Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe
-
Size
455KB
-
MD5
842f1b59474a8fd6c9b8df75d0e2d022
-
SHA1
d25ec17ab3e95ba1455d27633b0d02dc09619883
-
SHA256
b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a
-
SHA512
fb04140e6f9bf4985260f85f2f962c5fe8286debf8184b8d3d403c3b946b4980076bebcd6f55b1332351dc54c287ffb93a7dbeb24c748e7186e878fa61b37fed
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 48 IoCs
resource yara_rule behavioral1/memory/2216-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1032-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-111-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1900-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-199-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/852-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-387-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1484-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-414-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1388-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-584-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2528-633-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3048-640-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1928-742-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-798-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-812-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2460-826-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1908-1021-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-1027-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-1208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/960-1227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 bhnbbb.exe 2688 rlflxxl.exe 2968 dpjdj.exe 2824 3rlrrfx.exe 2644 tnhnbh.exe 2564 ppjpv.exe 2584 jvpjd.exe 1032 ppvjd.exe 2956 lfflrlf.exe 2120 thbhtt.exe 2852 ffxrrlx.exe 1348 5bnbth.exe 1900 9rlxrff.exe 2832 jppvp.exe 2876 xfrfllx.exe 2228 tntbnh.exe 1920 thnttt.exe 1908 9dpjv.exe 2176 5ntttt.exe 2224 3pddp.exe 852 nthttn.exe 3024 xxrrfxf.exe 564 thbbnb.exe 2256 vpddj.exe 1768 tnntnt.exe 1724 hhbthb.exe 2460 7djvj.exe 2400 1rrfrrf.exe 1644 1nhnth.exe 3000 ffrxllx.exe 1664 hntntn.exe 896 lllxrll.exe 2672 nnthnn.exe 2792 ppjdp.exe 2408 rlffxxl.exe 2972 nnhnht.exe 2736 1vjpd.exe 2968 lrrfxrr.exe 2696 1nbhtb.exe 2560 vdpvj.exe 2416 xrlxffx.exe 2564 xffxrxl.exe 1636 ttbbnb.exe 1040 9pjvd.exe 2376 lrrfrxr.exe 2124 thtthh.exe 1680 9vpvj.exe 1484 lrxlrfx.exe 332 7thnbh.exe 2420 ppdpj.exe 1976 5lrffxf.exe 808 nbbnht.exe 1336 ddvjp.exe 2768 1ttbnb.exe 1688 nhnthh.exe 1936 djjvp.exe 1920 ffxfrxr.exe 2184 htbhnh.exe 2020 1djpv.exe 976 xxxfrfx.exe 1916 lllxrfx.exe 852 hhnnbh.exe 3024 djvpd.exe 3008 fxflxll.exe -
resource yara_rule behavioral1/memory/2216-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-584-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2800-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-798-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-871-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2044-970-0x0000000000530000-0x000000000055A000-memory.dmp upx behavioral1/memory/1908-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-1027-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1372-1030-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-1122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-1177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-1208-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/960-1227-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lflrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2744 2216 