Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe
-
Size
455KB
-
MD5
2aa10351042c1c275e202bcbfaa936ab
-
SHA1
6a37b3189a38345ebb88917f4ed8b6b93ae91846
-
SHA256
214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1
-
SHA512
c6bb954350530837b3de73ef696a7dbd5c9ae2f798449a2a8990202727ab5af34b4d0e7d984bb457cc7f9bb7a419806648321db9fb5d2ad97213cb9b77ecc8fa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/1704-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1680-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-189-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2172-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1708-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-504-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2728-629-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-703-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-728-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-909-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/840-927-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1020-1041-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-1142-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-1164-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-1172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2072 flxxffr.exe 2692 ppjpd.exe 1680 nhtbnn.exe 1964 jpdpv.exe 2808 bnhhnt.exe 2764 tnhhnn.exe 2848 jvpjj.exe 2928 lfxfrxf.exe 2780 pjvvv.exe 2628 9xlfxfr.exe 2304 tnbbhn.exe 576 xrllxxf.exe 2900 hbnnhb.exe 1080 5rlllrx.exe 984 bthhnt.exe 2912 jvppp.exe 1916 xrflrfr.exe 1908 bthnbh.exe 2176 ppjvj.exe 3060 fxrrrff.exe 2172 btnttb.exe 2708 djvdp.exe 2140 htnnnh.exe 2992 nbthtt.exe 692 lfrxlrx.exe 696 xrxxxxx.exe 1792 pdddd.exe 1708 rfrrxxx.exe 3016 bbnntb.exe 2376 dpjjj.exe 876 tthbhn.exe 1712 pdpjd.exe 2404 3ttbtb.exe 2540 9bnhht.exe 2384 7jjpp.exe 2968 lxxfrrx.exe 2232 tbhtbn.exe 2824 1hhnnn.exe 2740 7pvvv.exe 2616 7jppj.exe 2728 xlxllfx.exe 2788 nntnbt.exe 316 1djjv.exe 2844 xrllxrf.exe 1424 rfrrxfl.exe 840 hthnhn.exe 1488 dvjvp.exe 1716 jjjdp.exe 576 rrfrlrl.exe 2432 bnbbbb.exe 2428 1pjpp.exe 1468 jjjpv.exe 2712 1ffflrr.exe 2896 5bbhnn.exe 1652 thbhnn.exe 1920 ddppj.exe 3064 xrllrfr.exe 2176 nhtbnh.exe 2164 3vvvd.exe 980 7pvjv.exe 1936 xrlrllf.exe 2592 9hbntt.exe 748 3nbhtn.exe 2004 1jjdv.exe -
resource yara_rule behavioral1/memory/1704-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/748-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-703-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-741-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-754-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-865-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-890-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-927-0x00000000001C0000-0x00000000001EA000-memory.dmp upx behavioral1/memory/2700-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-1115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-1142-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2672-1175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-1194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-1267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-1280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-1306-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2072 1704 214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe 30 PID 1704 wrote to memory of 2072 1704 214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe 30 PID 1704 wrote to memory of 2072 1704 214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe 