Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe
-
Size
454KB
-
MD5
01bb3e5eed4bb5943ffe7627893bf5ad
-
SHA1
ae12608104bef4f0dd3473df8f2416f0688978f2
-
SHA256
4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229
-
SHA512
df1e96cdd9b7bc97e23036d7a8979a068fa8049bc350f84b3c7ff029ba6b628aacad91352ec9733243ab732ee6989e567a0374dd7ab293ae406530192a1134e1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS2:q7Tc2NYHUrAwfMp3CDS2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-91-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2616-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-130-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/972-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/400-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-186-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/348-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-205-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2304-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-341-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2876-354-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/3004-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-413-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1736-430-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-442-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2604-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-703-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/820-751-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1564-785-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/696-819-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2416-854-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2628-919-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2616-926-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1548-980-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/820-1027-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2588 lxfrlll.exe 2388 ttnnbb.exe 1328 vpppv.exe 2528 ddjvv.exe 580 pjdvd.exe 2828 lxlrrlx.exe 2744 fxllrlx.exe 2892 jdjpv.exe 2656 xfxlxxl.exe 2616 tttbth.exe 2740 bbbbbh.exe 2180 5jpjv.exe 972 tntnnn.exe 1668 jdpdd.exe 1684 rfrrxxf.exe 1872 fxfxxll.exe 1152 ddjpp.exe 400 ddddp.exe 2944 jvjdp.exe 2288 xlxxffl.exe 2304 9pvvj.exe 348 htbbbt.exe 1624 vpvdd.exe 532 vpdvj.exe 832 ddvjv.exe 600 rlxfllr.exe 568 vpdpv.exe 3064 bnbhnn.exe 2100 djvdv.exe 628 ntnhnn.exe 548 vpvdp.exe 2572 1jdvv.exe 2328 5btbhh.exe 2404 lflllll.exe 2520 5llxxxx.exe 2980 5bnthh.exe 2528 hthbbt.exe 2748 jddvd.exe 2236 lxflllr.exe 2876 bthbhh.exe 3004 btnntt.exe 2896 vpjpv.exe 2880 xlflllr.exe 2732 hnhtbh.exe 2636 hhbbhh.exe 2012 pjddp.exe 2264 5lxxfff.exe 2580 llflrrx.exe 980 nbntnn.exe 1828 vvjjp.exe 2096 lxrxfxf.exe 1736 fxfflrl.exe 1204 3ntntn.exe 2604 1pjjd.exe 1976 dvjpv.exe 2920 lfrrxxl.exe 3044 bnhbnh.exe 2336 jvpvd.exe 2184 rfrrxfr.exe 1088 lfxfrfx.exe 2408 tnhntb.exe 1592 tnbbbt.exe 920 pdjpv.exe 584 rlxxffl.exe -
resource yara_rule behavioral1/memory/2380-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-146-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1684-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/400-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-563-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2828-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-703-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/1564-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-792-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-819-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/1744-861-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-874-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-881-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-939-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-980-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2004-993-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-1000-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/820-1027-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1200-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-1113-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2380 