Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 06:28
Behavioral task
behavioral1
Sample
92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
120 seconds
General
-
Target
92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe
-
Size
3.7MB
-
MD5
bcb7fbe544a5cb5cce83b81a3387fa51
-
SHA1
fdb957330a0ceece59d7b9d493a568eeed95a178
-
SHA256
92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b
-
SHA512
3c44b0ff6a207f9bb325d59b13e2e8891a34ef6619c647a49edf2bc673ca2d55ce0af87df615d429a83edd6543d249ecf3a8ff89ca6e5c81bc99cc7b10e156cc
-
SSDEEP
49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98P:U6XLq/qPPslzKx/dJg1ErmNY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2600-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1628-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2084-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2840-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1664-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2128-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2288-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1832-239-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2524-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1676-431-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2072-446-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/856-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2260-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-546-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-585-0x00000000003D0000-0x00000000003F7000-memory.dmp family_blackmoon behavioral1/memory/2928-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-619-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1720-646-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-698-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2352-711-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1864-758-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2264-784-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2184-785-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-910-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2696-960-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2540-1018-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1800-1083-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2156-1138-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon -
Njrat family
-
Executes dropped EXE 64 IoCs
pid Process 1628 nhntbb.exe 2084 3pddd.exe 2508 ddpdp.exe 2888 ttbhhn.exe 2800 7xllrrr.exe 2840 ntnbnt.exe 2844 frrrlff.exe 2812 5lxxrxl.exe 2648 lflxflr.exe 2056 xfxlxff.exe 2000 jdpjv.exe 2744 vjppp.exe 1336 9rflxfr.exe 1664 7jvvd.exe 2984 5vjjv.exe 264 pdvdd.exe 1948 pjdpp.exe 2128 thtthh.exe 2068 nnbnbt.exe 1864 7ttntb.exe 2136 9lxxllr.exe 2232 rlxlrfl.exe 2288 rfxxfrl.exe 1544 lxflxxx.exe 2264 xrfrffr.exe 1832 btnbtb.exe 900 bthttb.exe 2524 pjddd.exe 1756 bnnnnb.exe 1700 dvjjp.exe 1704 vjddd.exe 1668 5tbtbt.exe 1952 7nbbnn.exe 1612 hbnntt.exe 1816 5rlrrrr.exe 3024 bbbbnb.exe 2596 lffxlfl.exe 2772 9rxxffx.exe 2796 llfffll.exe 2868 vvvvj.exe 2468 dvvvd.exe 2936 tbthnh.exe 2808 lfxxfll.exe 2632 rfxlfxx.exe 2640 vvppp.exe 1984 9vjdp.exe 2624 btnthb.exe 1508 xrlfllx.exe 976 flxlrfr.exe 2848 vvjpv.exe 2992 7btttt.exe 2124 htnhnn.exe 264 rrlfflr.exe 1676 3jjpj.exe 2060 bthntt.exe 2052 hbbbnt.exe 2072 7lxfflr.exe 1864 pjvvd.exe 2400 hbnnth.exe 1708 rrlrrfr.exe 3064 dddvd.exe 1364 hnnhnh.exe 672 7bhttt.exe 1880 xrrrxfl.exe -
