Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:13
Behavioral task
behavioral1
Sample
5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe
-
Size
335KB
-
MD5
8683e87330813c165d02f97299dc7480
-
SHA1
b102ae817d516feb9e5d776fbad4e911c97d6fa4
-
SHA256
5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1d
-
SHA512
1e3f947e673874e84bf29e95b9c8c601f05dd0a786236abf648ff4f65f433a643321b21eee5ee876a7fea38227583306e424f6abce0a6aa543b28e3bac0ba691
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwfsDX2UznsaFVNJCMKAbe4GE:R4wFHoSHYHUrAwfMp3CD4GE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/2504-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2276-49-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2276-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2676-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1308-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1908-145-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1248-156-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1340-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2636-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2308-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-199-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/920-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1700-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-232-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3068-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2348-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1920-321-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2764-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-357-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2872-373-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3024-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-390-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1632-401-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2104-418-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1632-417-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1248-429-0x00000000002C0000-0x00000000002E7000-memory.dmp family_blackmoon behavioral1/memory/860-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/264-515-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/1812-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-607-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-615-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/692-661-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2512-703-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2268-724-0x0000000000260000-0x0000000000287000-memory.dmp family_blackmoon behavioral1/memory/1696-748-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2312-902-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-913-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-986-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2480-1081-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/548-9475-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/548-14556-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/548-15108-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 dvjjp.exe 2348 tntbhh.exe 1864 pvpvj.exe 2056 1lrrrrx.exe 2276 hbntbb.exe 2772 9vvjv.exe 2676 xlxffxl.exe 2576 thnnbb.exe 2656 pdvjv.exe 2704 ffflrxl.exe 2564 nhtntt.exe 2976 ddpdp.exe 2992 xxlxlll.exe 1632 thttbh.exe 1748 vvddj.exe 1308 xrfflff.exe 1908 nhntbb.exe 1248 dvjpp.exe 1340 xrfxlrl.exe 1388 bttntn.exe 2636 9vjdj.exe 2308 5xxxrrr.exe 2160 5httbt.exe 2168 dvpvj.exe 920 rfrrrff.exe 1700 1nbttt.exe 3068 jvpjd.exe 888 1lffrlr.exe 2264 bbnhbh.exe 264 jjddj.exe 1804 rlrxxfl.exe 2320 btthnt.exe 3036 dvdjp.exe 3044 5vppp.exe 2008 xrfrxxl.exe 1604 nnbnbb.exe 1812 hbntbb.exe 2068 vjvvv.exe 2348 pdppj.exe 3060 rfllxrr.exe 1920 btbbhh.exe 2764 bthhnh.exe 2696 jdppp.exe 2772 7ffxrlr.exe 2708 xrfflll.exe 2860 3tnhbt.exe 2872 pdddd.exe 2732 1jjvp.exe 2704 lxfxrrx.exe 2588 7nbnnh.exe 3024 1nbhbt.exe 2996 pvddv.exe 1532 7rfrxrx.exe 1636 5ffxrrx.exe 1632 7hntbn.exe 356 tnttbb.exe 1928 vddvp.exe 2104 vpddd.exe 1076 xrfrlrf.exe 1248 5flfxrr.exe 1476 3nntnh.exe 1160 nbntbb.exe 1644 jdjpv.exe 1776 lrxxrll.exe -
