Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe
-
Size
455KB
-
MD5
5505c6c7744fdf3d51ed2b92d1059570
-
SHA1
c6bebe2c38f8f154042492afaf8302ccea46e621
-
SHA256
a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58
-
SHA512
22b88597cadcb10c3d2e1f4d56aaf68ee8aab042cf8f033bde1061154827aa90e2f98476854f9d013240a053ffb0aa735c6db4b2b3c64cf91b19daf4945fce9d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2216-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-52-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2584-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3028-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-195-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1852-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-309-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1708-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-334-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-419-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1744-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/792-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-732-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3016-767-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2640-891-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2740-998-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2084-1005-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-1032-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 3bbhtb.exe 2680 vdvdj.exe 1352 nhhtnt.exe 2824 vvpdp.exe 2700 nnhnbh.exe 2548 lflxfff.exe 2584 7nhthn.exe 1300 hbtnbb.exe 3028 3fllxrl.exe 2128 ntthhb.exe 2844 7frxflf.exe 864 pjpdp.exe 2420 7xrxlrx.exe 484 bhbnhn.exe 2916 lrrfrxr.exe 1072 htthtn.exe 320 ppjvp.exe 2180 bttthh.exe 1920 3dpdd.exe 2224 lfffxrl.exe 848 jjvdj.exe 1852 hnbhhh.exe 564 jpvpj.exe 2256 thttbh.exe 1768 dvvdv.exe 1972 bbbnbh.exe 2308 vvppd.exe 2152 xlxlxrx.exe 2924 ttbhtb.exe 700 jpdjv.exe 2960 1bbhbn.exe 2616 nbtbbn.exe 2756 jdpjv.exe 1708 lxllllr.exe 2100 ppjpv.exe 2692 1frxfrx.exe 1352 1hbtht.exe 2348 3pjpv.exe 1584 rrllrrf.exe 2608 hhhbtt.exe 2652 dvjjp.exe 1304 vdppv.exe 2920 7flrrxf.exe 960 hnbhtt.exe 2120 vpjpp.exe 1484 xrffflx.exe 1672 bbbhnt.exe 1684 jddjv.exe 2424 rlflrrf.exe 540 fffxxfr.exe 2420 hnnbnt.exe 2848 jvjpd.exe 1624 lxxfxfr.exe 1332 tththn.exe 1744 ppdpj.exe 2188 fxxxxfl.exe 2340 lfxfrrf.exe 2156 hhbbbh.exe 976 vpdjv.exe 792 fxrxllf.exe 924 lxrxffr.exe 2028 1tntbh.exe 588 5pjjp.exe 1772 flffxlx.exe -
resource yara_rule behavioral1/memory/2216-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-52-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2584-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-283-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2616-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-419-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1744-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/792-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-891-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2920-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-998-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2084-1005-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxflrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2744 2216 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 30 PID 2216 wrote to memory of 2744 2216 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 30 PID 2216 wrote to memory of 2744 2216 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 30 PID 2216 wrote