Analysis
- max time kernel
120s - max time network
119s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
08/01/2025, 14:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
- Target 129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe
- Size 454KB
- Sample250108-rtjrhawkfp
- SHA256 129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0
- MD5 04f66637d66e78cb54de16f727739ab4
- SHA1 ab8fcb78c1c71ecd585d4b1bd77f3201ec5b723f
- SHA512 ff2685549c6a58c48e4d33d0d66ca0bced7fc22eae1fde69a5dd155265e6c2e0a1ca74a1e8efbf698894e3be74be387577a88e44e304f0a184117a500df068d8
- SSDEEP 6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Blackmoon family
- Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1640-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-57-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2156-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-61-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-76-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-164-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2456-166-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/828-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-184-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1268-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-220-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1764-230-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/876-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-331-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-390-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1276-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2704-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-603-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-611-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3048-691-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2108-720-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-771-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1196-816-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1648-847-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-953-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-966-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2208-1029-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1732-1043-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/764-1086-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-1148-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3068-1178-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/780-1206-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1312-1335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1644 jjdjv.exe 2532 llfrlrf.exe 2136 rlxfffl.exe 2860 3jvpv.exe 2156 jvjjj.exe 2884 vvpvd.exe 2828 flflxfr.exe 2632 rrxlfff.exe 1576 rflllrx.exe 1960 xrrfllr.exe 1724 xrxflrf.exe 2904 vvdpd.exe 1004 xxllxfl.exe 2908 tntttb.exe 2356 7lxxffl.exe 1680 hhbnbt.exe 2456 jpvjd.exe 2024 ttbhnn.exe 828 jdpjp.exe 2120 frllxrf.exe 2512 nnhtnn.exe 1268 pjpvv.exe 112 5hthnt.exe 1764 tbntbb.exe 792 bbttbb.exe 876 lxxxfxl.exe 764 hnttnb.exe 2160 5nntnn.exe 2128 fxlxlrx.exe 2524 pjdjv.exe 1240 lxlrxxl.exe 2520 tbhhhn.exe 2572 jddjp.exe 2536 lfxfxfr.exe 1672 rlffffr.exe 2424 thnnnb.exe 2720 pdpvd.exe 2808 xxxlrfr.exe 2728 7lflrxr.exe 2648 nnhhhh.exe 1788 9vppd.exe 2748 1jpvv.exe 1928 rfxfxff.exe 2644 tnbntb.exe 2040 btnthn.exe 2664 vppjp.exe 1276 vpddj.exe 1224 frrrrxx.exe 3048 ththnt.exe 1248 nhtbnn.exe 2968 5dpjd.exe 2928 llrxrxr.exe 772 bbnbht.exe 1904 tnhtbb.exe 2056 dvdjp.exe 2164 dvpvv.exe 2384 rllrflf.exe 2412 bttbnt.exe 2796 ntnbtt.exe 2208 ddddd.exe 408 xrrflrf.exe 1888 rlfflrf.exe 1312 7hhtbb.exe 280 9dddd.exe -
