Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 20:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe
-
Size
454KB
-
MD5
c63d14477da91588cb655e21d00964ab
-
SHA1
96a6d0ff1b443bd4b96327db5d90d8a8e8784b41
-
SHA256
12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb
-
SHA512
229d63470b59c344586712c73da2fe1a28e8998e5f30d84beb920a9232e26efdcaccc769c5fe19e8ab99675e67f8fe5372c94098077d840bada7c00b0146ae63
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/1704-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-84-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2616-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/820-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1860-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-214-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1536-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-246-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1704-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-328-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-585-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2632-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-722-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-738-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2532-837-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-874-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2860-876-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-1044-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2640-1173-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 vpdjj.exe 2384 lrlfrlx.exe 2924 hbtbnn.exe 2748 dvvdj.exe 2892 nhnthh.exe 2740 1vpvv.exe 2904 llffrxf.exe 2908 tnntnn.exe 2616 rxrxlrf.exe 2776 hbtbnn.exe 2332 lfflrrf.exe 820 pdvvj.exe 2024 5fxxflr.exe 2940 djvdj.exe 1280 9xrfxxf.exe 620 jdppv.exe 1120 xlfrffl.exe 1860 9vjvv.exe 2976 ddvdv.exe 536 jdvpd.exe 1476 llfrxfl.exe 2196 dvpvp.exe 1072 9bhntb.exe 1536 pjdpv.exe 1612 llfrflx.exe 2244 5vjjp.exe 2492 xxrlrfx.exe 1480 vpjjp.exe 1240 9ththn.exe 2536 dvppj.exe 2296 fxrxrrx.exe 1704 pdvdd.exe 2688 lxfxffl.exe 2528 7btntb.exe 2060 pjpjp.exe 2376 frllllr.exe 2316 lrfrflx.exe 2852 3bhhhb.exe 2204 jvpjp.exe 2740 frllrrf.exe 2912 ttnnth.exe 2884 bbttbh.exe 2656 vvjjv.exe 2728 rrflxxl.exe 2652 rlxfflx.exe 1108 nhhnnb.exe 1388 vvpjj.exe 2820 lfxxffr.exe 2824 hbttnt.exe 2364 bnbhnn.exe 1848 pjvjv.exe 1892 7fxfrxl.exe 620 fffxxxl.exe 1348 nththn.exe 1152 5jpjj.exe 1872 xlxfflx.exe 1608 xxxfflx.exe 264 nhnntt.exe 584 bnhhtb.exe 2588 vvvdj.exe 2392 xrlrxfr.exe 444 9hbnbh.exe 2196 bbtnbb.exe 1124 9pddd.exe -
resource yara_rule behavioral1/memory/1704-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-173-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/536-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-874-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2712-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-932-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2356 1704 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 1704 wrote to memory of 2356 1704 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 1704 wrote to memory of 2356 1704 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 1704 wrote to memory of 2356 1704 12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe 30 PID 2356 wrote to memory of 2384 2356 vpdjj.exe 31 PID 2356 wrote to memory of 2384 2356 vpdjj.exe 31 PID 2356 wrote to memory of 2384 2356 vpdjj.exe 31 PID 2356 wrote to