Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe
-
Size
455KB
-
MD5
67b70c6e5e6847b4beacabaf4252bab2
-
SHA1
2c3d0532c625043bdac6cca809ce50a0b5f6187c
-
SHA256
aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83
-
SHA512
199a9ec6c6133e530daf182b983c9c5fb22d74e82d1f3d33548f4e73e5264da446403763a051dfff820d39daaac411aa50f19e48607ddec9aea8cb1a90191b18
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbes:q7Tc2NYHUrAwfMp3CDs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/1836-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-64-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2304-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-79-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-104-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2632-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-101-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3016-122-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/3032-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-124-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1712-139-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1936-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-215-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-233-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/952-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-290-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1588-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-323-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2032-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-349-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-528-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2316-540-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1480-586-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2576-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-778-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-792-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2488-842-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1728-945-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-959-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-1083-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-1139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-1280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1944 5thnnn.exe 480 jjpdd.exe 2088 rfrlrlx.exe 2524 dvjpv.exe 2232 xrrfflr.exe 2304 1vpjp.exe 2792 1rflrxx.exe 2212 tnhtbh.exe 2856 9lfflrx.exe 2360 tnbbhh.exe 2632 3jvjd.exe 3016 rrflflf.exe 3032 bthhnb.exe 1712 rlxfrrl.exe 1936 hhhnhn.exe 1644 vvddv.exe 2028 jdddp.exe 1308 rfrrffl.exe 1780 thbntt.exe 2772 jdppj.exe 2900 1jjjp.exe 2884 lrllxxf.exe 1560 3tttbh.exe 2752 pjppd.exe 644 hbnnnh.exe 952 dpdjv.exe 2544 1nbnnn.exe 1028 dvjpd.exe 2420 hhttbt.exe 3052 1pdjp.exe 2156 rllrffr.exe 1588 1nhbhh.exe 2204 5djdp.exe 480 lfllxxf.exe 2308 lrxxlfr.exe 2032 bbnhhn.exe 3044 jjdjv.exe 2720 1lffllr.exe 2824 ffxxlfl.exe 2708 btnbbh.exe 2852 jdpvd.exe 2164 jjvdv.exe 2740 frrrxfl.exe 2688 thbhtb.exe 2620 7pdvj.exe 3020 jjvvv.exe 3016 5ffxlrx.exe 1676 nhhnbb.exe 2480 1nbbhn.exe 2004 jdvvj.exe 1848 vdpjp.exe 2332 xrllxrx.exe 1496 9bnhnt.exe 2028 vpppd.exe 1788 jdvpp.exe 2644 lxrrrxf.exe 3036 7bnnbh.exe 2996 vvjdp.exe 2428 pdpjp.exe 2456 5fxrrlr.exe 1124 rlrlrlr.exe 1804 thbhnt.exe 2140 jdjjv.exe 1384 dpjpp.exe -
