Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe
-
Size
453KB
-
MD5
545093a51fee83dc08841c4c33813e8c
-
SHA1
4996b0649cb4047506c27b53557d4ff60af7f7cb
-
SHA256
90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc
-
SHA512
ca6a1a78e67df4bbbc7e279496477e6b9ed540ef93568a9d28aaba6f96f6abd0e20afd69caad120775621b9a7dbb73b74f6d30f37fda7313bd0426c0134bb3d7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN4:q7Tc2NYHUrAwfMp3CDN4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-109-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1908-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-170-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2156-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-197-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2300-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-262-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-449-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1492-470-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2960-484-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1612-511-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/832-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-608-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 vvvdp.exe 2836 frxrxxr.exe 2400 hhhbth.exe 2776 ppjpd.exe 2740 xxffrfx.exe 2568 bhhnhn.exe 1660 hhhtth.exe 1536 vvpvp.exe 576 nhhhtb.exe 2864 djjdv.exe 372 fllxrff.exe 2004 ntbnbh.exe 1616 ffxfrxr.exe 1908 tnnthn.exe 620 xxxfrfx.exe 712 lrrlxrl.exe 1592 fxrffrl.exe 1492 dpvdp.exe 2156 djjdv.exe 2184 3dvdd.exe 2300 frrfxrr.exe 2160 hhbhtt.exe 1756 lllfxlf.exe 3032 hbtnnb.exe 2100 ffxlfxl.exe 1600 5ttbth.exe 640 9djdp.exe 1248 bhthnb.exe 2980 pvddp.exe 788 9lffrxr.exe 1748 1hhnnb.exe 896 httbhh.exe 2352 pddpj.exe 2704 9rxfrxr.exe 1572 nhhhtb.exe 2792 dvpvd.exe 2580 xrlrxfl.exe 2600 lfrxlrf.exe 2764 3hntbh.exe 2772 pdvvv.exe 2592 ppddd.exe 3000 tbbtnt.exe 3020 hhttbh.exe 680 vpjpv.exe 884 lfxfffr.exe 2888 hbtbhn.exe 2864 djjdp.exe 2908 ddpvd.exe 1920 fflrfrl.exe 1632 5hhbhh.exe 812 bbtnth.exe 1472 5pppd.exe 1976 xrrxlrl.exe 484 bbbtnb.exe 712 pvpvd.exe 1952 5rrrxxx.exe 1492 llrxrfx.exe 1160 1nnthb.exe 2960 dddjd.exe 1984 fflrxfx.exe 2988 xflrflx.exe 2220 bnnthh.exe 1612 1pdjv.exe 1596 9vpvd.exe -
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-72-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/576-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-608-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2684 2112 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 30 PID 2112 wrote to memory of 2684 2112 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 30 PID 2112 wrote to memory of 2684 2112 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 30 PID 2112 wrote to memory of 2684 2112 90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe 30 PID 2684 wrote to memory of 2836 2684 vvvdp.exe 31 PID 2684 wrote to memory of 2836 2684 vvvdp.exe 31 PID 2684 wrote to memory of 2836 2684 vvvdp.exe 31 PID 2684 wrote to memory of 2836 2684 vvvdp.exe 31 PID 2836 wrote to memory of 2400 2836 frxrxxr.exe 32 PID 2836 wrote to memory of 2400 2836 frxrxxr.exe 32 PID 2836 wrote to memory of 2400 2836 frxrxxr.exe 32 PID 2836 wrote to memory of 2400 2836 frxrxxr.exe 32 PID 2400 wrote to memory of 2776 2400 hhhbth.exe 