30 PID 1704 wrote to memory of 2072 1704 214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe 30 PID 2072 wrote to memory of 2692 2072 flxxffr.exe 31 PID 2072 wrote to memory of 2692 2072 flxxffr.exe 31 PID 2072 wrote to memory of 2692 2072 flxxffr.exe 31 PID 2072 wrote to memory of 2692 2072 flxxffr.exe 31 PID 2692 wrote to memory of 1680 2692 ppjpd.exe 32 PID 2692 wrote to memory of 1680 2692 ppjpd.exe 32 PID 2692 wrote to memory of 1680 2692 ppjpd.exe 32 PID 2692 wrote to memory of 1680 2692 ppjpd.exe 32 PID 1680 wrote to memory of 1964 1680 nhtbnn.exe 33 PID 1680 wrote to memory of 1964 1680 nhtbnn.exe 33 PID 1680 wrote to memory of 1964 1680 nhtbnn.exe 33 PID 1680 wrote to memory of 1964 1680 nhtbnn.exe 33 PID 1964 wrote to memory of 2808 1964 jpdpv.exe 34 PID 1964 wrote to memory of 2808 1964 jpdpv.exe 34 PID 1964 wrote to memory of 2808 1964 jpdpv.exe 34 PID 1964 wrote to memory of 2808 1964 jpdpv.exe 34 PID 2808 wrote to memory of 2764 2808 bnhhnt.exe 35 PID 2808 wrote to memory of 2764 2808 bnhhnt.exe 35 PID 2808 wrote to memory of 2764 2808 bnhhnt.exe 35 PID 2808 wrote to memory of 2764 2808 bnhhnt.exe 35 PID 2764 wrote to memory of 2848 2764 tnhhnn.exe 36 PID 2764 wrote to memory of 2848 2764 tnhhnn.exe 36 PID 2764 wrote to memory of 2848 2764 tnhhnn.exe 36 PID 2764 wrote to memory of 2848 2764 tnhhnn.exe 36 PID 2848 wrote to memory of 2928 2848 jvpjj.exe 37 PID 2848 wrote to memory of 2928 2848 jvpjj.exe 37 PID 2848 wrote to memory of 2928 2848 jvpjj.exe 37 PID 2848 wrote to memory of 2928 2848 jvpjj.exe 37 PID 2928 wrote to memory of 2780 2928 lfxfrxf.exe 38 PID 2928 wrote to memory of 2780 2928 lfxfrxf.exe 38 PID 2928 wrote to memory of 2780 2928 lfxfrxf.exe 38 PID 2928 wrote to memory of 2780 2928 lfxfrxf.exe 38 PID 2780 wrote to memory of 2628 2780 pjvvv.exe 39 PID 2780 wrote to memory of 2628 2780 pjvvv.exe 39 PID 2780 wrote to memory of 2628 2780 pjvvv.exe 39 PID 2780 wrote to memory of 2628 2780 pjvvv.exe 39 PID 2628 wrote to memory of 2304 2628 9xlfxfr.exe 40 PID 2628 wrote to memory of 2304 2628 9xlfxfr.exe 40 PID 2628 wrote to memory of 2304 2628 9xlfxfr.exe 40 PID 2628 wrote to memory of 2304 2628 9xlfxfr.exe 40 PID 2304 wrote to memory of 576 2304 tnbbhn.exe 41 PID 2304 wrote to memory of 576 2304 tnbbhn.exe 41 PID 2304 wrote to memory of 576 2304 tnbbhn.exe 41 PID 2304 wrote to memory of 576 2304 tnbbhn.exe 41 PID 576 wrote to memory of 2900 576 xrllxxf.exe 42 PID 576 wrote to memory of 2900 576 xrllxxf.exe 42 PID 576 wrote to memory of 2900 576 xrllxxf.exe 42 PID 576 wrote to memory of 2900 576 xrllxxf.exe 42 PID 2900 wrote to memory of 1080 2900 hbnnhb.exe 43 PID 2900 wrote to memory of 1080 2900 hbnnhb.exe 43 PID 2900 wrote to memory of 1080 2900 hbnnhb.exe 43 PID 2900 wrote to memory of 1080 2900 hbnnhb.exe 43 PID 1080 wrote to memory of 984 1080 5rlllrx.exe 44 PID 1080 wrote to memory of 984 1080 5rlllrx.exe 44 PID 1080 wrote to memory of 984 1080 5rlllrx.exe 44 PID 1080 wrote to memory of 984 1080 5rlllrx.exe 44 PID 984 wrote to memory of 2912 984 bthhnt.exe 45 PID 984 wrote to memory of 2912 984 bthhnt.exe 45 PID 984 wrote to memory of 2912 984 bthhnt.exe 45 PID 984 wrote to memory of 2912 984 