resource yara_rule behavioral1/memory/2600-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000e000000012261-8.dat upx behavioral1/memory/2600-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000019273-19.dat upx behavioral1/memory/1628-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000192f0-27.dat upx behavioral1/memory/2084-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001933e-34.dat upx behavioral1/memory/2888-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019346-43.dat upx behavioral1/memory/2840-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000019384-55.dat upx behavioral1/memory/2800-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193af-64.dat upx behavioral1/memory/2840-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000019234-70.dat upx behavioral1/memory/2812-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2648-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a325-80.dat upx behavioral1/files/0x000500000001a41a-89.dat upx behavioral1/files/0x000500000001a41b-101.dat upx behavioral1/memory/2056-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2744-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41c-109.dat upx behavioral1/files/0x000500000001a41d-118.dat upx behavioral1/memory/1664-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a41e-126.dat upx behavioral1/files/0x000500000001a455-135.dat upx behavioral1/files/0x000500000001a477-144.dat upx behavioral1/memory/264-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/264-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a478-152.dat upx behavioral1/files/0x000500000001a486-162.dat upx behavioral1/memory/1948-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a48a-169.dat upx behavioral1/memory/2128-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a497-179.dat upx behavioral1/memory/2068-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4a0-186.dat upx behavioral1/files/0x000500000001a4a2-196.dat upx behavioral1/files/0x000500000001a4a8-203.dat upx behavioral1/memory/2136-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4aa-213.dat upx behavioral1/memory/2264-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4ac-223.dat upx behavioral1/memory/1544-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2288-211-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4af-232.dat upx behavioral1/files/0x000500000001a4b1-241.dat upx behavioral1/files/0x000500000001a4b3-250.dat upx behavioral1/files/0x000500000001a4b5-259.dat upx behavioral1/memory/2524-257-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4b7-267.dat upx behavioral1/files/0x000500000001a4b9-276.dat upx behavioral1/memory/1700-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001a4bb-284.dat upx behavioral1/memory/2772-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-351-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/1984-371-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1508-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-397-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-404-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrxx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 1628 2600 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 2600 wrote to memory of 1628 2600 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 2600 wrote to memory of 1628 2600 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 2600 wrote to memory of 1628 2600 92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe 30 PID 1628 wrote to memory of 2084 1628 nhntbb.exe 31 PID 1628 wrote to memory of 2084 1628 nhntbb.exe 31 PID 1628 wrote to memory of 2084 