33 PID 2400 wrote to memory of 2776 2400 hhhbth.exe 33 PID 2400 wrote to memory of 2776 2400 hhhbth.exe 33 PID 2400 wrote to memory of 2776 2400 hhhbth.exe 33 PID 2776 wrote to memory of 2740 2776 ppjpd.exe 34 PID 2776 wrote to memory of 2740 2776 ppjpd.exe 34 PID 2776 wrote to memory of 2740 2776 ppjpd.exe 34 PID 2776 wrote to memory of 2740 2776 ppjpd.exe 34 PID 2740 wrote to memory of 2568 2740 xxffrfx.exe 35 PID 2740 wrote to memory of 2568 2740 xxffrfx.exe 35 PID 2740 wrote to memory of 2568 2740 xxffrfx.exe 35 PID 2740 wrote to memory of 2568 2740 xxffrfx.exe 35 PID 2568 wrote to memory of 1660 2568 bhhnhn.exe 36 PID 2568 wrote to memory of 1660 2568 bhhnhn.exe 36 PID 2568 wrote to memory of 1660 2568 bhhnhn.exe 36 PID 2568 wrote to memory of 1660 2568 bhhnhn.exe 36 PID 1660 wrote to memory of 1536 1660 hhhtth.exe 37 PID 1660 wrote to memory of 1536 1660 hhhtth.exe 37 PID 1660 wrote to memory of 1536 1660 hhhtth.exe 37 PID 1660 wrote to memory of 1536 1660 hhhtth.exe 37 PID 1536 wrote to memory of 576 1536 vvpvp.exe 38 PID 1536 wrote to memory of 576 1536 vvpvp.exe 38 PID 1536 wrote to memory of 576 1536 vvpvp.exe 38 PID 1536 wrote to memory of 576 1536 vvpvp.exe 38 PID 576 wrote to memory of 2864 576 nhhhtb.exe 39 PID 576 wrote to memory of 2864 576 nhhhtb.exe 39 PID 576 wrote to memory of 2864 576 nhhhtb.exe 39 PID 576 wrote to memory of 2864 576 nhhhtb.exe 39 PID 2864 wrote to memory of 372 2864 djjdv.exe 40 PID 2864 wrote to memory of 372 2864 djjdv.exe 40 PID 2864 wrote to memory of 372 2864 djjdv.exe 40 PID 2864 wrote to memory of 372 2864 djjdv.exe 40 PID 372 wrote to memory of 2004 372 fllxrff.exe 41 PID 372 wrote to memory of 2004 372 fllxrff.exe 41 PID 372 wrote to memory of 2004 372 fllxrff.exe 41 PID 372 wrote to memory of 2004 372 fllxrff.exe 41 PID 2004 wrote to memory of 1616 2004 ntbnbh.exe 42 PID 2004 wrote to memory of 1616 2004 ntbnbh.exe 42 PID 2004 wrote to memory of 1616 2004 ntbnbh.exe 42 PID 2004 wrote to memory of 1616 2004 ntbnbh.exe 42 PID 1616 wrote to memory of 1908 1616 ffxfrxr.exe 43 PID 1616 wrote to memory of 1908 1616 ffxfrxr.exe 43 PID 1616 wrote to memory of 1908 1616 ffxfrxr.exe 43 PID 1616 wrote to memory of 1908 1616 ffxfrxr.exe 43 PID 1908 wrote to memory of 620 1908 tnnthn.exe 44 PID 1908 wrote to memory of 620 1908 tnnthn.exe 44 PID 1908 wrote to memory of 620 1908 tnnthn.exe 44 PID 1908 wrote to memory of 620 1908 tnnthn.exe 44 PID 620 wrote to memory of 712 620 xxxfrfx.exe 45 PID 620 wrote to memory of 712 620 xxxfrfx.exe 45 PID 620 wrote to memory of 712 620 xxxfrfx.exe 45 PID 620 wrote to memory of 712 620 xxxfrfx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe"C:\Users\Admin\AppData\Local\Temp\90c459b6e6bf27d604defeec44a97df11cbbff6564adef843da5b44e7858a4cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vvvdp.exec:\vvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\frxrxxr.exec:\frxrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hhhbth.exec:\hhhbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ppjpd.exec:\ppjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\xxffrfx.exec:\xxffrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bhhnhn.exec:\bhhnhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hhhtth.exec:\hhhtth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