Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 04:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe
-
Size
454KB
-
MD5
5821692ae6abb3232de000abefa33e81
-
SHA1
d02bd8b27c2124d2344211cc4e5e934053f38908
-
SHA256
d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645
-
SHA512
1c9f3bf9a7fa74a71bec245b598de6bd562414026c1b95cc57089e671f0c0dd821e8269e28c42fcfe2d9988a796ec9b87c47bd5c9d9b6d96e8f42d08f650e51d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2260-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-68-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1068-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1816-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-326-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/372-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-576-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1376-586-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2612-645-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-682-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-718-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-1078-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1816-1135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-1156-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2868-1226-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2252 9vdjp.exe 2856 vppvj.exe 2724 lfrxxrf.exe 2244 thntbb.exe 2828 xrlflfr.exe 1980 vvjjv.exe 2612 rllrflf.exe 2080 7pjjj.exe 2536 1lxxxxx.exe 2980 ffffrrf.exe 2400 hhhtht.exe 1820 llxrxfr.exe 1864 nhnntt.exe 1732 fllrlrl.exe 1068 ttntnn.exe 1096 3dpvd.exe 1764 bbnthb.exe 1312 ffxflfx.exe 2052 nnhntn.exe 2140 xflrlxx.exe 808 tnttht.exe 2336 frxrffr.exe 1656 1nhthh.exe 1028 pjdpv.exe 1784 lxrxlxr.exe 1708 dddjv.exe 1040 7rlflrf.exe 3036 5nbthn.exe 3008 jdjjv.exe 2296 hhthtt.exe 2440 jvjpp.exe 860 bbnnhh.exe 1816 vdvdj.exe 2412 rrrffrl.exe 2840 7tnhtt.exe 2696 tnhtbh.exe 1576 pjjjv.exe 2352 llrxflr.exe 2912 nhhntb.exe 2756 vdjvv.exe 2828 5lflrxl.exe 2644 nhbbhb.exe 2156 5jvvd.exe 2080 pdvpd.exe 1152 3frxfrx.exe 2548 bnntht.exe 2980 bbthbn.exe 372 vjjjv.exe 2896 rllrfrf.exe 2944 5hhhnn.exe 2884 bbtbhn.exe 1968 dvpvd.exe 536 rlxlxxf.exe 1632 ttbnbn.exe 756 hhtbhh.exe 2200 9vvvd.exe 2348 9fxxllr.exe 1760 1rlxrxl.exe 1696 bhtnnn.exe 2052 5dddd.exe 2140 lxrrxrf.exe 1852 hbntbb.exe 896 vpddv.exe 2404 7xrrrrx.exe -
resource yara_rule behavioral1/memory/2260-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-68-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2980-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1068-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-489-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2812-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-576-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1376-586-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2904-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-637-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3024-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-824-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-879-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-958-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-1007-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2252 2260 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 30 PID 2260 wrote to memory of 2252 2260 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 30 PID 2260 wrote to memory of 2252 2260 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 30 PID 