resource yara_rule behavioral1/memory/1644-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-200-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/112-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-603-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1196-809-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-847-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-916-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/576-953-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-992-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1732-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-1086-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-1111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-1309-0x0000000000400000-0x000000000042A000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1644 1640 129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe 30 PID 1640 wrote to memory of 1644 1640 129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe 30 PID 1640 wrote to memory of 1644 1640 129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe 30 PID 1640 wrote to memory of 1644 1640 129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe 30 PID 1644 wrote to memory of 2532 1644 jjdjv.exe 31 PID 1644 wrote to memory of 2532 1644 jjdjv.exe 31 PID 1644 wrote to memory of 2532 1644 jjdjv.exe 31 PID 1644 wrote to memory of 2532 1644 jjdjv.exe 31 PID 2532 wrote to memory of 2136 2532 llfrlrf.exe 32 PID 2532 wrote to memory of 2136 2532 llfrlrf.exe 32 PID 2532 wrote to memory of 2136 2532 llfrlrf.exe 32 PID 2532 wrote to memory of 2136 2532 llfrlrf.exe 32 PID 2136 wrote to memory of 2860 2136 rlxfffl.exe 33 PID 2136 wrote to memory of 2860 2136 rlxfffl.exe 33 PID 2136 wrote to memory of 2860 2136 rlxfffl.exe 33 PID 2136 wrote to memory of 2860 2136 rlxfffl.exe 33 PID 2860 wrote to memory of 2156 2860 3jvpv.exe 34 PID 2860 wrote to memory of 2156 2860 3jvpv.exe 34 PID 2860 wrote to memory of 2156 2860 3jvpv.exe 34 PID 2860 wrote to memory of 2156 2860 3jvpv.exe 34 PID 2156 wrote to memory of 2884 2156 jvjjj.exe 35 PID 2156 wrote to memory of 2884 2156 jvjjj.exe 35 PID 2156 wrote to memory of 2884 2156 jvjjj.exe 35 PID 2156 wrote to memory of 2884 2156 jvjjj.exe 35 PID 2884 wrote to memory of 2828 2884 vvpvd.exe 36 PID 2884 wrote to memory of 2828 2884 vvpvd.exe 36 PID 2884 wrote to memory of 2828 2884 vvpvd.exe 36 PID 2884 wrote to memory of 2828 2884 vvpvd.exe 36 PID 2828 wrote to memory of 2632 2828 flflxfr.exe 37 PID 2828 wrote to memory of 2632 2828 flflxfr.exe 37 PID 2828 wrote to memory of 2632 2828 flflxfr.exe 37 PID 2828 wrote to memory of 2632 2828 flflxfr.exe 37 PID 2632 wrote to memory of 1576 2632 rrxlfff.exe 38 PID 2632 wrote to memory of 1576 2632 rrxlfff.exe 38 PID 2632 wrote to memory of 1576 2632 rrxlfff.exe 38 PID 2632 wrote to memory of 1576 2632 rrxlfff.exe 38 PID 1576 wrote to memory of 1960 1576 rflllrx.exe 39 PID 1576 wrote to memory of 1960 1576 rflllrx.exe 39 PID 1576 wrote to memory of 1960 1576 rflllrx.exe 39 PID 1576 wrote to memory of 1960 1576 rflllrx.exe 39 PID 1960 wrote to memory of 1724 1960 xrrfllr.exe 40 PID 1960 wrote to memory of 1724 1960 xrrfllr.exe 40 PID 1960 wrote to memory of 1724 1960 xrrfllr.exe 40 PID 1960 wrote to memory of 1724 1960 xrrfllr.exe 40 PID 1724 wrote to memory of 2904 1724 xrxflrf.exe 41 PID 1724 wrote to memory of 2904 1724 xrxflrf.exe 41 PID 1724 wrote to memory of 2904 1724 xrxflrf.exe 41 PID 1724 wrote to memory of 2904 1724 xrxflrf.exe 41 PID 2904 wrote to memory of 1004 2904 vvdpd.exe 42 PID 2904 wrote to memory of 1004 2904 vvdpd.exe 42 PID 2904 wrote to memory of 1004 2904 vvdpd.exe 42 PID 2904 wrote to memory of 1004 2904 vvdpd.exe 42 PID 1004 wrote to memory of 2908 1004 xxllxfl.exe 43 PID 1004 wrote to memory of 2908 1004 xxllxfl.exe 43 PID 1004 wrote to memory of 2908 1004 xxllxfl.exe 43 PID 1004 wrote to memory of 2908 1004 xxllxfl.exe 43 PID 2908 wrote to memory of 2356 2908 tntttb.exe 44 PID 2908 wrote to memory of 2356 2908 tntttb.exe 44 PID 2908 