memory of 2384 2356 vpdjj.exe 31 PID 2384 wrote to memory of 2924 2384 lrlfrlx.exe 32 PID 2384 wrote to memory of 2924 2384 lrlfrlx.exe 32 PID 2384 wrote to memory of 2924 2384 lrlfrlx.exe 32 PID 2384 wrote to memory of 2924 2384 lrlfrlx.exe 32 PID 2924 wrote to memory of 2748 2924 hbtbnn.exe 33 PID 2924 wrote to memory of 2748 2924 hbtbnn.exe 33 PID 2924 wrote to memory of 2748 2924 hbtbnn.exe 33 PID 2924 wrote to memory of 2748 2924 hbtbnn.exe 33 PID 2748 wrote to memory of 2892 2748 dvvdj.exe 34 PID 2748 wrote to memory of 2892 2748 dvvdj.exe 34 PID 2748 wrote to memory of 2892 2748 dvvdj.exe 34 PID 2748 wrote to memory of 2892 2748 dvvdj.exe 34 PID 2892 wrote to memory of 2740 2892 nhnthh.exe 35 PID 2892 wrote to memory of 2740 2892 nhnthh.exe 35 PID 2892 wrote to memory of 2740 2892 nhnthh.exe 35 PID 2892 wrote to memory of 2740 2892 nhnthh.exe 35 PID 2740 wrote to memory of 2904 2740 1vpvv.exe 36 PID 2740 wrote to memory of 2904 2740 1vpvv.exe 36 PID 2740 wrote to memory of 2904 2740 1vpvv.exe 36 PID 2740 wrote to memory of 2904 2740 1vpvv.exe 36 PID 2904 wrote to memory of 2908 2904 llffrxf.exe 37 PID 2904 wrote to memory of 2908 2904 llffrxf.exe 37 PID 2904 wrote to memory of 2908 2904 llffrxf.exe 37 PID 2904 wrote to memory of 2908 2904 llffrxf.exe 37 PID 2908 wrote to memory of 2616 2908 tnntnn.exe 38 PID 2908 wrote to memory of 2616 2908 tnntnn.exe 38 PID 2908 wrote to memory of 2616 2908 tnntnn.exe 38 PID 2908 wrote to memory of 2616 2908 tnntnn.exe 38 PID 2616 wrote to memory of 2776 2616 rxrxlrf.exe 39 PID 2616 wrote to memory of 2776 2616 rxrxlrf.exe 39 PID 2616 wrote to memory of 2776 2616 rxrxlrf.exe 39 PID 2616 wrote to memory of 2776 2616 rxrxlrf.exe 39 PID 2776 wrote to memory of 2332 2776 hbtbnn.exe 40 PID 2776 wrote to memory of 2332 2776 hbtbnn.exe 40 PID 2776 wrote to memory of 2332 2776 hbtbnn.exe 40 PID 2776 wrote to memory of 2332 2776 hbtbnn.exe 40 PID 2332 wrote to memory of 820 2332 lfflrrf.exe 41 PID 2332 wrote to memory of 820 2332 lfflrrf.exe 41 PID 2332 wrote to memory of 820 2332 lfflrrf.exe 41 PID 2332 wrote to memory of 820 2332 lfflrrf.exe 41 PID 820 wrote to memory of 2024 820 pdvvj.exe 42 PID 820 wrote to memory of 2024 820 pdvvj.exe 42 PID 820 wrote to memory of 2024 820 pdvvj.exe 42 PID 820 wrote to memory of 2024 820 pdvvj.exe 42 PID 2024 wrote to memory of 2940 2024 5fxxflr.exe 43 PID 2024 wrote to memory of 2940 2024 5fxxflr.exe 43 PID 2024 wrote to memory of 2940 2024 5fxxflr.exe 43 PID 2024 wrote to memory of 2940 2024 5fxxflr.exe 43 PID 2940 wrote to memory of 1280 2940 djvdj.exe 44 PID 2940 wrote to memory of 1280 2940 djvdj.exe 44 PID 2940 wrote to memory of 1280 2940 djvdj.exe 44 PID 2940 wrote to memory of 1280 2940 djvdj.exe 44 PID 1280 wrote to memory of 620 1280 9xrfxxf.exe 45 PID 1280 wrote to memory of 620 1280 9xrfxxf.exe 45 PID 1280 wrote to memory of 620 1280 9xrfxxf.exe 45 PID 1280 wrote to memory of 620 1280 9xrfxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe"C:\Users\Admin\AppData\Local\Temp\12e67291045029b5985c8fbe3fcf29d9c80340fa8ca5e6b5f970fbf633fcb3cb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\vpdjj.exec:\vpdjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lrlfrlx.exec:\lrlfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\hbtbnn.exec:\hbtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\dvvdj.exec:\dvvdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\nhnthh.exec:\nhnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\1vpvv.exec:\1vpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\llffrxf.exec:\llffrxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\tnntnn.exec:\tnntnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rxrxlrf.exec:\rxrxlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hbtbnn.exec:\hbtbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lfflrrf.exec:\lfflrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pdvvj.exec:\pdvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:820 -
