Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 04:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe
-
Size
455KB
-
MD5
e6908c9f107427a7e0a6aa2e79cad010
-
SHA1
5276a691b73cbd28c38ec32151d2eb790d95aa5d
-
SHA256
cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81
-
SHA512
6b7406d1d59c238976c10a36525d096674e498d1e987d078dbd552f9dbe6b71e76663f0dc1d1d2de3f548978e55bcbb3a76c308d0a689196a36ee3511c3c222a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT0:q7Tc2NYHUrAwfMp3CDQ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2460-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-33-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-143-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/336-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/328-202-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/328-201-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1692-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-273-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2448-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-482-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-531-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2744-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-608-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2252-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-620-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-744-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/696-760-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/696-761-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-775-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/1808-777-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-827-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2024-829-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2548-898-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-948-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1372-1004-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-1128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2084-1204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-1258-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2460 lfflrrf.exe 1484 5jvvv.exe 2088 dvpvj.exe 2764 flrlxrl.exe 2912 dddvj.exe 2704 llxxflx.exe 3056 9ddvj.exe 2536 rlfflrr.exe 2616 jjjpd.exe 2232 lxrfxfl.exe 612 dvjjv.exe 1940 1rrflrf.exe 2352 tthhnh.exe 1792 dvpvj.exe 1688 9flxxfr.exe 336 tthnbh.exe 2612 1pvjd.exe 2888 bbhhtt.exe 2180 hbbbnn.exe 2396 lflrxfr.exe 2992 7bnbht.exe 328 1dpvj.exe 1692 lxxxrrx.exe 840 tnnthn.exe 960 nhbhnt.exe 1536 5jvdj.exe 1800 5rlxlrr.exe 1932 7thhbh.exe 2220 ffxffff.exe 2224 ppdpd.exe 1756 9fxfrxl.exe 2328 hbnbtb.exe 1668 1rlxllr.exe 2448 5htbhn.exe 2796 jjvdd.exe 2692 pdvpv.exe 2744 5ffllxf.exe 2700 ttnbth.exe 2252 vvdjp.exe 2212 pjvdp.exe 1988 rfffllf.exe 2584 bbbntb.exe 2548 tnhnbh.exe 2540 vpdjv.exe 2380 5llrrfl.exe 904 7llfrxf.exe 1652 9httbb.exe 2840 dpdpp.exe 1300 7rxxxfl.exe 692 lfrlxfr.exe 1448 hbthtb.exe 884 jvjvp.exe 1144 pjpvd.exe 2732 7llrlrl.exe 2392 bthhnt.exe 2244 jvpdp.exe 1624 jdjjv.exe 2264 rrrlrxr.exe 2396 hbbnbh.exe 1936 bbthbb.exe 1584 vpddd.exe 1736 9xlllfl.exe 2172 9btbhh.exe 1524 btnnbh.exe -
resource yara_rule behavioral1/memory/3040-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-33-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-273-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1668-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-482-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-531-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2072-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-685-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-744-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/696-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-777-