Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe
-
Size
456KB
-
MD5
c2989940ec88530d98b3d7ccac0c4753
-
SHA1
95cae86808b3a58e4d6d0e7e1d7363c5b1d5e56b
-
SHA256
29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd
-
SHA512
35b96bfa9f004c5b4c432c10ab0a3d8e3f007359327dd726314f974964cd968ea7ec26db755e48c334f96fa6a554ad1304fe75bd9da9e23b5d5b8d318db8a539
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR0:q7Tc2NYHUrAwfMp3CDR0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 50 IoCs
resource yara_rule behavioral1/memory/2088-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-56-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2716-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/356-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-327-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-343-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2288-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/296-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-435-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1904-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-454-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2948-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-502-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/692-537-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-577-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1044-576-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2280-588-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-604-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2988-618-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2656-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-626-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2728-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1712-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-710-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-725-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/1904-736-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2580-743-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2584-756-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-789-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 hhttbb.exe 2752 bbthnt.exe 2804 3lrrrxx.exe 2364 hhhnhn.exe 2624 llrlrlr.exe 2716 7tbhnn.exe 2676 lrrxffl.exe 2180 pdppd.exe 3064 frffffr.exe 2488 nhbhbb.exe 2520 rlxxlfl.exe 536 5nbhhn.exe 2004 fxllrrx.exe 1912 dvjdj.exe 2924 1rffxxf.exe 1108 bbnbhh.exe 2964 xxfffxf.exe 1896 ntntnn.exe 544 1lxrrlr.exe 2584 bthhbh.exe 2444 lxllllx.exe 3012 nnbhtt.exe 1232 ppjvj.exe 1640 dpjjj.exe 1756 lfxllrx.exe 892 nhtbnn.exe 2528 1ntttb.exe 356 dddpj.exe 804 nhthnt.exe 2304 1pjvd.exe 868 nhnntn.exe 1812 btnbnt.exe 1568 ttnbhh.exe 2328 btnnht.exe 2808 dpvvv.exe 2728 3fxflrf.exe 2804 7hbbbb.exe 2892 1nbhtb.exe 2648 rflfrlr.exe 2616 lxlfxlx.exe 2296 thhbhb.exe 2288 ppjvj.exe 296 9frxxll.exe 2972 7fflrrx.exe 2224 jvjpp.exe 2932 pjdpj.exe 2144 lxrlrlr.exe 2780 tnhnbb.exe 1776 1dppj.exe 1920 rlxxxff.exe 1904 1ntnnn.exe 1352 nhbhth.exe 1608 5pdpv.exe 1268 9rrxflx.exe 2052 ntbbbb.exe 2948 jdpdp.exe 1048 3lxrrlr.exe 2244 hhbhtt.exe 2176 hbbhnt.exe 2492 dpdvd.exe 1612 3xrxlxx.exe 1668 hhbtbh.exe 1688 jvjdd.exe 1732 ddvdd.exe -
