Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/01/2025, 07:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe
-
Size
454KB
-
MD5
57f8dbf600286cb6cf5e966a541f8700
-
SHA1
0e256f952d78bd537dec1629995322e1b732ed6f
-
SHA256
f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30
-
SHA512
074fc83d6afc8551519f84f4b414de1e8cddde9a5e90161d253c20f025660b9a885566d6296b41e53e0e915b32e152e029bad3f73c9744efbadfc9be080b0a21
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe3:q7Tc2NYHUrAwfMp3CD3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-58-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2840-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2268-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-286-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-291-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2960-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-481-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-480-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1280-495-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2556-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-727-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1664-802-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2288-841-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-1085-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1992-1117-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3008-1143-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1092-1285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2660 5tbbtt.exe 2996 frflrlx.exe 2984 vjpjp.exe 2724 lxlrxxx.exe 2908 7pvdd.exe 2840 pdjdd.exe 2736 5xrrrrx.exe 2740 vpvpd.exe 2588 xrxflxf.exe 2968 nbhhhh.exe 560 3rfllrr.exe 1948 bhtnbb.exe 324 jjddp.exe 1716 thbbhh.exe 1648 lxrxffl.exe 1428 lfxxffr.exe 1952 jvjjp.exe 2812 jdpjp.exe 2268 lxrlxxx.exe 1000 1pdpv.exe 916 1lrxflr.exe 3024 jddjv.exe 1672 tnbhnn.exe 2560 9nhnbh.exe 1468 3pvjp.exe 1680 thnhhb.exe 540 rfrxxxx.exe 2076 nbhntt.exe 344 3fxfrlr.exe 2564 ntbhht.exe 892 dvppv.exe 1996 5rlrrxf.exe 1516 hbnnbh.exe 2960 vpjpd.exe 2380 ffxfrxr.exe 2384 xxrfxxl.exe 1488 9nttbh.exe 2820 dvpvd.exe 2700 rlxxfxf.exe 2584 xlffffx.exe 2612 tnhttn.exe 2988 jdppp.exe 2688 jjvvd.exe 2740 xxrfllx.exe 2588 hhbhtn.exe 2536 jjddv.exe 1536 3djjd.exe 1388 lfxfrxr.exe 2024 thbbhn.exe 2020 vjvdp.exe 1720 7dvpp.exe 1216 rlflrxr.exe 1844 hbbnnt.exe 1656 nnthbh.exe 1044 dvppv.exe 1040 xrlrflr.exe 2812 tnbnbt.exe 2268 1ntbbt.exe 536 vpddv.exe 1172 7xllxff.exe 2924 bnhhnn.exe 1280 tnhntt.exe 1608 vjvdj.exe 2556 9rrfllr.exe -
resource yara_rule behavioral1/memory/2660-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-18-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2660-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-154-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2268-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-261-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/892-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-291-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2380-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-495-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2556-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-841-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-1025-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-1117-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3008-1136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-1150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1092-1285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-1298-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2660 