bthhnt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe"C:\Users\Admin\AppData\Local\Temp\214dda02c358719bca968f965f15dc572619c3f140e581bac155eb09a9b946b1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\flxxffr.exec:\flxxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ppjpd.exec:\ppjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\nhtbnn.exec:\nhtbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\jpdpv.exec:\jpdpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bnhhnt.exec:\bnhhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\tnhhnn.exec:\tnhhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jvpjj.exec:\jvpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lfxfrxf.exec:\lfxfrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\pjvvv.exec:\pjvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9xlfxfr.exec:\9xlfxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\tnbbhn.exec:\tnbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\xrllxxf.exec:\xrllxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\hbnnhb.exec:\hbnnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\5rlllrx.exec:\5rlllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\bthhnt.exec:\bthhnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\jvppp.exec:\jvppp.exe17⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrflrfr.exec:\xrflrfr.exe18⤵
- Executes dropped EXE
PID:1916 -
\??\c:\bthnbh.exec:\bthnbh.exe19⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ppjvj.exec:\ppjvj.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\fxrrrff.exec:\fxrrrff.exe21⤵
- Executes dropped EXE
PID:3060 -
\??\c:\btnttb.exec:\btnttb.exe22⤵
- Executes dropped EXE
PID:2172 -
\??\c:\djvdp.exec:\djvdp.exe23⤵
- Executes dropped EXE
PID:2708 -
\??\c:\htnnnh.exec:\htnnnh.exe24⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nbthtt.exec:\nbthtt.exe25⤵
- Executes dropped EXE
PID:2992 -
\??\c:\lfrxlrx.exec:\lfrxlrx.exe26⤵
- Executes dropped EXE
PID:692 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe27⤵
- Executes dropped EXE
PID:696 -
\??\c:\pdddd.exec:\pdddd.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rfrrxxx.exec:\rfrrxxx.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bbnntb.exec:\bbnntb.exe30⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dpjjj.exec:\dpjjj.exe31⤵
- Executes dropped EXE
PID:2376 -
\??\c:\tthbhn.exec:\tthbhn.exe32⤵
- Executes dropped EXE
PID:876 -
\??\c:\pdpjd.exec:\pdpjd.exe33⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3ttbtb.exec:\3ttbtb.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9bnhht.exec:\9bnhht.exe35⤵
- Executes dropped EXE
PID:2540 -
\??\c:\7jjpp.exec:\7jjpp.exe36⤵
- Executes dropped EXE
PID:2384 -
\??\c:\lxxfrrx.exec:\lxxfrrx.exe37⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tbhtbn.exec:\tbhtbn.exe38⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1hhnnn.exec:\1hhnnn.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7pvvv.exec:\7pvvv.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7jppj.exec:\7jppj.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xlxllfx.exec:\xlxllfx.exe42⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nntnbt.exec:\nntnbt.exe43⤵
- Executes dropped EXE
PID:2788 -
\??\c:\1djjv.exec:\1djjv.exe44⤵
- Executes dropped EXE
PID:316 -
\??\c:\xrllxrf.exec:\xrllxrf.exe45⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\hthnhn.exec:\hthnhn.exe47⤵
- Executes dropped EXE
PID:840 -
\??\c:\dvjvp.exec:\dvjvp.exe48⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jjjdp.exec:\jjjdp.exe49⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rrfrlrl.exec:\rrfrlrl.exe50⤵
- Executes dropped EXE
PID:576 -
\??\c:\bnbbbb.exec:\bnbbbb.exe51⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1pjpp.exec:\1pjpp.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2428 -
\??\c:\jjjpv.exec:\jjjpv.exe53⤵