vvpvp.exec:\vvpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\nhhhtb.exec:\nhhhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\djjdv.exec:\djjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\fllxrff.exec:\fllxrff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\ntbnbh.exec:\ntbnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\tnnthn.exec:\tnnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\xxxfrfx.exec:\xxxfrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe17⤵
- Executes dropped EXE
PID:712 -
\??\c:\fxrffrl.exec:\fxrffrl.exe18⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dpvdp.exec:\dpvdp.exe19⤵
- Executes dropped EXE
PID:1492 -
\??\c:\djjdv.exec:\djjdv.exe20⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3dvdd.exec:\3dvdd.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\frrfxrr.exec:\frrfxrr.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hhbhtt.exec:\hhbhtt.exe23⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lllfxlf.exec:\lllfxlf.exe24⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hbtnnb.exec:\hbtnnb.exe25⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ffxlfxl.exec:\ffxlfxl.exe26⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5ttbth.exec:\5ttbth.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9djdp.exec:\9djdp.exe28⤵
- Executes dropped EXE
PID:640 -
\??\c:\bhthnb.exec:\bhthnb.exe29⤵
- Executes dropped EXE
PID:1248 -
\??\c:\pvddp.exec:\pvddp.exe30⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9lffrxr.exec:\9lffrxr.exe31⤵
- Executes dropped EXE
PID:788 -
\??\c:\1hhnnb.exec:\1hhnnb.exe32⤵
- Executes dropped EXE
PID:1748 -
\??\c:\httbhh.exec:\httbhh.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\pddpj.exec:\pddpj.exe34⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9rxfrxr.exec:\9rxfrxr.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\nhhhtb.exec:\nhhhtb.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\dvpvd.exec:\dvpvd.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe38⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3hntbh.exec:\3hntbh.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pdvvv.exec:\pdvvv.exe41⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ppddd.exec:\ppddd.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tbbtnt.exec:\tbbtnt.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hhttbh.exec:\hhttbh.exe44⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpjpv.exec:\vpjpv.exe45⤵
- Executes dropped EXE
PID:680 -
\??\c:\lfxfffr.exec:\lfxfffr.exe46⤵
- Executes dropped EXE
PID:884 -
\??\c:\hbtbhn.exec:\hbtbhn.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\djjdp.exec:\djjdp.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\ddpvd.exec:\ddpvd.exe49⤵
- Executes dropped EXE
PID:2908 -
\??\c:\fflrfrl.exec:\fflrfrl.exe50⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5hhbhh.exec:\5hhbhh.exe51⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bbtnth.exec:\bbtnth.exe52⤵
- Executes dropped EXE
PID:812 -
\??\c:\5pppd.exec:\5pppd.exe53⤵
- Executes dropped EXE
PID:1472 -
\??\c:\xrrxlrl.exec:\xrrxlrl.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bbbtnb.exec:\bbbtnb.exe55⤵
- Executes dropped EXE
PID:484 -
\??\c:\pvpvd.exec:\pvpvd.exe56⤵
- Executes dropped EXE
PID:712 -