to memory of 2744 2216 a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe 30 PID 2744 wrote to memory of 2680 2744 3bbhtb.exe 31 PID 2744 wrote to memory of 2680 2744 3bbhtb.exe 31 PID 2744 wrote to memory of 2680 2744 3bbhtb.exe 31 PID 2744 wrote to memory of 2680 2744 3bbhtb.exe 31 PID 2680 wrote to memory of 1352 2680 vdvdj.exe 32 PID 2680 wrote to memory of 1352 2680 vdvdj.exe 32 PID 2680 wrote to memory of 1352 2680 vdvdj.exe 32 PID 2680 wrote to memory of 1352 2680 vdvdj.exe 32 PID 1352 wrote to memory of 2824 1352 nhhtnt.exe 33 PID 1352 wrote to memory of 2824 1352 nhhtnt.exe 33 PID 1352 wrote to memory of 2824 1352 nhhtnt.exe 33 PID 1352 wrote to memory of 2824 1352 nhhtnt.exe 33 PID 2824 wrote to memory of 2700 2824 vvpdp.exe 34 PID 2824 wrote to memory of 2700 2824 vvpdp.exe 34 PID 2824 wrote to memory of 2700 2824 vvpdp.exe 34 PID 2824 wrote to memory of 2700 2824 vvpdp.exe 34 PID 2700 wrote to memory of 2548 2700 nnhnbh.exe 35 PID 2700 wrote to memory of 2548 2700 nnhnbh.exe 35 PID 2700 wrote to memory of 2548 2700 nnhnbh.exe 35 PID 2700 wrote to memory of 2548 2700 nnhnbh.exe 35 PID 2548 wrote to memory of 2584 2548 lflxfff.exe 36 PID 2548 wrote to memory of 2584 2548 lflxfff.exe 36 PID 2548 wrote to memory of 2584 2548 lflxfff.exe 36 PID 2548 wrote to memory of 2584 2548 lflxfff.exe 36 PID 2584 wrote to memory of 1300 2584 7nhthn.exe 37 PID 2584 wrote to memory of 1300 2584 7nhthn.exe 37 PID 2584 wrote to memory of 1300 2584 7nhthn.exe 37 PID 2584 wrote to memory of 1300 2584 7nhthn.exe 37 PID 1300 wrote to memory of 3028 1300 hbtnbb.exe 38 PID 1300 wrote to memory of 3028 1300 hbtnbb.exe 38 PID 1300 wrote to memory of 3028 1300 hbtnbb.exe 38 PID 1300 wrote to memory of 3028 1300 hbtnbb.exe 38 PID 3028 wrote to memory of 2128 3028 3fllxrl.exe 39 PID 3028 wrote to memory of 2128 3028 3fllxrl.exe 39 PID 3028 wrote to memory of 2128 3028 3fllxrl.exe 39 PID 3028 wrote to memory of 2128 3028 3fllxrl.exe 39 PID 2128 wrote to memory of 2844 2128 ntthhb.exe 40 PID 2128 wrote to memory of 2844 2128 ntthhb.exe 40 PID 2128 wrote to memory of 2844 2128 ntthhb.exe 40 PID 2128 wrote to memory of 2844 2128 ntthhb.exe 40 PID 2844 wrote to memory of 864 2844 7frxflf.exe 41 PID 2844 wrote to memory of 864 2844 7frxflf.exe 41 PID 2844 wrote to memory of 864 2844 7frxflf.exe 41 PID 2844 wrote to memory of 864 2844 7frxflf.exe 41 PID 864 wrote to memory of 2420 864 pjpdp.exe 42 PID 864 wrote to memory of 2420 864 pjpdp.exe 42 PID 864 wrote to memory of 2420 864 pjpdp.exe 42 PID 864 wrote to memory of 2420 864 pjpdp.exe 42 PID 2420 wrote to memory of 484 2420 7xrxlrx.exe 43 PID 2420 wrote to memory of 484 2420 7xrxlrx.exe 43 PID 2420 wrote to memory of 484 2420 7xrxlrx.exe 43 PID 2420 wrote to memory of 484 2420 7xrxlrx.exe 43 PID 484 wrote to memory of 2916 484 bhbnhn.exe 44 PID 484 wrote to memory of 2916 484 bhbnhn.exe 44 PID 484 wrote to memory of 2916 484 bhbnhn.exe 44 PID 484 wrote to memory of 2916 484 bhbnhn.exe 44 PID 2916 wrote to memory of 1072 2916 lrrfrxr.exe 45 PID 2916 wrote to memory of 1072 2916 lrrfrxr.exe 45 PID 2916 wrote to memory of 1072 2916 lrrfrxr.exe 45 PID 2916 wrote to memory of 1072 2916 