Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 05:31
Behavioral task
behavioral1
Sample
eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe
-
Size
331KB
-
MD5
ed013e150197635be29fd0555c56e745
-
SHA1
cadf784f76f07de47c0b1f7d492be773f66dcba3
-
SHA256
eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939
-
SHA512
d7517ef2925a921b2070db7a7180fc498120b6f5bc4d9d84284fc208afece1208b54bcaca19b2baf11feed48b6cc1f7512800b24dc03b6a28ff78e0a476641d1
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbem:R4wFHoSHYHUrAwfMp3CDm
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/3048-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2528-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2716-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-66-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2944-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1688-98-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2216-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-115-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1756-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/768-132-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2508-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-165-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/1980-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3068-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1236-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2072-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/304-354-0x0000000001B50000-0x0000000001B77000-memory.dmp family_blackmoon behavioral1/memory/2228-365-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/584-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/600-397-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2508-409-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2428-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-425-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2928-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-465-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3008-477-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2008-526-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2264-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-613-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1864-627-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2152-716-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2436-768-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2324-1293-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon behavioral1/memory/2324-6948-0x0000000077320000-0x000000007741A000-memory.dmp family_blackmoon behavioral1/memory/2324-24617-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon behavioral1/memory/2324-26274-0x0000000077420000-0x000000007753F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 ppjpj.exe 2528 dvpjv.exe 2544 3bhbhh.exe 2264 vvpvd.exe 2868 btbbbb.exe 2716 rlxfrrx.exe 2240 nbbnbb.exe 2944 hbnbbn.exe 2652 lfllxfr.exe 2624 xxxfxxf.exe 1688 1jvvd.exe 2216 3xfxffl.exe 1756 dvddp.exe 2968 xrllxfl.exe 768 bthntn.exe 2816 ppjpd.exe 2508 lfrrffr.exe 2428 9lrlfrr.exe 1980 bnbthb.exe 3068 nbhbnt.exe 1936 3btbhh.exe 820 vpdjp.exe 2704 hbnhtt.exe 3064 1jdjv.exe 1356 xrrrffr.exe 1312 ffrxrxl.exe 1236 ppdjv.exe 2468 bhbntb.exe 1444 ddvpd.exe 2108 llxrlrl.exe 1668 thntbt.exe 2072 dvvdv.exe 1516 rfxflrx.exe 1412 7bhnnt.exe 1736 1vdjj.exe 1280 vpdjp.exe 2348 frrxxff.exe 1608 hbhhnn.exe 2172 vjvpv.exe 2092 pjvdd.exe 2756 rrfxxrx.exe 2908 7xrlxll.exe 3004 hbbhhh.exe 2904 vdpjd.exe 2612 jdvdj.exe 1932 7xllrxx.exe 316 hhhtbb.exe 304 tttbtt.exe 2636 jjpdj.exe 2228 fxxrlfr.exe 2084 lfllrrx.exe 1084 thbntt.exe 1020 jdvvd.exe 1908 ddjpv.exe 584 ffrxfll.exe 600 5nnbbh.exe 768 tnbtbb.exe 2508 pdvpv.exe 2428 fxllrxf.exe 2896 5xffllx.exe 2928 thtttb.exe 3060 jpjdv.exe 2964 vpjvj.exe 2432 5fxrxfl.exe -