wrote to memory of 2588 2380 4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe 30 PID 2380 wrote to memory of 2588 2380 4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe 30 PID 2380 wrote to memory of 2588 2380 4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe 30 PID 2380 wrote to memory of 2588 2380 4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe 30 PID 2588 wrote to memory of 2388 2588 lxfrlll.exe 31 PID 2588 wrote to memory of 2388 2588 lxfrlll.exe 31 PID 2588 wrote to memory of 2388 2588 lxfrlll.exe 31 PID 2588 wrote to memory of 2388 2588 lxfrlll.exe 31 PID 2388 wrote to memory of 1328 2388 ttnnbb.exe 32 PID 2388 wrote to memory of 1328 2388 ttnnbb.exe 32 PID 2388 wrote to memory of 1328 2388 ttnnbb.exe 32 PID 2388 wrote to memory of 1328 2388 ttnnbb.exe 32 PID 1328 wrote to memory of 2528 1328 vpppv.exe 33 PID 1328 wrote to memory of 2528 1328 vpppv.exe 33 PID 1328 wrote to memory of 2528 1328 vpppv.exe 33 PID 1328 wrote to memory of 2528 1328 vpppv.exe 33 PID 2528 wrote to memory of 580 2528 ddjvv.exe 34 PID 2528 wrote to memory of 580 2528 ddjvv.exe 34 PID 2528 wrote to memory of 580 2528 ddjvv.exe 34 PID 2528 wrote to memory of 580 2528 ddjvv.exe 34 PID 580 wrote to memory of 2828 580 pjdvd.exe 35 PID 580 wrote to memory of 2828 580 pjdvd.exe 35 PID 580 wrote to memory of 2828 580 pjdvd.exe 35 PID 580 wrote to memory of 2828 580 pjdvd.exe 35 PID 2828 wrote to memory of 2744 2828 lxlrrlx.exe 36 PID 2828 wrote to memory of 2744 2828 lxlrrlx.exe 36 PID 2828 wrote to memory of 2744 2828 lxlrrlx.exe 36 PID 2828 wrote to memory of 2744 2828 lxlrrlx.exe 36 PID 2744 wrote to memory of 2892 2744 fxllrlx.exe 37 PID 2744 wrote to memory of 2892 2744 fxllrlx.exe 37 PID 2744 wrote to memory of 2892 2744 fxllrlx.exe 37 PID 2744 wrote to memory of 2892 2744 fxllrlx.exe 37 PID 2892 wrote to memory of 2656 2892 jdjpv.exe 38 PID 2892 wrote to memory of 2656 2892 jdjpv.exe 38 PID 2892 wrote to memory of 2656 2892 jdjpv.exe 38 PID 2892 wrote to memory of 2656 2892 jdjpv.exe 38 PID 2656 wrote to memory of 2616 2656 xfxlxxl.exe 39 PID 2656 wrote to memory of 2616 2656 xfxlxxl.exe 39 PID 2656 wrote to memory of 2616 2656 xfxlxxl.exe 39 PID 2656 wrote to memory of 2616 2656 xfxlxxl.exe 39 PID 2616 wrote to memory of 2740 2616 tttbth.exe 40 PID 2616 wrote to memory of 2740 2616 tttbth.exe 40 PID 2616 wrote to memory of 2740 2616 tttbth.exe 40 PID 2616 wrote to memory of 2740 2616 tttbth.exe 40 PID 2740 wrote to memory of 2180 2740 bbbbbh.exe 41 PID 2740 wrote to memory of 2180 2740 bbbbbh.exe 41 PID 2740 wrote to memory of 2180 2740 bbbbbh.exe 41 PID 2740 wrote to memory of 2180 2740 bbbbbh.exe 41 PID 2180 wrote to memory of 972 2180 5jpjv.exe 42 PID 2180 wrote to memory of 972 2180 5jpjv.exe 42 PID 2180 wrote to memory of 972 2180 5jpjv.exe 42 PID 2180 wrote to memory of 972 2180 5jpjv.exe 42 PID 972 wrote to memory of 1668 972 tntnnn.exe 43 PID 972 wrote to memory of 1668 972 tntnnn.exe 43 PID 972 wrote to memory of 1668 972 tntnnn.exe 43 PID 972 wrote to memory of 1668 972 tntnnn.exe 43 PID 1668 wrote to memory of 1684 1668 jdpdd.exe 44 PID 1668 wrote to memory of 1684 1668 jdpdd.exe 44 PID 1668 wrote to memory of 1684 1668 jdpdd.exe 44 PID 1668 wrote to memory of 1684 1668 jdpdd.exe 44 PID 1684 wrote to memory of 1872 1684 rfrrxxf.exe 45 PID 1684 wrote to memory of 1872 1684 rfrrxxf.exe 45 PID 1684 wrote to memory of 1872 1684 rfrrxxf.exe 45 PID 1684 wrote to memory of 1872 1684 rfrrxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe"C:\Users\Admin\AppData\Local\Temp\4e927e722283600038f8bab446ca1879b780759e4c8e4d58db470604dd2b2229.