Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 00:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe
-
Size
456KB
-
MD5
468b855cefd754d5fa8772c0d4bafa26
-
SHA1
c35fd3773f9d62152ace22b790f4bbd6ae9b3c21
-
SHA256
7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25
-
SHA512
25436252a5016b9ba4ca2cae64432b84807c236792b007f01994b0a7068f5627b0621ebcbd1affeeee8c0b4d968a7f6cbb9ce75e6ce63f2d0be18275317f7303
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRT:q7Tc2NYHUrAwfMp3CDRT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2940-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/800-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-139-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2132-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-489-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2632-622-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2728-646-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2852-697-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-1063-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-1112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-1182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-1239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2432 lxllxlx.exe 2860 jdjdd.exe 2712 xlffrrf.exe 2640 3ntbhh.exe 2168 xrlffll.exe 2660 tnthtb.exe 2672 ddddj.exe 2456 frlllrf.exe 800 jddjd.exe 2040 xrxxxfl.exe 2064 nhbbnt.exe 2832 9vpdj.exe 2696 rfxxlfl.exe 2152 nbnhhh.exe 2132 frfxfxf.exe 2020 nhnntn.exe 1644 9frxxfr.exe 1316 tnnbbn.exe 1488 jjvvv.exe 1264 rrxrxrr.exe 448 jvdvv.exe 2336 xrrrflx.exe 2292 bnnnhb.exe 2092 bhtnbb.exe 1780 jjjjj.exe 892 ffrrrrl.exe 568 hhtbbb.exe 2688 1dvpp.exe 2176 nhtbbb.exe 1040 thnhhh.exe 864 lfxxfxx.exe 2524 7thhnn.exe 1600 9dvdd.exe 2884 lxfrrfl.exe 2316 hbnhhh.exe 2348 1pjdd.exe 2864 rlffrrx.exe 2928 lxfrrlr.exe 1872 ttnthn.exe 2908 jdvdj.exe 2728 7xrffrx.exe 2680 bthhbt.exe 576 hbthtt.exe 2676 ppjjp.exe 2056 7vjvv.exe 2040 xrfffll.exe 2956 1thhnt.exe 2796 vjddd.exe 2852 5jdjj.exe 1724 lfrllll.exe 112 thtthh.exe 2960 5jddv.exe 2644 vpdpd.exe 620 rfxxllr.exe 2024 btbbbh.exe 2568 jvvvd.exe 1788 7vdjj.exe 2448 lflfllr.exe 1488 bbttbb.exe 1432 jjdpd.exe 820 7dvvv.exe 2324 rfrxxfl.exe 320 1hbhnt.exe 1520 ntnthh.exe -
resource yara_rule behavioral1/memory/2940-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/800-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-135-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2152-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2040-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-904-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-949-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-962-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-1106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-1181-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1080-1201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-1239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-1265-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2432 2940 7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe 30 PID 2940 wrote to memory of 2432 2940 7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe 30 PID 2940 wrote to memory of 2432 2940 7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe 30 PID 2940 wrote to memory of 2432 2940 7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe 30 PID 2432 wrote to memory of 2860 2432 lxllxlx.exe 31 PID 