resource yara_rule behavioral1/memory/1944-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-64-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2304-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-139-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/1936-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-213-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2884-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-285-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2156-290-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1588-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-326-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2824-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-528-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2576-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-779-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-778-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-876-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-918-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-959-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1284-970-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-1070-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-1126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-1139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-1206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-1255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-1280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-1306-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1944 1836 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 30 PID 1836 wrote to memory of 1944 1836 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 30 PID 1836 wrote to memory of 1944 1836 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 30 PID 1836 wrote to memory of 1944 1836 aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe 30 PID 1944 wrote to memory of 480 1944 5thnnn.exe 31 PID 1944 wrote to memory of 480 1944 5thnnn.exe 31 PID 1944 wrote to memory of 480 1944 5thnnn.exe 31 PID 1944 wrote to memory of 480 1944 5thnnn.exe 31 PID 480 wrote to memory of 2088 480 jjpdd.exe 32 PID 480 wrote to memory of 2088 480 jjpdd.exe 32 PID 480 wrote to memory of 2088 480 jjpdd.exe 32 PID 480 wrote to memory of 2088 480 jjpdd.exe 32 PID 2088 wrote to memory of 2524 2088 rfrlrlx.exe 33 PID 2088 wrote to memory of 2524 2088 rfrlrlx.exe 33 PID 2088 wrote to memory of 2524 2088 rfrlrlx.exe 33 PID 2088 wrote to memory of 2524 2088 rfrlrlx.exe 33 PID 2524 wrote to memory of 2232 2524 dvjpv.exe 34 PID 2524 wrote to memory of 2232 2524 dvjpv.exe 34 PID 2524 wrote to memory of 2232 2524 dvjpv.exe 34 PID 2524 wrote to memory of 2232 2524 dvjpv.exe 34 PID 2232 wrote to memory of 2304 2232 xrrfflr.exe 35 PID 2232 wrote to memory of 2304 2232 xrrfflr.exe 35 PID 2232 wrote to memory of 2304 2232 xrrfflr.exe 35 PID 2232 wrote to memory of 2304 2232 xrrfflr.exe 35 PID 2304 wrote to memory of 2792 2304 1vpjp.exe 36 PID 2304 wrote to memory of 2792 2304 1vpjp.exe 36 PID 2304 wrote to memory of 2792 2304 1vpjp.exe 36 PID 2304 wrote to memory of 2792 2304 1vpjp.exe 36 PID 2792 wrote to memory of 2212 2792 1rflrxx.exe 37 PID 2792 wrote to memory of 2212 2792 1rflrxx.exe 37 PID 2792 wrote to memory of 2212 2792 1rflrxx.exe 37 PID 2792 wrote to memory of 2212 2792 1rflrxx.exe 37 PID 2212 wrote to memory of 2856 2212 tnhtbh.exe 38 PID 2212 wrote to memory of 2856 2212 tnhtbh.exe 38 PID 2212 wrote to memory of 2856 2212 tnhtbh.exe 38 PID 2212 wrote to memory of 2856 2212 tnhtbh.exe 38 PID 2856 wrote to memory of 2360 2856 9lfflrx.exe 39 PID 2856 wrote to memory of 2360 2856 9lfflrx.exe 39 PID 2856 wrote to memory of 2360 2856 9lfflrx.exe 39 PID 2856 wrote to memory of 2360 2856 9lfflrx.exe 39 PID 2360 wrote to memory of 2632 2360 tnbbhh.exe 40 PID 2360 wrote to memory of 2632 2360 tnbbhh.exe 40 PID 2360 wrote to memory of 2632 2360 tnbbhh.exe 40 PID 2360 wrote to memory of 2632 2360 tnbbhh.exe 40 PID 2632 wrote to memory of 3016 2632 3jvjd.exe 41 PID 2632 wrote to memory of 3016 2632 3jvjd.exe 41 PID 2632 wrote to memory of 3016 2632 3jvjd.exe 41 PID 2632 wrote to memory of 3016 2632 3jvjd.exe 41 PID 3016 wrote to memory of 3032 3016 rrflflf.exe 42 PID 3016 wrote to memory of 3032 3016 rrflflf.exe 42 PID 3016 wrote to memory of 3032 3016 rrflflf.exe 42 PID 3016 wrote to memory of 3032 3016 rrflflf.exe 42 PID 3032 wrote to memory of 1712 3032 bthhnb.exe 43 PID 3032 wrote to memory of 1712 3032 bthhnb.exe 43 