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\lxfrlll.exec:\lxfrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\ttnnbb.exec:\ttnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\vpppv.exec:\vpppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\ddjvv.exec:\ddjvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pjdvd.exec:\pjdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\lxlrrlx.exec:\lxlrrlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxllrlx.exec:\fxllrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jdjpv.exec:\jdjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tttbth.exec:\tttbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bbbbbh.exec:\bbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5jpjv.exec:\5jpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\tntnnn.exec:\tntnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\jdpdd.exec:\jdpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\rfrrxxf.exec:\rfrrxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\fxfxxll.exec:\fxfxxll.exe17⤵
- Executes dropped EXE
PID:1872 -
\??\c:\ddjpp.exec:\ddjpp.exe18⤵
- Executes dropped EXE
PID:1152 -
\??\c:\ddddp.exec:\ddddp.exe19⤵
- Executes dropped EXE
PID:400 -
\??\c:\jvjdp.exec:\jvjdp.exe20⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xlxxffl.exec:\xlxxffl.exe21⤵
- Executes dropped EXE
PID:2288 -
\??\c:\9pvvj.exec:\9pvvj.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\htbbbt.exec:\htbbbt.exe23⤵
- Executes dropped EXE
PID:348 -
\??\c:\vpvdd.exec:\vpvdd.exe24⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vpdvj.exec:\vpdvj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:532 -
\??\c:\ddvjv.exec:\ddvjv.exe26⤵
- Executes dropped EXE
PID:832 -
\??\c:\rlxfllr.exec:\rlxfllr.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:600 -
\??\c:\vpdpv.exec:\vpdpv.exe28⤵
- Executes dropped EXE
PID:568 -
\??\c:\bnbhnn.exec:\bnbhnn.exe29⤵
- Executes dropped EXE
PID:3064 -
\??\c:\djvdv.exec:\djvdv.exe30⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ntnhnn.exec:\ntnhnn.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:628 -
\??\c:\vpvdp.exec:\vpvdp.exe32⤵
- Executes dropped EXE
PID:548 -
\??\c:\1jdvv.exec:\1jdvv.exe33⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5btbhh.exec:\5btbhh.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lflllll.exec:\lflllll.exe35⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5llxxxx.exec:\5llxxxx.exe36⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5bnthh.exec:\5bnthh.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hthbbt.exec:\hthbbt.exe38⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jddvd.exec:\jddvd.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\lxflllr.exec:\lxflllr.exe40⤵
- Executes dropped EXE
PID:2236 -
\??\c:\bthbhh.exec:\bthbhh.exe41⤵
- Executes dropped EXE
PID:2876 -
\??\c:\btnntt.exec:\btnntt.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpjpv.exec:\vpjpv.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\xlflllr.exec:\xlflllr.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hnhtbh.exec:\hnhtbh.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhbbhh.exec:\hhbbhh.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjddp.exec:\pjddp.exe47⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5lxxfff.exec:\5lxxfff.exe48⤵
- Executes dropped EXE
PID:2264 -
