Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe
-
Size
454KB
-
MD5
2b07a704c0ce84b5f1a7374eeb428340
-
SHA1
6699fbc2b36dce72b24deaf5d484d17224b7ca9b
-
SHA256
a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d
-
SHA512
75c410eec8ed7e6c4a10295fc902368a131b3d679794680cac9b96237980d9c7178a2b12d4d47e74afa06a3bc42b7be6c8aff1b60f8b97de7129ab5faabfab86
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2840-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/592-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/696-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/596-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-797-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1548-805-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2924-909-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/2468-984-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2348-988-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1108-1000-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1004-1014-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1284-1029-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2740 rfrxxxf.exe 2704 bthnht.exe 3020 3dddd.exe 2700 nhtntt.exe 2620 1vjjp.exe 2328 7rfxxxx.exe 592 bbhnnt.exe 584 ppdvd.exe 1496 hhbntn.exe 2360 nhtttn.exe 1680 1rlrxxf.exe 2568 9rffxrx.exe 2880 1httnn.exe 2868 7dpdj.exe 2876 rlxlrll.exe 680 tthtbn.exe 2008 xlxxxrx.exe 2648 nbttnt.exe 1988 9pjjd.exe 1608 pdppv.exe 2344 hnnnnt.exe 1532 vjpvv.exe 2160 lfrrxff.exe 1308 frlllfl.exe 1536 3thhhh.exe 2196 vpdvp.exe 944 bnbbhh.exe 2384 jpdpd.exe 2100 7vvjd.exe 1752 lxrxffr.exe 896 nbnhhb.exe 2476 vjvvp.exe 2816 llrrfrr.exe 2720 7hnhhh.exe 3012 dpjpp.exe 2808 1jpvv.exe 2764 7ffrrll.exe 2796 ththhb.exe 2836 vjvdj.exe 2420 pvdvd.exe 696 9rfxxxx.exe 380 9xrrxrr.exe 1480 nhttbb.exe 2504 jdppv.exe 2508 vpvdd.exe 816 frffrlf.exe 3024 7nhbbh.exe 2932 3bhnnh.exe 2568 9pvdj.exe 2772 vjvvd.exe 2908 rlrrrrl.exe 2952 tnhhnn.exe 2940 thnttn.exe 1132 5vppv.exe 2920 xrflllr.exe 2232 llflrlr.exe 768 3htbhh.exe 1988 djvpp.exe 832 pjvvv.exe 2036 lfrxxxx.exe 1000 htbtnn.exe 1812 thtntn.exe 1388 pdjjv.exe 1712 7fllllx.exe -
resource yara_rule behavioral1/memory/2840-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-762-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-909-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/2468-984-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1004-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2740 2840 a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe 30 PID 2840 wrote to memory of 2740 2840 a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe 30 PID 2840 wrote to memory of 2740 2840 a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe 30 PID 2840 wrote to memory of 2740 2840 a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe 30 PID 2740 wrote to memory of 2704 2740 rfrxxxf.exe 31 PID 2740 wrote to memory of 2704 2740 rfrxxxf.exe 31 PID 2740 wrote to memory of 2704 2740 rfrxxxf.exe 31 PID 2740 wrote to memory of 2704 2740 rfrxxxf.exe 31 PID 2704 wrote to memory of 3020 2704 bthnht.exe 32 PID 2704 wrote to memory of 3020 2704 bthnht.exe 32 PID 2704 wrote to memory of 3020 2704 bthnht.exe 32 PID 2704 wrote to memory of 3020 2704 bthnht.exe 32 PID 3020 wrote to memory of 2700 3020 3dddd.exe 111 PID 3020 wrote to memory