Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 04:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe
-
Size
455KB
-
MD5
c928735fd08144078f102f7c0cc8ebdf
-
SHA1
dbc899bf0def03fa9b6a4f0b45601b5e48130ca0
-
SHA256
d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7
-
SHA512
56e63161e29de19aef8ea028c4dc6354cc76202d3d32a1d7b19f719abfbc3e1bbf16d38c9f2c6d46fde584711c151b78555abfdeff65118fc97c10bfc7092c4c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-43-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1812-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-105-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-114-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1560-135-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1560-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-254-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/792-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-258-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2496-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-330-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1504-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-286-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/860-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/860-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-443-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/584-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-457-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1644-456-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1092-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-511-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1372-530-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/612-543-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-550-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-575-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1580-595-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2660-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-603-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2576-632-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/356-709-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1348-722-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2556-756-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1796-775-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/924-801-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2108-828-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 llfrffl.exe 1812 bbtthh.exe 2032 dvvdj.exe 2888 1frlrlr.exe 2080 nhbhtb.exe 2720 dpddp.exe 2700 tnnnbb.exe 2656 ddvvj.exe 2704 xrflrrf.exe 2580 hhtbhn.exe 2372 jpvdp.exe 672 xfrfllr.exe 1560 9tnnhh.exe 1900 pddvj.exe 1928 rxrlrff.exe 1248 bbtttt.exe 1476 jjddj.exe 1424 jdpvj.exe 2628 tbtbhn.exe 1776 jvdjp.exe 2392 xlxrrrx.exe 860 1xxflrx.exe 1032 9pjjd.exe 852 dvjpd.exe 1376 xrxrxxx.exe 2216 bthhhh.exe 3064 vjvdp.exe 792 vpvpv.exe 2252 1bnntb.exe 1504 1pdvv.exe 2496 xrllrff.exe 1580 thtbhh.exe 2328 3pjjj.exe 2316 lfrrllr.exe 2032 nnbhtb.exe 2056 bnbttn.exe 2888 7jvvv.exe 2080 jpvjd.exe 2792 fxrrrrr.exe 2728 lfflxfr.exe 2744 nhtnnt.exe 2848 pdvvd.exe 2616 1rrrflr.exe 3020 vpddj.exe 2844 3rlrlrx.exe 2976 hhbnbb.exe 2044 9vpvd.exe 2228 frflrxf.exe 692 hnbntn.exe 1808 djdjv.exe 1548 fxlrxxl.exe 776 nhbbhh.exe 584 7ddjj.exe 2752 jjddp.exe 1644 lxllxlx.exe 2424 bthhnt.exe 2448 jdvvd.exe 2824 3jvvd.exe 1092 rffxlxf.exe 1516 frfxrxx.exe 844 htbbhn.exe 900 7jvvd.exe 1372 9lxfflr.exe 764 lfxxflx.exe -
