Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe
-
Size
455KB
-
MD5
c160fc9558e6f046a55c288c66c8430c
-
SHA1
6f5e76da930beb6956be5ea7311f4ee08a8225b9
-
SHA256
ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d
-
SHA512
80d7605653b91eaf52d10144e24c42cd2e9e29bfe4a0815ec40e445b7398b24f3ea7d5d86fc8f4b698a8197175994455b0129a00b6cba25825a28e65e9865b52
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe4R:q7Tc2NYHUrAwfMp3CDC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1624-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-53-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-89-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-108-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-180-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2344-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-348-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-701-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1480-823-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-884-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2980-974-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-987-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/960-1044-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2764-1130-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 flrxlrl.exe 2548 bthhnn.exe 1484 7fflrxx.exe 2304 rlxlrxx.exe 2828 tthnhn.exe 2764 vjpjd.exe 2236 rrflxlr.exe 3008 1thnbh.exe 2656 7hbbhh.exe 2640 9vjdd.exe 2652 nhhhnb.exe 908 vdvjv.exe 1008 llllrrl.exe 2884 xfxfrfx.exe 1916 hbtnbh.exe 2672 fxrrffx.exe 2984 hbnntb.exe 1828 9lxxlfr.exe 1148 7thhbb.exe 2344 hbbbnt.exe 2148 7lxrxxf.exe 1228 7xllrxl.exe 916 hnntnb.exe 2136 1rxlrxl.exe 340 xxxxffr.exe 1692 hbtthn.exe 2248 flrrxfx.exe 2220 hbnnbb.exe 596 bbhtbb.exe 2384 3vvdp.exe 1264 tntbnn.exe 2492 3nbhnn.exe 1604 jjdpd.exe 1612 7xfflrf.exe 1640 tntnbt.exe 2800 nhbnbb.exe 2752 djpvj.exe 2488 9xrlrrf.exe 796 thtthn.exe 2848 ppdpd.exe 2872 jdppv.exe 2644 lfffxxr.exe 1976 tnbhtn.exe 1236 jjdjv.exe 2620 jdvvd.exe 2640 lfrxffr.exe 2324 hbbhtb.exe 2652 5nnbnn.exe 2888 ddvvd.exe 2988 1xlrrff.exe 2140 xrlrrrr.exe 1560 nhbhth.exe 2700 pjvpj.exe 2672 vjppp.exe 1840 rrflrrx.exe 2992 tnnnbt.exe 800 vpddj.exe 1844 jdvdj.exe 3012 frfflrf.exe 2380 thhnbb.exe 2316 tbthhn.exe 2108 ddvjd.exe 2588 vvppd.exe 2288 lfrxllr.exe -
resource yara_rule behavioral1/memory/1624-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-701-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/844-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-872-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-884-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1236-893-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-974-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-1006-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-1045-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-1130-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2640-1167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-1234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-1301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-1308-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bbhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1624 wrote to memory of 2696 1624 ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe 30 PID 1624 wrote to memory of 2696 1624 ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe 30 PID 1624 wrote to memory of 2696 1624 ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe 30 PID 1624 wrote to memory of 2696 1624 ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe 30 PID 2696 wrote to memory of 2548 2696 flrxlrl.exe 31 PID 2696 wrote to memory of 2548 2696 flrxlrl.exe 31 PID 2696 wrote to memory of 2548 2696 flrxlrl.exe 31 PID 2696 wrote to memory of 2548 2696 flrxlrl.exe 31 PID 2548 wrote to memory of 1484 2548 bthhnn.exe 32 PID 2548 wrote to memory of 1484 2548 bthhnn.exe 32 PID 2548 wrote to memory of 1484 2548 bthhnn.exe 32 PID 2548 wrote to memory of 1484 2548 bthhnn.exe 32 PID 1484 wrote to memory of 2304 1484 7fflrxx.exe 33 PID 1484 wrote to memory of 2304 1484 7fflrxx.exe 33 PID 1484 wrote to memory of 2304 1484 7fflrxx.exe 33 PID 1484 wrote to memory of 2304 1484 7fflrxx.exe 33 PID 2304 wrote to memory of 2828 2304 rlxlrxx.exe 34 PID 2304 wrote to memory of 2828 2304 rlxlrxx.exe 34 PID 2304 wrote to memory of 2828 2304 rlxlrxx.exe 34 PID 2304 wrote to memory of 2828 2304 rlxlrxx.exe 34 PID 2828 wrote to memory of 2764 2828 tthnhn.exe 35 PID 2828 wrote to memory of 2764 2828 tthnhn.exe 35 PID 2828 wrote to memory of 2764 2828 tthnhn.exe 35 PID 2828 wrote to memory of 2764 2828 tthnhn.exe 35 PID 2764 wrote to memory of 2236 2764 vjpjd.exe 36 PID 2764 wrote to memory of 2236 2764 vjpjd.exe 36 PID 2764 wrote to memory of 2236 2764 vjpjd.exe 36 PID 2764 wrote to memory of 2236 2764 vjpjd.exe 36 PID 2236 wrote to memory of 3008 2236 rrflxlr.exe 37 PID 2236 wrote to memory of 3008 2236 rrflxlr.exe 37 PID 2236 wrote to memory of 3008 2236 rrflxlr.exe 37 PID 2236 wrote to memory of 3008 2236 rrflxlr.exe 37 PID 3008 wrote to memory of 2656 3008 1thnbh.exe 38 PID 3008 wrote to memory of 2656 3008 1thnbh.exe 38 PID 3008 wrote to memory of 2656 3008 1thnbh.exe 38 PID 3008 wrote to memory of 2656 3008 1thnbh.exe 38 PID 2656 wrote to memory of 2640 2656 7hbbhh.exe 39 PID 2656 wrote to memory of 2640 2656 7hbbhh.exe 39 PID 2656 wrote to memory of 2640 2656 7hbbhh.exe 39 PID 2656 wrote to memory of 2640 2656 7hbbhh.exe 39 PID 2640 wrote to memory of 2652 2640 9vjdd.exe 40 PID 2640 wrote to memory of 2652 2640 9vjdd.exe 40 PID 2640 wrote to memory of 2652 2640 9vjdd.exe 40 PID 2640 wrote to memory of 2652 2640 9vjdd.exe 40 PID 2652 wrote to memory of 908 2652 nhhhnb.exe 41 PID 2652 wrote to memory of 908 2652 nhhhnb.exe 41 PID 2652 wrote to memory of 908 2652 nhhhnb.exe 41 PID 2652 wrote to memory of 908 2652 nhhhnb.exe 41 PID 908 wrote to memory of 1008 908 vdvjv.exe 42 PID 908 wrote to memory of 1008 908 vdvjv.exe 42 PID 908 wrote to memory of 1008 908 vdvjv.exe 42 PID 908 wrote to memory of 1008 908 vdvjv.exe 42 PID 1008 wrote to memory of 2884 1008 llllrrl.exe 43 PID 1008 wrote to memory of 2884 1008 llllrrl.exe 43 PID 1008 wrote to memory of 2884 1008 llllrrl.exe 43 PID 1008 wrote to memory of 2884 1008 llllrrl.exe 43 PID 2884 wrote to memory of 1916 2884 xfxfrfx.exe 44 PID 2884 wrote to memory of 1916 2884 xfxfrfx.exe 44 PID 2884 wrote to memory of 1916 2884 xfxfrfx.exe 44 PID 2884 wrote to memory of 1916 2884 xfxfrfx.exe 44 PID 1916 wrote to memory of 2672 1916 hbtnbh.exe 45 PID 1916 wrote to memory of 2672 1916 hbtnbh.exe 45 PID 1916 wrote to memory of 2672 1916 hbtnbh.exe 45 PID 1916 wrote to memory of 2672 1916 hbtnbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe"C:\Users\Admin\AppData\Local\Temp\ce42c846d966d33b378fbe3bbbfc0cd13d81a9f81dd795f7571b251ae4d8309d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\flrxlrl.exec:\flrxlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bthhnn.exec:\bthhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\7fflrxx.exec:\7fflrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\rlxlrxx.exec:\rlxlrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\tthnhn.exec:\tthnhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vjpjd.exec:\vjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\rrflxlr.exec:\rrflxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\1thnbh.exec:\1thnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\7hbbhh.exec:\7hbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\9vjdd.exec:\9vjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nhhhnb.exec:\nhhhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vdvjv.exec:\vdvjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\llllrrl.exec:\llllrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\xfxfrfx.exec:\xfxfrfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\hbtnbh.exec:\hbtnbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\fxrrffx.exec:\fxrrffx.exe17⤵
- Executes dropped EXE
PID:2672 -
\??\c:\hbnntb.exec:\hbnntb.exe18⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9lxxlfr.exec:\9lxxlfr.exe19⤵
- Executes dropped EXE
PID:1828 -
\??\c:\7thhbb.exec:\7thhbb.exe20⤵
- Executes dropped EXE
PID:1148 -
\??\c:\hbbbnt.exec:\hbbbnt.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\7lxrxxf.exec:\7lxrxxf.exe22⤵
- Executes dropped EXE
PID:2148 -
\??\c:\7xllrxl.exec:\7xllrxl.exe23⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hnntnb.exec:\hnntnb.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\1rxlrxl.exec:\1rxlrxl.exe25⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xxxxffr.exec:\xxxxffr.exe26⤵
- Executes dropped EXE
PID:340 -
\??\c:\hbtthn.exec:\hbtthn.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\flrrxfx.exec:\flrrxfx.exe28⤵
- Executes dropped EXE
PID:2248 -
\??\c:\hbnnbb.exec:\hbnnbb.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbhtbb.exec:\bbhtbb.exe30⤵
- Executes dropped EXE
PID:596 -
\??\c:\3vvdp.exec:\3vvdp.exe31⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tntbnn.exec:\tntbnn.exe32⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3nbhnn.exec:\3nbhnn.exe33⤵
- Executes dropped EXE
PID:2492 -
\??\c:\jjdpd.exec:\jjdpd.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7xfflrf.exec:\7xfflrf.exe35⤵
- Executes dropped EXE
PID:1612 -
\??\c:\tntnbt.exec:\tntnbt.exe36⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nhbnbb.exec:\nhbnbb.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\djpvj.exec:\djpvj.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9xrlrrf.exec:\9xrlrrf.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\thtthn.exec:\thtthn.exe40⤵
- Executes dropped EXE
PID:796 -
\??\c:\ppdpd.exec:\ppdpd.exe41⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jdppv.exec:\jdppv.exe42⤵
- Executes dropped EXE
PID:2872 -
\??\c:\lfffxxr.exec:\lfffxxr.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnbhtn.exec:\tnbhtn.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\jjdjv.exec:\jjdjv.exe45⤵
- Executes dropped EXE
PID:1236 -
\??\c:\jdvvd.exec:\jdvvd.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lfrxffr.exec:\lfrxffr.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hbbhtb.exec:\hbbhtb.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\5nnbnn.exec:\5nnbnn.exe49⤵
- Executes dropped EXE
PID:2652 -
\??\c:\ddvvd.exec:\ddvvd.exe50⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1xlrrff.exec:\1xlrrff.exe51⤵
- Executes dropped EXE