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-827-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2448-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-891-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-1078-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-1103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-1141-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2712-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-1179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-1204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-1217-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2460 3040 cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe 31 PID 3040 wrote to memory of 2460 3040 cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe 31 PID 3040 wrote to memory of 2460 3040 cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe 31 PID 3040 wrote to memory of 2460 3040 cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe 31 PID 2460 wrote to memory of 1484 2460 lfflrrf.exe 32 PID 2460 wrote to memory of 1484 2460 lfflrrf.exe 32 PID 2460 wrote to memory of 1484 2460 lfflrrf.exe 32 PID 2460 wrote to memory of 1484 2460 lfflrrf.exe 32 PID 1484 wrote to memory of 2088 1484 5jvvv.exe 33 PID 1484 wrote to memory of 2088 1484 5jvvv.exe 33 PID 1484 wrote to memory of 2088 1484 5jvvv.exe 33 PID 1484 wrote to memory of 2088 1484 5jvvv.exe 33 PID 2088 wrote to memory of 2764 2088 dvpvj.exe 34 PID 2088 wrote to memory of 2764 2088 dvpvj.exe 34 PID 2088 wrote to memory of 2764 2088 dvpvj.exe 34 PID 2088 wrote to memory of 2764 2088 dvpvj.exe 34 PID 2764 wrote to memory of 2912 2764 flrlxrl.exe 35 PID 2764 wrote to memory of 2912 2764 flrlxrl.exe 35 PID 2764 wrote to memory of 2912 2764 flrlxrl.exe 35 PID 2764 wrote to memory of 2912 2764 flrlxrl.exe 35 PID 2912 wrote to memory of 2704 2912 dddvj.exe 36 PID 2912 wrote to memory of 2704 2912 dddvj.exe 36 PID 2912 wrote to memory of 2704 2912 dddvj.exe 36 PID 2912 wrote to memory of 2704 2912 dddvj.exe 36 PID 2704 wrote to memory of 3056 2704 llxxflx.exe 37 PID 2704 wrote to memory of 3056 2704 llxxflx.exe 37 PID 2704 wrote to memory of 3056 2704 llxxflx.exe 37 PID 2704 wrote to memory of 3056 2704 llxxflx.exe 37 PID 3056 wrote to memory of 2536 3056 9ddvj.exe 38 PID 3056 wrote to memory of 2536 3056 9ddvj.exe 38 PID 3056 wrote to memory of 2536 3056 9ddvj.exe 38 PID 3056 wrote to memory of 2536 3056 9ddvj.exe 38 PID 2536 wrote to memory of 2616 2536 rlfflrr.exe 39 PID 2536 wrote to memory of 2616 2536 rlfflrr.exe 39 PID 2536 wrote to memory of 2616 2536 rlfflrr.exe 39 PID 2536 wrote to memory of 2616 2536 rlfflrr.exe 39 PID 2616 wrote to memory of 2232 2616 jjjpd.exe 40 PID 2616 wrote to memory of 2232 2616 jjjpd.exe 40 PID 2616 wrote to memory of 2232 2616 jjjpd.exe 40 PID 2616 wrote to memory of 2232 2616 jjjpd.exe 40 PID 2232 wrote to memory of 612 2232 lxrfxfl.exe 41 PID 2232 wrote to memory of 612 2232 lxrfxfl.exe 41 PID 2232 wrote to memory of 612 2232 lxrfxfl.exe 41 PID 2232 wrote to memory of 612 2232 lxrfxfl.exe 41 PID 612 wrote to memory of 1940 612 dvjjv.exe 42 PID 612 wrote to memory of 1940 612 dvjjv.exe 42 PID 612 wrote to memory of 1940 612 dvjjv.exe 42 PID 612 wrote to memory of 1940 612 dvjjv.exe 42 PID 1940 wrote to memory of 2352 1940 1rrflrf.exe 43 PID 1940 wrote to memory of 2352 1940 1rrflrf.exe 43 PID 1940 wrote to memory of 2352 1940 1rrflrf.exe 43 PID 1940 wrote to memory of 2352 1940 1rrflrf.exe 43 PID 2352 wrote to memory of 1792 2352 tthhnh.exe 44 PID 2352 wrote to memory of 1792 2352 tthhnh.exe 44 PID 2352 wrote to memory of 1792 2352 tthhnh.exe 44 PID 2352 wrote to memory of 1792 2352 tthhnh.exe 44 PID 1792 wrote to memory of 1688 1792 dvpvj.exe 45 PID 1792 wrote to memory of 1688 1792 dvpvj.exe 45 PID 1792 wrote to memory of 1688 1792 dvpvj.exe 45 PID 1792 wrote to memory of 1688 1792 dvpvj.exe 45 PID 1688 wrote to memory of 336 1688 9flxxfr.exe 46 PID 1688 wrote to memory of 336 1688 9flxxfr.exe 46 PID 1688 wrote to memory of 336 1688 9flxxfr.exe 46 PID 1688 wrote to memory of 336 1688 9flxxfr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe"C:\Users\Admin\AppData\Local\Temp\cbf5ea73c141804490cb9107259970112a10493f9993b866657b7d69b5f4da81.