Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe
-
Size
454KB
-
MD5
d4bf73f600dc07d4f1420e5284d06e59
-
SHA1
1087e674d998ed20830e34f770a4a4a6696bcb42
-
SHA256
da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be
-
SHA512
21e3af985d15f1cf8c524169e5c3d2348130e4809d97f8aaa56b49879f814fb28bd2f89b1ca36ce4e744f98fa5861cbd246eadaeca0212a368dd9dbb02462797
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe9:q7Tc2NYHUrAwfMp3CD9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-39-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2516-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-59-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2224-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-77-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2612-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-132-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2764-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-149-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-338-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2724-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-411-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1032-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-465-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1628-485-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1980-498-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/904-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-699-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1912-706-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2288-755-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1840-768-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-793-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-855-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-897-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1508-980-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1248-999-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-1022-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/1700-1049-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2584-1182-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1988 9xxrlxx.exe 2376 nnhhnb.exe 2516 bbnhnb.exe 1948 5fxlrfr.exe 2888 bhnntn.exe 2224 xlfffxr.exe 2612 rrlrlrl.exe 2632 ddjdp.exe 2604 vppvj.exe 2340 thnhht.exe 672 nhnbnt.exe 1468 fllxrlr.exe 2924 flxlxfx.exe 2764 jddjv.exe 680 lfxrflf.exe 504 tnhhtt.exe 1924 jvjpd.exe 316 9hhhhn.exe 3000 dvpvv.exe 2680 flrrlxx.exe 2288 tbbtbh.exe 952 lfxflrl.exe 3036 nnhhnb.exe 2212 pvjjp.exe 1284 xrflrlf.exe 2252 3pddp.exe 2188 rfrllrl.exe 1772 ntnbbn.exe 2384 nnnthn.exe 1480 5dvjd.exe 1820 lxrxrxx.exe 2476 nnnnhh.exe 2412 1dvdp.exe 876 ffxfrxl.exe 2080 bbnttn.exe 2528 jdjpv.exe 2724 xxlfrll.exe 2884 xrlrxlx.exe 2700 9hhnht.exe 1596 dvvjv.exe 2932 xrrxlrf.exe 2600 lfflrrl.exe 2596 tbbbbn.exe 2604 dddpj.exe 2772 5jjdd.exe 1664 llfrlrl.exe 1560 hbbbhh.exe 2936 ppvjj.exe 2776 vvjvj.exe 768 7lxxxfl.exe 2760 btntbh.exe 1936 dpdjp.exe 1032 5pjvj.exe 2016 rlfllrx.exe 1620 bnhhtt.exe 2328 bnbbhh.exe 2060 jpjpv.exe 448 flflllx.exe 1628 bththh.exe 1604 nnhnnb.exe 1980 vvvdv.exe 1684 frffrrf.exe 2212 bbthbh.exe 904 1vpjd.exe -
