Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe
-
Size
453KB
-
MD5
d5ef3fb54e3343b2e1b180ff17f0c37e
-
SHA1
c9c2139c59f2914d86b01859bda770a9cd8074c2
-
SHA256
94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5
-
SHA512
03ee9168124d0dac5284d5c28d3128e41d361814e611e67b54af0cd1a7a76893b1cbacff4c303b25c3b7321c91b75a7f70e61f3890d4f97b1aca6d1c69b82c5e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1444-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-91-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1820-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-97-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2380-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-110-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1396-129-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1396-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-169-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2236-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-365-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2392-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-392-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-425-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2948-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1304-560-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1260-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-724-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-849-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-919-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 352 rxrlxxr.exe 2184 ddpdp.exe 2816 lfrrfrf.exe 2696 nhttht.exe 2076 lfxlrfr.exe 2728 bbbbnn.exe 2584 3dpdp.exe 2280 pjvjd.exe 1820 nnhntb.exe 2124 jjddp.exe 2380 9fffrxf.exe 1260 dvjpj.exe 1396 nbbhtb.exe 2904 3vjpp.exe 1908 rlxxrrx.exe 2912 5dpvj.exe 2396 frllxfr.exe 2236 jdppv.exe 2208 dvppv.exe 3024 rfrllfx.exe 2068 7llrxxr.exe 3048 5htbhn.exe 972 1jpvd.exe 1044 hbtbnn.exe 2148 bnnhbt.exe 1292 7xrrrrf.exe 2496 bthhhh.exe 1736 pjvvv.exe 1800 htbbhb.exe 2476 5jvpv.exe 1512 1rllrrf.exe 2324 jdvvd.exe 1984 1jvjp.exe 2748 frrxlff.exe 2832 ddvjd.exe 2988 lxlrxxl.exe 2188 xxllrrx.exe 2592 1thhhb.exe 2856 1dppd.exe 2576 fxrlflx.exe 1980 ffxxffl.exe 2392 btnnbh.exe 572 9dvdj.exe 2452 vvjjd.exe 1436 lxfflxf.exe 2020 nbhbhh.exe 1152 hnthth.exe 2368 pdpjv.exe 2756 1rflllx.exe 1844 7tthnh.exe 1564 3ttbtn.exe 2948 dpvvj.exe 264 5rfrxfr.exe 1976 nhbtbb.exe 788 1httbn.exe 1636 pdppp.exe 2160 llffllr.exe 2336 hhnhtn.exe 2172 vjpvj.exe 1360 jdjdd.exe 3036 xlrlrrx.exe 1376 7tnhtb.exe 672 dvjjv.exe 1016 vvjjp.exe -
resource yara_rule behavioral1/memory/1444-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1292-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-724-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2320-811-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-849-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-919-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1444 wrote to memory of 352 1444 94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe 30 PID 1444 wrote to memory of 352 1444 94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe 30 PID 1444 wrote to memory of 352 1444 94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe 30 PID 1444 wrote to memory of 352 1444 94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe 30 PID 352 wrote to memory of 2184 352 rxrlxxr.exe 31 PID 352 wrote to memory of 2184 352 rxrlxxr.exe 31 PID 352 