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\lfflrrf.exec:\lfflrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\5jvvv.exec:\5jvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\dvpvj.exec:\dvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\flrlxrl.exec:\flrlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dddvj.exec:\dddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\llxxflx.exec:\llxxflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\9ddvj.exec:\9ddvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\rlfflrr.exec:\rlfflrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jjjpd.exec:\jjjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\lxrfxfl.exec:\lxrfxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvjjv.exec:\dvjjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\1rrflrf.exec:\1rrflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\tthhnh.exec:\tthhnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dvpvj.exec:\dvpvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\9flxxfr.exec:\9flxxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\tthnbh.exec:\tthnbh.exe17⤵
- Executes dropped EXE
PID:336 -
\??\c:\1pvjd.exec:\1pvjd.exe18⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bbhhtt.exec:\bbhhtt.exe19⤵
- Executes dropped EXE
PID:2888 -
\??\c:\hbbbnn.exec:\hbbbnn.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lflrxfr.exec:\lflrxfr.exe21⤵
- Executes dropped EXE
PID:2396 -
\??\c:\7bnbht.exec:\7bnbht.exe22⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1dpvj.exec:\1dpvj.exe23⤵
- Executes dropped EXE
PID:328 -
\??\c:\lxxxrrx.exec:\lxxxrrx.exe24⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tnnthn.exec:\tnnthn.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\nhbhnt.exec:\nhbhnt.exe26⤵
- Executes dropped EXE
PID:960 -
\??\c:\5jvdj.exec:\5jvdj.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\5rlxlrr.exec:\5rlxlrr.exe28⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7thhbh.exec:\7thhbh.exe29⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ffxffff.exec:\ffxffff.exe30⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ppdpd.exec:\ppdpd.exe31⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9fxfrxl.exec:\9fxfrxl.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\hbnbtb.exec:\hbnbtb.exe33⤵
- Executes dropped EXE
PID:2328 -
\??\c:\1rlxllr.exec:\1rlxllr.exe34⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5htbhn.exec:\5htbhn.exe35⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jjvdd.exec:\jjvdd.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pdvpv.exec:\pdvpv.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5ffllxf.exec:\5ffllxf.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\ttnbth.exec:\ttnbth.exe39⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vvdjp.exec:\vvdjp.exe40⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pjvdp.exec:\pjvdp.exe41⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rfffllf.exec:\rfffllf.exe42⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbbntb.exec:\bbbntb.exe43⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tnhnbh.exec:\tnhnbh.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpdjv.exec:\vpdjv.exe45⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5llrrfl.exec:\5llrrfl.exe46⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7llfrxf.exec:\7llfrxf.exe47⤵
- Executes dropped EXE
PID:904 -