2260 wrote to memory of 2252 2260 d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe 30 PID 2252 wrote to memory of 2856 2252 9vdjp.exe 31 PID 2252 wrote to memory of 2856 2252 9vdjp.exe 31 PID 2252 wrote to memory of 2856 2252 9vdjp.exe 31 PID 2252 wrote to memory of 2856 2252 9vdjp.exe 31 PID 2856 wrote to memory of 2724 2856 vppvj.exe 32 PID 2856 wrote to memory of 2724 2856 vppvj.exe 32 PID 2856 wrote to memory of 2724 2856 vppvj.exe 32 PID 2856 wrote to memory of 2724 2856 vppvj.exe 32 PID 2724 wrote to memory of 2244 2724 lfrxxrf.exe 33 PID 2724 wrote to memory of 2244 2724 lfrxxrf.exe 33 PID 2724 wrote to memory of 2244 2724 lfrxxrf.exe 33 PID 2724 wrote to memory of 2244 2724 lfrxxrf.exe 33 PID 2244 wrote to memory of 2828 2244 thntbb.exe 34 PID 2244 wrote to memory of 2828 2244 thntbb.exe 34 PID 2244 wrote to memory of 2828 2244 thntbb.exe 34 PID 2244 wrote to memory of 2828 2244 thntbb.exe 34 PID 2828 wrote to memory of 1980 2828 xrlflfr.exe 35 PID 2828 wrote to memory of 1980 2828 xrlflfr.exe 35 PID 2828 wrote to memory of 1980 2828 xrlflfr.exe 35 PID 2828 wrote to memory of 1980 2828 xrlflfr.exe 35 PID 1980 wrote to memory of 2612 1980 vvjjv.exe 36 PID 1980 wrote to memory of 2612 1980 vvjjv.exe 36 PID 1980 wrote to memory of 2612 1980 vvjjv.exe 36 PID 1980 wrote to memory of 2612 1980 vvjjv.exe 36 PID 2612 wrote to memory of 2080 2612 rllrflf.exe 37 PID 2612 wrote to memory of 2080 2612 rllrflf.exe 37 PID 2612 wrote to memory of 2080 2612 rllrflf.exe 37 PID 2612 wrote to memory of 2080 2612 rllrflf.exe 37 PID 2080 wrote to memory of 2536 2080 7pjjj.exe 38 PID 2080 wrote to memory of 2536 2080 7pjjj.exe 38 PID 2080 wrote to memory of 2536 2080 7pjjj.exe 38 PID 2080 wrote to memory of 2536 2080 7pjjj.exe 38 PID 2536 wrote to memory of 2980 2536 1lxxxxx.exe 39 PID 2536 wrote to memory of 2980 2536 1lxxxxx.exe 39 PID 2536 wrote to memory of 2980 2536 1lxxxxx.exe 39 PID 2536 wrote to memory of 2980 2536 1lxxxxx.exe 39 PID 2980 wrote to memory of 2400 2980 ffffrrf.exe 40 PID 2980 wrote to memory of 2400 2980 ffffrrf.exe 40 PID 2980 wrote to memory of 2400 2980 ffffrrf.exe 40 PID 2980 wrote to memory of 2400 2980 ffffrrf.exe 40 PID 2400 wrote to memory of 1820 2400 hhhtht.exe 41 PID 2400 wrote to memory of 1820 2400 hhhtht.exe 41 PID 2400 wrote to memory of 1820 2400 hhhtht.exe 41 PID 2400 wrote to memory of 1820 2400 hhhtht.exe 41 PID 1820 wrote to memory of 1864 1820 llxrxfr.exe 42 PID 1820 wrote to memory of 1864 1820 llxrxfr.exe 42 PID 1820 wrote to memory of 1864 1820 llxrxfr.exe 42 PID 1820 wrote to memory of 1864 1820 llxrxfr.exe 42 PID 1864 wrote to memory of 1732 1864 nhnntt.exe 43 PID 1864 wrote to memory of 1732 1864 nhnntt.exe 43 PID 1864 wrote to memory of 1732 1864 nhnntt.exe 43 PID 1864 wrote to memory of 1732 1864 nhnntt.exe 43 PID 1732 wrote to memory of 1068 1732 fllrlrl.exe 44 PID 1732 wrote to memory of 1068 1732 fllrlrl.exe 44 PID 1732 wrote to memory of 1068 1732 fllrlrl.exe 44 PID 1732 wrote to memory of 1068 1732 fllrlrl.exe 44 PID 1068 wrote to memory of 1096 1068 ttntnn.exe 45 PID 1068 wrote to memory of 1096 1068 ttntnn.exe 45 PID 1068 wrote to memory of 1096 1068 ttntnn.exe 45 PID 1068 wrote to memory of 1096 1068 ttntnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe"C:\Users\Admin\AppData\Local\Temp\d565fdeee6b61ea738021ee53e7f0a56d5d26f953eb9dab6ce252b0e96ca3645.