b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe 30 PID 2216 wrote to memory of 2744 2216 b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe 30 PID 2216 wrote to memory of 2744 2216 b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe 30 PID 2216 wrote to memory of 2744 2216 b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe 30 PID 2744 wrote to memory of 2688 2744 bhnbbb.exe 31 PID 2744 wrote to memory of 2688 2744 bhnbbb.exe 31 PID 2744 wrote to memory of 2688 2744 bhnbbb.exe 31 PID 2744 wrote to memory of 2688 2744 bhnbbb.exe 31 PID 2688 wrote to memory of 2968 2688 rlflxxl.exe 32 PID 2688 wrote to memory of 2968 2688 rlflxxl.exe 32 PID 2688 wrote to memory of 2968 2688 rlflxxl.exe 32 PID 2688 wrote to memory of 2968 2688 rlflxxl.exe 32 PID 2968 wrote to memory of 2824 2968 dpjdj.exe 33 PID 2968 wrote to memory of 2824 2968 dpjdj.exe 33 PID 2968 wrote to memory of 2824 2968 dpjdj.exe 33 PID 2968 wrote to memory of 2824 2968 dpjdj.exe 33 PID 2824 wrote to memory of 2644 2824 3rlrrfx.exe 34 PID 2824 wrote to memory of 2644 2824 3rlrrfx.exe 34 PID 2824 wrote to memory of 2644 2824 3rlrrfx.exe 34 PID 2824 wrote to memory of 2644 2824 3rlrrfx.exe 34 PID 2644 wrote to memory of 2564 2644 tnhnbh.exe 35 PID 2644 wrote to memory of 2564 2644 tnhnbh.exe 35 PID 2644 wrote to memory of 2564 2644 tnhnbh.exe 35 PID 2644 wrote to memory of 2564 2644 tnhnbh.exe 35 PID 2564 wrote to memory of 2584 2564 ppjpv.exe 36 PID 2564 wrote to memory of 2584 2564 ppjpv.exe 36 PID 2564 wrote to memory of 2584 2564 ppjpv.exe 36 PID 2564 wrote to memory of 2584 2564 ppjpv.exe 36 PID 2584 wrote to memory of 1032 2584 jvpjd.exe 37 PID 2584 wrote to memory of 1032 2584 jvpjd.exe 37 PID 2584 wrote to memory of 1032 2584 jvpjd.exe 37 PID 2584 wrote to memory of 1032 2584 jvpjd.exe 37 PID 1032 wrote to memory of 2956 1032 ppvjd.exe 38 PID 1032 wrote to memory of 2956 1032 ppvjd.exe 38 PID 1032 wrote to memory of 2956 1032 ppvjd.exe 38 PID 1032 wrote to memory of 2956 1032 ppvjd.exe 38 PID 2956 wrote to memory of 2120 2956 lfflrlf.exe 39 PID 2956 wrote to memory of 2120 2956 lfflrlf.exe 39 PID 2956 wrote to memory of 2120 2956 lfflrlf.exe 39 PID 2956 wrote to memory of 2120 2956 lfflrlf.exe 39 PID 2120 wrote to memory of 2852 2120 thbhtt.exe 40 PID 2120 wrote to memory of 2852 2120 thbhtt.exe 40 PID 2120 wrote to memory of 2852 2120 thbhtt.exe 40 PID 2120 wrote to memory of 2852 2120 thbhtt.exe 40 PID 2852 wrote to memory of 1348 2852 ffxrrlx.exe 41 PID 2852 wrote to memory of 1348 2852 ffxrrlx.exe 41 PID 2852 wrote to memory of 1348 2852 ffxrrlx.exe 41 PID 2852 wrote to memory of 1348 2852 ffxrrlx.exe 41 PID 1348 wrote to memory of 1900 1348 5bnbth.exe 42 PID 1348 wrote to memory of 1900 1348 5bnbth.exe 42 PID 1348 wrote to memory of 1900 1348 5bnbth.exe 42 PID 1348 wrote to memory of 1900 1348 5bnbth.exe 42 PID 1900 wrote to memory of 2832 1900 9rlxrff.exe 43 PID 1900 wrote to memory of 2832 1900 9rlxrff.exe 43 PID 1900 wrote to memory of 2832 1900 9rlxrff.exe 43 PID 1900 wrote to memory of 2832 1900 9rlxrff.exe 43 PID 2832 wrote to memory of 2876 2832 jppvp.exe 44 PID 2832 wrote to memory of 2876 2832 jppvp.exe 44 PID 2832 wrote to memory of 2876 2832 jppvp.exe 44 PID 2832 wrote to memory of 2876 2832 jppvp.exe 44 PID 2876 wrote to memory of 2228 2876 xfrfllx.exe 45 PID 2876 wrote to memory of 2228 2876 xfrfllx.exe 45 PID 2876 wrote to memory of 2228 2876 xfrfllx.exe 45 PID 2876 wrote to memory of 2228 2876 