wrote to memory of 2184 352 rxrlxxr.exe 31 PID 352 wrote to memory of 2184 352 rxrlxxr.exe 31 PID 2184 wrote to memory of 2816 2184 ddpdp.exe 32 PID 2184 wrote to memory of 2816 2184 ddpdp.exe 32 PID 2184 wrote to memory of 2816 2184 ddpdp.exe 32 PID 2184 wrote to memory of 2816 2184 ddpdp.exe 32 PID 2816 wrote to memory of 2696 2816 lfrrfrf.exe 33 PID 2816 wrote to memory of 2696 2816 lfrrfrf.exe 33 PID 2816 wrote to memory of 2696 2816 lfrrfrf.exe 33 PID 2816 wrote to memory of 2696 2816 lfrrfrf.exe 33 PID 2696 wrote to memory of 2076 2696 nhttht.exe 34 PID 2696 wrote to memory of 2076 2696 nhttht.exe 34 PID 2696 wrote to memory of 2076 2696 nhttht.exe 34 PID 2696 wrote to memory of 2076 2696 nhttht.exe 34 PID 2076 wrote to memory of 2728 2076 lfxlrfr.exe 35 PID 2076 wrote to memory of 2728 2076 lfxlrfr.exe 35 PID 2076 wrote to memory of 2728 2076 lfxlrfr.exe 35 PID 2076 wrote to memory of 2728 2076 lfxlrfr.exe 35 PID 2728 wrote to memory of 2584 2728 bbbbnn.exe 36 PID 2728 wrote to memory of 2584 2728 bbbbnn.exe 36 PID 2728 wrote to memory of 2584 2728 bbbbnn.exe 36 PID 2728 wrote to memory of 2584 2728 bbbbnn.exe 36 PID 2584 wrote to memory of 2280 2584 3dpdp.exe 37 PID 2584 wrote to memory of 2280 2584 3dpdp.exe 37 PID 2584 wrote to memory of 2280 2584 3dpdp.exe 37 PID 2584 wrote to memory of 2280 2584 3dpdp.exe 37 PID 2280 wrote to memory of 1820 2280 pjvjd.exe 38 PID 2280 wrote to memory of 1820 2280 pjvjd.exe 38 PID 2280 wrote to memory of 1820 2280 pjvjd.exe 38 PID 2280 wrote to memory of 1820 2280 pjvjd.exe 38 PID 1820 wrote to memory of 2124 1820 nnhntb.exe 39 PID 1820 wrote to memory of 2124 1820 nnhntb.exe 39 PID 1820 wrote to memory of 2124 1820 nnhntb.exe 39 PID 1820 wrote to memory of 2124 1820 nnhntb.exe 39 PID 2124 wrote to memory of 2380 2124 jjddp.exe 40 PID 2124 wrote to memory of 2380 2124 jjddp.exe 40 PID 2124 wrote to memory of 2380 2124 jjddp.exe 40 PID 2124 wrote to memory of 2380 2124 jjddp.exe 40 PID 2380 wrote to memory of 1260 2380 9fffrxf.exe 41 PID 2380 wrote to memory of 1260 2380 9fffrxf.exe 41 PID 2380 wrote to memory of 1260 2380 9fffrxf.exe 41 PID 2380 wrote to memory of 1260 2380 9fffrxf.exe 41 PID 1260 wrote to memory of 1396 1260 dvjpj.exe 42 PID 1260 wrote to memory of 1396 1260 dvjpj.exe 42 PID 1260 wrote to memory of 1396 1260 dvjpj.exe 42 PID 1260 wrote to memory of 1396 1260 dvjpj.exe 42 PID 1396 wrote to memory of 2904 1396 nbbhtb.exe 43 PID 1396 wrote to memory of 2904 1396 nbbhtb.exe 43 PID 1396 wrote to memory of 2904 1396 nbbhtb.exe 43 PID 1396 wrote to memory of 2904 1396 nbbhtb.exe 43 PID 2904 wrote to memory of 1908 2904 3vjpp.exe 44 PID 2904 wrote to memory of 1908 2904 3vjpp.exe 44 PID 2904 wrote to memory of 1908 2904 3vjpp.exe 44 PID 2904 wrote to memory of 1908 2904 3vjpp.exe 44 PID 1908 wrote to memory of 2912 1908 rlxxrrx.exe 45 PID 1908 wrote to memory of 2912 1908 rlxxrrx.exe 45 PID 1908 wrote to memory of 2912 1908 rlxxrrx.exe 45 PID 1908 wrote to memory of 2912 1908 rlxxrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe"C:\Users\Admin\AppData\Local\Temp\94824cc2f15b47e53175e908d0a2b4378c7f16560a1017b789f9e4a7fbbfaab5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\rxrlxxr.exec:\rxrlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\ddpdp.exec:\ddpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\lfrrfrf.exec:\lfrrfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nhttht.exec:\nhttht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\bbbbnn.exec:\bbbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\3dpdp.exec:\3dpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\pjvjd.exec:\pjvjd.