resource yara_rule behavioral1/memory/2336-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-77-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2612-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/680-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-647-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-699-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2288-755-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2500-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-825-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-835-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-1062-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxfrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1988 2336 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 30 PID 2336 wrote to memory of 1988 2336 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 30 PID 2336 wrote to memory of 1988 2336 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 30 PID 2336 wrote to memory of 1988 2336 da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe 30 PID 1988 wrote to memory of 2376 1988 9xxrlxx.exe 31 PID 1988 wrote to memory of 2376 1988 9xxrlxx.exe 31 PID 1988 wrote to memory of 2376 1988 9xxrlxx.exe 31 PID 1988 wrote to memory of 2376 1988 9xxrlxx.exe 31 PID 2376 wrote to memory of 2516 2376 nnhhnb.exe 32 PID 2376 wrote to memory of 2516 2376 nnhhnb.exe 32 PID 2376 wrote to memory of 2516 2376 nnhhnb.exe 32 PID 2376 wrote to memory of 2516 2376 nnhhnb.exe 32 PID 2516 wrote to memory of 1948 2516 bbnhnb.exe 33 PID 2516 wrote to memory of 1948 2516 bbnhnb.exe 33 PID 2516 wrote to memory of 1948 2516 bbnhnb.exe 33 PID 2516 wrote to memory of 1948 2516 bbnhnb.exe 33 PID 1948 wrote to memory of 2888 1948 5fxlrfr.exe 34 PID 1948 wrote to memory of 2888 1948 5fxlrfr.exe 34 PID 1948 wrote to memory of 2888 1948 5fxlrfr.exe 34 PID 1948 wrote to memory of 2888 1948 5fxlrfr.exe 34 PID 2888 wrote to memory of 2224 2888 bhnntn.exe 35 PID 2888 wrote to memory of 2224 2888 bhnntn.exe 35 PID 2888 wrote to memory of 2224 2888 bhnntn.exe 35 PID 2888 wrote to memory of 2224 2888 bhnntn.exe 35 PID 2224 wrote to memory of 2612 2224 xlfffxr.exe 36 PID 2224 wrote to memory of 2612 2224 xlfffxr.exe 36 PID 2224 wrote to memory of 2612 2224 xlfffxr.exe 36 PID 2224 wrote to memory of 2612 2224 xlfffxr.exe 36 PID 2612 wrote to memory of 2632 2612 rrlrlrl.exe 37 PID 2612 wrote to memory of 2632 2612 rrlrlrl.exe 37 PID 2612 wrote to memory of 2632 2612 rrlrlrl.exe 37 PID 2612 wrote to memory of 2632 2612 rrlrlrl.exe 37 PID 2632 wrote to memory of 2604 2632 ddjdp.exe 38 PID 2632 wrote to memory of 2604 2632 ddjdp.exe 38 PID 2632 wrote to memory of 2604 2632 ddjdp.exe 38 PID 2632 wrote to memory of 2604 2632 ddjdp.exe 38 PID 2604 wrote to memory of 2340 2604 vppvj.exe 39 PID 2604 wrote to memory of 2340 2604 vppvj.exe 39 PID 2604 wrote to memory of 2340 2604 vppvj.exe 39 PID 2604 wrote to memory of 2340 2604 vppvj.exe 39 PID 2340 wrote to memory of 672 2340 thnhht.exe 40 PID 2340 wrote to memory of 672 2340 thnhht.exe 40 PID 2340 wrote to memory of 672 2340 thnhht.exe 40 PID 2340 wrote to memory of 672 2340 thnhht.exe 40 PID 672 wrote to memory of 1468 672 nhnbnt.exe 41 PID 672 wrote to memory of 1468 672 nhnbnt.exe 41 PID 672 wrote to memory of 1468 672 nhnbnt.exe 41 PID 672 wrote to memory of 1468 672 nhnbnt.exe 41 PID 1468 wrote to memory of 2924 1468 fllxrlr.exe 42 PID 1468 wrote to memory of 2924 1468 fllxrlr.exe 42 PID 1468 wrote to memory of 2924 1468 fllxrlr.exe 42 PID 1468 wrote to memory of 2924 1468 fllxrlr.exe 42 PID 2924 wrote to memory of 2764 2924 flxlxfx.exe 43 PID 2924 wrote to memory of 2764 2924 flxlxfx.exe 43 PID 2924 wrote to memory of 2764 2924 flxlxfx.exe 43 PID 2924 wrote to memory of 2764 2924 flxlxfx.exe 43 PID 2764 wrote to memory of 680 2764 jddjv.exe 44 PID 2764 wrote to memory of 680 2764 jddjv.exe 44 PID 2764 wrote to memory of 680 2764 jddjv.exe 44 PID 2764 wrote to memory of 680 2764 jddjv.exe 44 PID 680 wrote to memory of 504 680 lfxrflf.exe 45 PID 680 wrote to memory of 504 680 lfxrflf.exe 45 PID 680 wrote to memory of 504 680 lfxrflf.exe 45 PID 680 wrote to memory of 504 680 lfxrflf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe"C:\Users\Admin\AppData\Local\Temp\da2a621f1c5faf9730a3cecc6d429ef8de160b7432c876a9a79b369913f625be.