2432 wrote to memory of 2860 2432 lxllxlx.exe 31 PID 2432 wrote to memory of 2860 2432 lxllxlx.exe 31 PID 2432 wrote to memory of 2860 2432 lxllxlx.exe 31 PID 2860 wrote to memory of 2712 2860 jdjdd.exe 32 PID 2860 wrote to memory of 2712 2860 jdjdd.exe 32 PID 2860 wrote to memory of 2712 2860 jdjdd.exe 32 PID 2860 wrote to memory of 2712 2860 jdjdd.exe 32 PID 2712 wrote to memory of 2640 2712 xlffrrf.exe 33 PID 2712 wrote to memory of 2640 2712 xlffrrf.exe 33 PID 2712 wrote to memory of 2640 2712 xlffrrf.exe 33 PID 2712 wrote to memory of 2640 2712 xlffrrf.exe 33 PID 2640 wrote to memory of 2168 2640 3ntbhh.exe 34 PID 2640 wrote to memory of 2168 2640 3ntbhh.exe 34 PID 2640 wrote to memory of 2168 2640 3ntbhh.exe 34 PID 2640 wrote to memory of 2168 2640 3ntbhh.exe 34 PID 2168 wrote to memory of 2660 2168 xrlffll.exe 35 PID 2168 wrote to memory of 2660 2168 xrlffll.exe 35 PID 2168 wrote to memory of 2660 2168 xrlffll.exe 35 PID 2168 wrote to memory of 2660 2168 xrlffll.exe 35 PID 2660 wrote to memory of 2672 2660 tnthtb.exe 36 PID 2660 wrote to memory of 2672 2660 tnthtb.exe 36 PID 2660 wrote to memory of 2672 2660 tnthtb.exe 36 PID 2660 wrote to memory of 2672 2660 tnthtb.exe 36 PID 2672 wrote to memory of 2456 2672 ddddj.exe 37 PID 2672 wrote to memory of 2456 2672 ddddj.exe 37 PID 2672 wrote to memory of 2456 2672 ddddj.exe 37 PID 2672 wrote to memory of 2456 2672 ddddj.exe 37 PID 2456 wrote to memory of 800 2456 frlllrf.exe 38 PID 2456 wrote to memory of 800 2456 frlllrf.exe 38 PID 2456 wrote to memory of 800 2456 frlllrf.exe 38 PID 2456 wrote to memory of 800 2456 frlllrf.exe 38 PID 800 wrote to memory of 2040 800 jddjd.exe 39 PID 800 wrote to memory of 2040 800 jddjd.exe 39 PID 800 wrote to memory of 2040 800 jddjd.exe 39 PID 800 wrote to memory of 2040 800 jddjd.exe 39 PID 2040 wrote to memory of 2064 2040 xrxxxfl.exe 40 PID 2040 wrote to memory of 2064 2040 xrxxxfl.exe 40 PID 2040 wrote to memory of 2064 2040 xrxxxfl.exe 40 PID 2040 wrote to memory of 2064 2040 xrxxxfl.exe 40 PID 2064 wrote to memory of 2832 2064 nhbbnt.exe 41 PID 2064 wrote to memory of 2832 2064 nhbbnt.exe 41 PID 2064 wrote to memory of 2832 2064 nhbbnt.exe 41 PID 2064 wrote to memory of 2832 2064 nhbbnt.exe 41 PID 2832 wrote to memory of 2696 2832 9vpdj.exe 42 PID 2832 wrote to memory of 2696 2832 9vpdj.exe 42 PID 2832 wrote to memory of 2696 2832 9vpdj.exe 42 PID 2832 wrote to memory of 2696 2832 9vpdj.exe 42 PID 2696 wrote to memory of 2152 2696 rfxxlfl.exe 43 PID 2696 wrote to memory of 2152 2696 rfxxlfl.exe 43 PID 2696 wrote to memory of 2152 2696 rfxxlfl.exe 43 PID 2696 wrote to memory of 2152 2696 rfxxlfl.exe 43 PID 2152 wrote to memory of 2132 2152 nbnhhh.exe 44 PID 2152 wrote to memory of 2132 2152 nbnhhh.exe 44 PID 2152 wrote to memory of 2132 2152 nbnhhh.exe 44 PID 2152 wrote to memory of 2132 2152 nbnhhh.exe 44 PID 2132 wrote to memory of 2020 2132 frfxfxf.exe 45 PID 2132 wrote to memory of 2020 2132 frfxfxf.exe 45 PID 2132 wrote to memory of 2020 2132 frfxfxf.exe 45 PID 2132 wrote to memory of 2020 2132 frfxfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe"C:\Users\Admin\AppData\Local\Temp\7196efef2ca5619fea5e1fb521eb8cd08e6070989c294ee16e69333a05520f25.