Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe
-
Size
455KB
-
MD5
65e251e656c2c2e1f9aad7aa2fcea49a
-
SHA1
b25cd800bef136d8e665ff4023ab73e35e62bc2c
-
SHA256
0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4
-
SHA512
de865be3d62817aafe5b921fc7967d70fc94764a8da39240c6c16f541beb6ae877ab901d4e3abae32675a277ea8d43d44581e8b0e4f046ac401cba0080b7c563
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/1292-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-93-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1100-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-131-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1984-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-210-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/828-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-273-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/612-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-287-0x0000000077820000-0x000000007793F000-memory.dmp family_blackmoon behavioral1/memory/2844-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-357-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2472-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-409-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1988-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3044-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-564-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-583-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-637-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2708-706-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1488-721-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-787-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 bbnbht.exe 2496 rxrfrxl.exe 2256 nnnbnb.exe 2808 jdppp.exe 2752 9fxfrxr.exe 3008 jvppp.exe 2640 rfflflx.exe 2660 ppjvj.exe 2656 7lxrlfx.exe 2220 5lxxfxf.exe 2856 jjjvv.exe 1100 nhhnbn.exe 1984 5htnnh.exe 2292 1rfrxfr.exe 2972 3nbhhb.exe 2332 fxrxlrf.exe 1892 hhhbnt.exe 536 7pppv.exe 276 llrxrfx.exe 3028 nbbbtn.exe 320 pppdp.exe 1628 nntnbt.exe 828 1hbnnh.exe 1944 rfxxffr.exe 636 htnttt.exe 1692 pjdvp.exe 1028 rfrlllx.exe 1756 vpvvj.exe 612 rrlllfr.exe 888 bbnntb.exe 2992 5pvvp.exe 1600 3tnnnn.exe 2496 9nbbhh.exe 2760 nnntbt.exe 2844 pdjvp.exe 2884 lfxrxll.exe 1668 bntbnh.exe 2840 tnbbtn.exe 2364 jvppv.exe 2928 9xrrxrr.exe 2136 hthhhn.exe 2472 3tnntn.exe 2196 djpdd.exe 832 1rfffff.exe 2856 xxrxffl.exe 2164 3ntnnn.exe 2460 vjvpv.exe 1988 pvvvd.exe 2948 1lfxffl.exe 2708 bnthnh.exe 1960 bnttnn.exe 1244 djpjv.exe 2004 xxfxflr.exe 2560 lxflllr.exe 2100 bthnth.exe 1968 jpjpv.exe 2016 1frfffl.exe 3044 llxxflr.exe 316 5nhhnh.exe 948 9ddpd.exe 1256 ffllrxf.exe 756 tbnbbb.exe 1620 hthhhn.exe 2008 3vjvv.exe -
resource yara_rule behavioral1/memory/1292-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-287-0x0000000077820000-0x000000007793F000-memory.dmp upx behavioral1/memory/1600-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/948-499-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/948-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-564-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-700-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1488-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-761-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-794-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/612-816-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2524 1292 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 30 PID 1292 wrote to memory of 2524 1292 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 30 PID 1292 wrote to memory of 2524 1292 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 30 PID 1292 wrote to memory of 2524 1292 0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe 30 PID 2524 wrote to memory of 2496 2524 bbnbht.exe 31 PID 2524 wrote to memory of 2496 2524 bbnbht.exe 31 PID 2524 wrote to memory of 2496 2524 bbnbht.exe 31 PID 2524 wrote to memory of 2496 2524 bbnbht.exe 31 PID 2496 wrote to memory of 2256 2496 rxrfrxl.exe 32 PID 2496 wrote to memory of 2256 2496 rxrfrxl.exe 32 PID 2496 wrote to memory of 2256 2496 rxrfrxl.exe 32 PID 2496 wrote