PID 3032 wrote to memory of 1712 3032 bthhnb.exe 43 PID 3032 wrote to memory of 1712 3032 bthhnb.exe 43 PID 1712 wrote to memory of 1936 1712 rlxfrrl.exe 44 PID 1712 wrote to memory of 1936 1712 rlxfrrl.exe 44 PID 1712 wrote to memory of 1936 1712 rlxfrrl.exe 44 PID 1712 wrote to memory of 1936 1712 rlxfrrl.exe 44 PID 1936 wrote to memory of 1644 1936 hhhnhn.exe 45 PID 1936 wrote to memory of 1644 1936 hhhnhn.exe 45 PID 1936 wrote to memory of 1644 1936 hhhnhn.exe 45 PID 1936 wrote to memory of 1644 1936 hhhnhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe"C:\Users\Admin\AppData\Local\Temp\aead2bfbce228ad5d1451276ffcd82336b25fdb4d086c80fef3ed4638160cf83.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5thnnn.exec:\5thnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\jjpdd.exec:\jjpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\rfrlrlx.exec:\rfrlrlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\dvjpv.exec:\dvjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xrrfflr.exec:\xrrfflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\1vpjp.exec:\1vpjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\1rflrxx.exec:\1rflrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tnhtbh.exec:\tnhtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\9lfflrx.exec:\9lfflrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\tnbbhh.exec:\tnbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\3jvjd.exec:\3jvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rrflflf.exec:\rrflflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bthhnb.exec:\bthhnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\rlxfrrl.exec:\rlxfrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\hhhnhn.exec:\hhhnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vvddv.exec:\vvddv.exe17⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jdddp.exec:\jdddp.exe18⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rfrrffl.exec:\rfrrffl.exe19⤵
- Executes dropped EXE
PID:1308 -
\??\c:\thbntt.exec:\thbntt.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jdppj.exec:\jdppj.exe21⤵
- Executes dropped EXE
PID:2772 -
\??\c:\1jjjp.exec:\1jjjp.exe22⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lrllxxf.exec:\lrllxxf.exe23⤵
- Executes dropped EXE
PID:2884 -
\??\c:\3tttbh.exec:\3tttbh.exe24⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjppd.exec:\pjppd.exe25⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbnnnh.exec:\hbnnnh.exe26⤵
- Executes dropped EXE
PID:644 -
\??\c:\dpdjv.exec:\dpdjv.exe27⤵
- Executes dropped EXE
PID:952 -
\??\c:\1nbnnn.exec:\1nbnnn.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\dvjpd.exec:\dvjpd.exe29⤵
- Executes dropped EXE
PID:1028 -
\??\c:\hhttbt.exec:\hhttbt.exe30⤵
- Executes dropped EXE
PID:2420 -
\??\c:\1pdjp.exec:\1pdjp.exe31⤵
- Executes dropped EXE
PID:3052 -
\??\c:\rllrffr.exec:\rllrffr.exe32⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1nhbhh.exec:\1nhbhh.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\5djdp.exec:\5djdp.exe34⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lfllxxf.exec:\lfllxxf.exe35⤵
- Executes dropped EXE
PID:480 -
\??\c:\lrxxlfr.exec:\lrxxlfr.exe36⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bbnhhn.exec:\bbnhhn.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jjdjv.exec:\jjdjv.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\1lffllr.exec:\1lffllr.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ffxxlfl.exec:\ffxxlfl.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\btnbbh.exec:\btnbbh.exe41⤵
- Executes dropped EXE
PID:2708 -
\??\c:\jdpvd.exec:\jdpvd.exe42⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jjvdv.exec:\jjvdv.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\frrrxfl.exec:\frrrxfl.exe44⤵
- Executes dropped EXE
PID:2740 -
\??\c:\thbhtb.exec:\thbhtb.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\7pdvj.exec:\7pdvj.exe46⤵
- Executes dropped EXE
PID:2620 -