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\lxllxlx.exec:\lxllxlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jdjdd.exec:\jdjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xlffrrf.exec:\xlffrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3ntbhh.exec:\3ntbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xrlffll.exec:\xrlffll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\tnthtb.exec:\tnthtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ddddj.exec:\ddddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\frlllrf.exec:\frlllrf.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jddjd.exec:\jddjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\xrxxxfl.exec:\xrxxxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nhbbnt.exec:\nhbbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\9vpdj.exec:\9vpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rfxxlfl.exec:\rfxxlfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\nbnhhh.exec:\nbnhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\frfxfxf.exec:\frfxfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nhnntn.exec:\nhnntn.exe17⤵
- Executes dropped EXE
PID:2020 -
\??\c:\9frxxfr.exec:\9frxxfr.exe18⤵
- Executes dropped EXE
PID:1644 -
\??\c:\tnnbbn.exec:\tnnbbn.exe19⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jjvvv.exec:\jjvvv.exe20⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rrxrxrr.exec:\rrxrxrr.exe21⤵
- Executes dropped EXE
PID:1264 -
\??\c:\jvdvv.exec:\jvdvv.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\xrrrflx.exec:\xrrrflx.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bnnnhb.exec:\bnnnhb.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\bhtnbb.exec:\bhtnbb.exe25⤵
- Executes dropped EXE
PID:2092 -
\??\c:\jjjjj.exec:\jjjjj.exe26⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ffrrrrl.exec:\ffrrrrl.exe27⤵
- Executes dropped EXE
PID:892 -
\??\c:\hhtbbb.exec:\hhtbbb.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\1dvpp.exec:\1dvpp.exe29⤵
- Executes dropped EXE
PID:2688 -
\??\c:\nhtbbb.exec:\nhtbbb.exe30⤵
- Executes dropped EXE
PID:2176 -
\??\c:\thnhhh.exec:\thnhhh.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lfxxfxx.exec:\lfxxfxx.exe32⤵
- Executes dropped EXE
PID:864 -
\??\c:\7thhnn.exec:\7thhnn.exe33⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9dvdd.exec:\9dvdd.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lxfrrfl.exec:\lxfrrfl.exe35⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbnhhh.exec:\hbnhhh.exe36⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1pjdd.exec:\1pjdd.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rlffrrx.exec:\rlffrrx.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\lxfrrlr.exec:\lxfrrlr.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ttnthn.exec:\ttnthn.exe40⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jdvdj.exec:\jdvdj.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\7xrffrx.exec:\7xrffrx.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\bthhbt.exec:\bthhbt.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hbthtt.exec:\hbthtt.exe44⤵
- Executes dropped EXE
PID:576 -
\??\c:\ppjjp.exec:\ppjjp.exe45⤵
- Executes dropped EXE
PID:2676 -
\??\c:\7vjvv.exec:\7vjvv.exe46⤵
- Executes dropped EXE
PID:2056 -
\??\c:\xrfffll.exec:\xrfffll.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\1thhnt.exec:\1thhnt.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\vjddd.exec:\vjddd.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5jdjj.exec:\5jdjj.exe50⤵
- Executes dropped EXE
PID:2852 -
\??\c:\lfrllll.exec:\lfrllll.exe51⤵
- Executes dropped EXE
PID:1724 -
\??\c:\thtthh.exec:\thtthh.exe52⤵
- Executes dropped EXE
PID:112 -
\??\c:\5jddv.exec:\5jddv.exe53⤵