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\9vdjp.exec:\9vdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vppvj.exec:\vppvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\thntbb.exec:\thntbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xrlflfr.exec:\xrlflfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vvjjv.exec:\vvjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\rllrflf.exec:\rllrflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\7pjjj.exec:\7pjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\1lxxxxx.exec:\1lxxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ffffrrf.exec:\ffffrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hhhtht.exec:\hhhtht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\llxrxfr.exec:\llxrxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\nhnntt.exec:\nhnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\fllrlrl.exec:\fllrlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\ttntnn.exec:\ttntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\3dpvd.exec:\3dpvd.exe17⤵
- Executes dropped EXE
PID:1096 -
\??\c:\bbnthb.exec:\bbnthb.exe18⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ffxflfx.exec:\ffxflfx.exe19⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nnhntn.exec:\nnhntn.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xflrlxx.exec:\xflrlxx.exe21⤵
- Executes dropped EXE
PID:2140 -
\??\c:\tnttht.exec:\tnttht.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\frxrffr.exec:\frxrffr.exe23⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1nhthh.exec:\1nhthh.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pjdpv.exec:\pjdpv.exe25⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lxrxlxr.exec:\lxrxlxr.exe26⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dddjv.exec:\dddjv.exe27⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7rlflrf.exec:\7rlflrf.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5nbthn.exec:\5nbthn.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jdjjv.exec:\jdjjv.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hhthtt.exec:\hhthtt.exe31⤵
- Executes dropped EXE
PID:2296 -
\??\c:\jvjpp.exec:\jvjpp.exe32⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bbnnhh.exec:\bbnnhh.exe33⤵
- Executes dropped EXE
PID:860 -
\??\c:\vdvdj.exec:\vdvdj.exe34⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rrrffrl.exec:\rrrffrl.exe35⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7tnhtt.exec:\7tnhtt.exe36⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnhtbh.exec:\tnhtbh.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjjjv.exec:\pjjjv.exe38⤵
- Executes dropped EXE
PID:1576 -
\??\c:\llrxflr.exec:\llrxflr.exe39⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhhntb.exec:\nhhntb.exe40⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vdjvv.exec:\vdjvv.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5lflrxl.exec:\5lflrxl.exe42⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nhbbhb.exec:\nhbbhb.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5jvvd.exec:\5jvvd.exe44⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pdvpd.exec:\pdvpd.exe45⤵
- Executes dropped EXE
PID:2080 -
\??\c:\3frxfrx.exec:\3frxfrx.exe46⤵
- Executes dropped EXE
PID:1152 -
\??\c:\bnntht.exec:\bnntht.exe47⤵
- Executes dropped EXE
PID:2548 -
\??\c:\bbthbn.exec:\bbthbn.exe48⤵
- Executes dropped EXE
PID:2980 -
\??\c:\vjjjv.exec:\vjjjv.exe49⤵
- Executes dropped EXE
PID:372 -
\??\c:\rllrfrf.exec:\rllrfrf.exe50⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5hhhnn.exec:\5hhhnn.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bbtbhn.exec:\bbtbhn.exe52⤵
- Executes dropped EXE
PID:2884 -