resource yara_rule behavioral1/memory/2504-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000012102-7.dat upx behavioral1/memory/2504-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000f000000018662-14.dat upx behavioral1/memory/2348-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000186c8-23.dat upx behavioral1/memory/1864-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001878d-32.dat upx behavioral1/files/0x00070000000190c6-40.dat upx behavioral1/memory/2056-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00090000000191f3-50.dat upx behavioral1/memory/2276-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000193b7-59.dat upx behavioral1/memory/2772-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c1-68.dat upx behavioral1/memory/2676-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193c8-76.dat upx behavioral1/memory/2656-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000193d4-83.dat upx behavioral1/files/0x00050000000193ec-93.dat upx behavioral1/files/0x0005000000019417-100.dat upx behavioral1/memory/2976-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001941a-109.dat upx behavioral1/memory/2992-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019436-118.dat upx behavioral1/files/0x0005000000019441-125.dat upx behavioral1/memory/1748-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00050000000194bd-133.dat upx behavioral1/files/0x00050000000194f3-140.dat upx behavioral1/memory/1308-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019537-149.dat upx behavioral1/files/0x00050000000195d9-157.dat upx behavioral1/memory/1340-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960a-164.dat upx behavioral1/files/0x000500000001960c-172.dat upx behavioral1/memory/2308-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2636-181-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2636-180-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0009000000017481-179.dat upx behavioral1/memory/2308-189-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2308-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000500000001960d-190.dat upx behavioral1/files/0x000500000001960e-198.dat upx behavioral1/memory/2168-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019610-206.dat upx behavioral1/files/0x0005000000019612-215.dat upx behavioral1/memory/920-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1700-222-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019614-223.dat upx behavioral1/files/0x0005000000019616-233.dat upx behavioral1/memory/3068-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0005000000019618-239.dat upx behavioral1/files/0x000500000001962a-246.dat upx behavioral1/files/0x000500000001966c-253.dat upx behavioral1/files/0x00050000000196ac-260.dat upx behavioral1/memory/3044-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2068-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2348-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1920-321-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2764-327-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2772-338-0x0000000000400000-0x0000000000427000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2516 