resource yara_rule behavioral1/memory/3048-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000120f9-5.dat upx behavioral1/memory/2312-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00080000000162e4-15.dat upx behavioral1/memory/2312-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2528-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000016399-24.dat upx behavioral1/files/0x00080000000164de-33.dat upx behavioral1/files/0x0008000000016689-40.dat upx behavioral1/memory/2264-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016b86-48.dat upx behavioral1/memory/2716-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016c89-59.dat upx behavioral1/memory/2716-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000016ca0-67.dat upx behavioral1/memory/2944-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000016cf0-76.dat upx behavioral1/memory/2624-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000174f8-84.dat upx behavioral1/files/0x0006000000017570-91.dat upx behavioral1/memory/1688-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000175f1-100.dat upx behavioral1/files/0x00060000000175f7-108.dat upx behavioral1/memory/2216-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000018683-118.dat upx behavioral1/memory/1756-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018697-124.dat upx behavioral1/memory/2816-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000018706-135.dat upx behavioral1/memory/768-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001870c-143.dat upx behavioral1/files/0x000500000001871c-150.dat upx behavioral1/files/0x0005000000018745-158.dat upx behavioral1/memory/2428-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015fa6-166.dat upx behavioral1/memory/3068-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1980-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018be7-177.dat upx behavioral1/memory/3068-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000018d7b-184.dat upx behavioral1/memory/820-191-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0006000000018d83-192.dat upx behavioral1/files/0x0006000000018fdf-201.dat upx behavioral1/memory/3064-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019056-209.dat upx behavioral1/memory/3064-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019203-216.dat upx behavioral1/files/0x0005000000019237-222.dat upx behavioral1/memory/1236-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001924f-229.dat upx behavioral1/files/0x0005000000019261-238.dat upx behavioral1/files/0x0005000000019274-244.dat upx behavioral1/memory/1444-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001927a-253.dat upx behavioral1/files/0x0005000000019299-260.dat upx behavioral1/memory/2072-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-283-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1280-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2612-336-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/304-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/304-353-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2312 3048 eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe 30 PID 3048 wrote to memory of 2312 3048 eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe 30 PID 3048 wrote to memory of 2312 3048 eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe 30 PID 3048 wrote to memory of 2312 3048 eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe 30 PID 2312 wrote to memory of 2528 2312 ppjpj.exe 31 PID 2312 wrote to memory of 2528 2312 ppjpj.exe 31 PID 2312 wrote to memory of 2528 2312 ppjpj.exe 31 PID 2312 wrote to memory of 2528 2312 ppjpj.exe 31 PID 2528 wrote to memory of 2544 2528 dvpjv.exe 32 PID 2528 wrote to memory of 2544 2528 dvpjv.exe 32 PID 2528 wrote to memory of 2544 2528 dvpjv.exe 32 PID 2528 wrote to memory of 2544 2528 dvpjv.exe 32 PID 2544 wrote to memory of 2264 2544 3bhbhh.exe 33 PID 2544 wrote to memory of 2264 2544 3bhbhh.exe 33 PID 2544 wrote to memory of 2264 2544 3bhbhh.exe 33 PID 2544 wrote to memory of 2264 2544 3bhbhh.exe 33 PID 2264 wrote to memory of 2868 2264 vvpvd.exe 34 PID 2264 wrote to memory of 2868 2264 vvpvd.exe 34 PID 2264 wrote to memory of 2868 2264 vvpvd.exe 34 PID 2264 wrote to memory of 2868 2264 vvpvd.exe 34 PID 2868 wrote to memory of 2716 2868 btbbbb.exe 35 PID 2868 wrote to memory of 2716 2868 btbbbb.exe 35 PID 2868 wrote to memory of 2716 2868 btbbbb.exe 35 PID 2868 wrote to memory of 2716 2868 btbbbb.exe 35 PID 2716 wrote to memory of 2240 2716 rlxfrrx.exe 36 PID 2716 wrote to memory of 2240 2716 rlxfrrx.exe 36 PID 2716 wrote to memory of 2240 2716 rlxfrrx.exe 36 PID 2716 wrote to memory of 2240 2716 rlxfrrx.exe 36 PID 2240 wrote to memory of 2944 2240 nbbnbb.exe 37 PID 2240 wrote to memory of 2944 2240 nbbnbb.exe 37 PID 2240 wrote to memory of 2944 2240 nbbnbb.exe 37 PID 2240 wrote to memory of 2944 2240 nbbnbb.exe 37 PID 2944 wrote to memory of 2652 2944 hbnbbn.exe 38 PID 2944 wrote to memory of 2652 2944 hbnbbn.exe 38 PID 2944 wrote to memory of 2652 2944 hbnbbn.exe 38 PID 2944 wrote to memory of 2652 2944 hbnbbn.exe 38 PID 2652 wrote to memory of 2624 2652 lfllxfr.exe 39 PID 2652 wrote to memory of 2624 2652 lfllxfr.exe 39 PID 2652 wrote to memory of 2624 2652 lfllxfr.exe 39 PID 2652 wrote to memory of 2624 2652 lfllxfr.exe 39 PID 2624 wrote to memory of 1688 2624 xxxfxxf.exe 40 PID 2624 wrote to memory of 1688 2624 xxxfxxf.exe 40 PID 2624 wrote to memory of 1688 2624 xxxfxxf.exe 40 PID 2624 wrote to memory of 1688 2624 xxxfxxf.exe 40 PID 1688 wrote to memory of 2216 1688 1jvvd.exe 41 PID 1688 wrote to memory of 2216 1688 1jvvd.exe 41 PID 1688 wrote to memory of 2216 1688 1jvvd.exe 41 PID 1688 wrote to memory of 2216 1688 1jvvd.exe 41 PID 2216 wrote to memory of 1756 2216 3xfxffl.exe 42 PID 2216 wrote to memory of 1756 2216 3xfxffl.exe 42 PID 2216 wrote to memory of 1756 2216 3xfxffl.exe 42 PID 2216 wrote to memory of 1756 2216 3xfxffl.exe 42 PID 1756 wrote to memory of 2968 1756 dvddp.exe 43 PID 1756 wrote to memory of 2968 1756 dvddp.exe 43 PID 1756 wrote to memory of 2968 1756 dvddp.exe 43 PID 1756 wrote to memory of 2968 1756 dvddp.exe 43 PID 2968 wrote to memory of 768 2968 xrllxfl.exe 44 PID 2968 wrote to memory of 768 2968 xrllxfl.exe 44 PID 2968 wrote to memory of 768 2968 xrllxfl.exe 44 PID 2968 wrote to memory of 768 2968 xrllxfl.exe 44 PID 768 wrote to memory of 2816 768 bthntn.exe 45 PID 768 wrote to memory of 2816 768 bthntn.exe 45 PID 768 wrote to memory of 2816 768 bthntn.exe 45 PID 768 wrote to memory of 2816 768 bthntn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe"C:\Users\Admin\AppData\Local\Temp\eb446efbef6b33ba2daca817e308bed15fd22eb61b916f3f9afcfc1f27681939.