resource yara_rule behavioral1/memory/2088-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-285-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2616-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-577-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2656-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-641-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2588-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-789-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/1500-818-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2696 2088 29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe 30 PID 2088 wrote to memory of 2696 2088 29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe 30 PID 2088 wrote to memory of 2696 2088 29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe 30 PID 2088 wrote to memory of 2696 2088 29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe 30 PID 2696 wrote to memory of 2752 2696 hhttbb.exe 31 PID 2696 wrote to memory of 2752 2696 hhttbb.exe 31 PID 2696 wrote to memory of 2752 2696 hhttbb.exe 31 PID 2696 wrote to memory of 2752 2696 hhttbb.exe 31 PID 2752 wrote to memory of 2804 2752 bbthnt.exe 32 PID 2752 wrote to memory of 2804 2752 bbthnt.exe 32 PID 2752 wrote to memory of 2804 2752 bbthnt.exe 32 PID 2752 wrote to memory of 2804 2752 bbthnt.exe 32 PID 2804 wrote to memory of 2364 2804 3lrrrxx.exe 33 PID 2804 wrote to memory of 2364 2804 3lrrrxx.exe 33 PID 2804 wrote to memory of 2364 2804 3lrrrxx.exe 33 PID 2804 wrote to memory of 2364 2804 3lrrrxx.exe 33 PID 2364 wrote to memory of 2624 2364 hhhnhn.exe 34 PID 2364 wrote to memory of 2624 2364 hhhnhn.exe 34 PID 2364 wrote to memory of 2624 2364 hhhnhn.exe 34 PID 2364 wrote to memory of 2624 2364 hhhnhn.exe 34 PID 2624 wrote to memory of 2716 2624 llrlrlr.exe 35 PID 2624 wrote to memory of 2716 2624 llrlrlr.exe 35 PID 2624 wrote to memory of 2716 2624 llrlrlr.exe 35 PID 2624 wrote to memory of 2716 2624 llrlrlr.exe 35 PID 2716 wrote to memory of 2676 2716 7tbhnn.exe 36 PID 2716 wrote to memory of 2676 2716 7tbhnn.exe 36 PID 2716 wrote to memory of 2676 2716 7tbhnn.exe 36 PID 2716 wrote to memory of 2676 2716 7tbhnn.exe 36 PID 2676 wrote to memory of 2180 2676 lrrxffl.exe 37 PID 2676 wrote to memory of 2180 2676 lrrxffl.exe 37 PID 2676 wrote to memory of 2180 2676 lrrxffl.exe 37 PID 2676 wrote to memory of 2180 2676 lrrxffl.exe 37 PID 2180 wrote to memory of 3064 2180 pdppd.exe 38 PID 2180 wrote to memory of 3064 2180 pdppd.exe 38 PID 2180 wrote to memory of 3064 2180 pdppd.exe 38 PID 2180 wrote to memory of 3064 2180 pdppd.exe 38 PID 3064 wrote to memory of 2488 3064 frffffr.exe 39 PID 3064 wrote to memory of 2488 3064 frffffr.exe 39 PID 3064 wrote to memory of 2488 3064 frffffr.exe 39 PID 3064 wrote to memory of 2488 3064 frffffr.exe 39 PID 2488 wrote to memory of 2520 2488 nhbhbb.exe 40 PID 2488 wrote to memory of 2520 2488 nhbhbb.exe 40 PID 2488 wrote to memory of 2520 2488 nhbhbb.exe 40 PID 2488 wrote to memory of 2520 2488 nhbhbb.exe 40 PID 2520 wrote to memory of 536 2520 rlxxlfl.exe 41 PID 2520 wrote to memory of 536 2520 rlxxlfl.exe 41 PID 2520 wrote to memory of 536 2520 rlxxlfl.exe 41 PID 2520 wrote to memory of 536 2520 rlxxlfl.exe 41 PID 536 wrote to memory of 2004 536 5nbhhn.exe 42 PID 536 wrote to memory of 2004 536 5nbhhn.exe 42 PID 536 wrote to memory of 2004 536 5nbhhn.exe 42 PID 536 wrote to memory of 2004 536 5nbhhn.exe 42 PID 2004 wrote to memory of 1912 2004 fxllrrx.exe 43 PID 2004 wrote to memory of 1912 2004 fxllrrx.exe 43 PID 2004 wrote to memory of 1912 2004 fxllrrx.exe 43 PID 2004 wrote to memory of 1912 2004 fxllrrx.exe 43 PID 1912 wrote to memory of 2924 1912 dvjdj.exe 44 PID 1912 wrote to memory of 2924 1912 dvjdj.exe 44 PID 1912 wrote to memory of 2924 1912 dvjdj.exe 44 PID 1912 wrote to memory of 2924 1912 dvjdj.exe 44 PID 2924 wrote to memory of 1108 2924 1rffxxf.exe 45 PID 2924 wrote to memory of 1108 2924 1rffxxf.exe 45 PID 2924 wrote to memory of 1108 2924 1rffxxf.exe 45 PID 2924 wrote to memory of 1108 2924 1rffxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe"C:\Users\Admin\AppData\Local\Temp\29349e7078b7124233b2d73ad272ec3c82e5e8238125d19769924475c7418fdd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\hhttbb.exec:\hhttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bbthnt.exec:\bbthnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3lrrrxx.exec:\3lrrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hhhnhn.exec:\hhhnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\llrlrlr.exec:\llrlrlr.