1628 nhntbb.exe 31 PID 1628 wrote to memory of 2084 1628 nhntbb.exe 31 PID 2084 wrote to memory of 2508 2084 3pddd.exe 32 PID 2084 wrote to memory of 2508 2084 3pddd.exe 32 PID 2084 wrote to memory of 2508 2084 3pddd.exe 32 PID 2084 wrote to memory of 2508 2084 3pddd.exe 32 PID 2508 wrote to memory of 2888 2508 ddpdp.exe 33 PID 2508 wrote to memory of 2888 2508 ddpdp.exe 33 PID 2508 wrote to memory of 2888 2508 ddpdp.exe 33 PID 2508 wrote to memory of 2888 2508 ddpdp.exe 33 PID 2888 wrote to memory of 2800 2888 ttbhhn.exe 34 PID 2888 wrote to memory of 2800 2888 ttbhhn.exe 34 PID 2888 wrote to memory of 2800 2888 ttbhhn.exe 34 PID 2888 wrote to memory of 2800 2888 ttbhhn.exe 34 PID 2800 wrote to memory of 2840 2800 7xllrrr.exe 35 PID 2800 wrote to memory of 2840 2800 7xllrrr.exe 35 PID 2800 wrote to memory of 2840 2800 7xllrrr.exe 35 PID 2800 wrote to memory of 2840 2800 7xllrrr.exe 35 PID 2840 wrote to memory of 2844 2840 ntnbnt.exe 112 PID 2840 wrote to memory of 2844 2840 ntnbnt.exe 112 PID 2840 wrote to memory of 2844 2840 ntnbnt.exe 112 PID 2840 wrote to memory of 2844 2840 ntnbnt.exe 112 PID 2844 wrote to memory of 2812 2844 frrrlff.exe 37 PID 2844 wrote to memory of 2812 2844 frrrlff.exe 37 PID 2844 wrote to memory of 2812 2844 frrrlff.exe 37 PID 2844 wrote to memory of 2812 2844 frrrlff.exe 37 PID 2812 wrote to memory of 2648 2812 5lxxrxl.exe 115 PID 2812 wrote to memory of 2648 2812 5lxxrxl.exe 115 PID 2812 wrote to memory of 2648 2812 5lxxrxl.exe 115 PID 2812 wrote to memory of 2648 2812 5lxxrxl.exe 115 PID 2648 wrote to memory of 2056 2648 lflxflr.exe 39 PID 2648 wrote to memory of 2056 2648 lflxflr.exe 39 PID 2648 wrote to memory of 2056 2648 lflxflr.exe 39 PID 2648 wrote to memory of 2056 2648 lflxflr.exe 39 PID 2056 wrote to memory of 2000 2056 xfxlxff.exe 40 PID 2056 wrote to memory of 2000 2056 xfxlxff.exe 40 PID 2056 wrote to memory of 2000 2056 xfxlxff.exe 40 PID 2056 wrote to memory of 2000 2056 xfxlxff.exe 40 PID 2000 wrote to memory of 2744 2000 jdpjv.exe 41 PID 2000 wrote to memory of 2744 2000 jdpjv.exe 41 PID 2000 wrote to memory of 2744 2000 jdpjv.exe 41 PID 2000 wrote to memory of 2744 2000 jdpjv.exe 41 PID 2744 wrote to memory of 1336 2744 vjppp.exe 42 PID 2744 wrote to memory of 1336 2744 vjppp.exe 42 PID 2744 wrote to memory of 1336 2744 vjppp.exe 42 PID 2744 wrote to memory of 1336 2744 vjppp.exe 42 PID 1336 wrote to memory of 1664 1336 9rflxfr.exe 43 PID 1336 wrote to memory of 1664 1336 9rflxfr.exe 43 PID 1336 wrote to memory of 1664 1336 9rflxfr.exe 43 PID 1336 wrote to memory of 1664 1336 9rflxfr.exe 43 PID 1664 wrote to memory of 2984 1664 7jvvd.exe 122 PID 1664 wrote to memory of 2984 1664 7jvvd.exe 122 PID 1664 wrote to memory of 2984 1664 7jvvd.exe 122 PID 1664 wrote to memory of 2984 1664 7jvvd.exe 122 PID 2984 wrote to memory of 264 2984 5vjjv.exe 82 PID 2984 wrote to memory of 264 2984 5vjjv.exe 82 PID 2984 wrote to memory of 264 2984 5vjjv.exe 82 PID 2984 wrote to memory of 264 2984 5vjjv.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe"C:\Users\Admin\AppData\Local\Temp\92152ddcad49daba8d7344aed4dba33eb07844bd02f7bd78f691e7d0615b863b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nhntbb.exec:\nhntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\3pddd.exec:\3pddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\ddpdp.exec:\ddpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\ttbhhn.exec:\ttbhhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\7xllrrr.exec:\7xllrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\ntnbnt.exec:\ntnbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\frrrlff.exec:\frrrlff.