Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe
-
Size
455KB
-
MD5
8a0a8ba3d77910cd5f8174b455237330
-
SHA1
b81b3b7e1d36a7c07c8a202d4c808616440db055
-
SHA256
14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9
-
SHA512
601752ad0912a32af699f4bb7667efa19449765d454664a6fd9b7efa9195618b425215e2450a96b200b55322d76a7bcc3f52fdfb2f6554c008c2b484bfacdc90
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 61 IoCs
resource yara_rule behavioral1/memory/604-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-13-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2264-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-36-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-56-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2276-64-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2888-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-76-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-121-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2776-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-348-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-412-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2612-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-477-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1596-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-503-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1312-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-505-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/268-513-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1648-520-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/1648-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-522-0x0000000000280000-0x00000000002AA000-memory.dmp family_blackmoon behavioral1/memory/908-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-558-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/604-566-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2824-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-614-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-677-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1364-756-0x00000000001E0000-0x000000000020A000-memory.dmp family_blackmoon behavioral1/memory/2452-763-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1520-815-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/1692-847-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2712-879-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2892-950-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-982-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1768-996-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2372-1002-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/572-1017-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1692 jdvjv.exe 2072 fxrxlxr.exe 2264 3rflffx.exe 2712 tnbntn.exe 2780 rrfrffx.exe 2276 hbhbhn.exe 2888 xrfrxxr.exe 2676 bthntb.exe 2616 1xllrrr.exe 1464 pdjdj.exe 1984 3xflllr.exe 2776 9nbhnn.exe 536 lxllrxf.exe 2540 hthtnt.exe 1920 lfxlffr.exe 2372 nnhnhn.exe 2876 rllrxxf.exe 2912 rlffxfr.exe 2220 dppvv.exe 1328 5lrrlxf.exe 1512 1vpdp.exe 1128 9dvvj.exe 352 5jdjp.exe 268 ffxflxl.exe 2180 btnnbn.exe 1532 pjvdp.exe 2380 jdpvp.exe 868 7lfrffl.exe 2444 vvjvp.exe 1592 vvjdv.exe 2848 3btbtb.exe 316 pjpvp.exe 2308 hbntbh.exe 1684 5vjpp.exe 484 xlffrxf.exe 1960 3rlxrff.exe 2796 hbnthh.exe 2816 5dvdp.exe 2664 9jjjj.exe 2688 rfrxffl.exe 2936 bthnnt.exe 2596 9ttbnn.exe 2552 jdvvd.exe 1676 xxrrlrf.exe 3032 xxrfxfx.exe 3048 nnhnbb.exe 1044 vpdjv.exe 2892 rrlrlxr.exe 716 fxxxfll.exe 2612 bbthtn.exe 2860 dpvvd.exe 1280 vjvvp.exe 1876 xxxflrx.exe 1656 hbnnbb.exe 1116 nnhhtn.exe 3012 pdppv.exe 3020 rlxxlrf.exe 1916 lfrrffl.exe 2256 btnbtt.exe 2952 dvjpj.exe 768 5lxxlfl.exe 2044 flfrrrf.exe 1596 hbnbnb.exe 1312 vvjvj.exe -
