Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe
-
Size
454KB
-
MD5
34e136b6e0a5194c2fbf75b4190e2428
-
SHA1
11984032f83f3422e253591378fd5bf3a4d8c9ae
-
SHA256
7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1
-
SHA512
eddbb0bfbd3e847893e5e1b851f1a7c5e6d51a0ed2e01e29c8f4f8fcbb572ab2a33db1c4f474910e055e97836cc7aa34973b413451890f24f405fc95e33184a6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTS:q7Tc2NYHUrAwfMp3CDG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2888-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-163-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1232-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1112-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2132-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-297-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/772-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-229-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1660-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1232-191-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2236-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-500-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2972-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-48-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2756-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-548-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2480-620-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-659-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-672-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/3036-750-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 btbhtt.exe 2736 jdddd.exe 2756 htnthh.exe 2640 ppvpp.exe 2344 7lxrrrx.exe 604 7flfrll.exe 292 tnntbh.exe 2876 dpdjj.exe 2336 1dvvd.exe 2136 3fxlrrx.exe 2972 nhnbnn.exe 2936 bnbhhh.exe 2528 7lxrrlr.exe 2236 bnnhhb.exe 1232 9lrffrx.exe 1412 7nnthn.exe 2284 tthhhn.exe 2112 hthnnn.exe 2216 3jpjp.exe 1112 9frrxff.exe 1660 nbnhnn.exe 3060 3jppv.exe 1044 rxxfxrx.exe 1632 nthnhh.exe 2556 pjppd.exe 1332 frxxxrx.exe 1684 thbhtn.exe 1848 9jjpv.exe 772 fxxfrxl.exe 1720 5nhhnt.exe 2776 vpjpv.exe 1808 frllrrx.exe 2796 rrflxxl.exe 2740 nhbhnn.exe 2820 xlllxfr.exe 500 xllllfx.exe 1512 1bbbhh.exe 528 dvjjj.exe 2132 5lffffr.exe 3020 rlxxxrr.exe 1072 nnbhhb.exe 2960 9pvjj.exe 1764 3dppv.exe 2124 7flxxxr.exe 2312 nhtnnn.exe 952 jvvpv.exe 2068 vpddj.exe 1440 9lffllr.exe 2200 1nnbhb.exe 2092 nnbhht.exe 1412 pjddd.exe 1132 ppjpv.exe 1296 fxffxfr.exe 2304 9nbhhh.exe 488 nbhhnh.exe 236 dvjdd.exe 2460 jdpjd.exe 2452 fxxfffl.exe 692 lffxxxf.exe 984 thnttn.exe 2076 jpdpv.exe 1800 dpjjp.exe 1688 lfrrxxr.exe 2724 frfxxrr.exe -
resource yara_rule behavioral1/memory/2772-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1112-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/488-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1232-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-699-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2772 2888 7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe 30 PID 2888 wrote to memory of 2772 2888 7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe 30 PID 2888 wrote to memory of 2772 2888 7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe 30 PID 2888 wrote to memory of 2772 2888 7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe 30 PID 2772 wrote to memory of 2736 2772 btbhtt.exe 31 PID 2772 wrote to memory of 2736 2772 btbhtt.exe 31 PID 2772 