resource yara_rule behavioral1/memory/2504-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-43-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2080-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/860-215-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2392-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-443-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/584-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-456-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1092-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-511-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/612-543-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-588-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2660-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-610-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2832-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-709-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1348-722-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1848-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-749-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-756-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2468-788-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2952-808-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-828-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1056-841-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2032-860-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2008 2504 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 30 PID 2504 wrote to memory of 2008 2504 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 30 PID 2504 wrote to memory of 2008 2504 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 30 PID 2504 wrote to memory of 2008 2504 d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe 30 PID 2008 wrote to memory of 1812 2008 llfrffl.exe 31 PID 2008 wrote to memory of 1812 2008 llfrffl.exe 31 PID 2008 wrote to memory of 1812 2008 llfrffl.exe 31 PID 2008 wrote to memory of 1812 2008 llfrffl.exe 31 PID 1812 wrote to memory of 2032 1812 bbtthh.exe 64 PID 1812 wrote to memory of 2032 1812 bbtthh.exe 64 PID 1812 wrote to memory of 2032 1812 bbtthh.exe 64 PID 1812 wrote to memory of 2032 1812 bbtthh.exe 64 PID 2032 wrote to memory of 2888 2032 dvvdj.exe 66 PID 2032 wrote to memory of 2888 2032 dvvdj.exe 66 PID 2032 wrote to memory of 2888 2032 dvvdj.exe 66 PID 2032 wrote to memory of 2888 2032 dvvdj.exe 66 PID 2888 wrote to memory of 2080 2888 1frlrlr.exe 67 PID 2888 wrote to memory of 2080 2888 1frlrlr.exe 67 PID 2888 wrote to memory of 2080 2888 1frlrlr.exe 67 PID 2888 wrote to memory of 2080 2888 1frlrlr.exe 67 PID 2080 wrote to memory of 2720 2080 nhbhtb.exe 35 PID 2080 wrote to memory of 2720 2080 nhbhtb.exe 35 PID 2080 wrote to memory of 2720 2080 nhbhtb.exe 35 PID 2080 wrote to memory of 2720 2080 nhbhtb.exe 35 PID 2720 wrote to memory of 2700 2720 dpddp.exe 36 PID 2720 wrote to memory of 2700 2720 dpddp.exe 36 PID 2720 wrote to memory of 2700 2720 dpddp.exe 36 PID 2720 wrote to memory of 2700 2720 dpddp.exe 36 PID 2700 wrote to memory of 2656 2700 tnnnbb.exe 37 PID 2700 wrote to memory of 2656 2700 tnnnbb.exe 37 PID 2700 wrote to memory of 2656 2700 tnnnbb.exe 37 PID 2700 wrote to memory of 2656 2700 tnnnbb.exe 37 PID 2656 wrote to memory of 2704 2656 ddvvj.exe 38 PID 2656 wrote to memory of 2704 2656 ddvvj.exe 38 PID 2656 wrote to memory of 2704 2656 ddvvj.exe 38 PID 2656 wrote to memory of 2704 2656 ddvvj.exe 38 PID 2704 wrote to memory of 2580 2704 xrflrrf.exe 39 PID 2704 wrote to memory of 2580 2704 xrflrrf.exe 39 PID 2704 wrote to memory of 2580 2704 xrflrrf.exe 39 PID 2704 wrote to memory of 2580 2704 xrflrrf.exe 39 PID 2580 wrote to memory of 2372 2580 hhtbhn.exe 40 PID 2580 wrote to memory of 2372 2580 hhtbhn.exe 40 PID 2580 wrote to memory of 2372 2580 hhtbhn.exe 40 PID 2580 wrote to memory of 2372 2580 hhtbhn.exe 40 PID 2372 wrote to memory of 672 2372 jpvdp.exe 41 PID 2372 wrote to memory of 672 2372 jpvdp.exe 41 PID 2372 wrote to memory of 672 2372 jpvdp.exe 41 PID 2372 wrote to memory of 672 2372 jpvdp.exe 41 PID 672 wrote to memory of 1560 672 xfrfllr.exe 42 PID 672 wrote to memory of 1560 672 xfrfllr.exe 42 PID 672 wrote to memory of 1560 672 xfrfllr.exe 42 PID 672 wrote to memory of 1560 672 xfrfllr.exe 42 PID 1560 wrote to memory of 1900 1560 9tnnhh.exe 43 PID 1560 wrote to memory of 1900 1560 9tnnhh.exe 43 PID 1560 wrote to memory of 1900 1560 9tnnhh.exe 43 PID 1560 wrote to memory of 1900 1560 9tnnhh.exe 43 PID 1900 wrote to memory of 1928 1900 pddvj.exe 44 PID 1900 wrote to memory of 1928 1900 pddvj.exe 44 PID 1900 wrote to memory of 1928 1900 pddvj.exe 44 PID 1900 wrote to memory of 1928 1900 pddvj.exe 44 PID 1928 wrote to memory of 1248 1928 rxrlrff.exe 45 PID 1928 wrote to memory of 1248 1928 rxrlrff.exe 45 PID 1928 wrote to memory of 1248 1928 rxrlrff.exe 45 PID 1928 wrote to memory of 1248 1928 rxrlrff.