of 2700 3020 3dddd.exe 111 PID 3020 wrote to memory of 2700 3020 3dddd.exe 111 PID 3020 wrote to memory of 2700 3020 3dddd.exe 111 PID 2700 wrote to memory of 2620 2700 nhtntt.exe 34 PID 2700 wrote to memory of 2620 2700 nhtntt.exe 34 PID 2700 wrote to memory of 2620 2700 nhtntt.exe 34 PID 2700 wrote to memory of 2620 2700 nhtntt.exe 34 PID 2620 wrote to memory of 2328 2620 1vjjp.exe 35 PID 2620 wrote to memory of 2328 2620 1vjjp.exe 35 PID 2620 wrote to memory of 2328 2620 1vjjp.exe 35 PID 2620 wrote to memory of 2328 2620 1vjjp.exe 35 PID 2328 wrote to memory of 592 2328 7rfxxxx.exe 36 PID 2328 wrote to memory of 592 2328 7rfxxxx.exe 36 PID 2328 wrote to memory of 592 2328 7rfxxxx.exe 36 PID 2328 wrote to memory of 592 2328 7rfxxxx.exe 36 PID 592 wrote to memory of 584 592 bbhnnt.exe 37 PID 592 wrote to memory of 584 592 bbhnnt.exe 37 PID 592 wrote to memory of 584 592 bbhnnt.exe 37 PID 592 wrote to memory of 584 592 bbhnnt.exe 37 PID 584 wrote to memory of 1496 584 ppdvd.exe 38 PID 584 wrote to memory of 1496 584 ppdvd.exe 38 PID 584 wrote to memory of 1496 584 ppdvd.exe 38 PID 584 wrote to memory of 1496 584 ppdvd.exe 38 PID 1496 wrote to memory of 2360 1496 hhbntn.exe 39 PID 1496 wrote to memory of 2360 1496 hhbntn.exe 39 PID 1496 wrote to memory of 2360 1496 hhbntn.exe 39 PID 1496 wrote to memory of 2360 1496 hhbntn.exe 39 PID 2360 wrote to memory of 1680 2360 nhtttn.exe 40 PID 2360 wrote to memory of 1680 2360 nhtttn.exe 40 PID 2360 wrote to memory of 1680 2360 nhtttn.exe 40 PID 2360 wrote to memory of 1680 2360 nhtttn.exe 40 PID 1680 wrote to memory of 2568 1680 1rlrxxf.exe 78 PID 1680 wrote to memory of 2568 1680 1rlrxxf.exe 78 PID 1680 wrote to memory of 2568 1680 1rlrxxf.exe 78 PID 1680 wrote to memory of 2568 1680 1rlrxxf.exe 78 PID 2568 wrote to memory of 2880 2568 9rffxrx.exe 42 PID 2568 wrote to memory of 2880 2568 9rffxrx.exe 42 PID 2568 wrote to memory of 2880 2568 9rffxrx.exe 42 PID 2568 wrote to memory of 2880 2568 9rffxrx.exe 42 PID 2880 wrote to memory of 2868 2880 1httnn.exe 43 PID 2880 wrote to memory of 2868 2880 1httnn.exe 43 PID 2880 wrote to memory of 2868 2880 1httnn.exe 43 PID 2880 wrote to memory of 2868 2880 1httnn.exe 43 PID 2868 wrote to memory of 2876 2868 7dpdj.exe 44 PID 2868 wrote to memory of 2876 2868 7dpdj.exe 44 PID 2868 wrote to memory of 2876 2868 7dpdj.exe 44 PID 2868 wrote to memory of 2876 2868 7dpdj.exe 44 PID 2876 wrote to memory of 680 2876 rlxlrll.exe 45 PID 2876 wrote to memory of 680 2876 rlxlrll.exe 45 PID 2876 wrote to memory of 680 2876 rlxlrll.exe 45 PID 2876 wrote to memory of 680 2876 rlxlrll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe"C:\Users\Admin\AppData\Local\Temp\a526fecf68852ad364d390206c4de742eda301f93f72fafe8760a6bba8b8e73d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rfrxxxf.exec:\rfrxxxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bthnht.exec:\bthnht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\3dddd.exec:\3dddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\nhtntt.exec:\nhtntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1vjjp.exec:\1vjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7rfxxxx.exec:\7rfxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\bbhnnt.exec:\bbhnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\ppdvd.exec:\ppdvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