??\c:\ppjpj.exec:\ppjpj.exe74⤵PID:1032
-
\??\c:\dvjpd.exec:\dvjpd.exe75⤵PID:2104
-
\??\c:\llxfllx.exec:\llxfllx.exe76⤵PID:2744
-
\??\c:\bntbbb.exec:\bntbbb.exe77⤵PID:2836
-
\??\c:\vdvjp.exec:\vdvjp.exe78⤵PID:2812
-
\??\c:\ppdjp.exec:\ppdjp.exe79⤵PID:2760
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe80⤵PID:2860
-
\??\c:\hbtbnn.exec:\hbtbnn.exe81⤵PID:2884
-
\??\c:\hthbhb.exec:\hthbhb.exe82⤵PID:2628
-
\??\c:\dpvjp.exec:\dpvjp.exe83⤵PID:1716
-
\??\c:\jjpvd.exec:\jjpvd.exe84⤵PID:2648
-
\??\c:\lfrrffr.exec:\lfrrffr.exe85⤵PID:2600
-
\??\c:\9hbhbh.exec:\9hbhbh.exe86⤵PID:2076
-
\??\c:\pdppv.exec:\pdppv.exe87⤵PID:2216
-
\??\c:\dvjjd.exec:\dvjjd.exe88⤵PID:2892
-
\??\c:\7lfflrx.exec:\7lfflrx.exe89⤵PID:1052
-
\??\c:\5bhbnt.exec:\5bhbnt.exe90⤵PID:2584
-
\??\c:\nhbhtt.exec:\nhbhtt.exe91⤵PID:2496
-
\??\c:\7pdjp.exec:\7pdjp.exe92⤵PID:2668
-
\??\c:\rrfxxrf.exec:\rrfxxrf.exe93⤵PID:548
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe94⤵PID:1896
-
\??\c:\ttbhhn.exec:\ttbhhn.exe95⤵PID:1992
-
\??\c:\1pjjp.exec:\1pjjp.exe96⤵PID:1996
-
\??\c:\lflxlfr.exec:\lflxlfr.exe97⤵PID:2920
-
\??\c:\xfrlflx.exec:\xfrlflx.exe98⤵PID:2140
-
\??\c:\thnhhb.exec:\thnhhb.exe99⤵PID:2224
-
\??\c:\vjdjv.exec:\vjdjv.exe100⤵PID:2232
-
\??\c:\jdppv.exec:\jdppv.exe101⤵PID:1136
-
\??\c:\xlxxllr.exec:\xlxxllr.exe102⤵PID:1756
-
\??\c:\bttttt.exec:\bttttt.exe103⤵PID:3004
-
\??\c:\hbttnn.exec:\hbttnn.exe104⤵PID:692
-
\??\c:\jpdvj.exec:\jpdvj.exe105⤵PID:1804
-
\??\c:\9rxffxf.exec:\9rxffxf.exe106⤵PID:292
-
\??\c:\3httbt.exec:\3httbt.exe107⤵PID:3048
-
\??\c:\hhnnhb.exec:\hhnnhb.exe108⤵PID:1708
-
\??\c:\3vjvd.exec:\3vjvd.exe109⤵PID:1448
-
\??\c:\llllxxr.exec:\llllxxr.exe110⤵PID:2372
-
\??\c:\xrfflrr.exec:\xrfflrr.exe111⤵PID:2152
-
\??\c:\1bnnbh.exec:\1bnnbh.exe112⤵PID:2504
-
\??\c:\pdvvd.exec:\pdvvd.exe113⤵PID:1308
-
\??\c:\ddvjv.exec:\ddvjv.exe114⤵PID:1820
-
\??\c:\xllflfl.exec:\xllflfl.exe115⤵PID:2320
-
\??\c:\5bhthh.exec:\5bhthh.exe116⤵PID:1480
-
\??\c:\7htthh.exec:\7htthh.exe117⤵PID:2208
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe118⤵PID:2708
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe119⤵PID:2812
-
\??\c:\3hbtbb.exec:\3hbtbb.exe120⤵PID:2780
-
\??\c:\jvvpv.exec:\jvvpv.exe121⤵PID:2860
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-