2516 f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe 30 PID 2516 wrote to memory of 2660 2516 f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe 30 PID 2516 wrote to memory of 2660 2516 f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe 30 PID 2516 wrote to memory of 2660 2516 f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe 30 PID 2660 wrote to memory of 2996 2660 5tbbtt.exe 31 PID 2660 wrote to memory of 2996 2660 5tbbtt.exe 31 PID 2660 wrote to memory of 2996 2660 5tbbtt.exe 31 PID 2660 wrote to memory of 2996 2660 5tbbtt.exe 31 PID 2996 wrote to memory of 2984 2996 frflrlx.exe 32 PID 2996 wrote to memory of 2984 2996 frflrlx.exe 32 PID 2996 wrote to memory of 2984 2996 frflrlx.exe 32 PID 2996 wrote to memory of 2984 2996 frflrlx.exe 32 PID 2984 wrote to memory of 2724 2984 vjpjp.exe 33 PID 2984 wrote to memory of 2724 2984 vjpjp.exe 33 PID 2984 wrote to memory of 2724 2984 vjpjp.exe 33 PID 2984 wrote to memory of 2724 2984 vjpjp.exe 33 PID 2724 wrote to memory of 2908 2724 lxlrxxx.exe 34 PID 2724 wrote to memory of 2908 2724 lxlrxxx.exe 34 PID 2724 wrote to memory of 2908 2724 lxlrxxx.exe 34 PID 2724 wrote to memory of 2908 2724 lxlrxxx.exe 34 PID 2908 wrote to memory of 2840 2908 7pvdd.exe 35 PID 2908 wrote to memory of 2840 2908 7pvdd.exe 35 PID 2908 wrote to memory of 2840 2908 7pvdd.exe 35 PID 2908 wrote to memory of 2840 2908 7pvdd.exe 35 PID 2840 wrote to memory of 2736 2840 pdjdd.exe 36 PID 2840 wrote to memory of 2736 2840 pdjdd.exe 36 PID 2840 wrote to memory of 2736 2840 pdjdd.exe 36 PID 2840 wrote to memory of 2736 2840 pdjdd.exe 36 PID 2736 wrote to memory of 2740 2736 5xrrrrx.exe 37 PID 2736 wrote to memory of 2740 2736 5xrrrrx.exe 37 PID 2736 wrote to memory of 2740 2736 5xrrrrx.exe 37 PID 2736 wrote to memory of 2740 2736 5xrrrrx.exe 37 PID 2740 wrote to memory of 2588 2740 vpvpd.exe 38 PID 2740 wrote to memory of 2588 2740 vpvpd.exe 38 PID 2740 wrote to memory of 2588 2740 vpvpd.exe 38 PID 2740 wrote to memory of 2588 2740 vpvpd.exe 38 PID 2588 wrote to memory of 2968 2588 xrxflxf.exe 39 PID 2588 wrote to memory of 2968 2588 xrxflxf.exe 39 PID 2588 wrote to memory of 2968 2588 xrxflxf.exe 39 PID 2588 wrote to memory of 2968 2588 xrxflxf.exe 39 PID 2968 wrote to memory of 560 2968 nbhhhh.exe 40 PID 2968 wrote to memory of 560 2968 nbhhhh.exe 40 PID 2968 wrote to memory of 560 2968 nbhhhh.exe 40 PID 2968 wrote to memory of 560 2968 nbhhhh.exe 40 PID 560 wrote to memory of 1948 560 3rfllrr.exe 41 PID 560 wrote to memory of 1948 560 3rfllrr.exe 41 PID 560 wrote to memory of 1948 560 3rfllrr.exe 41 PID 560 wrote to memory of 1948 560 3rfllrr.exe 41 PID 1948 wrote to memory of 324 1948 bhtnbb.exe 42 PID 1948 wrote to memory of 324 1948 bhtnbb.exe 42 PID 1948 wrote to memory of 324 1948 bhtnbb.exe 42 PID 1948 wrote to memory of 324 1948 bhtnbb.exe 42 PID 324 wrote to memory of 1716 324 jjddp.exe 43 PID 324 wrote to memory of 1716 324 jjddp.exe 43 PID 324 wrote to memory of 1716 324 jjddp.exe 43 PID 324 wrote to memory of 1716 324 jjddp.exe 43 PID 1716 wrote to memory of 1648 1716 thbbhh.exe 44 PID 1716 wrote to memory of 1648 1716 thbbhh.exe 44 PID 1716 wrote to memory of 1648 1716 thbbhh.exe 44 PID 1716 wrote to memory of 1648 1716 thbbhh.exe 44 PID 1648 wrote to memory of 1428 1648 lxrxffl.exe 45 PID 1648 wrote to memory of 1428 1648 lxrxffl.exe 45 PID 1648 wrote to memory of 1428 1648 lxrxffl.exe 45 PID 1648 wrote to memory of 1428 1648 lxrxffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe"C:\Users\Admin\AppData\Local\Temp\f58f4514626ceaba702e55abe0cde7029b93d932d2f933d6ab2b5fde8d562d30N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\5tbbtt.exec:\5tbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\frflrlx.exec:\frflrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vjpjp.exec:\vjpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\lxlrxxx.exec:\lxlrxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7pvdd.exec:\7pvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\pdjdd.exec:\pdjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5xrrrrx.exec:\5xrrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vpvpd.exec:\vpvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xrxflxf.exec:\xrxflxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\nbhhhh.exec:\nbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\3rfllrr.exec:\3rfllrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\bhtnbb.exec:\bhtnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jjddp.exec:\jjddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\thbbhh.exec:\thbbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\lxrxffl.exec:\lxrxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\lfxxffr.exec:\lfxxffr.exe17⤵
- Executes dropped EXE
PID:1428 -
\??\c:\jvjjp.exec:\jvjjp.exe18⤵
- Executes dropped EXE
PID:1952 -
\??\c:\jdpjp.exec:\jdpjp.exe19⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lxrlxxx.exec:\lxrlxxx.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\1pdpv.exec:\1pdpv.exe21⤵
- Executes dropped EXE
PID:1000 -
\??\c:\1lrxflr.exec:\1lrxflr.exe22⤵
- Executes dropped EXE
PID:916 -
\??\c:\jddjv.exec:\jddjv.exe23⤵
- Executes dropped EXE
PID:3024 -
\??\c:\tnbhnn.exec:\tnbhnn.exe24⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9nhnbh.exec:\9nhnbh.exe25⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3pvjp.exec:\3pvjp.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\thnhhb.exec:\thnhhb.exe27⤵
- Executes dropped EXE
PID:1680 -
\??\c:\rfrxxxx.exec:\rfrxxxx.exe28⤵
- Executes dropped EXE
PID:540 -
\??\c:\nbhntt.exec:\nbhntt.exe29⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3fxfrlr.exec:\3fxfrlr.exe30⤵
- Executes dropped EXE
PID:344 -
\??\c:\ntbhht.exec:\ntbhht.exe31⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dvppv.exec:\dvppv.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\5rlrrxf.exec:\5rlrrxf.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\hbnnbh.exec:\hbnnbh.exe34⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vpjpd.exec:\vpjpd.exe35⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\xxrfxxl.exec:\xxrfxxl.exe37⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9nttbh.exec:\9nttbh.exe38⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dvpvd.exec:\dvpvd.exe39⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\xlffffx.exec:\xlffffx.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\tnhttn.exec:\tnhttn.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jdppp.exec:\jdppp.exe43⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jjvvd.exec:\jjvvd.exe44⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xxrfllx.exec:\xxrfllx.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hhbhtn.exec:\hhbhtn.exe46⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jjddv.exec:\jjddv.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3djjd.exec:\3djjd.exe48⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe49⤵
- Executes dropped EXE
PID:1388 -
\??\c:\thbbhn.exec:\thbbhn.exe50⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjvdp.exec:\vjvdp.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7dvpp.exec:\7dvpp.exe52⤵