\hhbntn.exec:\hhbntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\nhtttn.exec:\nhtttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\1rlrxxf.exec:\1rlrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\9rffxrx.exec:\9rffxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\1httnn.exec:\1httnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\7dpdj.exec:\7dpdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rlxlrll.exec:\rlxlrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tthtbn.exec:\tthtbn.exe17⤵
- Executes dropped EXE
PID:680 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe18⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nbttnt.exec:\nbttnt.exe19⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9pjjd.exec:\9pjjd.exe20⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pdppv.exec:\pdppv.exe21⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hnnnnt.exec:\hnnnnt.exe22⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vjpvv.exec:\vjpvv.exe23⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lfrrxff.exec:\lfrrxff.exe24⤵
- Executes dropped EXE
PID:2160 -
\??\c:\frlllfl.exec:\frlllfl.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3thhhh.exec:\3thhhh.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vpdvp.exec:\vpdvp.exe27⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bnbbhh.exec:\bnbbhh.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\jpdpd.exec:\jpdpd.exe29⤵
- Executes dropped EXE
PID:2384 -
\??\c:\7vvjd.exec:\7vvjd.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lxrxffr.exec:\lxrxffr.exe31⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nbnhhb.exec:\nbnhhb.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\vjvvp.exec:\vjvvp.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\llrrfrr.exec:\llrrfrr.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7hnhhh.exec:\7hnhhh.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dpjpp.exec:\dpjpp.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1jpvv.exec:\1jpvv.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7ffrrll.exec:\7ffrrll.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ththhb.exec:\ththhb.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vjvdj.exec:\vjvdj.exe40⤵
- Executes dropped EXE
PID:2836 -
\??\c:\pvdvd.exec:\pvdvd.exe41⤵
- Executes dropped EXE
PID:2420 -
\??\c:\9rfxxxx.exec:\9rfxxxx.exe42⤵
- Executes dropped EXE
PID:696 -
\??\c:\9xrrxrr.exec:\9xrrxrr.exe43⤵
- Executes dropped EXE
PID:380 -
\??\c:\nhttbb.exec:\nhttbb.exe44⤵
- Executes dropped EXE
PID:1480 -
\??\c:\jdppv.exec:\jdppv.exe45⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vpvdd.exec:\vpvdd.exe46⤵
- Executes dropped EXE
PID:2508 -
\??\c:\frffrlf.exec:\frffrlf.exe47⤵
- Executes dropped EXE
PID:816 -
\??\c:\7nhbbh.exec:\7nhbbh.exe48⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3bhnnh.exec:\3bhnnh.exe49⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9pvdj.exec:\9pvdj.exe50⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vjvvd.exec:\vjvvd.exe51⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe52⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tnhhnn.exec:\tnhhnn.exe53⤵
- Executes dropped EXE
PID:2952 -
\??\c:\thnttn.exec:\thnttn.exe54⤵
- Executes dropped EXE
PID:2940 -