- Executes dropped EXE
PID:1468 -
\??\c:\1ffflrr.exec:\1ffflrr.exe54⤵
- Executes dropped EXE
PID:2712 -
\??\c:\5bbhnn.exec:\5bbhnn.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\thbhnn.exec:\thbhnn.exe56⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ddppj.exec:\ddppj.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrllrfr.exec:\xrllrfr.exe58⤵
- Executes dropped EXE
PID:3064 -
\??\c:\nhtbnh.exec:\nhtbnh.exe59⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3vvvd.exec:\3vvvd.exe60⤵
- Executes dropped EXE
PID:2164 -
\??\c:\7pvjv.exec:\7pvjv.exe61⤵
- Executes dropped EXE
PID:980 -
\??\c:\xrlrllf.exec:\xrlrllf.exe62⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9hbntt.exec:\9hbntt.exe63⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3nbhtn.exec:\3nbhtn.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\1jjdv.exec:\1jjdv.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1vddj.exec:\1vddj.exe66⤵PID:1368
-
\??\c:\lfrfrrf.exec:\lfrfrrf.exe67⤵PID:1992
-
\??\c:\bthhnt.exec:\bthhnt.exe68⤵PID:2272
-
\??\c:\jdpvd.exec:\jdpvd.exe69⤵PID:564
-
\??\c:\1fxxrlr.exec:\1fxxrlr.exe70⤵PID:1912
-
\??\c:\ffxrrrf.exec:\ffxrrrf.exe71⤵PID:1272
-
\??\c:\5htthn.exec:\5htthn.exe72⤵PID:608
-
\??\c:\1jvjp.exec:\1jvjp.exe73⤵PID:2376
-
\??\c:\pjvvj.exec:\pjvvj.exe74⤵PID:2528
-
\??\c:\frfxxxl.exec:\frfxxxl.exe75⤵PID:2388
-
\??\c:\nbntnn.exec:\nbntnn.exe76⤵PID:1548
-
\??\c:\bthhtt.exec:\bthhtt.exe77⤵PID:1616
-
\??\c:\dddjj.exec:\dddjj.exe78⤵PID:2252
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe79⤵PID:2704
-
\??\c:\fxxlxrx.exec:\fxxlxrx.exe80⤵PID:588
-
\??\c:\9hhtnn.exec:\9hhtnn.exe81⤵PID:2232
-
\??\c:\hbbbhn.exec:\hbbbhn.exe82⤵PID:2824
-
\??\c:\jpjvp.exec:\jpjvp.exe83⤵PID:1968
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe84⤵PID:2860
-
\??\c:\nhbntt.exec:\nhbntt.exe85⤵PID:2728
-
\??\c:\3httth.exec:\3httth.exe86⤵PID:2632
-
\??\c:\jdppd.exec:\jdppd.exe87⤵PID:316
-
\??\c:\rfxxxxf.exec:\rfxxxxf.exe88⤵
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\lfrrllx.exec:\lfrrllx.exe89⤵PID:2344
-
\??\c:\htbbhb.exec:\htbbhb.exe90⤵PID:1340
-
\??\c:\vpddp.exec:\vpddp.exe91⤵PID:1516
-
\??\c:\vvvjp.exec:\vvvjp.exe92⤵PID:2948
-
\??\c:\xflxrfl.exec:\xflxrfl.exe93⤵PID:1692
-
\??\c:\bbnbhn.exec:\bbnbhn.exe94⤵PID:1180
-
\??\c:\7btnnn.exec:\7btnnn.exe95⤵PID:1072
-
\??\c:\ddpdv.exec:\ddpdv.exe96⤵PID:2660
-
\??\c:\frxrllx.exec:\frxrllx.exe97⤵PID:1952
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe98⤵PID:2076
-
\??\c:\1bbbbt.exec:\1bbbbt.exe99⤵PID:2024
-
\??\c:\7bnhnn.exec:\7bnhnn.exe100⤵PID:2648
-
\??\c:\3djjj.exec:\3djjj.exe101⤵PID:2156
-
\??\c:\lllrrll.exec:\lllrrll.exe102⤵PID:1044
-
\??\c:\1tbhnn.exec:\1tbhnn.exe103⤵PID:3060
-
\??\c:\vpddp.exec:\vpddp.exe104⤵PID:2268
-
\??\c:\pjvdj.exec:\pjvdj.exe105⤵PID:2188
-
\??\c:\rfllllx.exec:\rfllllx.exe106⤵PID:1776
-
\??\c:\tthhhh.exec:\tthhhh.exe107⤵PID:2800
-
\??\c:\nhtbhn.exec:\nhtbhn.exe108⤵PID:1596
-
\??\c:\jvjpv.exec:\jvjpv.exe109⤵PID:1760
-
\??\c:\rrfxxrx.exec:\rrfxxrx.exe110⤵PID:768
-
\??\c:\rlffrrx.exec:\rlffrrx.exe111⤵PID:2392
-
\??\c:\1nbhtb.exec:\1nbhtb.exe112⤵PID:1792
-
\??\c:\djjpv.exec:\djjpv.exe113⤵PID:1708
-
\??\c:\llllllf.exec:\llllllf.exe114⤵PID:1472
-
\??\c:\5rlrffl.exec:\5rlrffl.exe115⤵PID:280
-
\??\c:\hhbbnn.exec:\hhbbnn.exe116⤵PID:2524
-
\??\c:\vpdjj.exec:\vpdjj.exe117⤵PID:340
-
\??\c:\vppvd.exec:\vppvd.exe118⤵PID:876
-
\??\c:\xrlfrxf.exec:\xrlfrxf.exe119⤵PID:2972
-
\??\c:\frxxfxl.exec:\frxxfxl.exe120⤵PID:1584
-
\??\c:\hbhhtt.exec:\hbhhtt.exe121⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-