\??\c:\5rrrxxx.exec:\5rrrxxx.exe57⤵
- Executes dropped EXE
PID:1952 -
\??\c:\llrxrfx.exec:\llrxrfx.exe58⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1nnthb.exec:\1nnthb.exe59⤵
- Executes dropped EXE
PID:1160 -
\??\c:\dddjd.exec:\dddjd.exe60⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fflrxfx.exec:\fflrxfx.exe61⤵
- Executes dropped EXE
PID:1984 -
\??\c:\xflrflx.exec:\xflrflx.exe62⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bnnthh.exec:\bnnthh.exe63⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1pdjv.exec:\1pdjv.exe64⤵
- Executes dropped EXE
PID:1612 -
\??\c:\9vpvd.exec:\9vpvd.exe65⤵
- Executes dropped EXE
PID:1596 -
\??\c:\lllfrfx.exec:\lllfrfx.exe66⤵PID:832
-
\??\c:\hbnbhn.exec:\hbnbhn.exe67⤵PID:1524
-
\??\c:\1nthtb.exec:\1nthtb.exe68⤵PID:1956
-
\??\c:\jjjvp.exec:\jjjvp.exe69⤵PID:2120
-
\??\c:\fffrlxr.exec:\fffrlxr.exe70⤵PID:640
-
\??\c:\hbhtnt.exec:\hbhtnt.exe71⤵PID:2200
-
\??\c:\nttbnt.exec:\nttbnt.exe72⤵PID:1328
-
\??\c:\vvjpd.exec:\vvjpd.exe73⤵PID:2464
-
\??\c:\xxxfrlf.exec:\xxxfrlf.exe74⤵PID:2364
-
\??\c:\5tnnth.exec:\5tnnth.exe75⤵
- System Location Discovery: System Language Discovery
PID:1196 -
\??\c:\ddpdd.exec:\ddpdd.exe76⤵PID:1336
-
\??\c:\lffrflf.exec:\lffrflf.exe77⤵PID:2820
-
\??\c:\5rlxlxx.exec:\5rlxlxx.exe78⤵PID:1568
-
\??\c:\nnntbb.exec:\nnntbb.exe79⤵PID:1960
-
\??\c:\vvvjd.exec:\vvvjd.exe80⤵PID:2792
-
\??\c:\3rlrflx.exec:\3rlrflx.exe81⤵PID:2796
-
\??\c:\3rxfrll.exec:\3rxfrll.exe82⤵PID:2600
-
\??\c:\bttbhn.exec:\bttbhn.exe83⤵PID:2764
-
\??\c:\7djjv.exec:\7djjv.exe84⤵PID:2616
-
\??\c:\fxrrfrl.exec:\fxrrfrl.exe85⤵PID:2632
-
\??\c:\fffflfx.exec:\fffflfx.exe86⤵PID:2696
-
\??\c:\thnnnt.exec:\thnnnt.exe87⤵PID:1660
-
\??\c:\7ppdj.exec:\7ppdj.exe88⤵PID:1252
-
\??\c:\ffflxff.exec:\ffflxff.exe89⤵PID:2880
-
\??\c:\xxxrlrf.exec:\xxxrlrf.exe90⤵PID:2872
-
\??\c:\hbthnt.exec:\hbthnt.exe91⤵PID:2372
-
\??\c:\jjppv.exec:\jjppv.exe92⤵PID:1692
-
\??\c:\rrrxflx.exec:\rrrxflx.exe93⤵PID:1528
-
\??\c:\3lxrflr.exec:\3lxrflr.exe94⤵PID:380
-
\??\c:\5tnthn.exec:\5tnthn.exe95⤵PID:1624
-
\??\c:\ddvdj.exec:\ddvdj.exe96⤵PID:308
-
\??\c:\rrfflrx.exec:\rrfflrx.exe97⤵PID:536
-
\??\c:\fffrlxr.exec:\fffrlxr.exe98⤵PID:484
-
\??\c:\1bnnnn.exec:\1bnnnn.exe99⤵PID:2284
-
\??\c:\1vpdd.exec:\1vpdd.exe100⤵PID:1084
-
\??\c:\rlxxfff.exec:\rlxxfff.exe101⤵PID:2144
-
\??\c:\7lxfrxl.exec:\7lxfrxl.exe102⤵PID:2552
-
\??\c:\bhbbhh.exec:\bhbbhh.exe103⤵PID:2184
-
\??\c:\btbnbn.exec:\btbnbn.exe104⤵PID:1264
-
\??\c:\dddjv.exec:\dddjv.exe105⤵PID:2612
-
\??\c:\rlrfxfx.exec:\rlrfxfx.exe106⤵PID:2220
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe107⤵PID:2188
-
\??\c:\tnhntb.exec:\tnhntb.exe108⤵PID:1756
-
\??\c:\pjpjj.exec:\pjpjj.exe109⤵PID:268
-
\??\c:\3vjjp.exec:\3vjjp.exe110⤵PID:1732
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe111⤵PID:2912
-
\??\c:\7bthht.exec:\7bthht.exe112⤵PID:2460
-
\??\c:\hbnnnn.exec:\hbnnnn.exe113⤵PID:2512
-
\??\c:\ddvjp.exec:\ddvjp.exe114⤵PID:1764
-
\??\c:\7fxxffr.exec:\7fxxffr.exe115⤵PID:1036
-
\??\c:\fffrxrf.exec:\fffrxrf.exe116⤵PID:2240
-
\??\c:\bbtbnt.exec:\bbtbnt.exe117⤵PID:1752
-
\??\c:\jjpvd.exec:\jjpvd.exe118⤵PID:2320
-
\??\c:\5jjjj.exec:\5jjjj.exe119⤵PID:2720
-
\??\c:\nhhtht.exec:\nhhtht.exe120⤵PID:2724
-
\??\c:\vpjvd.exec:\vpjvd.exe121⤵PID:2840
-
\??\c:\jpvjv.exec:\jpvjv.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-