wrote to memory of 2736 2772 btbhtt.exe 31 PID 2772 wrote to memory of 2736 2772 btbhtt.exe 31 PID 2736 wrote to memory of 2756 2736 jdddd.exe 32 PID 2736 wrote to memory of 2756 2736 jdddd.exe 32 PID 2736 wrote to memory of 2756 2736 jdddd.exe 32 PID 2736 wrote to memory of 2756 2736 jdddd.exe 32 PID 2756 wrote to memory of 2640 2756 htnthh.exe 33 PID 2756 wrote to memory of 2640 2756 htnthh.exe 33 PID 2756 wrote to memory of 2640 2756 htnthh.exe 33 PID 2756 wrote to memory of 2640 2756 htnthh.exe 33 PID 2640 wrote to memory of 2344 2640 ppvpp.exe 34 PID 2640 wrote to memory of 2344 2640 ppvpp.exe 34 PID 2640 wrote to memory of 2344 2640 ppvpp.exe 34 PID 2640 wrote to memory of 2344 2640 ppvpp.exe 34 PID 2344 wrote to memory of 604 2344 7lxrrrx.exe 35 PID 2344 wrote to memory of 604 2344 7lxrrrx.exe 35 PID 2344 wrote to memory of 604 2344 7lxrrrx.exe 35 PID 2344 wrote to memory of 604 2344 7lxrrrx.exe 35 PID 604 wrote to memory of 292 604 7flfrll.exe 36 PID 604 wrote to memory of 292 604 7flfrll.exe 36 PID 604 wrote to memory of 292 604 7flfrll.exe 36 PID 604 wrote to memory of 292 604 7flfrll.exe 36 PID 292 wrote to memory of 2876 292 tnntbh.exe 37 PID 292 wrote to memory of 2876 292 tnntbh.exe 37 PID 292 wrote to memory of 2876 292 tnntbh.exe 37 PID 292 wrote to memory of 2876 292 tnntbh.exe 37 PID 2876 wrote to memory of 2336 2876 dpdjj.exe 38 PID 2876 wrote to memory of 2336 2876 dpdjj.exe 38 PID 2876 wrote to memory of 2336 2876 dpdjj.exe 38 PID 2876 wrote to memory of 2336 2876 dpdjj.exe 38 PID 2336 wrote to memory of 2136 2336 1dvvd.exe 39 PID 2336 wrote to memory of 2136 2336 1dvvd.exe 39 PID 2336 wrote to memory of 2136 2336 1dvvd.exe 39 PID 2336 wrote to memory of 2136 2336 1dvvd.exe 39 PID 2136 wrote to memory of 2972 2136 3fxlrrx.exe 40 PID 2136 wrote to memory of 2972 2136 3fxlrrx.exe 40 PID 2136 wrote to memory of 2972 2136 3fxlrrx.exe 40 PID 2136 wrote to memory of 2972 2136 3fxlrrx.exe 40 PID 2972 wrote to memory of 2936 2972 nhnbnn.exe 41 PID 2972 wrote to memory of 2936 2972 nhnbnn.exe 41 PID 2972 wrote to memory of 2936 2972 nhnbnn.exe 41 PID 2972 wrote to memory of 2936 2972 nhnbnn.exe 41 PID 2936 wrote to memory of 2528 2936 bnbhhh.exe 42 PID 2936 wrote to memory of 2528 2936 bnbhhh.exe 42 PID 2936 wrote to memory of 2528 2936 bnbhhh.exe 42 PID 2936 wrote to memory of 2528 2936 bnbhhh.exe 42 PID 2528 wrote to memory of 2236 2528 7lxrrlr.exe 43 PID 2528 wrote to memory of 2236 2528 7lxrrlr.exe 43 PID 2528 wrote to memory of 2236 2528 7lxrrlr.exe 43 PID 2528 wrote to memory of 2236 2528 7lxrrlr.exe 43 PID 2236 wrote to memory of 1232 2236 bnnhhb.exe 44 PID 2236 wrote to memory of 1232 2236 bnnhhb.exe 44 PID 2236 wrote to memory of 1232 2236 bnnhhb.exe 44 PID 2236 wrote to memory of 1232 2236 bnnhhb.exe 44 PID 1232 wrote to memory of 1412 1232 9lrffrx.exe 80 PID 1232 wrote to memory of 1412 1232 9lrffrx.exe 80 PID 1232 wrote to memory of 1412 1232 9lrffrx.exe 80 PID 1232 wrote to memory of 1412 1232 9lrffrx.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe"C:\Users\Admin\AppData\Local\Temp\7ce5f9993366d7c4204750fac9dea2cea74a68ac19c76b628964a08b31cdc3f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\btbhtt.exec:\btbhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\jdddd.exec:\jdddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\htnthh.exec:\htnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\ppvpp.exec:\ppvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\7lxrrrx.exec:\7lxrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\7flfrll.exec:\7flfrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\tnntbh.exec:\tnntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:292 -