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\nnhntb.exec:\nnhntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\jjddp.exec:\jjddp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9fffrxf.exec:\9fffrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\dvjpj.exec:\dvjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\nbbhtb.exec:\nbbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\3vjpp.exec:\3vjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rlxxrrx.exec:\rlxxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\5dpvj.exec:\5dpvj.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\frllxfr.exec:\frllxfr.exe18⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jdppv.exec:\jdppv.exe19⤵
- Executes dropped EXE
PID:2236 -
\??\c:\dvppv.exec:\dvppv.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2208 -
\??\c:\rfrllfx.exec:\rfrllfx.exe21⤵
- Executes dropped EXE
PID:3024 -
\??\c:\7llrxxr.exec:\7llrxxr.exe22⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5htbhn.exec:\5htbhn.exe23⤵
- Executes dropped EXE
PID:3048 -
\??\c:\1jpvd.exec:\1jpvd.exe24⤵
- Executes dropped EXE
PID:972 -
\??\c:\hbtbnn.exec:\hbtbnn.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\bnnhbt.exec:\bnnhbt.exe26⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7xrrrrf.exec:\7xrrrrf.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bthhhh.exec:\bthhhh.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjvvv.exec:\pjvvv.exe29⤵
- Executes dropped EXE
PID:1736 -
\??\c:\htbbhb.exec:\htbbhb.exe30⤵
- Executes dropped EXE
PID:1800 -
\??\c:\5jvpv.exec:\5jvpv.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1rllrrf.exec:\1rllrrf.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jdvvd.exec:\jdvvd.exe33⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1jvjp.exec:\1jvjp.exe34⤵
- Executes dropped EXE
PID:1984 -
\??\c:\frrxlff.exec:\frrxlff.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\ddvjd.exec:\ddvjd.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lxlrxxl.exec:\lxlrxxl.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xxllrrx.exec:\xxllrrx.exe38⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1thhhb.exec:\1thhhb.exe39⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1dppd.exec:\1dppd.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\fxrlflx.exec:\fxrlflx.exe41⤵
- Executes dropped EXE
PID:2576 -
\??\c:\ffxxffl.exec:\ffxxffl.exe42⤵
- Executes dropped EXE
PID:1980 -
\??\c:\btnnbh.exec:\btnnbh.exe43⤵
- Executes dropped EXE
PID:2392 -
\??\c:\9dvdj.exec:\9dvdj.exe44⤵
- Executes dropped EXE
PID:572 -
\??\c:\vvjjd.exec:\vvjjd.exe45⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lxfflxf.exec:\lxfflxf.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\nbhbhh.exec:\nbhbhh.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\hnthth.exec:\hnthth.exe48⤵
- Executes dropped EXE
PID:1152 -
\??\c:\pdpjv.exec:\pdpjv.exe49⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1rflllx.exec:\1rflllx.exe50⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7tthnh.exec:\7tthnh.exe51⤵
- Executes dropped EXE
PID:1844 -
\??\c:\3ttbtn.exec:\3ttbtn.exe52⤵
- Executes dropped EXE
PID:1564 -
\??\c:\dpvvj.exec:\dpvvj.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5rfrxfr.exec:\5rfrxfr.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\nhbtbb.exec:\nhbtbb.exe55⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1httbn.exec:\1httbn.exe56⤵