resource yara_rule behavioral1/memory/604-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-192-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1512-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/716-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-503-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1312-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-505-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1648-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-558-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/604-566-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2824-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-614-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-733-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2756-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-783-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-815-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/896-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-847-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/972-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-879-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2764-898-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-914-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1484-943-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1052-963-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 604 wrote to memory of 1692 604 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 31 PID 604 wrote to memory of 1692 604 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 31 PID 604 wrote to memory of 1692 604 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 31 PID 604 wrote to memory of 1692 604 14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe 31 PID 1692 wrote to memory of 2072 1692 jdvjv.exe 32 PID 1692 wrote to memory of 2072 1692 jdvjv.exe 32 PID 1692 wrote to memory of 2072 1692 jdvjv.exe 32 PID 1692 wrote to memory of 2072 1692 jdvjv.exe 32 PID 2072 wrote to memory of 2264 2072 fxrxlxr.exe 33 PID 2072 wrote to memory of 2264 2072 fxrxlxr.exe 33 PID 2072 wrote to memory of 2264 2072 fxrxlxr.exe 33 PID 2072 wrote to memory of 2264 2072 fxrxlxr.exe 33 PID 2264 wrote to memory of 2712 2264 3rflffx.exe 34 PID 2264 wrote to memory of 2712 2264 3rflffx.exe 34 PID 2264 wrote to memory of 2712 2264 3rflffx.exe 34 PID 2264 wrote to memory of 2712 2264 3rflffx.exe 34 PID 2712 wrote to memory of 2780 2712 tnbntn.exe 35 PID 2712 wrote to memory of 2780 2712 tnbntn.exe 35 PID 2712 wrote to memory of 2780 2712 tnbntn.exe 35 PID 2712 wrote to memory of 2780 2712 tnbntn.exe 35 PID 2780 wrote to memory of 2276 2780 rrfrffx.exe 36 PID 2780 wrote to memory of 2276 2780 rrfrffx.exe 36 PID 2780 wrote to memory of 2276 2780 rrfrffx.exe 36 PID 2780 wrote to memory of 2276 2780 rrfrffx.exe 36 PID 2276 wrote to memory of 2888 2276 hbhbhn.exe 37 PID 2276 wrote to memory of 2888 2276 hbhbhn.exe 37 PID 2276 wrote to memory of 2888 2276 hbhbhn.exe 37 PID 2276 wrote to memory of 2888 2276 hbhbhn.exe 37 PID 2888 wrote to memory of 2676 2888 xrfrxxr.exe 38 PID 2888 wrote to memory of 2676 2888 xrfrxxr.exe 38 PID 2888 wrote to memory of 2676 2888 xrfrxxr.exe 38 PID 2888 wrote to memory of 2676 2888 xrfrxxr.exe 38 PID 2676 wrote to memory of 2616 2676 bthntb.exe 39 PID 2676 wrote to memory of 2616 2676 bthntb.exe 39 PID 2676 wrote to memory of 2616 2676 bthntb.exe 39 PID 2676 wrote to memory of 2616 2676 bthntb.exe 39 PID 2616 wrote to memory of 1464 2616 1xllrrr.exe 40 PID 2616 wrote to memory of 1464 2616 1xllrrr.exe 40 PID 2616 wrote to memory of 1464 2616 1xllrrr.exe 40 PID 2616 wrote to memory of 1464 2616 1xllrrr.exe 40 PID 1464 wrote to memory of 1984 1464 pdjdj.exe 41 PID 1464 wrote to memory of 1984 1464 pdjdj.exe 41 PID 1464 wrote to memory of 1984 1464 pdjdj.exe 41 PID 1464 wrote to memory of 1984 1464 pdjdj.exe 41 PID 1984 wrote to memory of 2776 1984 3xflllr.exe 42 PID 1984 wrote to memory of 2776 1984 3xflllr.exe 42 PID 1984 wrote to memory of 2776 1984 3xflllr.exe 42 PID 1984 wrote to memory of 2776 1984 3xflllr.exe 42 PID 2776 wrote to memory of 536 2776 9nbhnn.exe 43 PID 2776 wrote to memory of 536 2776 9nbhnn.exe 43 PID 2776 wrote to memory of 536 2776 9nbhnn.exe 43 PID 2776 wrote to memory of 536 2776 9nbhnn.exe 43 PID 536 