\??\c:\jjvvv.exec:\jjvvv.exe47⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5ffxlrx.exec:\5ffxlrx.exe48⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nhhnbb.exec:\nhhnbb.exe49⤵
- Executes dropped EXE
PID:1676 -
\??\c:\1nbbhn.exec:\1nbbhn.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jdvvj.exec:\jdvvj.exe51⤵
- Executes dropped EXE
PID:2004 -
\??\c:\vdpjp.exec:\vdpjp.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrllxrx.exec:\xrllxrx.exe53⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9bnhnt.exec:\9bnhnt.exe54⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vpppd.exec:\vpppd.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\jdvpp.exec:\jdvpp.exe56⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxrrrxf.exec:\lxrrrxf.exe57⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7bnnbh.exec:\7bnnbh.exe58⤵
- Executes dropped EXE
PID:3036 -
\??\c:\vvjdp.exec:\vvjdp.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pdpjp.exec:\pdpjp.exe60⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5fxrrlr.exec:\5fxrrlr.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe62⤵
- Executes dropped EXE
PID:1124 -
\??\c:\thbhnt.exec:\thbhnt.exe63⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jdjjv.exec:\jdjjv.exe64⤵
- Executes dropped EXE
PID:2140 -
\??\c:\dpjpp.exec:\dpjpp.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rxxxfrx.exec:\rxxxfrx.exe66⤵PID:1316
-
\??\c:\tnhnhh.exec:\tnhnhh.exe67⤵PID:1756
-
\??\c:\9nttbb.exec:\9nttbb.exe68⤵PID:2252
-
\??\c:\ppjpv.exec:\ppjpv.exe69⤵PID:972
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe70⤵PID:2316
-
\??\c:\rffxxxf.exec:\rffxxxf.exe71⤵PID:828
-
\??\c:\nhbbnn.exec:\nhbbnn.exe72⤵PID:296
-
\??\c:\7vddj.exec:\7vddj.exe73⤵PID:2656
-
\??\c:\ddpjj.exec:\ddpjj.exe74⤵PID:3064
-
\??\c:\5rlrrrr.exec:\5rlrrrr.exe75⤵PID:2488
-
\??\c:\hbttbh.exec:\hbttbh.exe76⤵PID:2500
-
\??\c:\dvjjv.exec:\dvjjv.exe77⤵PID:1480
-
\??\c:\ppdpd.exec:\ppdpd.exe78⤵PID:2516
-
\??\c:\xfxrxxf.exec:\xfxrxxf.exe79⤵PID:2032
-
\??\c:\nbtbhh.exec:\nbtbhh.exe80⤵PID:2668
-
\??\c:\hbnnbh.exec:\hbnnbh.exe81⤵PID:2240
-
\??\c:\7jvdp.exec:\7jvdp.exe82⤵PID:2940
-
\??\c:\xlffllx.exec:\xlffllx.exe83⤵PID:2296
-
\??\c:\lfrrrrf.exec:\lfrrrrf.exe84⤵PID:2700
-
\??\c:\1hbbhh.exec:\1hbbhh.exe85⤵PID:2844
-
\??\c:\vdpjj.exec:\vdpjj.exe86⤵PID:2624
-
\??\c:\ppdjd.exec:\ppdjd.exe87⤵PID:2812
-
\??\c:\lxllrlr.exec:\lxllrlr.exe88⤵PID:2576
-
\??\c:\hthhnh.exec:\hthhnh.exe89⤵PID:2620
-
\??\c:\3httbb.exec:\3httbb.exe90⤵PID:1620
-
\??\c:\vjvvp.exec:\vjvvp.exe91⤵PID:3016
-
\??\c:\7lfxxff.exec:\7lfxxff.exe92⤵PID:1676
-
\??\c:\7ttnhb.exec:\7ttnhb.exe93⤵PID:2480
-
\??\c:\bnhhnt.exec:\bnhhnt.exe94⤵PID:2004
-
\??\c:\djpvj.exec:\djpvj.exe95⤵PID:1848
-
\??\c:\rfxxffl.exec:\rfxxffl.exe96⤵PID:1644
-
\??\c:\lxlxlrf.exec:\lxlxlrf.exe97⤵PID:1696
-
\??\c:\nbttbt.exec:\nbttbt.exe98⤵PID:280
-
\??\c:\pdpjp.exec:\pdpjp.exe99⤵PID:2564
-
\??\c:\pjdjp.exec:\pjdjp.exe100⤵PID:804
-
\??\c:\llffllf.exec:\llffllf.exe101⤵PID:3036
-
\??\c:\bbtbnn.exec:\bbtbnn.exe102⤵PID:2900
-
\??\c:\vjvpp.exec:\vjvpp.exe103⤵PID:2428
-
\??\c:\9vjdd.exec:\9vjdd.exe104⤵PID:440
-
\??\c:\xrfxffr.exec:\xrfxffr.exe105⤵PID:2472
-
\??\c:\7htttn.exec:\7htttn.exe106⤵PID:2176
-
\??\c:\hhtthb.exec:\hhtthb.exe107⤵PID:2140
-
\??\c:\ddpvv.exec:\ddpvv.exe108⤵PID:556
-
\??\c:\xrfrxfx.exec:\xrfrxfx.exe109⤵PID:1316
-
\??\c:\lflrxfl.exec:\lflrxfl.exe110⤵PID:2828
-
\??\c:\bbttbb.exec:\bbttbb.exe111⤵PID:2252
-
\??\c:\5tbhtt.exec:\5tbhtt.exe112⤵
- System Location Discovery: System Language Discovery
PID:972 -
\??\c:\7vdjp.exec:\7vdjp.exe113⤵PID:3052
-
\??\c:\xflrrff.exec:\xflrrff.exe114⤵PID:768
-
\??\c:\bhbbhh.exec:\bhbbhh.exe115⤵PID:296
-
\??\c:\nhntbb.exec:\nhntbb.exe116⤵PID:2656
-
\??\c:\5dvdp.exec:\5dvdp.exe117⤵PID:2512
-
\??\c:\7jppd.exec:\7jppd.exe118⤵PID:2488
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe119⤵PID:2204
-
\??\c:\nhtthb.exec:\nhtthb.exe120⤵PID:2524
-
\??\c:\pvjvp.exec:\pvjvp.exe121⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-