\??\c:\5vppv.exec:\5vppv.exe55⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xrflllr.exec:\xrflllr.exe56⤵
- Executes dropped EXE
PID:2920 -
\??\c:\llflrlr.exec:\llflrlr.exe57⤵
- Executes dropped EXE
PID:2232 -
\??\c:\3htbhh.exec:\3htbhh.exe58⤵
- Executes dropped EXE
PID:768 -
\??\c:\djvpp.exec:\djvpp.exe59⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pjvvv.exec:\pjvvv.exe60⤵
- Executes dropped EXE
PID:832 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe61⤵
- Executes dropped EXE
PID:2036 -
\??\c:\htbtnn.exec:\htbtnn.exe62⤵
- Executes dropped EXE
PID:1000 -
\??\c:\thtntn.exec:\thtntn.exe63⤵
- Executes dropped EXE
PID:1812 -
\??\c:\pdjjv.exec:\pdjjv.exe64⤵
- Executes dropped EXE
PID:1388 -
\??\c:\7fllllx.exec:\7fllllx.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lxxlfrl.exec:\lxxlfrl.exe66⤵PID:912
-
\??\c:\hbhbbt.exec:\hbhbbt.exe67⤵PID:2216
-
\??\c:\htbbtn.exec:\htbbtn.exe68⤵PID:2428
-
\??\c:\vpvvd.exec:\vpvvd.exe69⤵PID:2120
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe70⤵PID:1864
-
\??\c:\7lflrrl.exec:\7lflrrl.exe71⤵PID:1744
-
\??\c:\nbhhhh.exec:\nbhhhh.exe72⤵PID:1636
-
\??\c:\pdvpp.exec:\pdvpp.exe73⤵PID:1640
-
\??\c:\pdvdp.exec:\pdvdp.exe74⤵PID:3068
-
\??\c:\7rlffff.exec:\7rlffff.exe75⤵PID:1556
-
\??\c:\7bhbht.exec:\7bhbht.exe76⤵PID:2744
-
\??\c:\hnbttt.exec:\hnbttt.exe77⤵PID:1528
-
\??\c:\jdpvp.exec:\jdpvp.exe78⤵PID:2616
-
\??\c:\dpvpv.exec:\dpvpv.exe79⤵PID:2632
-
\??\c:\frlrlxl.exec:\frlrlxl.exe80⤵PID:1244
-
\??\c:\thnntn.exec:\thnntn.exe81⤵PID:2660
-
\??\c:\tnhnnn.exec:\tnhnnn.exe82⤵PID:1920
-
\??\c:\3vpvp.exec:\3vpvp.exe83⤵PID:2700
-
\??\c:\vpdpv.exec:\vpdpv.exe84⤵PID:536
-
\??\c:\rflfxrr.exec:\rflfxrr.exe85⤵PID:804
-
\??\c:\bbnntt.exec:\bbnntt.exe86⤵PID:596
-
\??\c:\pdpvj.exec:\pdpvj.exe87⤵PID:800
-
\??\c:\7xffxxf.exec:\7xffxxf.exe88⤵PID:1672
-
\??\c:\jdvpv.exec:\jdvpv.exe89⤵PID:2404
-
\??\c:\jvpjd.exec:\jvpjd.exe90⤵PID:2080
-
\??\c:\fflrxfl.exec:\fflrxfl.exe91⤵PID:2964
-
\??\c:\nnhbhh.exec:\nnhbhh.exe92⤵PID:2956
-
\??\c:\vjpdv.exec:\vjpdv.exe93⤵PID:3008
-
\??\c:\llxfrxl.exec:\llxfrxl.exe94⤵PID:2688
-
\??\c:\9nbbhh.exec:\9nbbhh.exe95⤵PID:1492
-
\??\c:\jddvd.exec:\jddvd.exe96⤵PID:2188
-
\??\c:\rflfxrf.exec:\rflfxrf.exe97⤵PID:2016
-
\??\c:\nbnnhb.exec:\nbnnhb.exe98⤵PID:2176
-
\??\c:\5jvvv.exec:\5jvvv.exe99⤵PID:3060
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe100⤵PID:2092
-
\??\c:\tnbtbb.exec:\tnbtbb.exe101⤵PID:1884
-
\??\c:\7djjp.exec:\7djjp.exe102⤵PID:2372
-
\??\c:\rlllrxx.exec:\rlllrxx.exe103⤵PID:1608
-
\??\c:\1httbb.exec:\1httbb.exe104⤵PID:844
-
\??\c:\jdjjv.exec:\jdjjv.exe105⤵PID:1000
-
\??\c:\3rflrxr.exec:\3rflrxr.exe106⤵PID:1812
-
\??\c:\7btntb.exec:\7btntb.exe107⤵PID:1808
-
\??\c:\jvjdv.exec:\jvjdv.exe108⤵PID:1712
-
\??\c:\lfrrffx.exec:\lfrrffx.exe109⤵PID:1704
-
\??\c:\ttnnbn.exec:\ttnnbn.exe110⤵PID:1880
-
\??\c:\vddpj.exec:\vddpj.exe111⤵PID:1548
-
\??\c:\rxrxlfr.exec:\rxrxlfr.exe112⤵PID:2524
-
\??\c:\fxrxflr.exec:\fxrxflr.exe113⤵PID:2784
-
\??\c:\tntthh.exec:\tntthh.exe114⤵PID:2728
-
\??\c:\jdppd.exec:\jdppd.exe115⤵PID:2520
-
\??\c:\fxllxxl.exec:\fxllxxl.exe116⤵PID:2740
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe117⤵PID:1604
-
\??\c:\ntnnbb.exec:\ntnnbb.exe118⤵PID:1124
-
\??\c:\3vjpd.exec:\3vjpd.exe119⤵PID:2612
-
\??\c:\vjppv.exec:\vjppv.exe120⤵PID:3048
-
\??\c:\xlrxffl.exec:\xlrxffl.exe121⤵PID:2592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-