wrote to memory of 2540 536 lxllrxf.exe 44 PID 536 wrote to memory of 2540 536 lxllrxf.exe 44 PID 536 wrote to memory of 2540 536 lxllrxf.exe 44 PID 536 wrote to memory of 2540 536 lxllrxf.exe 44 PID 2540 wrote to memory of 1920 2540 hthtnt.exe 45 PID 2540 wrote to memory of 1920 2540 hthtnt.exe 45 PID 2540 wrote to memory of 1920 2540 hthtnt.exe 45 PID 2540 wrote to memory of 1920 2540 hthtnt.exe 45 PID 1920 wrote to memory of 2372 1920 lfxlffr.exe 46 PID 1920 wrote to memory of 2372 1920 lfxlffr.exe 46 PID 1920 wrote to memory of 2372 1920 lfxlffr.exe 46 PID 1920 wrote to memory of 2372 1920 lfxlffr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe"C:\Users\Admin\AppData\Local\Temp\14097823b6a20d76c45418eaf5e1a91fdf467f22c98f596492ba01bdc5356af9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\jdvjv.exec:\jdvjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\fxrxlxr.exec:\fxrxlxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\3rflffx.exec:\3rflffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\tnbntn.exec:\tnbntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rrfrffx.exec:\rrfrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hbhbhn.exec:\hbhbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xrfrxxr.exec:\xrfrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\bthntb.exec:\bthntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\1xllrrr.exec:\1xllrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pdjdj.exec:\pdjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\3xflllr.exec:\3xflllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\9nbhnn.exec:\9nbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lxllrxf.exec:\lxllrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hthtnt.exec:\hthtnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lfxlffr.exec:\lfxlffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\nnhnhn.exec:\nnhnhn.exe17⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rllrxxf.exec:\rllrxxf.exe18⤵
- Executes dropped EXE
PID:2876 -
\??\c:\rlffxfr.exec:\rlffxfr.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\dppvv.exec:\dppvv.exe20⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5lrrlxf.exec:\5lrrlxf.exe21⤵
- Executes dropped EXE
PID:1328 -
\??\c:\1vpdp.exec:\1vpdp.exe22⤵
- Executes dropped EXE
PID:1512 -
\??\c:\9dvvj.exec:\9dvvj.exe23⤵
- Executes dropped EXE
PID:1128 -
\??\c:\5jdjp.exec:\5jdjp.exe24⤵
- Executes dropped EXE
PID:352 -
\??\c:\ffxflxl.exec:\ffxflxl.exe25⤵
- Executes dropped EXE
PID:268 -
\??\c:\btnnbn.exec:\btnnbn.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjvdp.exec:\pjvdp.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\jdpvp.exec:\jdpvp.exe28⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7lfrffl.exec:\7lfrffl.exe29⤵
- Executes dropped EXE
PID:868 -
\??\c:\vvjvp.exec:\vvjvp.exe30⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvjdv.exec:\vvjdv.exe31⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3btbtb.exec:\3btbtb.exe32⤵
- Executes dropped EXE
PID:2848 -
\??\c:\pjpvp.exec:\pjpvp.exe33⤵
- Executes dropped EXE
PID:316 -
\??\c:\hbntbh.exec:\hbntbh.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5vjpp.exec:\5vjpp.exe35⤵
- Executes dropped EXE
PID:1684 -
\??\c:\xlffrxf.exec:\xlffrxf.exe36⤵
- Executes dropped EXE
PID:484 -
\??\c:\3rlxrff.exec:\3rlxrff.exe37⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hbnthh.exec:\hbnthh.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5dvdp.exec:\5dvdp.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\9jjjj.exec:\9jjjj.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rfrxffl.exec:\rfrxffl.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\bthnnt.exec:\bthnnt.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2936 -
\??\c:\9ttbnn.exec:\9ttbnn.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdvvd.exec:\jdvvd.exe44⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xxrrlrf.exec:\xxrrlrf.exe45⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xxrfxfx.exec:\xxrfxfx.exe46⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nnhnbb.exec:\nnhnbb.exe47⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vpdjv.exec:\vpdjv.exe48⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rrlrlxr.exec:\rrlrlxr.exe49⤵