wrote to memory of 2356 2908 tntttb.exe 44 PID 2908 wrote to memory of 2356 2908 tntttb.exe 44 PID 2356 wrote to memory of 1680 2356 7lxxffl.exe 45 PID 2356 wrote to memory of 1680 2356 7lxxffl.exe 45 PID 2356 wrote to memory of 1680 2356 7lxxffl.exe 45 PID 2356 wrote to memory of 1680 2356 7lxxffl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe"C:\Users\Admin\AppData\Local\Temp\129e737a4d159d34427d6f123e0a88bd3031fb09ba6ac9125bb762a31b65e0e0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\jjdjv.exec:\jjdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\llfrlrf.exec:\llfrlrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rlxfffl.exec:\rlxfffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3jvpv.exec:\3jvpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\jvjjj.exec:\jvjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\vvpvd.exec:\vvpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\flflxfr.exec:\flflxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\rrxlfff.exec:\rrxlfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rflllrx.exec:\rflllrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\xrrfllr.exec:\xrrfllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\xrxflrf.exec:\xrxflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\vvdpd.exec:\vvdpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\xxllxfl.exec:\xxllxfl.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\tntttb.exec:\tntttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\7lxxffl.exec:\7lxxffl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\hhbnbt.exec:\hhbnbt.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jpvjd.exec:\jpvjd.exe18⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ttbhnn.exec:\ttbhnn.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\jdpjp.exec:\jdpjp.exe20⤵
- Executes dropped EXE
PID:828 -
\??\c:\frllxrf.exec:\frllxrf.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nnhtnn.exec:\nnhtnn.exe22⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pjpvv.exec:\pjpvv.exe23⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5hthnt.exec:\5hthnt.exe24⤵
- Executes dropped EXE
PID:112 -
\??\c:\tbntbb.exec:\tbntbb.exe25⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbttbb.exec:\bbttbb.exe26⤵
- Executes dropped EXE
PID:792 -
\??\c:\lxxxfxl.exec:\lxxxfxl.exe27⤵
- Executes dropped EXE
PID:876 -
\??\c:\hnttnb.exec:\hnttnb.exe28⤵
- Executes dropped EXE
PID:764 -
\??\c:\5nntnn.exec:\5nntnn.exe29⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxlxlrx.exec:\fxlxlrx.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pjdjv.exec:\pjdjv.exe31⤵
- Executes dropped EXE
PID:2524 -
\??\c:\lxlrxxl.exec:\lxlrxxl.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tbhhhn.exec:\tbhhhn.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jddjp.exec:\jddjp.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\lfxfxfr.exec:\lfxfxfr.exe35⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rlffffr.exec:\rlffffr.exe36⤵
- Executes dropped EXE
PID:1672 -
\??\c:\thnnnb.exec:\thnnnb.exe37⤵
- Executes dropped EXE
PID:2424 -
\??\c:\pdpvd.exec:\pdpvd.exe38⤵
- Executes dropped EXE
PID:2720 -
\??\c:\xxxlrfr.exec:\xxxlrfr.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7lflrxr.exec:\7lflrxr.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nnhhhh.exec:\nnhhhh.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9vppd.exec:\9vppd.exe42⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1jpvv.exec:\1jpvv.exe43⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rfxfxff.exec:\rfxfxff.exe44⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tnbntb.exec:\tnbntb.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\btnthn.exec:\btnthn.exe46⤵
- Executes dropped EXE
PID:2040 -
\??\c:\vppjp.exec:\vppjp.exe47⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vpddj.exec:\vpddj.exe48⤵