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe"C:\Users\Admin\AppData\Local\Temp\d609c080f6bc1f10ef303809c53d948fc8ef42fc421ef4988b240a5b8fc3fca7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\llfrffl.exec:\llfrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bbtthh.exec:\bbtthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\dvvdj.exec:\dvvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\1frlrlr.exec:\1frlrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\nhbhtb.exec:\nhbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\dpddp.exec:\dpddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\tnnnbb.exec:\tnnnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ddvvj.exec:\ddvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xrflrrf.exec:\xrflrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hhtbhn.exec:\hhtbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\jpvdp.exec:\jpvdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xfrfllr.exec:\xfrfllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\9tnnhh.exec:\9tnnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\pddvj.exec:\pddvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\rxrlrff.exec:\rxrlrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bbtttt.exec:\bbtttt.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jjddj.exec:\jjddj.exe18⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jdpvj.exec:\jdpvj.exe19⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tbtbhn.exec:\tbtbhn.exe20⤵
- Executes dropped EXE
PID:2628 -
\??\c:\jvdjp.exec:\jvdjp.exe21⤵
- Executes dropped EXE
PID:1776 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\1xxflrx.exec:\1xxflrx.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\9pjjd.exec:\9pjjd.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\dvjpd.exec:\dvjpd.exe25⤵
- Executes dropped EXE
PID:852 -
\??\c:\xrxrxxx.exec:\xrxrxxx.exe26⤵
- Executes dropped EXE
PID:1376 -
\??\c:\bthhhh.exec:\bthhhh.exe27⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vjvdp.exec:\vjvdp.exe28⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vpvpv.exec:\vpvpv.exe29⤵
- Executes dropped EXE
PID:792 -
\??\c:\1bnntb.exec:\1bnntb.exe30⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1pdvv.exec:\1pdvv.exe31⤵
- Executes dropped EXE
PID:1504 -
\??\c:\xrllrff.exec:\xrllrff.exe32⤵
- Executes dropped EXE
PID:2496 -
\??\c:\thtbhh.exec:\thtbhh.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3pjjj.exec:\3pjjj.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lfrrllr.exec:\lfrrllr.exe35⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nnbhtb.exec:\nnbhtb.exe36⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnbttn.exec:\bnbttn.exe37⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7jvvv.exec:\7jvvv.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jpvjd.exec:\jpvjd.exe39⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lfflxfr.exec:\lfflxfr.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nhtnnt.exec:\nhtnnt.exe42⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pdvvd.exec:\pdvvd.exe43⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1rrrflr.exec:\1rrrflr.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpddj.exec:\vpddj.exe45⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3rlrlrx.exec:\3rlrlrx.exe46⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hhbnbb.exec:\hhbnbb.exe47⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9vpvd.exec:\9vpvd.exe48⤵
- Executes dropped EXE
PID:2044 -