2504 5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe 30 PID 2504 wrote to memory of 2516 2504 5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe 30 PID 2504 wrote to memory of 2516 2504 5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe 30 PID 2504 wrote to memory of 2516 2504 5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe 30 PID 2516 wrote to memory of 2348 2516 dvjjp.exe 31 PID 2516 wrote to memory of 2348 2516 dvjjp.exe 31 PID 2516 wrote to memory of 2348 2516 dvjjp.exe 31 PID 2516 wrote to memory of 2348 2516 dvjjp.exe 31 PID 2348 wrote to memory of 1864 2348 tntbhh.exe 32 PID 2348 wrote to memory of 1864 2348 tntbhh.exe 32 PID 2348 wrote to memory of 1864 2348 tntbhh.exe 32 PID 2348 wrote to memory of 1864 2348 tntbhh.exe 32 PID 1864 wrote to memory of 2056 1864 pvpvj.exe 33 PID 1864 wrote to memory of 2056 1864 pvpvj.exe 33 PID 1864 wrote to memory of 2056 1864 pvpvj.exe 33 PID 1864 wrote to memory of 2056 1864 pvpvj.exe 33 PID 2056 wrote to memory of 2276 2056 1lrrrrx.exe 34 PID 2056 wrote to memory of 2276 2056 1lrrrrx.exe 34 PID 2056 wrote to memory of 2276 2056 1lrrrrx.exe 34 PID 2056 wrote to memory of 2276 2056 1lrrrrx.exe 34 PID 2276 wrote to memory of 2772 2276 hbntbb.exe 35 PID 2276 wrote to memory of 2772 2276 hbntbb.exe 35 PID 2276 wrote to memory of 2772 2276 hbntbb.exe 35 PID 2276 wrote to memory of 2772 2276 hbntbb.exe 35 PID 2772 wrote to memory of 2676 2772 9vvjv.exe 36 PID 2772 wrote to memory of 2676 2772 9vvjv.exe 36 PID 2772 wrote to memory of 2676 2772 9vvjv.exe 36 PID 2772 wrote to memory of 2676 2772 9vvjv.exe 36 PID 2676 wrote to memory of 2576 2676 xlxffxl.exe 37 PID 2676 wrote to memory of 2576 2676 xlxffxl.exe 37 PID 2676 wrote to memory of 2576 2676 xlxffxl.exe 37 PID 2676 wrote to memory of 2576 2676 xlxffxl.exe 37 PID 2576 wrote to memory of 2656 2576 thnnbb.exe 38 PID 2576 wrote to memory of 2656 2576 thnnbb.exe 38 PID 2576 wrote to memory of 2656 2576 thnnbb.exe 38 PID 2576 wrote to memory of 2656 2576 thnnbb.exe 38 PID 2656 wrote to memory of 2704 2656 pdvjv.exe 39 PID 2656 wrote to memory of 2704 2656 pdvjv.exe 39 PID 2656 wrote to memory of 2704 2656 pdvjv.exe 39 PID 2656 wrote to memory of 2704 2656 pdvjv.exe 39 PID 2704 wrote to memory of 2564 2704 ffflrxl.exe 40 PID 2704 wrote to memory of 2564 2704 ffflrxl.exe 40 PID 2704 wrote to memory of 2564 2704 ffflrxl.exe 40 PID 2704 wrote to memory of 2564 2704 ffflrxl.exe 40 PID 2564 wrote to memory of 2976 2564 nhtntt.exe 41 PID 2564 wrote to memory of 2976 2564 nhtntt.exe 41 PID 2564 wrote to memory of 2976 2564 nhtntt.exe 41 PID 2564 wrote to memory of 2976 2564 nhtntt.exe 41 PID 2976 wrote to memory of 2992 2976 ddpdp.exe 42 PID 2976 wrote to memory of 2992 2976 ddpdp.exe 42 PID 2976 wrote to memory of 2992 2976 ddpdp.exe 42 PID 2976 wrote to memory of 2992 2976 ddpdp.exe 42 PID 2992 wrote to memory of 1632 2992 xxlxlll.exe 43 PID 2992 wrote to memory of 1632 2992 xxlxlll.exe 43 PID 2992 wrote to memory of 1632 2992 xxlxlll.exe 43 PID 2992 wrote to memory of 1632 2992 xxlxlll.exe 43 PID 1632 wrote to memory of 1748 1632 thttbh.exe 44 PID 1632 wrote to memory of 1748 1632 thttbh.exe 44 PID 1632 wrote to memory of 1748 1632 thttbh.exe 44 PID 1632 wrote to memory of 1748 1632 thttbh.exe 44 PID 1748 wrote to memory of 1308 1748 vvddj.exe 45 PID 1748 wrote to memory of 1308 1748 vvddj.exe 45 PID 1748 wrote to memory of 1308 1748 vvddj.exe 45 PID 1748 wrote to memory of 1308 1748 