lrrfrxr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe"C:\Users\Admin\AppData\Local\Temp\a5cdfd1a31f7406febfee33cd793d2c42d561bb52c927fa630753444ccc1db58N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\3bbhtb.exec:\3bbhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vdvdj.exec:\vdvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\nhhtnt.exec:\nhhtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\vvpdp.exec:\vvpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nnhnbh.exec:\nnhnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lflxfff.exec:\lflxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\7nhthn.exec:\7nhthn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\hbtnbb.exec:\hbtnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\3fllxrl.exec:\3fllxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\ntthhb.exec:\ntthhb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\7frxflf.exec:\7frxflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pjpdp.exec:\pjpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\7xrxlrx.exec:\7xrxlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\bhbnhn.exec:\bhbnhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\lrrfrxr.exec:\lrrfrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\htthtn.exec:\htthtn.exe17⤵
- Executes dropped EXE
PID:1072 -
\??\c:\ppjvp.exec:\ppjvp.exe18⤵
- Executes dropped EXE
PID:320 -
\??\c:\bttthh.exec:\bttthh.exe19⤵
- Executes dropped EXE
PID:2180 -
\??\c:\3dpdd.exec:\3dpdd.exe20⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfffxrl.exec:\lfffxrl.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jjvdj.exec:\jjvdj.exe22⤵
- Executes dropped EXE
PID:848 -
\??\c:\hnbhhh.exec:\hnbhhh.exe23⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jpvpj.exec:\jpvpj.exe24⤵
- Executes dropped EXE
PID:564 -
\??\c:\thttbh.exec:\thttbh.exe25⤵
- Executes dropped EXE
PID:2256 -
\??\c:\dvvdv.exec:\dvvdv.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\bbbnbh.exec:\bbbnbh.exe27⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vvppd.exec:\vvppd.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\xlxlxrx.exec:\xlxlxrx.exe29⤵
- Executes dropped EXE
PID:2152 -
\??\c:\ttbhtb.exec:\ttbhtb.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924 -
\??\c:\jpdjv.exec:\jpdjv.exe31⤵
- Executes dropped EXE
PID:700 -
\??\c:\1bbhbn.exec:\1bbhbn.exe32⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nbtbbn.exec:\nbtbbn.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jdpjv.exec:\jdpjv.exe34⤵
- Executes dropped EXE
PID:2756 -
\??\c:\lxllllr.exec:\lxllllr.exe35⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ppjpv.exec:\ppjpv.exe36⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1frxfrx.exec:\1frxfrx.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1hbtht.exec:\1hbtht.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1352 -
\??\c:\3pjpv.exec:\3pjpv.exe39⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rrllrrf.exec:\rrllrrf.exe40⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hhhbtt.exec:\hhhbtt.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\dvjjp.exec:\dvjjp.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vdppv.exec:\vdppv.exe43⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7flrrxf.exec:\7flrrxf.exe44⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hnbhtt.exec:\hnbhtt.exe45⤵
- Executes dropped EXE
PID:960 -
\??\c:\vpjpp.exec:\vpjpp.exe46⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrffflx.exec:\xrffflx.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bbbhnt.exec:\bbbhnt.exe48⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jddjv.exec:\jddjv.exe49⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rlflrrf.exec:\rlflrrf.exe50⤵
- Executes dropped EXE
PID:2424 -
\??\c:\fffxxfr.exec:\fffxxfr.exe51⤵
- Executes dropped EXE
PID:540 -