- Executes dropped EXE
PID:1276 -
\??\c:\frrrrxx.exec:\frrrrxx.exe49⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ththnt.exec:\ththnt.exe50⤵
- Executes dropped EXE
PID:3048 -
\??\c:\nhtbnn.exec:\nhtbnn.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5dpjd.exec:\5dpjd.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\llrxrxr.exec:\llrxrxr.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\bbnbht.exec:\bbnbht.exe54⤵
- Executes dropped EXE
PID:772 -
\??\c:\tnhtbb.exec:\tnhtbb.exe55⤵
- Executes dropped EXE
PID:1904 -
\??\c:\dvdjp.exec:\dvdjp.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvpvv.exec:\dvpvv.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rllrflf.exec:\rllrflf.exe58⤵
- Executes dropped EXE
PID:2384 -
\??\c:\bttbnt.exec:\bttbnt.exe59⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ntnbtt.exec:\ntnbtt.exe60⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ddddd.exec:\ddddd.exe61⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrrflrf.exec:\xrrflrf.exe62⤵
- Executes dropped EXE
PID:408 -
\??\c:\rlfflrf.exec:\rlfflrf.exe63⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7hhtbb.exec:\7hhtbb.exe64⤵
- Executes dropped EXE
PID:1312 -
\??\c:\9dddd.exec:\9dddd.exe65⤵
- Executes dropped EXE
PID:280 -
\??\c:\pjjjv.exec:\pjjjv.exe66⤵PID:1464
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe67⤵PID:2984
-
\??\c:\bbtbnb.exec:\bbtbnb.exe68⤵PID:1592
-
\??\c:\bbnnbb.exec:\bbnnbb.exe69⤵PID:552
-
\??\c:\dvvvp.exec:\dvvvp.exe70⤵PID:1196
-
\??\c:\ffxxffl.exec:\ffxxffl.exe71⤵PID:1988
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe72⤵PID:2540
-
\??\c:\tnbhtb.exec:\tnbhtb.exe73⤵PID:2000
-
\??\c:\pdvdj.exec:\pdvdj.exe74⤵PID:2436
-
\??\c:\5vvdj.exec:\5vvdj.exe75⤵PID:1244
-
\??\c:\fffrfxl.exec:\fffrfxl.exe76⤵PID:316
-
\??\c:\hhtbhn.exec:\hhtbhn.exe77⤵PID:1644
-
\??\c:\nhbhtn.exec:\nhbhtn.exe78⤵PID:2704
-
\??\c:\jdvpp.exec:\jdvpp.exe79⤵PID:1524
-
\??\c:\1xllllr.exec:\1xllllr.exe80⤵PID:320
-
\??\c:\httbbb.exec:\httbbb.exe81⤵PID:2756
-
\??\c:\thtntt.exec:\thtntt.exe82⤵PID:2888
-
\??\c:\vpjjv.exec:\vpjjv.exe83⤵PID:3068
-
\??\c:\llrrrlr.exec:\llrrrlr.exe84⤵PID:2744
-
\??\c:\bbnthh.exec:\bbnthh.exe85⤵PID:2844
-
\??\c:\nnbhhn.exec:\nnbhhn.exe86⤵PID:2884
-
\??\c:\vpdvj.exec:\vpdvj.exe87⤵PID:476
-
\??\c:\dvjjv.exec:\dvjjv.exe88⤵PID:2732
-
\??\c:\fffflxl.exec:\fffflxl.exe89⤵PID:756
-
\??\c:\5httbh.exec:\5httbh.exe90⤵PID:1484
-
\??\c:\thnnnn.exec:\thnnnn.exe91⤵PID:2924
-
\??\c:\3vvdd.exec:\3vvdd.exe92⤵PID:576
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe93⤵PID:1724
-
\??\c:\1rlflxl.exec:\1rlflxl.exe94⤵PID:1224
-
\??\c:\btnntt.exec:\btnntt.exe95⤵PID:3048
-
\??\c:\pjvvd.exec:\pjvvd.exe96⤵PID:1248
-
\??\c:\jjjjp.exec:\jjjjp.exe97⤵PID:2868
-
\??\c:\1rfflff.exec:\1rfflff.exe98⤵PID:2032
-
\??\c:\7ntbtb.exec:\7ntbtb.exe99⤵PID:2148
-
\??\c:\5dppv.exec:\5dppv.exe100⤵PID:2108
-
\??\c:\pddvv.exec:\pddvv.exe101⤵PID:2056
-
\??\c:\xfxfrxr.exec:\xfxfrxr.exe102⤵PID:2024
-
\??\c:\thbhnt.exec:\thbhnt.exe103⤵PID:2944
-
\??\c:\1ntbbb.exec:\1ntbbb.exe104⤵PID:828
-
\??\c:\5pdvd.exec:\5pdvd.exe105⤵PID:2140
-
\??\c:\vpddj.exec:\vpddj.exe106⤵PID:1100
-
\??\c:\fxrrffr.exec:\fxrrffr.exe107⤵PID:668
-
\??\c:\3htbhh.exec:\3htbhh.exe108⤵PID:2596
-
\??\c:\7pdvv.exec:\7pdvv.exe109⤵PID:1312
-
\??\c:\3vdjv.exec:\3vdjv.exe110⤵PID:788
-
\??\c:\lfrrffl.exec:\lfrrffl.exe111⤵PID:1608
-
\??\c:\hhbbnt.exec:\hhbbnt.exe112⤵PID:1924
-
\??\c:\7nnntt.exec:\7nnntt.exe113⤵PID:876
-
\??\c:\9pvvv.exec:\9pvvv.exe114⤵PID:2252
-
\??\c:\fxrrrxr.exec:\fxrrrxr.exe115⤵PID:1196
-
\??\c:\rlflllr.exec:\rlflllr.exe116⤵PID:1204
-
\??\c:\nhbbhh.exec:\nhbbhh.exe117⤵PID:1408
-
\??\c:\pppvp.exec:\pppvp.exe118⤵PID:2476
-
\??\c:\7dvvd.exec:\7dvvd.exe119⤵PID:1660
-
\??\c:\rxxfrxl.exec:\rxxfrxl.exe120⤵PID:1648
-
\??\c:\5bhtbt.exec:\5bhtbt.exe121⤵PID:2792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-