xfrfllx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe"C:\Users\Admin\AppData\Local\Temp\b35d0ff7d0311bf8a48fca17bfd2eeb08d5cfbaccac1b7a2f07a85cdba10175a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\bhnbbb.exec:\bhnbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\rlflxxl.exec:\rlflxxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\dpjdj.exec:\dpjdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\3rlrrfx.exec:\3rlrrfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\tnhnbh.exec:\tnhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\ppjpv.exec:\ppjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\jvpjd.exec:\jvpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ppvjd.exec:\ppvjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\lfflrlf.exec:\lfflrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\thbhtt.exec:\thbhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\ffxrrlx.exec:\ffxrrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5bnbth.exec:\5bnbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\9rlxrff.exec:\9rlxrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\jppvp.exec:\jppvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xfrfllx.exec:\xfrfllx.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\tntbnh.exec:\tntbnh.exe17⤵
- Executes dropped EXE
PID:2228 -
\??\c:\thnttt.exec:\thnttt.exe18⤵
- Executes dropped EXE
PID:1920 -
\??\c:\9dpjv.exec:\9dpjv.exe19⤵
- Executes dropped EXE
PID:1908 -
\??\c:\5ntttt.exec:\5ntttt.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3pddp.exec:\3pddp.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\nthttn.exec:\nthttn.exe22⤵
- Executes dropped EXE
PID:852 -
\??\c:\xxrrfxf.exec:\xxrrfxf.exe23⤵
- Executes dropped EXE
PID:3024 -
\??\c:\thbbnb.exec:\thbbnb.exe24⤵
- Executes dropped EXE
PID:564 -
\??\c:\vpddj.exec:\vpddj.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tnntnt.exec:\tnntnt.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\hhbthb.exec:\hhbthb.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7djvj.exec:\7djvj.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\1rrfrrf.exec:\1rrfrrf.exe29⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1nhnth.exec:\1nhnth.exe30⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ffrxllx.exec:\ffrxllx.exe31⤵
- Executes dropped EXE
PID:3000 -
\??\c:\hntntn.exec:\hntntn.exe32⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lllxrll.exec:\lllxrll.exe33⤵
- Executes dropped EXE
PID:896 -
\??\c:\nnthnn.exec:\nnthnn.exe34⤵
- Executes dropped EXE
PID:2672 -
\??\c:\ppjdp.exec:\ppjdp.exe35⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rlffxxl.exec:\rlffxxl.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\nnhnht.exec:\nnhnht.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1vjpd.exec:\1vjpd.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\lrrfxrr.exec:\lrrfxrr.exe39⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1nbhtb.exec:\1nbhtb.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vdpvj.exec:\vdpvj.exe41⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xrlxffx.exec:\xrlxffx.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xffxrxl.exec:\xffxrxl.exe43⤵
- Executes dropped EXE
PID:2564 -
\??\c:\ttbbnb.exec:\ttbbnb.exe44⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9pjvd.exec:\9pjvd.exe45⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lrrfrxr.exec:\lrrfrxr.exe46⤵
- Executes dropped EXE
PID:2376 -
\??\c:\thtthh.exec:\thtthh.exe47⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9vpvj.exec:\9vpvj.exe48⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lrxlrfx.exec:\lrxlrfx.exe49⤵
- Executes dropped EXE
PID:1484 -
\??\c:\7thnbh.exec:\7thnbh.exe50⤵
- Executes dropped EXE
PID:332 -
\??\c:\ppdpj.exec:\ppdpj.exe51⤵
- Executes dropped EXE