\??\c:\dpdjj.exec:\dpdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\1dvvd.exec:\1dvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\3fxlrrx.exec:\3fxlrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\nhnbnn.exec:\nhnbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\bnbhhh.exec:\bnbhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\7lxrrlr.exec:\7lxrrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\bnnhhb.exec:\bnnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\9lrffrx.exec:\9lrffrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\7nnthn.exec:\7nnthn.exe17⤵
- Executes dropped EXE
PID:1412 -
\??\c:\tthhhn.exec:\tthhhn.exe18⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hthnnn.exec:\hthnnn.exe19⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3jpjp.exec:\3jpjp.exe20⤵
- Executes dropped EXE
PID:2216 -
\??\c:\9frrxff.exec:\9frrxff.exe21⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nbnhnn.exec:\nbnhnn.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\3jppv.exec:\3jppv.exe23⤵
- Executes dropped EXE
PID:3060 -
\??\c:\rxxfxrx.exec:\rxxfxrx.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nthnhh.exec:\nthnhh.exe25⤵
- Executes dropped EXE
PID:1632 -
\??\c:\pjppd.exec:\pjppd.exe26⤵
- Executes dropped EXE
PID:2556 -
\??\c:\frxxxrx.exec:\frxxxrx.exe27⤵
- Executes dropped EXE
PID:1332 -
\??\c:\thbhtn.exec:\thbhtn.exe28⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9jjpv.exec:\9jjpv.exe29⤵
- Executes dropped EXE
PID:1848 -
\??\c:\fxxfrxl.exec:\fxxfrxl.exe30⤵
- Executes dropped EXE
PID:772 -
\??\c:\5nhhnt.exec:\5nhhnt.exe31⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vpjpv.exec:\vpjpv.exe32⤵
- Executes dropped EXE
PID:2776 -
\??\c:\frllrrx.exec:\frllrrx.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rrflxxl.exec:\rrflxxl.exe34⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nhbhnn.exec:\nhbhnn.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xlllxfr.exec:\xlllxfr.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\xllllfx.exec:\xllllfx.exe37⤵
- Executes dropped EXE
PID:500 -
\??\c:\1bbbhh.exec:\1bbbhh.exe38⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dvjjj.exec:\dvjjj.exe39⤵
- Executes dropped EXE
PID:528 -
\??\c:\5lffffr.exec:\5lffffr.exe40⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe41⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nnbhhb.exec:\nnbhhb.exe42⤵
- Executes dropped EXE
PID:1072 -
\??\c:\9pvjj.exec:\9pvjj.exe43⤵
- Executes dropped EXE
PID:2960 -
\??\c:\3dppv.exec:\3dppv.exe44⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7flxxxr.exec:\7flxxxr.exe45⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhtnnn.exec:\nhtnnn.exe46⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jvvpv.exec:\jvvpv.exe47⤵
- Executes dropped EXE
PID:952 -
\??\c:\vpddj.exec:\vpddj.exe48⤵
- Executes dropped EXE
PID:2068 -
\??\c:\9lffllr.exec:\9lffllr.exe49⤵
- Executes dropped EXE
PID:1440 -
\??\c:\1nnbhb.exec:\1nnbhb.exe50⤵
- Executes dropped EXE
PID:2200 -
\??\c:\nnbhht.exec:\nnbhht.exe51⤵
- Executes dropped EXE
PID:2092 -
\??\c:\pjddd.exec:\pjddd.exe52⤵
- Executes dropped EXE
PID:1412 -
\??\c:\ppjpv.exec:\ppjpv.exe53⤵
- Executes dropped EXE
PID:1132 -