\??\c:\hnnbnt.exec:\hnnbnt.exe52⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jvjpd.exec:\jvjpd.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lxxfxfr.exec:\lxxfxfr.exe54⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tththn.exec:\tththn.exe55⤵
- Executes dropped EXE
PID:1332 -
\??\c:\ppdpj.exec:\ppdpj.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fxxxxfl.exec:\fxxxxfl.exe57⤵
- Executes dropped EXE
PID:2188 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hhbbbh.exec:\hhbbbh.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vpdjv.exec:\vpdjv.exe60⤵
- Executes dropped EXE
PID:976 -
\??\c:\fxrxllf.exec:\fxrxllf.exe61⤵
- Executes dropped EXE
PID:792 -
\??\c:\lxrxffr.exec:\lxrxffr.exe62⤵
- Executes dropped EXE
PID:924 -
\??\c:\1tntbh.exec:\1tntbh.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\5pjjp.exec:\5pjjp.exe64⤵
- Executes dropped EXE
PID:588 -
\??\c:\flffxlx.exec:\flffxlx.exe65⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nbtnhn.exec:\nbtnhn.exe66⤵PID:2032
-
\??\c:\1dvjd.exec:\1dvjd.exe67⤵PID:2500
-
\??\c:\vvdpj.exec:\vvdpj.exe68⤵PID:2404
-
\??\c:\9lfflrx.exec:\9lfflrx.exe69⤵PID:2304
-
\??\c:\nnhnht.exec:\nnhnht.exe70⤵PID:2276
-
\??\c:\pjpvj.exec:\pjpvj.exe71⤵PID:1540
-
\??\c:\5dpdj.exec:\5dpdj.exe72⤵PID:696
-
\??\c:\xflxxff.exec:\xflxxff.exe73⤵PID:2200
-
\??\c:\bbtbbn.exec:\bbtbbn.exe74⤵PID:2448
-
\??\c:\jpjpd.exec:\jpjpd.exe75⤵PID:1848
-
\??\c:\llflrrf.exec:\llflrrf.exe76⤵PID:2612
-
\??\c:\llffxfr.exec:\llffxfr.exe77⤵PID:2676
-
\??\c:\nhttbh.exec:\nhttbh.exe78⤵PID:2752
-
\??\c:\jvddp.exec:\jvddp.exe79⤵PID:2656
-
\??\c:\rrllxxx.exec:\rrllxxx.exe80⤵PID:2972
-
\??\c:\nnnbth.exec:\nnnbth.exe81⤵PID:2780
-
\??\c:\jdpvd.exec:\jdpvd.exe82⤵PID:2772
-
\??\c:\fxlffff.exec:\fxlffff.exe83⤵PID:2588
-
\??\c:\ffxlrfx.exec:\ffxlrfx.exe84⤵PID:2528
-
\??\c:\tthnth.exec:\tthnth.exe85⤵PID:2144
-
\??\c:\jjddp.exec:\jjddp.exe86⤵PID:1636
-
\??\c:\7fxrflr.exec:\7fxrflr.exe87⤵PID:2908
-
\??\c:\9rlrffr.exec:\9rlrffr.exe88⤵PID:1300
-
\??\c:\btnthn.exec:\btnthn.exe89⤵PID:2936
-
\??\c:\ttntnt.exec:\ttntnt.exe90⤵PID:1988
-
\??\c:\vvpvd.exec:\vvpvd.exe91⤵PID:2232
-
\??\c:\7flxrfl.exec:\7flxrfl.exe92⤵PID:2844
-
\??\c:\nhhntn.exec:\nhhntn.exe93⤵PID:864
-
\??\c:\3pvdj.exec:\3pvdj.exe94⤵PID:2012
-
\??\c:\jjvpv.exec:\jjvpv.exe95⤵PID:1900
-
\??\c:\lllrlrf.exec:\lllrlrf.exe96⤵PID:2776
-
\??\c:\nnhbtb.exec:\nnhbtb.exe97⤵PID:2916
-
\??\c:\pvvvd.exec:\pvvvd.exe98⤵PID:2848
-
\??\c:\jddvd.exec:\jddvd.exe99⤵PID:812
-
\??\c:\7rllxlx.exec:\7rllxlx.exe100⤵PID:448
-
\??\c:\5nnbht.exec:\5nnbht.exe101⤵PID:2228
-
\??\c:\bhhthn.exec:\bhhthn.exe102⤵PID:1936
-
\??\c:\fxfllll.exec:\fxfllll.exe103⤵PID:916
-
\??\c:\5xrrxfr.exec:\5xrrxfr.exe104⤵PID:2224
-
\??\c:\9bbttb.exec:\9bbttb.exe105⤵PID:3016
-
\??\c:\pppdj.exec:\pppdj.exe106⤵PID:716
-
\??\c:\7lfxffl.exec:\7lfxffl.exe107⤵PID:1820
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe108⤵PID:1112
-
\??\c:\pdvjj.exec:\pdvjj.exe109⤵PID:2256
-
\??\c:\thtnbt.exec:\thtnbt.exe110⤵PID:2136
-
\??\c:\ntthnt.exec:\ntthnt.exe111⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\5dddj.exec:\5dddj.exe112⤵PID:1316
-
\??\c:\fxxrllf.exec:\fxxrllf.exe113⤵PID:2816
-
\??\c:\rxflflf.exec:\rxflflf.exe114⤵PID:2152
-
\??\c:\hnbhnn.exec:\hnbhnn.exe115⤵PID:1012
-
\??\c:\7jpjd.exec:\7jpjd.exe116⤵PID:1664
-
\??\c:\dvppd.exec:\dvppd.exe117⤵PID:896
-
\??\c:\xlxfflx.exec:\xlxfflx.exe118⤵PID:2264
-
\??\c:\bhbhnt.exec:\bhbhnt.exe119⤵PID:1848
-
\??\c:\7jdvd.exec:\7jdvd.exe120⤵PID:2764
-
\??\c:\3fxrxlf.exec:\3fxrxlf.exe121⤵PID:2640
-
\??\c:\5rlrxxf.exec:\5rlrxxf.exe122⤵PID:2812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-