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\9xxrlxx.exec:\9xxrlxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\nnhhnb.exec:\nnhhnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bbnhnb.exec:\bbnhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\5fxlrfr.exec:\5fxlrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\bhnntn.exec:\bhnntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\xlfffxr.exec:\xlfffxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ddjdp.exec:\ddjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\vppvj.exec:\vppvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\thnhht.exec:\thnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nhnbnt.exec:\nhnbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\fllxrlr.exec:\fllxrlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\flxlxfx.exec:\flxlxfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\jddjv.exec:\jddjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lfxrflf.exec:\lfxrflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\tnhhtt.exec:\tnhhtt.exe17⤵
- Executes dropped EXE
PID:504 -
\??\c:\jvjpd.exec:\jvjpd.exe18⤵
- Executes dropped EXE
PID:1924 -
\??\c:\9hhhhn.exec:\9hhhhn.exe19⤵
- Executes dropped EXE
PID:316 -
\??\c:\dvpvv.exec:\dvpvv.exe20⤵
- Executes dropped EXE
PID:3000 -
\??\c:\flrrlxx.exec:\flrrlxx.exe21⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tbbtbh.exec:\tbbtbh.exe22⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lfxflrl.exec:\lfxflrl.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\nnhhnb.exec:\nnhhnb.exe24⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pvjjp.exec:\pvjjp.exe25⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xrflrlf.exec:\xrflrlf.exe26⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3pddp.exec:\3pddp.exe27⤵
- Executes dropped EXE
PID:2252 -
\??\c:\rfrllrl.exec:\rfrllrl.exe28⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ntnbbn.exec:\ntnbbn.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nnnthn.exec:\nnnthn.exe30⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5dvjd.exec:\5dvjd.exe31⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lxrxrxx.exec:\lxrxrxx.exe32⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nnnnhh.exec:\nnnnhh.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\1dvdp.exec:\1dvdp.exe34⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ffxfrxl.exec:\ffxfrxl.exe35⤵
- Executes dropped EXE
PID:876 -
\??\c:\bbnttn.exec:\bbnttn.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jdjpv.exec:\jdjpv.exe37⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xxlfrll.exec:\xxlfrll.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xrlrxlx.exec:\xrlrxlx.exe39⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9hhnht.exec:\9hhnht.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\dvvjv.exec:\dvvjv.exe41⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lfflrrl.exec:\lfflrrl.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tbbbbn.exec:\tbbbbn.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dddpj.exec:\dddpj.exe45⤵
- Executes dropped EXE
PID:2604 -
\??\c:\5jjdd.exec:\5jjdd.exe46⤵
- Executes dropped EXE
PID:2772 -
\??\c:\llfrlrl.exec:\llfrlrl.exe47⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hbbbhh.exec:\hbbbhh.exe48⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ppvjj.exec:\ppvjj.exe49⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vvjvj.exec:\vvjvj.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7lxxxfl.exec:\7lxxxfl.exe51⤵