- Executes dropped EXE
PID:788 -
\??\c:\pdppp.exec:\pdppp.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\llffllr.exec:\llffllr.exe58⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hhnhtn.exec:\hhnhtn.exe59⤵
- Executes dropped EXE
PID:2336 -
\??\c:\vjpvj.exec:\vjpvj.exe60⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jdjdd.exec:\jdjdd.exe61⤵
- Executes dropped EXE
PID:1360 -
\??\c:\xlrlrrx.exec:\xlrlrrx.exe62⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7tnhtb.exec:\7tnhtb.exe63⤵
- Executes dropped EXE
PID:1376 -
\??\c:\dvjjv.exec:\dvjjv.exe64⤵
- Executes dropped EXE
PID:672 -
\??\c:\vvjjp.exec:\vvjjp.exe65⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xlflrrl.exec:\xlflrrl.exe66⤵PID:2012
-
\??\c:\bthnbh.exec:\bthnbh.exe67⤵PID:284
-
\??\c:\dppvp.exec:\dppvp.exe68⤵PID:3008
-
\??\c:\rlxxxrx.exec:\rlxxxrx.exe69⤵PID:2468
-
\??\c:\lfxrllx.exec:\lfxrllx.exe70⤵PID:2304
-
\??\c:\bbthhb.exec:\bbthhb.exe71⤵PID:556
-
\??\c:\7jdjd.exec:\7jdjd.exe72⤵PID:1304
-
\??\c:\9pjvd.exec:\9pjvd.exe73⤵PID:2644
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe74⤵PID:1512
-
\??\c:\3htnnn.exec:\3htnnn.exe75⤵PID:1604
-
\??\c:\5hnhhh.exec:\5hnhhh.exe76⤵PID:2704
-
\??\c:\dvjdj.exec:\dvjdj.exe77⤵PID:2812
-
\??\c:\xlrlrll.exec:\xlrlrll.exe78⤵PID:2844
-
\??\c:\lllfxff.exec:\lllfxff.exe79⤵PID:2832
-
\??\c:\hbtbtt.exec:\hbtbtt.exe80⤵PID:2680
-
\??\c:\dvddj.exec:\dvddj.exe81⤵PID:2908
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe82⤵PID:2592
-
\??\c:\5nhbnt.exec:\5nhbnt.exe83⤵PID:2076
-
\??\c:\5tbbbh.exec:\5tbbbh.exe84⤵PID:2628
-
\??\c:\pppvj.exec:\pppvj.exe85⤵PID:1980
-
\??\c:\rllxrxl.exec:\rllxrxl.exe86⤵PID:2392
-
\??\c:\bhhnnb.exec:\bhhnnb.exe87⤵PID:2552
-
\??\c:\dvppp.exec:\dvppp.exe88⤵
- System Location Discovery: System Language Discovery
PID:2452 -
\??\c:\vpjjp.exec:\vpjjp.exe89⤵PID:1624
-
\??\c:\fxrxfrx.exec:\fxrxfrx.exe90⤵PID:2020
-
\??\c:\1nbhnb.exec:\1nbhnb.exe91⤵PID:2300
-
\??\c:\jpjdj.exec:\jpjdj.exe92⤵PID:1260
-
\??\c:\dvdvj.exec:\dvdvj.exe93⤵PID:2796
-
\??\c:\7xrrffl.exec:\7xrrffl.exe94⤵PID:1844
-
\??\c:\tntbbb.exec:\tntbbb.exe95⤵PID:2924
-
\??\c:\pdpjp.exec:\pdpjp.exe96⤵PID:2948
-
\??\c:\7jppv.exec:\7jppv.exe97⤵PID:700
-
\??\c:\rlxfllr.exec:\rlxfllr.exe98⤵PID:604
-
\??\c:\nhtbhh.exec:\nhtbhh.exe99⤵PID:2396
-
\??\c:\pdvpd.exec:\pdvpd.exe100⤵PID:1636
-
\??\c:\vpvvj.exec:\vpvvj.exe101⤵PID:1316
-
\??\c:\xrrlrrf.exec:\xrrlrrf.exe102⤵PID:3024
-
\??\c:\tnhntn.exec:\tnhntn.exe103⤵PID:2964
-
\??\c:\djddp.exec:\djddp.exe104⤵PID:1332
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe105⤵PID:3036
-
\??\c:\tttbnt.exec:\tttbnt.exe106⤵PID:972
-
\??\c:\bttthh.exec:\bttthh.exe107⤵PID:672
-
\??\c:\vpddv.exec:\vpddv.exe108⤵PID:820
-
\??\c:\lxlffxf.exec:\lxlffxf.exe109⤵PID:2312
-
\??\c:\nhttbn.exec:\nhttbn.exe110⤵PID:2264
-
\??\c:\dvjjp.exec:\dvjjp.exe111⤵PID:2320
-
\??\c:\5jvpd.exec:\5jvpd.exe112⤵PID:372
-
\??\c:\rlxflxf.exec:\rlxflxf.exe113⤵PID:708
-
\??\c:\tntthn.exec:\tntthn.exe114⤵PID:2476
-
\??\c:\hbtnbh.exec:\hbtnbh.exe115⤵PID:2276
-
\??\c:\vdppv.exec:\vdppv.exe116⤵PID:2656
-
\??\c:\rlflxxl.exec:\rlflxxl.exe117⤵PID:1512
-
\??\c:\frxflxf.exec:\frxflxf.exe118⤵PID:2668
-
\??\c:\djdpj.exec:\djdpj.exe119⤵PID:2828
-
\??\c:\9fxfflr.exec:\9fxfflr.exe120⤵PID:2840
-
\??\c:\ttbhbh.exec:\ttbhbh.exe121⤵PID:2976
-
\??\c:\vvjdj.exec:\vvjdj.exe122⤵PID:2896
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-