PID:2988 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhbhth.exec:\nhbhth.exe53⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjvpj.exec:\pjvpj.exe54⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vjppp.exec:\vjppp.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\rrflrrx.exec:\rrflrrx.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tnnnbt.exec:\tnnnbt.exe57⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpddj.exec:\vpddj.exe58⤵
- Executes dropped EXE
PID:800 -
\??\c:\jdvdj.exec:\jdvdj.exe59⤵
- Executes dropped EXE
PID:1844 -
\??\c:\frfflrf.exec:\frfflrf.exe60⤵
- Executes dropped EXE
PID:3012 -
\??\c:\thhnbb.exec:\thhnbb.exe61⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tbthhn.exec:\tbthhn.exe62⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ddvjd.exec:\ddvjd.exe63⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vvppd.exec:\vvppd.exe64⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lfrxllr.exec:\lfrxllr.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnbhhh.exec:\tnbhhh.exe66⤵PID:2136
-
\??\c:\tnttbb.exec:\tnttbb.exe67⤵PID:2312
-
\??\c:\jdvdj.exec:\jdvdj.exe68⤵PID:612
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe69⤵PID:2100
-
\??\c:\9rllrxf.exec:\9rllrxf.exe70⤵PID:2564
-
\??\c:\3bnntt.exec:\3bnntt.exe71⤵PID:2220
-
\??\c:\vppvp.exec:\vppvp.exe72⤵PID:1648
-
\??\c:\ddvdp.exec:\ddvdp.exe73⤵PID:1404
-
\??\c:\fxrxflr.exec:\fxrxflr.exe74⤵PID:2516
-
\??\c:\hhbtbb.exec:\hhbtbb.exe75⤵PID:2692
-
\??\c:\9dddd.exec:\9dddd.exe76⤵PID:2880
-
\??\c:\djdpj.exec:\djdpj.exe77⤵PID:3028
-
\??\c:\xlffrrf.exec:\xlffrrf.exe78⤵PID:2548
-
\??\c:\bbnhnt.exec:\bbnhnt.exe79⤵PID:2392
-
\??\c:\bbbbnn.exec:\bbbbnn.exe80⤵PID:2716
-
\??\c:\5pddj.exec:\5pddj.exe81⤵PID:2752
-
\??\c:\7xxlrxf.exec:\7xxlrxf.exe82⤵PID:2828
-
\??\c:\9lfxflx.exec:\9lfxflx.exe83⤵PID:2836
-
\??\c:\tnbhtt.exec:\tnbhtt.exe84⤵PID:2744
-
\??\c:\vvpdj.exec:\vvpdj.exe85⤵PID:2232
-
\??\c:\7lxlrxl.exec:\7lxlrxl.exe86⤵PID:2632
-
\??\c:\ffxlrxl.exec:\ffxlrxl.exe87⤵PID:2664
-
\??\c:\nnnbtb.exec:\nnnbtb.exe88⤵PID:2624
-
\??\c:\1pdjv.exec:\1pdjv.exe89⤵PID:2004
-
\??\c:\vdvpj.exec:\vdvpj.exe90⤵PID:2428
-
\??\c:\9flfllr.exec:\9flfllr.exe91⤵PID:1992
-
\??\c:\xxxxxlr.exec:\xxxxxlr.exe92⤵PID:344
-
\??\c:\bbhntb.exec:\bbhntb.exe93⤵PID:2964
-
\??\c:\jpvjp.exec:\jpvjp.exe94⤵PID:1008
-
\??\c:\5djdd.exec:\5djdd.exe95⤵PID:2712
-
\??\c:\rrrfflx.exec:\rrrfflx.exe96⤵PID:1420
-
\??\c:\tttthn.exec:\tttthn.exe97⤵PID:2928
-
\??\c:\bbbnbn.exec:\bbbnbn.exe98⤵PID:2020
-
\??\c:\9dpvj.exec:\9dpvj.exe99⤵PID:2152
-
\??\c:\1fxxflx.exec:\1fxxflx.exe100⤵PID:844
-
\??\c:\fxxxxff.exec:\fxxxxff.exe101⤵PID:2448
-
\??\c:\tthbnn.exec:\tthbnn.exe102⤵PID:2340
-
\??\c:\jpdjp.exec:\jpdjp.exe103⤵PID:2104
-
\??\c:\ppjvd.exec:\ppjvd.exe104⤵PID:2144
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe105⤵PID:2160
-
\??\c:\thbhnn.exec:\thbhnn.exe106⤵PID:2240
-
\??\c:\5bnbnt.exec:\5bnbnt.exe107⤵PID:1268
-
\??\c:\pjvvd.exec:\pjvvd.exe108⤵PID:816
-
\??\c:\fxxlxxl.exec:\fxxlxxl.exe109⤵PID:1284
-
\??\c:\xrfllrf.exec:\xrfllrf.exe110⤵PID:1276
-
\??\c:\tbnthh.exec:\tbnthh.exe111⤵PID:2508
-
\??\c:\vpppd.exec:\vpppd.exe112⤵PID:2124
-
\??\c:\vvvvd.exec:\vvvvd.exe113⤵PID:2252
-
\??\c:\ffxfflx.exec:\ffxfflx.exe114⤵PID:2568
-
\??\c:\1bnbnn.exec:\1bnbnn.exe115⤵PID:572
-
\??\c:\bttbhh.exec:\bttbhh.exe116⤵PID:2196
-
\??\c:\9jdjd.exec:\9jdjd.exe117⤵PID:1624
-
\??\c:\xxxlrxl.exec:\xxxlrxl.exe118⤵PID:1480
-
\??\c:\lrlrlrf.exec:\lrlrlrf.exe119⤵PID:2876
-
\??\c:\1nnbhn.exec:\1nnbhn.exe120⤵PID:2064
-
\??\c:\dvpvd.exec:\dvpvd.exe121⤵PID:2372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-