vvddj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe"C:\Users\Admin\AppData\Local\Temp\5a2167e8684d1275919ab85e411ef4a80a7d5c800022a1e6a7113f7811db9a1dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dvjjp.exec:\dvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tntbhh.exec:\tntbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\pvpvj.exec:\pvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\1lrrrrx.exec:\1lrrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\hbntbb.exec:\hbntbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\9vvjv.exec:\9vvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\xlxffxl.exec:\xlxffxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\thnnbb.exec:\thnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pdvjv.exec:\pdvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\ffflrxl.exec:\ffflrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhtntt.exec:\nhtntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ddpdp.exec:\ddpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\xxlxlll.exec:\xxlxlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\thttbh.exec:\thttbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\vvddj.exec:\vvddj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\xrfflff.exec:\xrfflff.exe17⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nhntbb.exec:\nhntbb.exe18⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvjpp.exec:\dvjpp.exe19⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xrfxlrl.exec:\xrfxlrl.exe20⤵
- Executes dropped EXE
PID:1340 -
\??\c:\bttntn.exec:\bttntn.exe21⤵
- Executes dropped EXE
PID:1388 -
\??\c:\9vjdj.exec:\9vjdj.exe22⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5xxxrrr.exec:\5xxxrrr.exe23⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5httbt.exec:\5httbt.exe24⤵
- Executes dropped EXE
PID:2160 -
\??\c:\dvpvj.exec:\dvpvj.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rfrrrff.exec:\rfrrrff.exe26⤵
- Executes dropped EXE
PID:920 -
\??\c:\1nbttt.exec:\1nbttt.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1700 -
\??\c:\jvpjd.exec:\jvpjd.exe28⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1lffrlr.exec:\1lffrlr.exe29⤵
- Executes dropped EXE
PID:888 -
\??\c:\bbnhbh.exec:\bbnhbh.exe30⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jjddj.exec:\jjddj.exe31⤵
- Executes dropped EXE
PID:264 -
\??\c:\rlrxxfl.exec:\rlrxxfl.exe32⤵
- Executes dropped EXE
PID:1804 -
\??\c:\btthnt.exec:\btthnt.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\dvdjp.exec:\dvdjp.exe34⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5vppp.exec:\5vppp.exe35⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe36⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nnbnbb.exec:\nnbnbb.exe37⤵
- Executes dropped EXE
PID:1604 -
\??\c:\hbntbb.exec:\hbntbb.exe38⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vjvvv.exec:\vjvvv.exe39⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pdppj.exec:\pdppj.exe40⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rfllxrr.exec:\rfllxrr.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\btbbhh.exec:\btbbhh.exe42⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bthhnh.exec:\bthhnh.exe43⤵
- Executes dropped EXE
PID:2764 -
\??\c:\jdppp.exec:\jdppp.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7ffxrlr.exec:\7ffxrlr.exe45⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xrfflll.exec:\xrfflll.exe46⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3tnhbt.exec:\3tnhbt.exe47⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdddd.exec:\pdddd.exe48⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1jjvp.exec:\1jjvp.exe49⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lxfxrrx.exec:\lxfxrrx.exe50⤵
- Executes dropped EXE
PID:2704 -