\??\c:\dvpvd.exec:\dvpvd.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\rlxlxxf.exec:\rlxlxxf.exe54⤵
- Executes dropped EXE
PID:536 -
\??\c:\ttbnbn.exec:\ttbnbn.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hhtbhh.exec:\hhtbhh.exe56⤵
- Executes dropped EXE
PID:756 -
\??\c:\9vvvd.exec:\9vvvd.exe57⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9fxxllr.exec:\9fxxllr.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\1rlxrxl.exec:\1rlxrxl.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bhtnnn.exec:\bhtnnn.exe60⤵
- Executes dropped EXE
PID:1696 -
\??\c:\5dddd.exec:\5dddd.exe61⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lxrrxrf.exec:\lxrrxrf.exe62⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hbntbb.exec:\hbntbb.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vpddv.exec:\vpddv.exe64⤵
- Executes dropped EXE
PID:896 -
\??\c:\7xrrrrx.exec:\7xrrrrx.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\xrrrxrl.exec:\xrrrxrl.exe66⤵PID:1656
-
\??\c:\nbnbnb.exec:\nbnbnb.exe67⤵PID:2796
-
\??\c:\jdvvd.exec:\jdvvd.exe68⤵PID:2812
-
\??\c:\ffrfrrl.exec:\ffrfrrl.exe69⤵PID:1704
-
\??\c:\nhbbnt.exec:\nhbbnt.exe70⤵PID:2436
-
\??\c:\ttbbbt.exec:\ttbbbt.exe71⤵PID:3040
-
\??\c:\1vjjv.exec:\1vjjv.exe72⤵PID:1936
-
\??\c:\xxrrxlr.exec:\xxrrxlr.exe73⤵PID:3008
-
\??\c:\tnbhnn.exec:\tnbhnn.exe74⤵PID:2316
-
\??\c:\tnhntn.exec:\tnhntn.exe75⤵PID:2172
-
\??\c:\dvjjv.exec:\dvjjv.exe76⤵PID:268
-
\??\c:\ffxllxf.exec:\ffxllxf.exe77⤵PID:3048
-
\??\c:\nhtbbb.exec:\nhtbbb.exe78⤵
- System Location Discovery: System Language Discovery
PID:1376 -
\??\c:\jvjpd.exec:\jvjpd.exe79⤵PID:2720
-
\??\c:\jpjpj.exec:\jpjpj.exe80⤵PID:2340
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe81⤵PID:2904
-
\??\c:\nhhbbh.exec:\nhhbbh.exe82⤵PID:2244
-
\??\c:\5nnbnb.exec:\5nnbnb.exe83⤵PID:1804
-
\??\c:\jvddj.exec:\jvddj.exe84⤵PID:2816
-
\??\c:\fxllxfr.exec:\fxllxfr.exe85⤵PID:2756
-
\??\c:\hthbhn.exec:\hthbhn.exe86⤵PID:2916
-
\??\c:\hbtbtb.exec:\hbtbtb.exe87⤵PID:2612
-
\??\c:\pppvd.exec:\pppvd.exe88⤵PID:1052
-
\??\c:\3fffrxf.exec:\3fffrxf.exe89⤵PID:1476
-
\??\c:\1btntt.exec:\1btntt.exe90⤵PID:3024
-
\??\c:\ppjpj.exec:\ppjpj.exe91⤵PID:2356
-
\??\c:\dvpdp.exec:\dvpdp.exe92⤵PID:2400
-
\??\c:\rrlrlrx.exec:\rrlrlrx.exe93⤵PID:2056
-
\??\c:\7hbtbh.exec:\7hbtbh.exe94⤵PID:2896
-
\??\c:\7pjpd.exec:\7pjpd.exe95⤵PID:1864
-
\??\c:\pdvpv.exec:\pdvpv.exe96⤵PID:1972
-
\??\c:\9fxfllr.exec:\9fxfllr.exe97⤵PID:1228
-
\??\c:\1hnntb.exec:\1hnntb.exe98⤵PID:1944
-
\??\c:\dvvvj.exec:\dvvvj.exe99⤵PID:2768
-
\??\c:\jdppd.exec:\jdppd.exe100⤵PID:2344
-
\??\c:\llrrffr.exec:\llrrffr.exe101⤵PID:2220
-
\??\c:\bthbnt.exec:\bthbnt.exe102⤵PID:1312
-
\??\c:\9pjpp.exec:\9pjpp.exe103⤵PID:1388
-
\??\c:\7vvvd.exec:\7vvvd.exe104⤵PID:2364
-
\??\c:\rlfffxf.exec:\rlfffxf.exe105⤵PID:1596
-
\??\c:\btnhnb.exec:\btnhnb.exe106⤵PID:324
-
\??\c:\5dppp.exec:\5dppp.exe107⤵PID:2336
-
\??\c:\dvjpj.exec:\dvjpj.exe108⤵PID:300
-
\??\c:\lxrrxfr.exec:\lxrrxfr.exe109⤵PID:2404
-
\??\c:\fxfrrll.exec:\fxfrrll.exe110⤵PID:1516
-
\??\c:\bbtnhn.exec:\bbtnhn.exe111⤵PID:1824
-
\??\c:\ppdpv.exec:\ppdpv.exe112⤵PID:1652
-
\??\c:\flrrlxr.exec:\flrrlxr.exe113⤵PID:2420
-
\??\c:\5flrxrx.exec:\5flrxrx.exe114⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\9nbbnn.exec:\9nbbnn.exe115⤵PID:2552
-
\??\c:\nhbhtn.exec:\nhbhtn.exe116⤵PID:2476
-
\??\c:\jvdjp.exec:\jvdjp.exe117⤵PID:2296
-
\??\c:\llxxfll.exec:\llxxfll.exe118⤵PID:1744
-
\??\c:\7tthtb.exec:\7tthtb.exe119⤵PID:880
-
\??\c:\7djpp.exec:\7djpp.exe120⤵PID:1144
-
\??\c:\flfrfrf.exec:\flfrfrf.exe121⤵PID:1800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-