\??\c:\fxffxfr.exec:\fxffxfr.exe54⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9nbhhh.exec:\9nbhhh.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nbhhnh.exec:\nbhhnh.exe56⤵
- Executes dropped EXE
PID:488 -
\??\c:\dvjdd.exec:\dvjdd.exe57⤵
- Executes dropped EXE
PID:236 -
\??\c:\jdpjd.exec:\jdpjd.exe58⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fxxfffl.exec:\fxxfffl.exe59⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lffxxxf.exec:\lffxxxf.exe60⤵
- Executes dropped EXE
PID:692 -
\??\c:\thnttn.exec:\thnttn.exe61⤵
- Executes dropped EXE
PID:984 -
\??\c:\jpdpv.exec:\jpdpv.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\dpjjp.exec:\dpjjp.exe63⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frfxxrr.exec:\frfxxrr.exe65⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3pddj.exec:\3pddj.exe66⤵PID:2064
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe67⤵PID:2020
-
\??\c:\1bnntn.exec:\1bnntn.exe68⤵PID:1620
-
\??\c:\pjppd.exec:\pjppd.exe69⤵
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\3tbhnn.exec:\3tbhnn.exe70⤵PID:3068
-
\??\c:\vdpjd.exec:\vdpjd.exe71⤵PID:2328
-
\??\c:\nhhnbb.exec:\nhhnbb.exe72⤵PID:1808
-
\??\c:\pjpjj.exec:\pjpjj.exe73⤵PID:2204
-
\??\c:\3ntnbt.exec:\3ntnbt.exe74⤵
- System Location Discovery: System Language Discovery
PID:2792 -
\??\c:\hhbnnt.exec:\hhbnnt.exe75⤵PID:780
-
\??\c:\xrxxfll.exec:\xrxxfll.exe76⤵PID:2820
-
\??\c:\7xrrrff.exec:\7xrrrff.exe77⤵PID:540
-
\??\c:\pjvdp.exec:\pjvdp.exe78⤵PID:2592
-
\??\c:\7vvdv.exec:\7vvdv.exe79⤵PID:2480
-
\??\c:\xrllrxf.exec:\xrllrxf.exe80⤵PID:1972
-
\??\c:\7hbnnt.exec:\7hbnnt.exe81⤵PID:3028
-
\??\c:\jdvjp.exec:\jdvjp.exe82⤵PID:1952
-
\??\c:\vvpdj.exec:\vvpdj.exe83⤵PID:2192
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe84⤵PID:2680
-
\??\c:\5tntbb.exec:\5tntbb.exe85⤵PID:3056
-
\??\c:\7hnntt.exec:\7hnntt.exe86⤵PID:2860
-
\??\c:\vdvdj.exec:\vdvdj.exe87⤵PID:2692
-
\??\c:\rxrxxlx.exec:\rxrxxlx.exe88⤵PID:1880
-
\??\c:\hbthth.exec:\hbthth.exe89⤵PID:1232
-
\??\c:\hbthnt.exec:\hbthnt.exe90⤵PID:380
-
\??\c:\jppdv.exec:\jppdv.exe91⤵PID:1976
-
\??\c:\vpdjj.exec:\vpdjj.exe92⤵PID:2580
-
\??\c:\llrrxlr.exec:\llrrxlr.exe93⤵PID:1672
-
\??\c:\nhhnbh.exec:\nhhnbh.exe94⤵PID:2112
-
\??\c:\1tntbb.exec:\1tntbb.exe95⤵PID:2488
-
\??\c:\dvppd.exec:\dvppd.exe96⤵PID:2484
-
\??\c:\9xllrrr.exec:\9xllrrr.exe97⤵PID:2524
-
\??\c:\ffflxxl.exec:\ffflxxl.exe98⤵PID:1660
-
\??\c:\nthnbt.exec:\nthnbt.exe99⤵PID:3036
-
\??\c:\pppjp.exec:\pppjp.exe100⤵PID:1956
-
\??\c:\ffxlxll.exec:\ffxlxll.exe101⤵PID:692
-
\??\c:\lrlxrfx.exec:\lrlxrfx.exe102⤵PID:1380
-
\??\c:\httbbh.exec:\httbbh.exe103⤵PID:1760
-
\??\c:\ntnnhn.exec:\ntnnhn.exe104⤵PID:648
-
\??\c:\ddjpv.exec:\ddjpv.exe105⤵PID:2032
-
\??\c:\frxrxrf.exec:\frxrxrf.exe106⤵PID:1668
-
\??\c:\lllrffl.exec:\lllrffl.exe107⤵PID:2064
-
\??\c:\1ttbnt.exec:\1ttbnt.exe108⤵PID:1492
-
\??\c:\9jvdv.exec:\9jvdv.exe109⤵PID:1796
-
\??\c:\pppvp.exec:\pppvp.exe110⤵PID:2808
-
\??\c:\xrflrxf.exec:\xrflrxf.exe111⤵PID:2776
-
\??\c:\hbnthb.exec:\hbnthb.exe112⤵PID:2668
-
\??\c:\9jddj.exec:\9jddj.exe113⤵PID:1808
-
\??\c:\5xrrfff.exec:\5xrrfff.exe114⤵PID:2624
-
\??\c:\rrlrrxf.exec:\rrlrrxf.exe115⤵PID:536
-
\??\c:\hhhbtb.exec:\hhhbtb.exe116⤵PID:780
-
\??\c:\hhthtb.exec:\hhthtb.exe117⤵PID:2820
-
\??\c:\7pdjj.exec:\7pdjj.exe118⤵PID:540
-
\??\c:\7fxfxfr.exec:\7fxfxfr.exe119⤵PID:2948
-
\??\c:\1nhntt.exec:\1nhntt.exe120⤵PID:2132
-
\??\c:\ttttnn.exec:\ttttnn.exe121⤵PID:2108
-
\??\c:\pjvvd.exec:\pjvvd.exe122⤵PID:3020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-