to memory of 2256 2496 rxrfrxl.exe 32 PID 2256 wrote to memory of 2808 2256 nnnbnb.exe 33 PID 2256 wrote to memory of 2808 2256 nnnbnb.exe 33 PID 2256 wrote to memory of 2808 2256 nnnbnb.exe 33 PID 2256 wrote to memory of 2808 2256 nnnbnb.exe 33 PID 2808 wrote to memory of 2752 2808 jdppp.exe 34 PID 2808 wrote to memory of 2752 2808 jdppp.exe 34 PID 2808 wrote to memory of 2752 2808 jdppp.exe 34 PID 2808 wrote to memory of 2752 2808 jdppp.exe 34 PID 2752 wrote to memory of 3008 2752 9fxfrxr.exe 35 PID 2752 wrote to memory of 3008 2752 9fxfrxr.exe 35 PID 2752 wrote to memory of 3008 2752 9fxfrxr.exe 35 PID 2752 wrote to memory of 3008 2752 9fxfrxr.exe 35 PID 3008 wrote to memory of 2640 3008 jvppp.exe 36 PID 3008 wrote to memory of 2640 3008 jvppp.exe 36 PID 3008 wrote to memory of 2640 3008 jvppp.exe 36 PID 3008 wrote to memory of 2640 3008 jvppp.exe 36 PID 2640 wrote to memory of 2660 2640 rfflflx.exe 37 PID 2640 wrote to memory of 2660 2640 rfflflx.exe 37 PID 2640 wrote to memory of 2660 2640 rfflflx.exe 37 PID 2640 wrote to memory of 2660 2640 rfflflx.exe 37 PID 2660 wrote to memory of 2656 2660 ppjvj.exe 38 PID 2660 wrote to memory of 2656 2660 ppjvj.exe 38 PID 2660 wrote to memory of 2656 2660 ppjvj.exe 38 PID 2660 wrote to memory of 2656 2660 ppjvj.exe 38 PID 2656 wrote to memory of 2220 2656 7lxrlfx.exe 39 PID 2656 wrote to memory of 2220 2656 7lxrlfx.exe 39 PID 2656 wrote to memory of 2220 2656 7lxrlfx.exe 39 PID 2656 wrote to memory of 2220 2656 7lxrlfx.exe 39 PID 2220 wrote to memory of 2856 2220 5lxxfxf.exe 40 PID 2220 wrote to memory of 2856 2220 5lxxfxf.exe 40 PID 2220 wrote to memory of 2856 2220 5lxxfxf.exe 40 PID 2220 wrote to memory of 2856 2220 5lxxfxf.exe 40 PID 2856 wrote to memory of 1100 2856 jjjvv.exe 41 PID 2856 wrote to memory of 1100 2856 jjjvv.exe 41 PID 2856 wrote to memory of 1100 2856 jjjvv.exe 41 PID 2856 wrote to memory of 1100 2856 jjjvv.exe 41 PID 1100 wrote to memory of 1984 1100 nhhnbn.exe 42 PID 1100 wrote to memory of 1984 1100 nhhnbn.exe 42 PID 1100 wrote to memory of 1984 1100 nhhnbn.exe 42 PID 1100 wrote to memory of 1984 1100 nhhnbn.exe 42 PID 1984 wrote to memory of 2292 1984 5htnnh.exe 43 PID 1984 wrote to memory of 2292 1984 5htnnh.exe 43 PID 1984 wrote to memory of 2292 1984 5htnnh.exe 43 PID 1984 wrote to memory of 2292 1984 5htnnh.exe 43 PID 2292 wrote to memory of 2972 2292 1rfrxfr.exe 44 PID 2292 wrote to memory of 2972 2292 1rfrxfr.exe 44 PID 2292 wrote to memory of 2972 2292 1rfrxfr.exe 44 PID 2292 wrote to memory of 2972 2292 1rfrxfr.exe 44 PID 2972 wrote to memory of 2332 2972 3nbhhb.exe 45 PID 2972 wrote to memory of 2332 2972 3nbhhb.exe 45 PID 2972 wrote to memory of 2332 2972 3nbhhb.exe 45 PID 2972 wrote to memory of 2332 2972 3nbhhb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe"C:\Users\Admin\AppData\Local\Temp\0ea8bc610687fc3d793d64254c44d94e2ade304724aaec1b07e04b2cd53796c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\bbnbht.exec:\bbnbht.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\rxrfrxl.exec:\rxrfrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\nnnbnb.exec:\nnnbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\jdppp.exec:\jdppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9fxfrxr.exec:\9fxfrxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\jvppp.exec:\jvppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\rfflflx.exec:\rfflflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\ppjvj.exec:\ppjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7lxrlfx.exec:\7lxrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5lxxfxf.exec:\5lxxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jjjvv.exec:\jjjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\nhhnbn.exec:\nhhnbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\5htnnh.exec:\5htnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\1rfrxfr.exec:\1rfrxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\3nbhhb.exec:\3nbhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe17⤵
- Executes dropped EXE
PID:2332 -
\??\c:\hhhbnt.exec:\hhhbnt.exe18⤵
- Executes dropped EXE
PID:1892 -
\??\c:\7pppv.exec:\7pppv.exe19⤵
- Executes dropped EXE