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\ppjpj.exec:\ppjpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\dvpjv.exec:\dvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\3bhbhh.exec:\3bhbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\vvpvd.exec:\vvpvd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\btbbbb.exec:\btbbbb.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\nbbnbb.exec:\nbbnbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\hbnbbn.exec:\hbnbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\lfllxfr.exec:\lfllxfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xxxfxxf.exec:\xxxfxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\1jvvd.exec:\1jvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\3xfxffl.exec:\3xfxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\dvddp.exec:\dvddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\xrllxfl.exec:\xrllxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\bthntn.exec:\bthntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\ppjpd.exec:\ppjpd.exe17⤵
- Executes dropped EXE
PID:2816 -
\??\c:\lfrrffr.exec:\lfrrffr.exe18⤵
- Executes dropped EXE
PID:2508 -
\??\c:\9lrlfrr.exec:\9lrlfrr.exe19⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bnbthb.exec:\bnbthb.exe20⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nbhbnt.exec:\nbhbnt.exe21⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3btbhh.exec:\3btbhh.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vpdjp.exec:\vpdjp.exe23⤵
- Executes dropped EXE
PID:820 -
\??\c:\hbnhtt.exec:\hbnhtt.exe24⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1jdjv.exec:\1jdjv.exe25⤵
- Executes dropped EXE
PID:3064 -
\??\c:\xrrrffr.exec:\xrrrffr.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\ffrxrxl.exec:\ffrxrxl.exe27⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ppdjv.exec:\ppdjv.exe28⤵
- Executes dropped EXE
PID:1236 -
\??\c:\bhbntb.exec:\bhbntb.exe29⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ddvpd.exec:\ddvpd.exe30⤵
- Executes dropped EXE
PID:1444 -
\??\c:\llxrlrl.exec:\llxrlrl.exe31⤵
- Executes dropped EXE
PID:2108 -
\??\c:\thntbt.exec:\thntbt.exe32⤵
- Executes dropped EXE
PID:1668 -
\??\c:\dvvdv.exec:\dvvdv.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rfxflrx.exec:\rfxflrx.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7bhnnt.exec:\7bhnnt.exe35⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1vdjj.exec:\1vdjj.exe36⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vpdjp.exec:\vpdjp.exe37⤵
- Executes dropped EXE
PID:1280 -
\??\c:\frrxxff.exec:\frrxxff.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hbhhnn.exec:\hbhhnn.exe39⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vjvpv.exec:\vjvpv.exe40⤵
- Executes dropped EXE
PID:2172 -
\??\c:\pjvdd.exec:\pjvdd.exe41⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rrfxxrx.exec:\rrfxxrx.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7xrlxll.exec:\7xrlxll.exe43⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hbbhhh.exec:\hbbhhh.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vdpjd.exec:\vdpjd.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\jdvdj.exec:\jdvdj.exe46⤵
- Executes dropped EXE
PID:2612 -
\??\c:\7xllrxx.exec:\7xllrxx.exe47⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hhhtbb.exec:\hhhtbb.exe48⤵
- Executes dropped EXE
PID:316 -
\??\c:\tttbtt.exec:\tttbtt.exe49⤵
- Executes dropped EXE
PID:304 -
\??\c:\jjpdj.exec:\jjpdj.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\fxxrlfr.exec:\fxxrlfr.exe51⤵
- Executes dropped EXE
PID:2228 -