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\7tbhnn.exec:\7tbhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\lrrxffl.exec:\lrrxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pdppd.exec:\pdppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\frffffr.exec:\frffffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\nhbhbb.exec:\nhbhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rlxxlfl.exec:\rlxxlfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\5nbhhn.exec:\5nbhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\fxllrrx.exec:\fxllrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\dvjdj.exec:\dvjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\1rffxxf.exec:\1rffxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\bbnbhh.exec:\bbnbhh.exe17⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xxfffxf.exec:\xxfffxf.exe18⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ntntnn.exec:\ntntnn.exe19⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1lxrrlr.exec:\1lxrrlr.exe20⤵
- Executes dropped EXE
PID:544 -
\??\c:\bthhbh.exec:\bthhbh.exe21⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lxllllx.exec:\lxllllx.exe22⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nnbhtt.exec:\nnbhtt.exe23⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ppjvj.exec:\ppjvj.exe24⤵
- Executes dropped EXE
PID:1232 -
\??\c:\dpjjj.exec:\dpjjj.exe25⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lfxllrx.exec:\lfxllrx.exe26⤵
- Executes dropped EXE
PID:1756 -
\??\c:\nhtbnn.exec:\nhtbnn.exe27⤵
- Executes dropped EXE
PID:892 -
\??\c:\1ntttb.exec:\1ntttb.exe28⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dddpj.exec:\dddpj.exe29⤵
- Executes dropped EXE
PID:356 -
\??\c:\nhthnt.exec:\nhthnt.exe30⤵
- Executes dropped EXE
PID:804 -
\??\c:\1pjvd.exec:\1pjvd.exe31⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhnntn.exec:\nhnntn.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\btnbnt.exec:\btnbnt.exe33⤵
- Executes dropped EXE
PID:1812 -
\??\c:\ttnbhh.exec:\ttnbhh.exe34⤵
- Executes dropped EXE
PID:1568 -
\??\c:\btnnht.exec:\btnnht.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dpvvv.exec:\dpvvv.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3fxflrf.exec:\3fxflrf.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7hbbbb.exec:\7hbbbb.exe38⤵
- Executes dropped EXE
PID:2804 -
\??\c:\1nbhtb.exec:\1nbhtb.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rflfrlr.exec:\rflfrlr.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lxlfxlx.exec:\lxlfxlx.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\thhbhb.exec:\thhbhb.exe42⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ppjvj.exec:\ppjvj.exe43⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9frxxll.exec:\9frxxll.exe44⤵
- Executes dropped EXE
PID:296 -
\??\c:\7fflrrx.exec:\7fflrrx.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jvjpp.exec:\jvjpp.exe46⤵
- Executes dropped EXE
PID:2224 -
\??\c:\pjdpj.exec:\pjdpj.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lxrlrlr.exec:\lxrlrlr.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tnhnbb.exec:\tnhnbb.exe49⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1dppj.exec:\1dppj.exe50⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rlxxxff.exec:\rlxxxff.exe51⤵