PID:2420 -
\??\c:\5lrffxf.exec:\5lrffxf.exe52⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nbbnht.exec:\nbbnht.exe53⤵
- Executes dropped EXE
PID:808 -
\??\c:\ddvjp.exec:\ddvjp.exe54⤵
- Executes dropped EXE
PID:1336 -
\??\c:\1ttbnb.exec:\1ttbnb.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhnthh.exec:\nhnthh.exe56⤵
- Executes dropped EXE
PID:1688 -
\??\c:\djjvp.exec:\djjvp.exe57⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe58⤵
- Executes dropped EXE
PID:1920 -
\??\c:\htbhnh.exec:\htbhnh.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\1djpv.exec:\1djpv.exe60⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xxxfrfx.exec:\xxxfrfx.exe61⤵
- Executes dropped EXE
PID:976 -
\??\c:\lllxrfx.exec:\lllxrfx.exe62⤵
- Executes dropped EXE
PID:1916 -
\??\c:\hhnnbh.exec:\hhnnbh.exe63⤵
- Executes dropped EXE
PID:852 -
\??\c:\djvpd.exec:\djvpd.exe64⤵
- Executes dropped EXE
PID:3024 -
\??\c:\fxflxll.exec:\fxflxll.exe65⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bhhthn.exec:\bhhthn.exe66⤵PID:2368
-
\??\c:\ttntht.exec:\ttntht.exe67⤵PID:2032
-
\??\c:\ppppd.exec:\ppppd.exe68⤵PID:2500
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe69⤵PID:1388
-
\??\c:\bbtbnt.exec:\bbtbnt.exe70⤵PID:2436
-
\??\c:\dddpv.exec:\dddpv.exe71⤵PID:1632
-
\??\c:\rlfrffr.exec:\rlfrffr.exe72⤵PID:1540
-
\??\c:\nnhtnn.exec:\nnhtnn.exe73⤵PID:1644
-
\??\c:\nnbhnh.exec:\nnbhnh.exe74⤵PID:700
-
\??\c:\djddp.exec:\djddp.exe75⤵PID:904
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe76⤵PID:896
-
\??\c:\nnbhnt.exec:\nnbhnt.exe77⤵PID:2760
-
\??\c:\jddjp.exec:\jddjp.exe78⤵PID:2808
-
\??\c:\fxfrxfl.exec:\fxfrxfl.exe79⤵PID:2640
-
\??\c:\bbtbnb.exec:\bbtbnb.exe80⤵PID:2788
-
\??\c:\djjdv.exec:\djjdv.exe81⤵PID:2568
-
\??\c:\rrrrxfl.exec:\rrrrxfl.exe82⤵PID:2704
-
\??\c:\3nnthn.exec:\3nnthn.exe83⤵PID:2800
-
\??\c:\1tnttt.exec:\1tnttt.exe84⤵PID:2528
-
\??\c:\ffflffx.exec:\ffflffx.exe85⤵PID:3048
-
\??\c:\bthnht.exec:\bthnht.exe86⤵PID:3040
-
\??\c:\dddpj.exec:\dddpj.exe87⤵PID:2920
-
\??\c:\rrrllxr.exec:\rrrllxr.exe88⤵PID:2160
-
\??\c:\lrrfrxf.exec:\lrrfrxf.exe89⤵PID:2936
-
\??\c:\nbttnt.exec:\nbttnt.exe90⤵PID:1260
-
\??\c:\dvpvp.exec:\dvpvp.exe91⤵PID:444
-
\??\c:\xxrxrxr.exec:\xxrxrxr.exe92⤵PID:864
-
\??\c:\llflfrf.exec:\llflfrf.exe93⤵PID:1980
-
\??\c:\hnhbbn.exec:\hnhbbn.exe94⤵PID:2248
-
\??\c:\vvvdv.exec:\vvvdv.exe95⤵PID:484
-
\??\c:\flxfrxr.exec:\flxfrxr.exe96⤵PID:1144
-
\??\c:\bnbhnn.exec:\bnbhnn.exe97⤵PID:2900
-
\??\c:\nhhhbb.exec:\nhhhbb.exe98⤵PID:1072
-
\??\c:\ttnhht.exec:\ttnhht.exe99⤵PID:2188
-
\??\c:\jvpjd.exec:\jvpjd.exe100⤵PID:2336
-
\??\c:\5rrxlfr.exec:\5rrxlfr.exe101⤵
- System Location Discovery: System Language Discovery
PID:1928 -
\??\c:\5xrlrxl.exec:\5xrlrxl.exe102⤵PID:1092
-
\??\c:\ddddv.exec:\ddddv.exe103⤵PID:2184
-
\??\c:\frllrxf.exec:\frllrxf.exe104⤵PID:2020
-
\??\c:\7nntnt.exec:\7nntnt.exe105⤵PID:1628
-
\??\c:\bhbbnt.exec:\bhbbnt.exe106⤵PID:1916
-
\??\c:\5pvvd.exec:\5pvvd.exe107⤵PID:1508
-
\??\c:\7xfrxfr.exec:\7xfrxfr.exe108⤵PID:3024
-
\??\c:\tbtnht.exec:\tbtnht.exe109⤵PID:1612
-
\??\c:\1nnbth.exec:\1nnbth.exe110⤵PID:1772
-
\??\c:\1vpvp.exec:\1vpvp.exe111⤵PID:2720
-
\??\c:\llfrfrx.exec:\llfrfrx.exe112⤵PID:2500
-
\??\c:\htbnht.exec:\htbnht.exe113⤵PID:3032
-
\??\c:\thhtbb.exec:\thhtbb.exe114⤵PID:2460
-
\??\c:\pppdd.exec:\pppdd.exe115⤵PID:2276
-
\??\c:\flllrff.exec:\flllrff.exe116⤵PID:1004
-
\??\c:\ttnthn.exec:\ttnthn.exe117⤵PID:1656
-
\??\c:\1bhbtb.exec:\1bhbtb.exe118⤵PID:700
-
\??\c:\vjddp.exec:\vjddp.exe119⤵PID:904
-
\??\c:\9jpdp.exec:\9jpdp.exe120⤵PID:2480
-
\??\c:\rlfxlrr.exec:\rlfxlrr.exe121⤵PID:1608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-