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5lxxrxl.exec:\5lxxrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\lflxflr.exec:\lflxflr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xfxlxff.exec:\xfxlxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\jdpjv.exec:\jdpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\vjppp.exec:\vjppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9rflxfr.exec:\9rflxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\7jvvd.exec:\7jvvd.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\5vjjv.exec:\5vjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pdvdd.exec:\pdvdd.exe17⤵
- Executes dropped EXE
PID:264 -
\??\c:\pjdpp.exec:\pjdpp.exe18⤵
- Executes dropped EXE
PID:1948 -
\??\c:\thtthh.exec:\thtthh.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnbnbt.exec:\nnbnbt.exe20⤵
- Executes dropped EXE
PID:2068 -
\??\c:\7ttntb.exec:\7ttntb.exe21⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9lxxllr.exec:\9lxxllr.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rlxlrfl.exec:\rlxlrfl.exe23⤵
- Executes dropped EXE
PID:2232 -
\??\c:\rfxxfrl.exec:\rfxxfrl.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\lxflxxx.exec:\lxflxxx.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xrfrffr.exec:\xrfrffr.exe26⤵
- Executes dropped EXE
PID:2264 -
\??\c:\btnbtb.exec:\btnbtb.exe27⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bthttb.exec:\bthttb.exe28⤵
- Executes dropped EXE
PID:900 -
\??\c:\pjddd.exec:\pjddd.exe29⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bnnnnb.exec:\bnnnnb.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dvjjp.exec:\dvjjp.exe31⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vjddd.exec:\vjddd.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\5tbtbt.exec:\5tbtbt.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\7nbbnn.exec:\7nbbnn.exe34⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hbnntt.exec:\hbnntt.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5rlrrrr.exec:\5rlrrrr.exe36⤵
- Executes dropped EXE
PID:1816 -
\??\c:\bbbbnb.exec:\bbbbnb.exe37⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lffxlfl.exec:\lffxlfl.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9rxxffx.exec:\9rxxffx.exe39⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llfffll.exec:\llfffll.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\vvvvj.exec:\vvvvj.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dvvvd.exec:\dvvvd.exe42⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tbthnh.exec:\tbthnh.exe43⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lfxxfll.exec:\lfxxfll.exe44⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rfxlfxx.exec:\rfxlfxx.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vvppp.exec:\vvppp.exe46⤵
- Executes dropped EXE
PID:2640 -
\??\c:\9vjdp.exec:\9vjdp.exe47⤵
- Executes dropped EXE
PID:1984 -
\??\c:\btnthb.exec:\btnthb.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\xrlfllx.exec:\xrlfllx.exe49⤵
- Executes dropped EXE
PID:1508 -
\??\c:\flxlrfr.exec:\flxlrfr.exe50⤵
- Executes dropped EXE
PID:976 -
\??\c:\vvjpv.exec:\vvjpv.exe51⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7btttt.exec:\7btttt.exe52⤵
- Executes dropped EXE
PID:2992 -
\??\c:\htnhnn.exec:\htnhnn.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rrlfflr.exec:\rrlfflr.exe54⤵
- Executes dropped EXE
PID:264 -