\??\c:\llflrrx.exec:\llflrrx.exe49⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nbntnn.exec:\nbntnn.exe50⤵
- Executes dropped EXE
PID:980 -
\??\c:\vvjjp.exec:\vvjjp.exe51⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe52⤵
- Executes dropped EXE
PID:2096 -
\??\c:\fxfflrl.exec:\fxfflrl.exe53⤵
- Executes dropped EXE
PID:1736 -
\??\c:\3ntntn.exec:\3ntntn.exe54⤵
- Executes dropped EXE
PID:1204 -
\??\c:\1pjjd.exec:\1pjjd.exe55⤵
- Executes dropped EXE
PID:2604 -
\??\c:\dvjpv.exec:\dvjpv.exe56⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe57⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bnhbnh.exec:\bnhbnh.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jvpvd.exec:\jvpvd.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2336 -
\??\c:\rfrrxfr.exec:\rfrrxfr.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe61⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tnhntb.exec:\tnhntb.exe62⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tnbbbt.exec:\tnbbbt.exe63⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pdjpv.exec:\pdjpv.exe64⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlxxffl.exec:\rlxxffl.exe65⤵
- Executes dropped EXE
PID:584 -
\??\c:\xrfrxxx.exec:\xrfrxxx.exe66⤵PID:2448
-
\??\c:\hbttbb.exec:\hbttbb.exe67⤵PID:2072
-
\??\c:\5jvpp.exec:\5jvpp.exe68⤵PID:2280
-
\??\c:\xrlrxxf.exec:\xrlrxxf.exe69⤵PID:2224
-
\??\c:\lxrfllr.exec:\lxrfllr.exe70⤵PID:1844
-
\??\c:\nbtbnh.exec:\nbtbnh.exe71⤵PID:2212
-
\??\c:\9vpdp.exec:\9vpdp.exe72⤵PID:2100
-
\??\c:\9vjjd.exec:\9vjjd.exe73⤵PID:1520
-
\??\c:\5rllrrx.exec:\5rllrrx.exe74⤵PID:2124
-
\??\c:\bbtntt.exec:\bbtntt.exe75⤵PID:2572
-
\??\c:\hhbhbb.exec:\hhbhbb.exe76⤵PID:1712
-
\??\c:\vjvvd.exec:\vjvvd.exe77⤵PID:2328
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe78⤵PID:1900
-
\??\c:\nnhhnn.exec:\nnhhnn.exe79⤵PID:3056
-
\??\c:\nhttbb.exec:\nhttbb.exe80⤵PID:2980
-
\??\c:\9pjpv.exec:\9pjpv.exe81⤵PID:2172
-
\??\c:\rlffllx.exec:\rlffllx.exe82⤵PID:2300
-
\??\c:\llrrxxl.exec:\llrrxxl.exe83⤵PID:2828
-
\??\c:\hbnnbb.exec:\hbnnbb.exe84⤵PID:2216
-
\??\c:\vjjpp.exec:\vjjpp.exe85⤵PID:2736
-
\??\c:\7xrffxf.exec:\7xrffxf.exe86⤵PID:2860
-
\??\c:\llflxxx.exec:\llflxxx.exe87⤵PID:2664
-
\??\c:\thbntb.exec:\thbntb.exe88⤵PID:2632
-
\??\c:\9jjjv.exec:\9jjjv.exe89⤵PID:2684
-
\??\c:\pjdpj.exec:\pjdpj.exe90⤵PID:2176
-
\??\c:\rxrxxrx.exec:\rxrxxrx.exe91⤵PID:2788
-
\??\c:\nhthnn.exec:\nhthnn.exe92⤵PID:2264
-
\??\c:\bhtnth.exec:\bhtnth.exe93⤵PID:2856
-
\??\c:\7vjjv.exec:\7vjjv.exe94⤵PID:1668
-
\??\c:\xxflxxf.exec:\xxflxxf.exe95⤵PID:1956
-
\??\c:\xrflxxf.exec:\xrflxxf.exe96⤵PID:1864
-
\??\c:\1bbttt.exec:\1bbttt.exe97⤵PID:1696
-
\??\c:\vvpvj.exec:\vvpvj.exe98⤵PID:1536
-
\??\c:\dvdvd.exec:\dvdvd.exe99⤵PID:316
-
\??\c:\7frxfff.exec:\7frxfff.exe100⤵PID:1040
-
\??\c:\bnhntb.exec:\bnhntb.exe101⤵PID:288
-
\??\c:\7nbbhh.exec:\7nbbhh.exe102⤵PID:2920
-
\??\c:\vjppp.exec:\vjppp.exe103⤵PID:2276
-
\??\c:\1xxxlrr.exec:\1xxxlrr.exe104⤵PID:820
-
\??\c:\rfrxfff.exec:\rfrxfff.exe105⤵PID:2184
-
\??\c:\hthntt.exec:\hthntt.exe106⤵PID:1916
-
\??\c:\vpjpp.exec:\vpjpp.exe107⤵PID:1140
-
\??\c:\jdvvd.exec:\jdvvd.exe108⤵PID:2292
-
\??\c:\5xflfxf.exec:\5xflfxf.exe109⤵PID:1564
-
\??\c:\9btbbh.exec:\9btbbh.exe110⤵PID:832
-
\??\c:\3vdvv.exec:\3vdvv.exe111⤵PID:1788
-
\??\c:\7rrrxxx.exec:\7rrrxxx.exe112⤵PID:2068
-
\??\c:\3rfxffl.exec:\3rfxffl.exe113⤵PID:568
-
\??\c:\nhnnnt.exec:\nhnnnt.exe114⤵PID:2472
-
\??\c:\9vjdj.exec:\9vjdj.exe115⤵PID:696
-
\??\c:\ddvdv.exec:\ddvdv.exe116⤵PID:628
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe117⤵PID:548
-
\??\c:\hnbhnt.exec:\hnbhnt.exe118⤵PID:2192
-
\??\c:\nnhnbb.exec:\nnhnbb.exe119⤵PID:2412
-
\??\c:\dpjpp.exec:\dpjpp.exe120⤵PID:2416
-
\??\c:\3xxxflx.exec:\3xxxflx.exe121⤵PID:2424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-