\??\c:\5fxxflr.exec:\5fxxflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\djvdj.exec:\djvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\9xrfxxf.exec:\9xrfxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\jdppv.exec:\jdppv.exe17⤵
- Executes dropped EXE
PID:620 -
\??\c:\xlfrffl.exec:\xlfrffl.exe18⤵
- Executes dropped EXE
PID:1120 -
\??\c:\9vjvv.exec:\9vjvv.exe19⤵
- Executes dropped EXE
PID:1860 -
\??\c:\ddvdv.exec:\ddvdv.exe20⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jdvpd.exec:\jdvpd.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\llfrxfl.exec:\llfrxfl.exe22⤵
- Executes dropped EXE
PID:1476 -
\??\c:\dvpvp.exec:\dvpvp.exe23⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9bhntb.exec:\9bhntb.exe24⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pjdpv.exec:\pjdpv.exe25⤵
- Executes dropped EXE
PID:1536 -
\??\c:\llfrflx.exec:\llfrflx.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5vjjp.exec:\5vjjp.exe27⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxrlrfx.exec:\xxrlrfx.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vpjjp.exec:\vpjjp.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9ththn.exec:\9ththn.exe30⤵
- Executes dropped EXE
PID:1240 -
\??\c:\dvppj.exec:\dvppj.exe31⤵
- Executes dropped EXE
PID:2536 -
\??\c:\fxrxrrx.exec:\fxrxrrx.exe32⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pdvdd.exec:\pdvdd.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\lxfxffl.exec:\lxfxffl.exe34⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7btntb.exec:\7btntb.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pjpjp.exec:\pjpjp.exe36⤵
- Executes dropped EXE
PID:2060 -
\??\c:\frllllr.exec:\frllllr.exe37⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lrfrflx.exec:\lrfrflx.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3bhhhb.exec:\3bhhhb.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jvpjp.exec:\jvpjp.exe40⤵
- Executes dropped EXE
PID:2204 -
\??\c:\frllrrf.exec:\frllrrf.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ttnnth.exec:\ttnnth.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bbttbh.exec:\bbttbh.exe43⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vvjjv.exec:\vvjjv.exe44⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrflxxl.exec:\rrflxxl.exe45⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rlxfflx.exec:\rlxfflx.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nhhnnb.exec:\nhhnnb.exe47⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvpjj.exec:\vvpjj.exe48⤵
- Executes dropped EXE
PID:1388 -
\??\c:\lfxxffr.exec:\lfxxffr.exe49⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hbttnt.exec:\hbttnt.exe50⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bnbhnn.exec:\bnbhnn.exe51⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pjvjv.exec:\pjvjv.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7fxfrxl.exec:\7fxfrxl.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\fffxxxl.exec:\fffxxxl.exe54⤵
- Executes dropped EXE