\??\c:\3jjpj.exec:\3jjpj.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\bthntt.exec:\bthntt.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbbbnt.exec:\hbbbnt.exe57⤵
- Executes dropped EXE
PID:2052 -
\??\c:\7lxfflr.exec:\7lxfflr.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\pjvvd.exec:\pjvvd.exe59⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hbnnth.exec:\hbnnth.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrlrrfr.exec:\rrlrrfr.exe61⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dddvd.exec:\dddvd.exe62⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hnnhnh.exec:\hnnhnh.exe63⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7bhttt.exec:\7bhttt.exe64⤵
- Executes dropped EXE
PID:672 -
\??\c:\xrrrxfl.exec:\xrrrxfl.exe65⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1pvvd.exec:\1pvvd.exe66⤵PID:2264
-
\??\c:\vvvjv.exec:\vvvjv.exe67⤵PID:856
-
\??\c:\7tbbbh.exec:\7tbbbh.exe68⤵PID:2260
-
\??\c:\lxrrxfx.exec:\lxrrxfx.exe69⤵
- System Location Discovery: System Language Discovery
PID:608 -
\??\c:\jdvvd.exec:\jdvvd.exe70⤵PID:2168
-
\??\c:\5tntbb.exec:\5tntbb.exe71⤵PID:2552
-
\??\c:\rlrxflr.exec:\rlrxflr.exe72⤵PID:1672
-
\??\c:\1ddvv.exec:\1ddvv.exe73⤵PID:2608
-
\??\c:\vvdpd.exec:\vvdpd.exe74⤵PID:1624
-
\??\c:\bbhbnn.exec:\bbhbnn.exe75⤵PID:340
-
\??\c:\1fxxflr.exec:\1fxxflr.exe76⤵PID:2612
-
\??\c:\jjjpv.exec:\jjjpv.exe77⤵PID:2272
-
\??\c:\ntttbb.exec:\ntttbb.exe78⤵PID:2904
-
\??\c:\7tbntb.exec:\7tbntb.exe79⤵PID:2876
-
\??\c:\btbntt.exec:\btbntt.exe80⤵PID:2796
-
\??\c:\5llrxfl.exec:\5llrxfl.exe81⤵PID:2948
-
\??\c:\jjjvj.exec:\jjjvj.exe82⤵PID:2928
-
\??\c:\nbntbh.exec:\nbntbh.exe83⤵PID:2844
-
\??\c:\lfrxxff.exec:\lfrxxff.exe84⤵
- System Location Discovery: System Language Discovery
PID:1996 -
\??\c:\9vjjv.exec:\9vjjv.exe85⤵PID:3016
-
\??\c:\pvjpp.exec:\pvjpp.exe86⤵PID:2648
-
\??\c:\ntnnbb.exec:\ntnnbb.exe87⤵PID:1164
-
\??\c:\lfllllr.exec:\lfllllr.exe88⤵PID:1720
-
\??\c:\5jdvp.exec:\5jdvp.exe89⤵PID:2268
-
\??\c:\tnntnn.exec:\tnntnn.exe90⤵PID:2940
-
\??\c:\1xlrxrr.exec:\1xlrxrr.exe91⤵
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\djddp.exec:\djddp.exe92⤵PID:548
-
\??\c:\pdjjd.exec:\pdjjd.exe93⤵PID:2984
-
\??\c:\nbhhnn.exec:\nbhhnn.exe94⤵PID:2968
-
\??\c:\7lxllrf.exec:\7lxllrf.exe95⤵PID:1980
-
\??\c:\pjjpj.exec:\pjjpj.exe96⤵
- System Location Discovery: System Language Discovery
PID:2344 -
\??\c:\3nbnth.exec:\3nbnth.exe97⤵PID:2352
-
\??\c:\7htnnh.exec:\7htnnh.exe98⤵PID:1160
-
\??\c:\1hnbnt.exec:\1hnbnt.exe99⤵PID:2432
-
\??\c:\fxrrlxf.exec:\fxrrlxf.exe100⤵
- System Location Discovery: System Language Discovery
PID:2616 -
\??\c:\dvdjd.exec:\dvdjd.exe101⤵PID:1864
-
\??\c:\jvddd.exec:\jvddd.exe102⤵PID:2244
-
\??\c:\htbbbb.exec:\htbbbb.exe103⤵PID:1708
-
\??\c:\tnnntb.exec:\tnnntb.exe104⤵PID:3064
-
\??\c:\llxlrxx.exec:\llxlrxx.exe105⤵PID:1364
-
\??\c:\ddpjv.exec:\ddpjv.exe106⤵PID:1636
-
\??\c:\nbnttn.exec:\nbnttn.exe107⤵PID:1724
-
\??\c:\bnbtbt.exec:\bnbtbt.exe108⤵PID:2264
-
\??\c:\lllxlxl.exec:\lllxlxl.exe109⤵PID:2184
-
\??\c:\vpdjd.exec:\vpdjd.exe110⤵PID:2544
-
\??\c:\pvdjj.exec:\pvdjj.exe111⤵PID:3052
-
\??\c:\bntnhh.exec:\bntnhh.exe112⤵PID:1656
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe113⤵PID:1520
-
\??\c:\pjppp.exec:\pjppp.exe114⤵PID:1668
-
\??\c:\nbhbnn.exec:\nbhbnn.exe115⤵PID:1952
-
\??\c:\bnnnth.exec:\bnnnth.exe116⤵PID:1612
-
\??\c:\rllrflx.exec:\rllrflx.exe117⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\vpvpj.exec:\vpvpj.exe118⤵PID:2828
-
\??\c:\hhhnbb.exec:\hhhnbb.exe119⤵PID:2500
-
\??\c:\5hnhhh.exec:\5hnhhh.exe120⤵PID:2508
-
\??\c:\lfrxxrr.exec:\lfrxxrr.exe121⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-