- Executes dropped EXE
PID:768 -
\??\c:\btntbh.exec:\btntbh.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dpdjp.exec:\dpdjp.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\5pjvj.exec:\5pjvj.exe54⤵
- Executes dropped EXE
PID:1032 -
\??\c:\rlfllrx.exec:\rlfllrx.exe55⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bnhhtt.exec:\bnhhtt.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bnbbhh.exec:\bnbbhh.exe57⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jpjpv.exec:\jpjpv.exe58⤵
- Executes dropped EXE
PID:2060 -
\??\c:\flflllx.exec:\flflllx.exe59⤵
- Executes dropped EXE
PID:448 -
\??\c:\bththh.exec:\bththh.exe60⤵
- Executes dropped EXE
PID:1628 -
\??\c:\nnhnnb.exec:\nnhnnb.exe61⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvvdv.exec:\vvvdv.exe62⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frffrrf.exec:\frffrrf.exe63⤵
- Executes dropped EXE
PID:1684 -
\??\c:\bbthbh.exec:\bbthbh.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1vpjd.exec:\1vpjd.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\jdppp.exec:\jdppp.exe66⤵PID:736
-
\??\c:\xfrfxff.exec:\xfrfxff.exe67⤵PID:2420
-
\??\c:\1hhtnt.exec:\1hhtnt.exe68⤵PID:488
-
\??\c:\ddvdp.exec:\ddvdp.exe69⤵PID:1772
-
\??\c:\ppjjv.exec:\ppjjv.exe70⤵PID:352
-
\??\c:\5flrfll.exec:\5flrfll.exe71⤵PID:2452
-
\??\c:\httttb.exec:\httttb.exe72⤵PID:1496
-
\??\c:\tnhbnh.exec:\tnhbnh.exe73⤵PID:2548
-
\??\c:\dvdjp.exec:\dvdjp.exe74⤵PID:1592
-
\??\c:\rxxrlxx.exec:\rxxrlxx.exe75⤵PID:1708
-
\??\c:\btthtt.exec:\btthtt.exe76⤵PID:1252
-
\??\c:\bnhbbh.exec:\bnhbbh.exe77⤵PID:2416
-
\??\c:\dvddj.exec:\dvddj.exe78⤵PID:2676
-
\??\c:\3xxffll.exec:\3xxffll.exe79⤵PID:2872
-
\??\c:\bhhhht.exec:\bhhhht.exe80⤵PID:2728
-
\??\c:\1ntbhh.exec:\1ntbhh.exe81⤵PID:1948
-
\??\c:\jvppd.exec:\jvppd.exe82⤵PID:3060
-
\??\c:\lfxrlrl.exec:\lfxrlrl.exe83⤵PID:2552
-
\??\c:\fxlfrfl.exec:\fxlfrfl.exe84⤵PID:1916
-
\??\c:\tnhhnn.exec:\tnhhnn.exe85⤵PID:2632
-
\??\c:\jdvdp.exec:\jdvdp.exe86⤵PID:2704
-
\??\c:\lffrfrr.exec:\lffrfrr.exe87⤵PID:2616
-
\??\c:\3llfrfr.exec:\3llfrfr.exe88⤵PID:1472
-
\??\c:\bhbhhh.exec:\bhbhhh.exe89⤵PID:1676
-
\??\c:\pjvpd.exec:\pjvpd.exe90⤵PID:1084
-
\??\c:\vjdvd.exec:\vjdvd.exe91⤵PID:1464
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe92⤵PID:2572
-
\??\c:\tnbnhn.exec:\tnbnhn.exe93⤵PID:1616
-
\??\c:\btbhnn.exec:\btbhnn.exe94⤵PID:2972
-
\??\c:\dvdjd.exec:\dvdjd.exe95⤵PID:1912
-
\??\c:\fxlxffr.exec:\fxlxffr.exe96⤵PID:300
-
\??\c:\1rxfxff.exec:\1rxfxff.exe97⤵PID:1884
-
\??\c:\hnbbtb.exec:\hnbbtb.exe98⤵PID:316
-
\??\c:\vpjjj.exec:\vpjjj.exe99⤵PID:2484
-
\??\c:\rfrfffr.exec:\rfrfffr.exe100⤵PID:3000
-
\??\c:\rrrxrxf.exec:\rrrxrxf.exe101⤵PID:2984
-
\??\c:\ttthhh.exec:\ttthhh.exe102⤵PID:2568
-
\??\c:\1ddjv.exec:\1ddjv.exe103⤵PID:2288
-
\??\c:\lfrflrf.exec:\lfrflrf.exe104⤵PID:1052
-
\??\c:\frrrlxf.exec:\frrrlxf.exe105⤵PID:1840
-
\??\c:\7nntbh.exec:\7nntbh.exe106⤵PID:1776
-
\??\c:\9vjpd.exec:\9vjpd.exe107⤵PID:1536
-
\??\c:\pdjjp.exec:\pdjjp.exe108⤵PID:1520
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe109⤵PID:2500
-
\??\c:\hbnthn.exec:\hbnthn.exe110⤵PID:3068
-
\??\c:\vpvdv.exec:\vpvdv.exe111⤵PID:828
-
\??\c:\ppjpd.exec:\ppjpd.exe112⤵PID:896
-
\??\c:\xrllrlx.exec:\xrllrlx.exe113⤵PID:2272
-
\??\c:\xrlfrrf.exec:\xrlfrrf.exe114⤵PID:1036
-
\??\c:\7nntbh.exec:\7nntbh.exe115⤵PID:2236
-
\??\c:\9dpvd.exec:\9dpvd.exe116⤵PID:1552
-
\??\c:\7jpdv.exec:\7jpdv.exe117⤵PID:2360
-
\??\c:\rlrrfxl.exec:\rlrrfxl.exe118⤵PID:1592
-
\??\c:\jpjjv.exec:\jpjjv.exe119⤵PID:2376
-
\??\c:\fxrrxfx.exec:\fxrrxfx.exe120⤵PID:2256
-
\??\c:\9rffflx.exec:\9rffflx.exe121⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-