\??\c:\7nbnnh.exec:\7nbnnh.exe51⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1nbhbt.exec:\1nbhbt.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3024 -
\??\c:\pvddv.exec:\pvddv.exe53⤵
- Executes dropped EXE
PID:2996 -
\??\c:\7rfrxrx.exec:\7rfrxrx.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5ffxrrx.exec:\5ffxrrx.exe55⤵
- Executes dropped EXE
PID:1636 -
\??\c:\7hntbn.exec:\7hntbn.exe56⤵
- Executes dropped EXE
PID:1632 -
\??\c:\tnttbb.exec:\tnttbb.exe57⤵
- Executes dropped EXE
PID:356 -
\??\c:\vddvp.exec:\vddvp.exe58⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpddd.exec:\vpddd.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\xrfrlrf.exec:\xrfrlrf.exe60⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5flfxrr.exec:\5flfxrr.exe61⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3nntnh.exec:\3nntnh.exe62⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nbntbb.exec:\nbntbb.exe63⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jdjpv.exec:\jdjpv.exe64⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lrxxrll.exec:\lrxxrll.exe65⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rxlllff.exec:\rxlllff.exe66⤵PID:2432
-
\??\c:\1hhhbb.exec:\1hhhbb.exe67⤵PID:2184
-
\??\c:\jdppd.exec:\jdppd.exe68⤵PID:860
-
\??\c:\pddpj.exec:\pddpj.exe69⤵PID:1472
-
\??\c:\1fxrrrx.exec:\1fxrrrx.exe70⤵PID:1132
-
\??\c:\7fllllr.exec:\7fllllr.exe71⤵PID:1684
-
\??\c:\hbnttt.exec:\hbnttt.exe72⤵PID:2452
-
\??\c:\pvjdd.exec:\pvjdd.exe73⤵PID:2076
-
\??\c:\pjjpv.exec:\pjjpv.exe74⤵PID:1372
-
\??\c:\rlxrlrx.exec:\rlxrlrx.exe75⤵PID:1544
-
\??\c:\bththn.exec:\bththn.exe76⤵PID:576
-
\??\c:\tthhtt.exec:\tthhtt.exe77⤵PID:2940
-
\??\c:\7pddp.exec:\7pddp.exe78⤵PID:264
-
\??\c:\pjppp.exec:\pjppp.exe79⤵PID:2956
-
\??\c:\xrfrrlr.exec:\xrfrrlr.exe80⤵PID:3028
-
\??\c:\3tbnnt.exec:\3tbnnt.exe81⤵PID:884
-
\??\c:\dvppj.exec:\dvppj.exe82⤵PID:3036
-
\??\c:\7vdvp.exec:\7vdvp.exe83⤵PID:3032
-
\??\c:\1xrxxfl.exec:\1xrxxfl.exe84⤵PID:2008
-
\??\c:\3lxllff.exec:\3lxllff.exe85⤵PID:1720
-
\??\c:\btbhhh.exec:\btbhhh.exe86⤵PID:1812
-
\??\c:\ppvpj.exec:\ppvpj.exe87⤵PID:2484
-
\??\c:\pdpdd.exec:\pdpdd.exe88⤵PID:2296
-
\??\c:\5frllll.exec:\5frllll.exe89⤵PID:2852
-
\??\c:\tnbbtb.exec:\tnbbtb.exe90⤵PID:3056
-
\??\c:\tbnbbt.exec:\tbnbbt.exe91⤵PID:2800
-
\??\c:\1vddj.exec:\1vddj.exe92⤵PID:2908
-
\??\c:\xxrrffl.exec:\xxrrffl.exe93⤵PID:2692
-
\??\c:\5ntbbn.exec:\5ntbbn.exe94⤵PID:2900
-
\??\c:\bthhhb.exec:\bthhhb.exe95⤵PID:2728
-
\??\c:\vpvvp.exec:\vpvvp.exe96⤵PID:2860
-
\??\c:\dpjjj.exec:\dpjjj.exe97⤵PID:2872
-
\??\c:\1rllrrr.exec:\1rllrrr.exe98⤵PID:2736
-
\??\c:\llrrfff.exec:\llrrfff.exe99⤵PID:2632
-
\??\c:\btnntt.exec:\btnntt.exe100⤵PID:2844
-
\??\c:\dvdjv.exec:\dvdjv.exe101⤵PID:2620
-
\??\c:\pjvvj.exec:\pjvvj.exe102⤵PID:2436
-
\??\c:\lxlfffr.exec:\lxlfffr.exe103⤵PID:1672
-
\??\c:\bnbnnh.exec:\bnbnnh.exe104⤵PID:1296
-
\??\c:\nhtnhn.exec:\nhtnhn.exe105⤵PID:692
-
\??\c:\vjppp.exec:\vjppp.exe106⤵PID:1660
-
\??\c:\5rxrxxx.exec:\5rxrxxx.exe107⤵PID:2460
-
\??\c:\rlxxffl.exec:\rlxxffl.exe108⤵PID:1548
-
\??\c:\7ttnnb.exec:\7ttnnb.exe109⤵PID:536
-
\??\c:\9btbhn.exec:\9btbhn.exe110⤵PID:380
-
\??\c:\7vjjd.exec:\7vjjd.exe111⤵PID:1792
-
\??\c:\ppvdp.exec:\ppvdp.exe112⤵PID:2752
-
\??\c:\xllflfl.exec:\xllflfl.exe113⤵PID:2512
-
\??\c:\3thhtt.exec:\3thhtt.exe114⤵PID:956
-
\??\c:\dpdpp.exec:\dpdpp.exe115⤵PID:2140
-
\??\c:\jdpvd.exec:\jdpvd.exe116⤵PID:2308
-
\??\c:\fxrlrfr.exec:\fxrlrfr.exe117⤵PID:2268
-
\??\c:\fxxxfff.exec:\fxxxfff.exe118⤵PID:1592
-
\??\c:\9tbbbb.exec:\9tbbbb.exe119⤵PID:920
-
\??\c:\jjjjv.exec:\jjjjv.exe120⤵PID:1712
-
\??\c:\jdvpd.exec:\jdvpd.exe121⤵PID:1552
-
\??\c:\1fxxxrf.exec:\1fxxxrf.exe122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-