- Executes dropped EXE
PID:2960 -
\??\c:\vpdpd.exec:\vpdpd.exe54⤵
- Executes dropped EXE
PID:2644 -
\??\c:\rfxxllr.exec:\rfxxllr.exe55⤵
- Executes dropped EXE
PID:620 -
\??\c:\btbbbh.exec:\btbbbh.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jvvvd.exec:\jvvvd.exe57⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7vdjj.exec:\7vdjj.exe58⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lflfllr.exec:\lflfllr.exe59⤵
- Executes dropped EXE
PID:2448 -
\??\c:\bbttbb.exec:\bbttbb.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jjdpd.exec:\jjdpd.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7dvvv.exec:\7dvvv.exe62⤵
- Executes dropped EXE
PID:820 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe63⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1hbhnt.exec:\1hbhnt.exe64⤵
- Executes dropped EXE
PID:320 -
\??\c:\ntnthh.exec:\ntnthh.exe65⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pvjjp.exec:\pvjjp.exe66⤵PID:1004
-
\??\c:\xxrffxf.exec:\xxrffxf.exe67⤵PID:1764
-
\??\c:\xlffllx.exec:\xlffllx.exe68⤵PID:1756
-
\??\c:\btbbbb.exec:\btbbbb.exe69⤵PID:1440
-
\??\c:\dpddp.exec:\dpddp.exe70⤵PID:1496
-
\??\c:\3pvvp.exec:\3pvvp.exe71⤵PID:2536
-
\??\c:\lrflflx.exec:\lrflflx.exe72⤵PID:1892
-
\??\c:\5nhbtt.exec:\5nhbtt.exe73⤵PID:2540
-
\??\c:\nnbbbb.exec:\nnbbbb.exe74⤵PID:3032
-
\??\c:\pdvvp.exec:\pdvvp.exe75⤵PID:2080
-
\??\c:\fxrlxxf.exec:\fxrlxxf.exe76⤵PID:2388
-
\??\c:\tnhntt.exec:\tnhntt.exe77⤵PID:2432
-
\??\c:\bthntt.exec:\bthntt.exe78⤵PID:2896
-
\??\c:\pjppv.exec:\pjppv.exe79⤵PID:2872
-
\??\c:\flxfrxr.exec:\flxfrxr.exe80⤵PID:2900
-
\??\c:\fxffffr.exec:\fxffffr.exe81⤵PID:2708
-
\??\c:\bttthn.exec:\bttthn.exe82⤵PID:2768
-
\??\c:\dvpjj.exec:\dvpjj.exe83⤵PID:2632
-
\??\c:\3vvvv.exec:\3vvvv.exe84⤵PID:2168
-
\??\c:\fxrxflx.exec:\fxrxflx.exe85⤵PID:2652
-
\??\c:\7nnttt.exec:\7nnttt.exe86⤵PID:3068
-
\??\c:\nbhbbb.exec:\nbhbbb.exe87⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\jvddd.exec:\jvddd.exe88⤵PID:2456
-
\??\c:\9rrxrxf.exec:\9rrxrxf.exe89⤵PID:2124
-
\??\c:\tnhhnn.exec:\tnhhnn.exe90⤵PID:1676
-
\??\c:\nhtthh.exec:\nhtthh.exe91⤵PID:1636
-
\??\c:\pvjdv.exec:\pvjdv.exe92⤵PID:2040
-
\??\c:\djvpp.exec:\djvpp.exe93⤵PID:2832
-
\??\c:\xflxxrx.exec:\xflxxrx.exe94⤵PID:2796
-
\??\c:\7htttt.exec:\7htttt.exe95⤵PID:2852
-
\??\c:\jdjdd.exec:\jdjdd.exe96⤵PID:2824
-
\??\c:\xrlrxfx.exec:\xrlrxfx.exe97⤵PID:764
-
\??\c:\fxllffl.exec:\fxllffl.exe98⤵PID:2960
-
\??\c:\thnbbt.exec:\thnbbt.exe99⤵PID:2192
-
\??\c:\1pjdv.exec:\1pjdv.exe100⤵PID:1580
-
\??\c:\vjjdd.exec:\vjjdd.exe101⤵PID:584
-
\??\c:\lxlrrlr.exec:\lxlrrlr.exe102⤵PID:1644
-
\??\c:\bthbhh.exec:\bthbhh.exe103⤵PID:2248
-
\??\c:\bthnhh.exec:\bthnhh.exe104⤵PID:2584
-
\??\c:\pjpjj.exec:\pjpjj.exe105⤵PID:3052
-
\??\c:\lflfffl.exec:\lflfffl.exe106⤵PID:288
-
\??\c:\rlxxffl.exec:\rlxxffl.exe107⤵PID:1244
-
\??\c:\nhttbb.exec:\nhttbb.exe108⤵PID:2336
-
\??\c:\1vdjd.exec:\1vdjd.exe109⤵PID:2300
-
\??\c:\jvjjj.exec:\jvjjj.exe110⤵PID:2272
-
\??\c:\1rxrrlr.exec:\1rxrrlr.exe111⤵PID:1576
-
\??\c:\frxxrrx.exec:\frxxrrx.exe112⤵PID:652
-
\??\c:\7thnht.exec:\7thnht.exe113⤵PID:892
-
\??\c:\pjvdd.exec:\pjvdd.exe114⤵PID:568
-
\??\c:\7jjdd.exec:\7jjdd.exe115⤵PID:2392
-
\??\c:\lxlllll.exec:\lxlllll.exe116⤵PID:680
-
\??\c:\llxfrrx.exec:\llxfrrx.exe117⤵PID:2176
-
\??\c:\nbnhhb.exec:\nbnhhb.exe118⤵PID:1848
-
\??\c:\jdppp.exec:\jdppp.exe119⤵PID:2344
-
\??\c:\lxlfffl.exec:\lxlfffl.exe120⤵PID:2736
-
\??\c:\9rrllff.exec:\9rrllff.exe121⤵PID:2524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-