\??\c:\9httbb.exec:\9httbb.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\dpdpp.exec:\dpdpp.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\7rxxxfl.exec:\7rxxxfl.exe50⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe51⤵
- Executes dropped EXE
PID:692 -
\??\c:\hbthtb.exec:\hbthtb.exe52⤵
- Executes dropped EXE
PID:1448 -
\??\c:\jvjvp.exec:\jvjvp.exe53⤵
- Executes dropped EXE
PID:884 -
\??\c:\pjpvd.exec:\pjpvd.exe54⤵
- Executes dropped EXE
PID:1144 -
\??\c:\7llrlrl.exec:\7llrlrl.exe55⤵
- Executes dropped EXE
PID:2732 -
\??\c:\bthhnt.exec:\bthhnt.exe56⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jvpdp.exec:\jvpdp.exe57⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jdjjv.exec:\jdjjv.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\rrrlrxr.exec:\rrrlrxr.exe59⤵
- Executes dropped EXE
PID:2264 -
\??\c:\hbbnbh.exec:\hbbnbh.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bbthbb.exec:\bbthbb.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vpddd.exec:\vpddd.exe62⤵
- Executes dropped EXE
PID:1584 -
\??\c:\9xlllfl.exec:\9xlllfl.exe63⤵
- Executes dropped EXE
PID:1736 -
\??\c:\9btbhh.exec:\9btbhh.exe64⤵
- Executes dropped EXE
PID:2172 -
\??\c:\btnnbh.exec:\btnnbh.exe65⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3pjpv.exec:\3pjpv.exe66⤵PID:960
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe67⤵PID:1808
-
\??\c:\3rflrxl.exec:\3rflrxl.exe68⤵PID:2016
-
\??\c:\nbnnhh.exec:\nbnnhh.exe69⤵PID:1740
-
\??\c:\pdddj.exec:\pdddj.exe70⤵PID:2140
-
\??\c:\lxxfrrx.exec:\lxxfrrx.exe71⤵PID:1160
-
\??\c:\3rxxflr.exec:\3rxxflr.exe72⤵PID:1004
-
\??\c:\9nhnhb.exec:\9nhnhb.exe73⤵PID:2076
-
\??\c:\7pdjp.exec:\7pdjp.exe74⤵PID:1756
-
\??\c:\ffrlflf.exec:\ffrlflf.exe75⤵PID:2036
-
\??\c:\5rlxffr.exec:\5rlxffr.exe76⤵PID:2072
-
\??\c:\tttbhn.exec:\tttbhn.exe77⤵PID:1592
-
\??\c:\ddpvj.exec:\ddpvj.exe78⤵
- System Location Discovery: System Language Discovery
PID:2276 -
\??\c:\9dpvd.exec:\9dpvd.exe79⤵PID:1484
-
\??\c:\xrlrxrf.exec:\xrlrxrf.exe80⤵PID:2692
-
\??\c:\bntbnn.exec:\bntbnn.exe81⤵PID:2744
-
\??\c:\3tnttt.exec:\3tnttt.exe82⤵PID:2700
-
\??\c:\9pvvd.exec:\9pvvd.exe83⤵PID:2252
-
\??\c:\7lxxxfl.exec:\7lxxxfl.exe84⤵PID:2704
-
\??\c:\rllllrx.exec:\rllllrx.exe85⤵PID:2656
-
\??\c:\tnhhnt.exec:\tnhhnt.exe86⤵PID:2608
-
\??\c:\jdpvj.exec:\jdpvj.exe87⤵PID:3016
-
\??\c:\xrxxlxf.exec:\xrxxlxf.exe88⤵PID:3020
-
\??\c:\rrlrflf.exec:\rrlrflf.exe89⤵PID:1644
-
\??\c:\bbnbtt.exec:\bbnbtt.exe90⤵PID:1200
-
\??\c:\dddjj.exec:\dddjj.exe91⤵PID:672
-
\??\c:\rfxfxxr.exec:\rfxfxxr.exe92⤵PID:2064
-
\??\c:\ffxlrrl.exec:\ffxlrrl.exe93⤵PID:1788
-
\??\c:\hhtbnn.exec:\hhtbnn.exe94⤵PID:692
-
\??\c:\pdvdp.exec:\pdvdp.exe95⤵PID:1268
-
\??\c:\pjvjv.exec:\pjvjv.exe96⤵PID:884
-
\??\c:\rlfrflr.exec:\rlfrflr.exe97⤵PID:2644
-
\??\c:\bbhbhn.exec:\bbhbhn.exe98⤵PID:2116
-
\??\c:\ppjpd.exec:\ppjpd.exe99⤵PID:2120
-
\??\c:\jdvvd.exec:\jdvvd.exe100⤵PID:1132
-
\??\c:\lfllxxf.exec:\lfllxxf.exe101⤵PID:2516
-
\??\c:\tthnbb.exec:\tthnbb.exe102⤵PID:1672
-
\??\c:\1tnnbb.exec:\1tnnbb.exe103⤵PID:964
-
\??\c:\pjjpd.exec:\pjjpd.exe104⤵PID:764
-
\??\c:\pjvpd.exec:\pjvpd.exe105⤵PID:1584
-
\??\c:\lrfrxfr.exec:\lrfrxfr.exe106⤵PID:1704
-
\??\c:\5hnnth.exec:\5hnnth.exe107⤵PID:696
-
\??\c:\vvjpv.exec:\vvjpv.exe108⤵PID:2304
-
\??\c:\jdpvd.exec:\jdpvd.exe109⤵PID:960
-
\??\c:\ffllxxx.exec:\ffllxxx.exe110⤵PID:1808
-
\??\c:\ntbnnn.exec:\ntbnnn.exe111⤵PID:2472
-
\??\c:\bttbnh.exec:\bttbnh.exe112⤵PID:988
-
\??\c:\jdjjp.exec:\jdjjp.exe113⤵PID:1856
-
\??\c:\3rffflr.exec:\3rffflr.exe114⤵PID:892
-
\??\c:\llrlxrf.exec:\llrlxrf.exe115⤵PID:2884
-
\??\c:\bbntbh.exec:\bbntbh.exe116⤵PID:3040
-
\??\c:\dvjjv.exec:\dvjjv.exe117⤵PID:2024
-
\??\c:\9djpd.exec:\9djpd.exe118⤵PID:2460
-
\??\c:\rrfrllx.exec:\rrfrllx.exe119⤵PID:2448
-
\??\c:\btbhnt.exec:\btbhnt.exe120⤵PID:2684
-
\??\c:\tnttnn.exec:\tnttnn.exe121⤵PID:2756
-
\??\c:\vpdjp.exec:\vpdjp.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-