\??\c:\lfllrrx.exec:\lfllrrx.exe52⤵
- Executes dropped EXE
PID:2084 -
\??\c:\thbntt.exec:\thbntt.exe53⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jdvvd.exec:\jdvvd.exe54⤵
- Executes dropped EXE
PID:1020 -
\??\c:\ddjpv.exec:\ddjpv.exe55⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ffrxfll.exec:\ffrxfll.exe56⤵
- Executes dropped EXE
PID:584 -
\??\c:\5nnbbh.exec:\5nnbbh.exe57⤵
- Executes dropped EXE
PID:600 -
\??\c:\tnbtbb.exec:\tnbtbb.exe58⤵
- Executes dropped EXE
PID:768 -
\??\c:\pdvpv.exec:\pdvpv.exe59⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fxllrxf.exec:\fxllrxf.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5xffllx.exec:\5xffllx.exe61⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thtttb.exec:\thtttb.exe62⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jpjdv.exec:\jpjdv.exe63⤵
- Executes dropped EXE
PID:3060 -
\??\c:\vpjvj.exec:\vpjvj.exe64⤵
- Executes dropped EXE
PID:2964 -
\??\c:\5fxrxfl.exec:\5fxrxfl.exe65⤵
- Executes dropped EXE
PID:2432 -
\??\c:\9nhntn.exec:\9nhntn.exe66⤵PID:2444
-
\??\c:\nnbthh.exec:\nnbthh.exe67⤵PID:1936
-
\??\c:\pjpdp.exec:\pjpdp.exe68⤵PID:2112
-
\??\c:\lllflrr.exec:\lllflrr.exe69⤵PID:3052
-
\??\c:\xxrflrr.exec:\xxrflrr.exe70⤵PID:956
-
\??\c:\5nbbbn.exec:\5nbbbn.exe71⤵PID:3008
-
\??\c:\jjdjj.exec:\jjdjj.exe72⤵PID:2380
-
\??\c:\lxxflrl.exec:\lxxflrl.exe73⤵PID:908
-
\??\c:\rlllxxl.exec:\rlllxxl.exe74⤵PID:1300
-
\??\c:\nhtttt.exec:\nhtttt.exe75⤵PID:2268
-
\??\c:\bbnnnh.exec:\bbnnnh.exe76⤵PID:2468
-
\??\c:\jvvpv.exec:\jvvpv.exe77⤵PID:2304
-
\??\c:\rfllxxl.exec:\rfllxxl.exe78⤵PID:2108
-
\??\c:\lfrflll.exec:\lfrflll.exe79⤵PID:2140
-
\??\c:\hbthtb.exec:\hbthtb.exe80⤵PID:848
-
\??\c:\7jvvp.exec:\7jvvp.exe81⤵PID:2008
-
\??\c:\jdpvv.exec:\jdpvv.exe82⤵PID:896
-
\??\c:\xrflrxx.exec:\xrflrxx.exe83⤵PID:1412
-
\??\c:\5fxlrxf.exec:\5fxlrxf.exe84⤵PID:1736
-
\??\c:\nnbhnn.exec:\nnbhnn.exe85⤵PID:1280
-
\??\c:\pjjjp.exec:\pjjjp.exe86⤵PID:2340
-
\??\c:\3pdvv.exec:\3pdvv.exe87⤵PID:1624
-
\??\c:\frxrxrx.exec:\frxrxrx.exe88⤵PID:2700
-
\??\c:\7rfrrrr.exec:\7rfrrrr.exe89⤵PID:2264
-
\??\c:\nntnnh.exec:\nntnnh.exe90⤵PID:2864
-
\??\c:\3ppdj.exec:\3ppdj.exe91⤵PID:2856
-
\??\c:\5dpvd.exec:\5dpvd.exe92⤵PID:2716
-
\??\c:\7lflxfr.exec:\7lflxfr.exe93⤵PID:2740
-
\??\c:\3rllrxx.exec:\3rllrxx.exe94⤵PID:2992
-
\??\c:\tnhnbh.exec:\tnhnbh.exe95⤵PID:2944
-
\??\c:\btbhnn.exec:\btbhnn.exe96⤵PID:2608
-
\??\c:\7vjpd.exec:\7vjpd.exe97⤵PID:2772
-
\??\c:\1ffrrxx.exec:\1ffrrxx.exe98⤵PID:2728
-
\??\c:\bnhbtb.exec:\bnhbtb.exe99⤵PID:1864
-
\??\c:\1nnntn.exec:\1nnntn.exe100⤵PID:1876
-
\??\c:\ppvvp.exec:\ppvvp.exe101⤵PID:1084
-
\??\c:\xrflxfx.exec:\xrflxfx.exe102⤵PID:1020
-
\??\c:\lffrxxl.exec:\lffrxxl.exe103⤵PID:2020
-
\??\c:\5bnntb.exec:\5bnntb.exe104⤵PID:1488
-
\??\c:\3dvpv.exec:\3dvpv.exe105⤵PID:600
-
\??\c:\dvjjv.exec:\dvjjv.exe106⤵PID:768
-
\??\c:\ffflrxl.exec:\ffflrxl.exe107⤵PID:2508
-
\??\c:\xrflrrx.exec:\xrflrrx.exe108⤵PID:1868
-
\??\c:\nhtntt.exec:\nhtntt.exe109⤵PID:1664
-
\??\c:\vjvdj.exec:\vjvdj.exe110⤵PID:2932
-
\??\c:\jvpdj.exec:\jvpdj.exe111⤵PID:1980
-
\??\c:\rxlxfrr.exec:\rxlxfrr.exe112⤵PID:2696
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe113⤵PID:2064
-
\??\c:\9bthbb.exec:\9bthbb.exe114⤵PID:2432
-
\??\c:\3tbnnt.exec:\3tbnnt.exe115⤵PID:2444
-
\??\c:\vpjjj.exec:\vpjjj.exe116⤵PID:2152
-
\??\c:\rfxlxfx.exec:\rfxlxfx.exe117⤵PID:644
-
\??\c:\xxxlfrf.exec:\xxxlfrf.exe118⤵PID:2184
-
\??\c:\bthnbb.exec:\bthnbb.exe119⤵PID:1356
-
\??\c:\7pvvj.exec:\7pvvj.exe120⤵PID:1240
-
\??\c:\1jpjd.exec:\1jpjd.exe121⤵PID:2368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-