PID:620 -
\??\c:\nththn.exec:\nththn.exe55⤵
- Executes dropped EXE
PID:1348 -
\??\c:\5jpjj.exec:\5jpjj.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xlxfflx.exec:\xlxfflx.exe57⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xxxfflx.exec:\xxxfflx.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nhnntt.exec:\nhnntt.exe59⤵
- Executes dropped EXE
PID:264 -
\??\c:\bnhhtb.exec:\bnhhtb.exe60⤵
- Executes dropped EXE
PID:584 -
\??\c:\vvvdj.exec:\vvvdj.exe61⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrlrxfr.exec:\xrlrxfr.exe62⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9hbnbh.exec:\9hbnbh.exe63⤵
- Executes dropped EXE
PID:444 -
\??\c:\bbtnbb.exec:\bbtnbb.exe64⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9pddd.exec:\9pddd.exe65⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rfrxxfx.exec:\rfrxxfx.exe66⤵PID:1368
-
\??\c:\fxffrxf.exec:\fxffrxf.exe67⤵PID:1276
-
\??\c:\7hnntn.exec:\7hnntn.exe68⤵PID:1612
-
\??\c:\vvjjp.exec:\vvjjp.exe69⤵PID:1028
-
\??\c:\7dddd.exec:\7dddd.exe70⤵PID:3040
-
\??\c:\frlfllx.exec:\frlfllx.exe71⤵PID:976
-
\??\c:\hbntbh.exec:\hbntbh.exe72⤵PID:1640
-
\??\c:\dvvvd.exec:\dvvvd.exe73⤵PID:1240
-
\??\c:\lxllllr.exec:\lxllllr.exe74⤵PID:2144
-
\??\c:\fxrxllr.exec:\fxrxllr.exe75⤵PID:1560
-
\??\c:\nhnnbt.exec:\nhnnbt.exe76⤵PID:1592
-
\??\c:\pjppd.exec:\pjppd.exe77⤵PID:2544
-
\??\c:\vjvdd.exec:\vjvdd.exe78⤵PID:2380
-
\??\c:\3frrlll.exec:\3frrlll.exe79⤵PID:2528
-
\??\c:\tnbbnh.exec:\tnbbnh.exe80⤵PID:2324
-
\??\c:\vvppd.exec:\vvppd.exe81⤵PID:2376
-
\??\c:\vdvdj.exec:\vdvdj.exe82⤵PID:2316
-
\??\c:\xllfxxx.exec:\xllfxxx.exe83⤵PID:2724
-
\??\c:\nbtttn.exec:\nbtttn.exe84⤵PID:2880
-
\??\c:\vjvdd.exec:\vjvdd.exe85⤵PID:2632
-
\??\c:\7fxrrrf.exec:\7fxrrrf.exe86⤵PID:2772
-
\??\c:\tnnntt.exec:\tnnntt.exe87⤵PID:2600
-
\??\c:\5hhbtb.exec:\5hhbtb.exe88⤵PID:2172
-
\??\c:\vdvjv.exec:\vdvjv.exe89⤵PID:1964
-
\??\c:\rlxfllx.exec:\rlxfllx.exe90⤵PID:2652
-
\??\c:\nbbtnh.exec:\nbbtnh.exe91⤵PID:820
-
\??\c:\ntnnbb.exec:\ntnnbb.exe92⤵PID:2932
-
\??\c:\jdppv.exec:\jdppv.exe93⤵PID:852
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe94⤵PID:2136
-
\??\c:\xrllffl.exec:\xrllffl.exe95⤵PID:2804
-
\??\c:\hnbttn.exec:\hnbttn.exe96⤵PID:1848
-
\??\c:\dvvjp.exec:\dvvjp.exe97⤵PID:1744
-
\??\c:\5dpjj.exec:\5dpjj.exe98⤵PID:620
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe99⤵PID:1348
-
\??\c:\tnhttt.exec:\tnhttt.exe100⤵PID:1152
-
\??\c:\7vpdj.exec:\7vpdj.exe101⤵PID:2428
-
\??\c:\vpdvv.exec:\vpdvv.exe102⤵PID:2976
-
\??\c:\1xrxxxf.exec:\1xrxxxf.exe103⤵PID:900
-
\??\c:\7hthhb.exec:\7hthhb.exe104⤵PID:1076
-
\??\c:\vpdjp.exec:\vpdjp.exe105⤵PID:1300
-
\??\c:\pjvdd.exec:\pjvdd.exe106⤵PID:3024
-
\??\c:\xrffllr.exec:\xrffllr.exe107⤵PID:3008
-
\??\c:\lfrrfxf.exec:\lfrrfxf.exe108⤵
- System Location Discovery: System Language Discovery
PID:2308 -
\??\c:\hbbbnn.exec:\hbbbnn.exe109⤵PID:1484
-
\??\c:\dvjpv.exec:\dvjpv.exe110⤵PID:768
-
\??\c:\xrrxrrx.exec:\xrrxrrx.exe111⤵
- System Location Discovery: System Language Discovery
PID:2468 -
\??\c:\lllflfl.exec:\lllflfl.exe112⤵PID:3036
-
\??\c:\7bntbt.exec:\7bntbt.exe113⤵PID:2212
-
\??\c:\vvjpv.exec:\vvjpv.exe114⤵PID:2300
-
\??\c:\dvpjp.exec:\dvpjp.exe115⤵PID:3028
-
\??\c:\3lrfxrx.exec:\3lrfxrx.exe116⤵PID:352
-
\??\c:\hhbbhh.exec:\hhbbhh.exe117⤵PID:2532
-
\??\c:\pdpvv.exec:\pdpvv.exe118⤵PID:2104
-
\??\c:\lrffrrr.exec:\lrffrrr.exe119⤵PID:2116
-
\??\c:\tntnnn.exec:\tntnnn.exe120⤵PID:2108
-
\??\c:\ddvvd.exec:\ddvvd.exe121⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-