- Executes dropped EXE
PID:1920 -
\??\c:\1ntnnn.exec:\1ntnnn.exe52⤵
- Executes dropped EXE
PID:1904 -
\??\c:\nhbhth.exec:\nhbhth.exe53⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5pdpv.exec:\5pdpv.exe54⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9rrxflx.exec:\9rrxflx.exe55⤵
- Executes dropped EXE
PID:1268 -
\??\c:\ntbbbb.exec:\ntbbbb.exe56⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jdpdp.exec:\jdpdp.exe57⤵
- Executes dropped EXE
PID:2948 -
\??\c:\3lxrrlr.exec:\3lxrrlr.exe58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\hhbhtt.exec:\hhbhtt.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hbbhnt.exec:\hbbhnt.exe60⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dpdvd.exec:\dpdvd.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\3xrxlxx.exec:\3xrxlxx.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hhbtbh.exec:\hhbtbh.exe63⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jvjdd.exec:\jvjdd.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ddvdd.exec:\ddvdd.exe65⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lxlffxx.exec:\lxlffxx.exe66⤵PID:924
-
\??\c:\bbtnht.exec:\bbtnht.exe67⤵PID:692
-
\??\c:\nnbttb.exec:\nnbttb.exe68⤵PID:1532
-
\??\c:\dvpdj.exec:\dvpdj.exe69⤵PID:2068
-
\??\c:\lxrllfl.exec:\lxrllfl.exe70⤵PID:1044
-
\??\c:\1thbbh.exec:\1thbbh.exe71⤵PID:268
-
\??\c:\vjddd.exec:\vjddd.exe72⤵PID:3056
-
\??\c:\1vjjp.exec:\1vjjp.exe73⤵PID:2788
-
\??\c:\5lrlfff.exec:\5lrlfff.exe74⤵PID:1692
-
\??\c:\nthnbh.exec:\nthnbh.exe75⤵PID:2280
-
\??\c:\jvjvd.exec:\jvjvd.exe76⤵PID:2696
-
\??\c:\lfxxxrf.exec:\lfxxxrf.exe77⤵PID:2864
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe78⤵PID:2728
-
\??\c:\hbtbnt.exec:\hbtbnt.exe79⤵PID:2988
-
\??\c:\dvddj.exec:\dvddj.exe80⤵PID:2656
-
\??\c:\dvpvd.exec:\dvpvd.exe81⤵PID:2596
-
\??\c:\rfffrll.exec:\rfffrll.exe82⤵PID:2204
-
\??\c:\hbhhhh.exec:\hbhhhh.exe83⤵PID:1956
-
\??\c:\jdvpj.exec:\jdvpj.exe84⤵PID:2196
-
\??\c:\xlfxffr.exec:\xlfxffr.exe85⤵PID:1720
-
\??\c:\hthhhh.exec:\hthhhh.exe86⤵PID:2700
-
\??\c:\1bnntt.exec:\1bnntt.exe87⤵PID:1448
-
\??\c:\7ddvv.exec:\7ddvv.exe88⤵PID:1712
-
\??\c:\7fffflr.exec:\7fffflr.exe89⤵PID:2000
-
\??\c:\bnbbbb.exec:\bnbbbb.exe90⤵PID:1996
-
\??\c:\bnhhnn.exec:\bnhhnn.exe91⤵PID:2780
-
\??\c:\vvddd.exec:\vvddd.exe92⤵PID:1928
-
\??\c:\xrlrffr.exec:\xrlrffr.exe93⤵PID:2588
-
\??\c:\xrfrfxl.exec:\xrfrfxl.exe94⤵PID:1904
-
\??\c:\tnhnbh.exec:\tnhnbh.exe95⤵PID:840
-
\??\c:\jvjjp.exec:\jvjjp.exe96⤵PID:2964
-
\??\c:\rlffrrx.exec:\rlffrrx.exe97⤵PID:1748
-
\??\c:\3rrlrll.exec:\3rrlrll.exe98⤵PID:2580
-
\??\c:\bbtbnn.exec:\bbtbnn.exe99⤵PID:2456
-
\??\c:\vjvvv.exec:\vjvvv.exe100⤵PID:2584
-
\??\c:\3xxxlrx.exec:\3xxxlrx.exe101⤵PID:3000
-
\??\c:\xlxrrxl.exec:\xlxrrxl.exe102⤵PID:2236
-
\??\c:\nhbhtb.exec:\nhbhtb.exe103⤵PID:1376
-
\??\c:\dddjv.exec:\dddjv.exe104⤵PID:2568
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe105⤵PID:1840
-
\??\c:\lfflrrr.exec:\lfflrrr.exe106⤵PID:2400
-
\??\c:\hbntbb.exec:\hbntbb.exe107⤵PID:2376
-
\??\c:\jdjdp.exec:\jdjdp.exe108⤵PID:2212
-
\??\c:\hhbhnt.exec:\hhbhnt.exe109⤵PID:3032
-
\??\c:\nhnhhb.exec:\nhnhhb.exe110⤵PID:1500
-
\??\c:\7vpdj.exec:\7vpdj.exe111⤵PID:2200
-
\??\c:\xlffxxl.exec:\xlffxxl.exe112⤵PID:2068
-
\??\c:\lfxllrf.exec:\lfxllrf.exe113⤵PID:1828
-
\??\c:\5nbhnn.exec:\5nbhnn.exe114⤵PID:3052
-
\??\c:\tnbhtb.exec:\tnbhtb.exe115⤵PID:1588
-
\??\c:\jdpvj.exec:\jdpvj.exe116⤵PID:1592
-
\??\c:\xxffllr.exec:\xxffllr.exe117⤵PID:1692
-
\??\c:\3tnttb.exec:\3tnttb.exe118⤵PID:3004
-
\??\c:\hbhnnt.exec:\hbhnnt.exe119⤵PID:2736
-
\??\c:\1pjdd.exec:\1pjdd.exe120⤵PID:2840
-
\??\c:\3frlrrf.exec:\3frlrrf.exe121⤵PID:2156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-