- Executes dropped EXE
PID:1720 -
\??\c:\rlflrxr.exec:\rlflrxr.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\hbbnnt.exec:\hbbnnt.exe54⤵
- Executes dropped EXE
PID:1844 -
\??\c:\nnthbh.exec:\nnthbh.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dvppv.exec:\dvppv.exe56⤵
- Executes dropped EXE
PID:1044 -
\??\c:\xrlrflr.exec:\xrlrflr.exe57⤵
- Executes dropped EXE
PID:1040 -
\??\c:\tnbnbt.exec:\tnbnbt.exe58⤵
- Executes dropped EXE
PID:2812 -
\??\c:\1ntbbt.exec:\1ntbbt.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vpddv.exec:\vpddv.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\7xllxff.exec:\7xllxff.exe61⤵
- Executes dropped EXE
PID:1172 -
\??\c:\bnhhnn.exec:\bnhhnn.exe62⤵
- Executes dropped EXE
PID:2924 -
\??\c:\tnhntt.exec:\tnhntt.exe63⤵
- Executes dropped EXE
PID:1280 -
\??\c:\vjvdj.exec:\vjvdj.exe64⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9rrfllr.exec:\9rrfllr.exe65⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7nhbhh.exec:\7nhbhh.exe66⤵PID:1592
-
\??\c:\3btbhn.exec:\3btbhn.exe67⤵PID:920
-
\??\c:\pppdj.exec:\pppdj.exe68⤵PID:2256
-
\??\c:\fxrrlrf.exec:\fxrrlrf.exe69⤵PID:2088
-
\??\c:\lfrfxxf.exec:\lfrfxxf.exe70⤵PID:3020
-
\??\c:\tthhtb.exec:\tthhtb.exe71⤵PID:2280
-
\??\c:\pjjjj.exec:\pjjjj.exe72⤵PID:1412
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe73⤵PID:2072
-
\??\c:\fxllflx.exec:\fxllflx.exe74⤵PID:892
-
\??\c:\bthnbh.exec:\bthnbh.exe75⤵PID:2508
-
\??\c:\9ppdd.exec:\9ppdd.exe76⤵PID:1484
-
\??\c:\rlffflx.exec:\rlffflx.exe77⤵PID:3008
-
\??\c:\xxrfflr.exec:\xxrfflr.exe78⤵PID:2864
-
\??\c:\bbthnn.exec:\bbthnn.exe79⤵PID:2684
-
\??\c:\9vppv.exec:\9vppv.exe80⤵PID:2796
-
\??\c:\frflrxf.exec:\frflrxf.exe81⤵PID:2764
-
\??\c:\3frxxxx.exec:\3frxxxx.exe82⤵PID:2908
-
\??\c:\tbnhtb.exec:\tbnhtb.exe83⤵PID:3044
-
\??\c:\dvjjv.exec:\dvjjv.exe84⤵PID:2892
-
\??\c:\dvpjv.exec:\dvpjv.exe85⤵PID:2320
-
\??\c:\3fxxxfl.exec:\3fxxxfl.exe86⤵PID:2572
-
\??\c:\ntnthh.exec:\ntnthh.exe87⤵PID:2620
-
\??\c:\dvvjj.exec:\dvvjj.exe88⤵PID:2208
-
\??\c:\1pjpv.exec:\1pjpv.exe89⤵PID:1764
-
\??\c:\ffrrrrf.exec:\ffrrrrf.exe90⤵PID:2536
-
\??\c:\nnbhnn.exec:\nnbhnn.exe91⤵PID:1868
-
\??\c:\nnhhnn.exec:\nnhhnn.exe92⤵PID:1388
-
\??\c:\vvpvj.exec:\vvpvj.exe93⤵PID:1700
-
\??\c:\5rffffl.exec:\5rffffl.exe94⤵PID:2020
-
\??\c:\fxrrfll.exec:\fxrrfll.exe95⤵PID:1892
-
\??\c:\7hthnt.exec:\7hthnt.exe96⤵PID:2372
-
\??\c:\9jjdj.exec:\9jjdj.exe97⤵PID:1884
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe98⤵PID:1248
-
\??\c:\xrflxfl.exec:\xrflxfl.exe99⤵PID:764
-
\??\c:\nnbbhn.exec:\nnbbhn.exe100⤵PID:2152
-
\??\c:\vvpvv.exec:\vvpvv.exe101⤵PID:2616
-
\??\c:\rfxrflx.exec:\rfxrflx.exe102⤵PID:812
-
\??\c:\fxrrxxx.exec:\fxrrxxx.exe103⤵PID:2916
-
\??\c:\nhtnnn.exec:\nhtnnn.exe104⤵PID:988
-
\??\c:\jvddd.exec:\jvddd.exe105⤵PID:2636
-
\??\c:\ddpdj.exec:\ddpdj.exe106⤵PID:908
-
\??\c:\9xxfffl.exec:\9xxfffl.exe107⤵PID:336
-
\??\c:\nhbhnh.exec:\nhbhnh.exe108⤵PID:1664
-
\??\c:\nnnnbh.exec:\nnnnbh.exe109⤵PID:1596
-
\??\c:\jvjvv.exec:\jvjvv.exe110⤵PID:1592
-
\??\c:\rlllxxf.exec:\rlllxxf.exe111⤵PID:2408
-
\??\c:\nbtbbb.exec:\nbtbbb.exe112⤵PID:3040
-
\??\c:\hhbhnt.exec:\hhbhnt.exe113⤵PID:2088
-
\??\c:\1pjpj.exec:\1pjpj.exe114⤵PID:2428
-
\??\c:\rrlrflx.exec:\rrlrflx.exe115⤵PID:1604
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe116⤵PID:808
-
\??\c:\nbhbbb.exec:\nbhbbb.exe117⤵PID:1992
-
\??\c:\dvddd.exec:\dvddd.exe118⤵PID:2288
-
\??\c:\ppvvp.exec:\ppvvp.exe119⤵PID:2956
-
\??\c:\3rlfffl.exec:\3rlfffl.exe120⤵PID:2940
-
\??\c:\hhnthh.exec:\hhnthh.exe121⤵PID:2656
-
\??\c:\hhttbh.exec:\hhttbh.exe122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-