\??\c:\frflrxf.exec:\frflrxf.exe49⤵
- Executes dropped EXE
PID:2228 -
\??\c:\hnbntn.exec:\hnbntn.exe50⤵
- Executes dropped EXE
PID:692 -
\??\c:\djdjv.exec:\djdjv.exe51⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe52⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nhbbhh.exec:\nhbbhh.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:776 -
\??\c:\7ddjj.exec:\7ddjj.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\jjddp.exec:\jjddp.exe55⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lxllxlx.exec:\lxllxlx.exe56⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bthhnt.exec:\bthhnt.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jdvvd.exec:\jdvvd.exe58⤵
- Executes dropped EXE
PID:2448 -
\??\c:\3jvvd.exec:\3jvvd.exe59⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rffxlxf.exec:\rffxlxf.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\frfxrxx.exec:\frfxrxx.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\htbbhn.exec:\htbbhn.exe62⤵
- Executes dropped EXE
PID:844 -
\??\c:\7jvvd.exec:\7jvvd.exe63⤵
- Executes dropped EXE
PID:900 -
\??\c:\9lxfflr.exec:\9lxfflr.exe64⤵
- Executes dropped EXE
PID:1372 -
\??\c:\lfxxflx.exec:\lfxxflx.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\nnbhtb.exec:\nnbhtb.exe66⤵PID:2948
-
\??\c:\vvvvd.exec:\vvvvd.exe67⤵PID:2440
-
\??\c:\rrflrrx.exec:\rrflrrx.exe68⤵PID:1804
-
\??\c:\xlrlrlr.exec:\xlrlrlr.exe69⤵PID:612
-
\??\c:\ttnthn.exec:\ttnthn.exe70⤵PID:2252
-
\??\c:\3pjdv.exec:\3pjdv.exe71⤵PID:552
-
\??\c:\vvvvd.exec:\vvvvd.exe72⤵PID:2120
-
\??\c:\1rlrlxr.exec:\1rlrlxr.exe73⤵PID:2036
-
\??\c:\hhbbhh.exec:\hhbbhh.exe74⤵PID:1580
-
\??\c:\dvddp.exec:\dvddp.exe75⤵PID:2852
-
\??\c:\3ppjj.exec:\3ppjj.exe76⤵PID:2276
-
\??\c:\xrlflrx.exec:\xrlflrx.exe77⤵PID:2380
-
\??\c:\1thhtb.exec:\1thhtb.exe78⤵PID:2660
-
\??\c:\thbbhn.exec:\thbbhn.exe79⤵PID:1732
-
\??\c:\7dppp.exec:\7dppp.exe80⤵PID:2836
-
\??\c:\lfxxrrx.exec:\lfxxrrx.exe81⤵PID:2832
-
\??\c:\nhtthn.exec:\nhtthn.exe82⤵PID:2576
-
\??\c:\hbhhnt.exec:\hbhhnt.exe83⤵PID:2596
-
\??\c:\7flrxfl.exec:\7flrxfl.exe84⤵PID:1708
-
\??\c:\lllrrxl.exec:\lllrrxl.exe85⤵PID:2644
-
\??\c:\5thtbb.exec:\5thtbb.exe86⤵PID:2688
-
\??\c:\bhtnhh.exec:\bhtnhh.exe87⤵
- System Location Discovery: System Language Discovery
PID:1972 -
\??\c:\jdvvd.exec:\jdvvd.exe88⤵PID:2840
-
\??\c:\jvpjp.exec:\jvpjp.exe89⤵PID:1660
-
\??\c:\1xllrrx.exec:\1xllrrx.exe90⤵PID:1176
-
\??\c:\ttnhbb.exec:\ttnhbb.exe91⤵PID:2104
-
\??\c:\3tnntb.exec:\3tnntb.exe92⤵PID:1784
-
\??\c:\1dpvj.exec:\1dpvj.exe93⤵PID:1076
-
\??\c:\5frrrrx.exec:\5frrrrx.exe94⤵PID:356
-
\??\c:\rfxfrrf.exec:\rfxfrrf.exe95⤵PID:1388
-
\??\c:\1bntbb.exec:\1bntbb.exe96⤵PID:1348
-
\??\c:\7jvvv.exec:\7jvvv.exe97⤵PID:1480
-
\??\c:\pjvdd.exec:\pjvdd.exe98⤵PID:2556
-
\??\c:\xlfllfr.exec:\xlfllfr.exe99⤵PID:1776
-
\??\c:\nhhhnn.exec:\nhhhnn.exe100⤵PID:1848
-
\??\c:\tnbhtt.exec:\tnbhtt.exe101⤵PID:2164
-
\??\c:\dvjpd.exec:\dvjpd.exe102⤵PID:1772
-
\??\c:\llflxfl.exec:\llflxfl.exe103⤵PID:1132
-
\??\c:\hbtbtn.exec:\hbtbtn.exe104⤵PID:1796
-
\??\c:\bnbbbb.exec:\bnbbbb.exe105⤵PID:900
-
\??\c:\jdppv.exec:\jdppv.exe106⤵PID:2468
-
\??\c:\1rxxfff.exec:\1rxxfff.exe107⤵PID:764
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe108⤵
- System Location Discovery: System Language Discovery
PID:924 -
\??\c:\1nbbbb.exec:\1nbbbb.exe109⤵PID:792
-
\??\c:\9pdvv.exec:\9pdvv.exe110⤵PID:2952
-
\??\c:\pdjdj.exec:\pdjdj.exe111⤵
- System Location Discovery: System Language Discovery
PID:1144 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe112⤵PID:2108
-
\??\c:\9hnhnn.exec:\9hnhnn.exe113⤵PID:1720
-
\??\c:\nhnhnn.exec:\nhnhnn.exe114⤵PID:1056
-
\??\c:\7dvdj.exec:\7dvdj.exe115⤵PID:2296
-
\??\c:\9rfxxrx.exec:\9rfxxrx.exe116⤵PID:2068
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe117⤵PID:1920
-
\??\c:\hbntbb.exec:\hbntbb.exe118⤵PID:2032
-
\??\c:\ppddd.exec:\ppddd.exe119⤵PID:2796
-
\??\c:\vpdjj.exec:\vpdjj.exe120⤵PID:2888
-
\??\c:\3fffllr.exec:\3fffllr.exe121⤵PID:1732
-
\??\c:\hhbbnn.exec:\hhbbnn.exe122⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-