- Executes dropped EXE
PID:2892 -
\??\c:\fxxxfll.exec:\fxxxfll.exe50⤵
- Executes dropped EXE
PID:716 -
\??\c:\bbthtn.exec:\bbthtn.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpvvd.exec:\dpvvd.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vjvvp.exec:\vjvvp.exe53⤵
- Executes dropped EXE
PID:1280 -
\??\c:\xxxflrx.exec:\xxxflrx.exe54⤵
- Executes dropped EXE
PID:1876 -
\??\c:\hbnnbb.exec:\hbnnbb.exe55⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nnhhtn.exec:\nnhhtn.exe56⤵
- Executes dropped EXE
PID:1116 -
\??\c:\pdppv.exec:\pdppv.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rlxxlrf.exec:\rlxxlrf.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\lfrrffl.exec:\lfrrffl.exe59⤵
- Executes dropped EXE
PID:1916 -
\??\c:\btnbtt.exec:\btnbtt.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvjpj.exec:\dvjpj.exe61⤵
- Executes dropped EXE
PID:2952 -
\??\c:\5lxxlfl.exec:\5lxxlfl.exe62⤵
- Executes dropped EXE
PID:768 -
\??\c:\flfrrrf.exec:\flfrrrf.exe63⤵
- Executes dropped EXE
PID:2044 -
\??\c:\hbnbnb.exec:\hbnbnb.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vvjvj.exec:\vvjvj.exe65⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dvpvd.exec:\dvpvd.exe66⤵PID:268
-
\??\c:\rlfrlrl.exec:\rlfrlrl.exe67⤵PID:1648
-
\??\c:\nhbhbn.exec:\nhbhbn.exe68⤵PID:2504
-
\??\c:\pjdvd.exec:\pjdvd.exe69⤵PID:1520
-
\??\c:\rlrrffl.exec:\rlrrffl.exe70⤵PID:1852
-
\??\c:\tnhhnn.exec:\tnhhnn.exe71⤵PID:2228
-
\??\c:\bthntt.exec:\bthntt.exe72⤵PID:908
-
\??\c:\vpddp.exec:\vpddp.exe73⤵PID:1592
-
\??\c:\lfflxxf.exec:\lfflxxf.exe74⤵
- System Location Discovery: System Language Discovery
PID:604 -
\??\c:\3lxfxxl.exec:\3lxfxxl.exe75⤵PID:2076
-
\??\c:\7thnbb.exec:\7thnbb.exe76⤵PID:1560
-
\??\c:\pdpdp.exec:\pdpdp.exe77⤵PID:972
-
\??\c:\5dpdj.exec:\5dpdj.exe78⤵PID:2652
-
\??\c:\rfrrfxf.exec:\rfrrfxf.exe79⤵PID:856
-
\??\c:\hnnbbt.exec:\hnnbbt.exe80⤵PID:2824
-
\??\c:\1bthth.exec:\1bthth.exe81⤵PID:1800
-
\??\c:\3jpvd.exec:\3jpvd.exe82⤵PID:2780
-
\??\c:\llffxxf.exec:\llffxxf.exe83⤵PID:2764
-
\??\c:\nnbnhh.exec:\nnbnhh.exe84⤵PID:2728
-
\??\c:\tnbnbh.exec:\tnbnbh.exe85⤵PID:2564
-
\??\c:\jdpdj.exec:\jdpdj.exe86⤵PID:2548
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe87⤵PID:2632
-
\??\c:\fxrrllf.exec:\fxrrllf.exe88⤵PID:2556
-
\??\c:\btnnnt.exec:\btnnnt.exe89⤵PID:1484
-
\??\c:\jjjpd.exec:\jjjpd.exe90⤵PID:1864
-
\??\c:\ppjpv.exec:\ppjpv.exe91⤵PID:2872
-
\??\c:\lrrxrrl.exec:\lrrxrrl.exe92⤵PID:1680
-
\??\c:\9hbnhh.exec:\9hbnhh.exe93⤵PID:1660
-
\??\c:\vvdjv.exec:\vvdjv.exe94⤵PID:2860
-
\??\c:\djvdp.exec:\djvdp.exe95⤵PID:1280
-
\??\c:\rrlrxfr.exec:\rrlrxfr.exe96⤵PID:280
-
\??\c:\hnhnbb.exec:\hnhnbb.exe97⤵PID:1656
-
\??\c:\btnntn.exec:\btnntn.exe98⤵PID:1240
-
\??\c:\vvpjp.exec:\vvpjp.exe99⤵PID:3056
-
\??\c:\7rlffxx.exec:\7rlffxx.exe100⤵PID:3020
-
\??\c:\tnhtbt.exec:\tnhtbt.exe101⤵PID:2056
-
\??\c:\nhtbnh.exec:\nhtbnh.exe102⤵PID:2256
-
\??\c:\5dvjv.exec:\5dvjv.exe103⤵PID:1364
-
\??\c:\llflrrl.exec:\llflrrl.exe104⤵PID:2452
-
\??\c:\ffxfffx.exec:\ffxfffx.exe105⤵PID:976
-
\??\c:\5tntbh.exec:\5tntbh.exe106⤵PID:1596
-
\??\c:\1vppd.exec:\1vppd.exe107⤵PID:2756
-
\??\c:\jvppj.exec:\jvppj.exe108⤵PID:1712
-
\??\c:\xxfrflx.exec:\xxfrflx.exe109⤵PID:2424
-
\??\c:\5nhnnn.exec:\5nhnnn.exe110⤵PID:1492
-
\??\c:\nhbntb.exec:\nhbntb.exe111⤵
- System Location Discovery: System Language Discovery
PID:2084 -
\??\c:\9pjvv.exec:\9pjvv.exe112⤵PID:1520
-
\??\c:\fxlrxrf.exec:\fxlrxrf.exe113⤵PID:1852
-
\??\c:\5lxxllr.exec:\5lxxllr.exe114⤵PID:896
-
\??\c:\tnbntb.exec:\tnbntb.exe115⤵PID:2400
-
\??\c:\jddjj.exec:\jddjj.exe116⤵PID:2360
-
\??\c:\llxflrl.exec:\llxflrl.exe117⤵PID:1692
-
\??\c:\lxrxffl.exec:\lxrxffl.exe118⤵PID:2292
-
\??\c:\htnbhh.exec:\htnbhh.exe119⤵PID:1560
-
\??\c:\vpjpd.exec:\vpjpd.exe120⤵PID:972
-
\??\c:\pvjpd.exec:\pvjpd.exe121⤵PID:1960
-
\??\c:\rrrrffr.exec:\rrrrffr.exe122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-