PID:536 -
\??\c:\llrxrfx.exec:\llrxrfx.exe20⤵
- Executes dropped EXE
PID:276 -
\??\c:\nbbbtn.exec:\nbbbtn.exe21⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pppdp.exec:\pppdp.exe22⤵
- Executes dropped EXE
PID:320 -
\??\c:\nntnbt.exec:\nntnbt.exe23⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1hbnnh.exec:\1hbnnh.exe24⤵
- Executes dropped EXE
PID:828 -
\??\c:\rfxxffr.exec:\rfxxffr.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\htnttt.exec:\htnttt.exe26⤵
- Executes dropped EXE
PID:636 -
\??\c:\pjdvp.exec:\pjdvp.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rfrlllx.exec:\rfrlllx.exe28⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vpvvj.exec:\vpvvj.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\rrlllfr.exec:\rrlllfr.exe30⤵
- Executes dropped EXE
PID:612 -
\??\c:\bbnntb.exec:\bbnntb.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:888 -
\??\c:\5pvvp.exec:\5pvvp.exe32⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1tnhnh.exec:\1tnhnh.exe33⤵PID:2372
-
\??\c:\3tnnnn.exec:\3tnnnn.exe34⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9nbbhh.exec:\9nbbhh.exe35⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nnntbt.exec:\nnntbt.exe36⤵
- Executes dropped EXE
PID:2760 -
\??\c:\pdjvp.exec:\pdjvp.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lfxrxll.exec:\lfxrxll.exe38⤵
- Executes dropped EXE
PID:2884 -
\??\c:\bntbnh.exec:\bntbnh.exe39⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tnbbtn.exec:\tnbbtn.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jvppv.exec:\jvppv.exe41⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9xrrxrr.exec:\9xrrxrr.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hthhhn.exec:\hthhhn.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\3tnntn.exec:\3tnntn.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\djpdd.exec:\djpdd.exe45⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1rfffff.exec:\1rfffff.exe46⤵
- Executes dropped EXE
PID:832 -
\??\c:\xxrxffl.exec:\xxrxffl.exe47⤵
- Executes dropped EXE
PID:2856 -
\??\c:\3ntnnn.exec:\3ntnnn.exe48⤵
- Executes dropped EXE
PID:2164 -
\??\c:\vjvpv.exec:\vjvpv.exe49⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pvvvd.exec:\pvvvd.exe50⤵
- Executes dropped EXE
PID:1988 -
\??\c:\1lfxffl.exec:\1lfxffl.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bnthnh.exec:\bnthnh.exe52⤵
- Executes dropped EXE
PID:2708 -
\??\c:\bnttnn.exec:\bnttnn.exe53⤵
- Executes dropped EXE
PID:1960 -
\??\c:\djpjv.exec:\djpjv.exe54⤵
- Executes dropped EXE
PID:1244 -
\??\c:\xxfxflr.exec:\xxfxflr.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lxflllr.exec:\lxflllr.exe56⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bthnth.exec:\bthnth.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jpjpv.exec:\jpjpv.exe58⤵
- Executes dropped EXE
PID:1968 -
\??\c:\1frfffl.exec:\1frfffl.exe59⤵
- Executes dropped EXE
PID:2016 -
\??\c:\llxxflr.exec:\llxxflr.exe60⤵
- Executes dropped EXE
PID:3044 -
\??\c:\5nhhnh.exec:\5nhhnh.exe61⤵
- Executes dropped EXE
PID:316 -
\??\c:\9ddpd.exec:\9ddpd.exe62⤵
- Executes dropped EXE
PID:948 -
\??\c:\ffllrxf.exec:\ffllrxf.exe63⤵
- Executes dropped EXE
PID:1256 -
\??\c:\tbnbbb.exec:\tbnbbb.exe64⤵
- Executes dropped EXE
PID:756 -
\??\c:\hthhhn.exec:\hthhhn.exe65⤵
- Executes dropped EXE
PID:1620 -
\??\c:\3vjvv.exec:\3vjvv.exe66⤵
- Executes dropped EXE
PID:2008 -
\??\c:\frffllf.exec:\frffllf.exe67⤵PID:3048
-
\??\c:\bbnhnt.exec:\bbnhnt.exe68⤵PID:2512
-
\??\c:\5bttnh.exec:\5bttnh.exe69⤵
- System Location Discovery: System Language Discovery
PID:3056 -
\??\c:\pdvvd.exec:\pdvvd.exe70⤵PID:108
-
\??\c:\9pddv.exec:\9pddv.exe71⤵PID:1760
-
\??\c:\lxlfllr.exec:\lxlfllr.exe72⤵PID:656
-
\??\c:\nhbhtt.exec:\nhbhtt.exe73⤵PID:1604
-
\??\c:\tnbtbb.exec:\tnbtbb.exe74⤵PID:2488
-
\??\c:\vpjpp.exec:\vpjpp.exe75⤵PID:2280
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe76⤵PID:2464
-
\??\c:\lxffflr.exec:\lxffflr.exe77⤵PID:2800
-
\??\c:\5ntnnn.exec:\5ntnnn.exe78⤵PID:2704
-
\??\c:\dpdvd.exec:\dpdvd.exe79⤵PID:2912
-
\??\c:\1pjpv.exec:\1pjpv.exe80⤵PID:2752
-
\??\c:\9lrfrlx.exec:\9lrfrlx.exe81⤵PID:2636
-
\??\c:\hbntbh.exec:\hbntbh.exe82⤵PID:2748
-
\??\c:\hthbtt.exec:\hthbtt.exe83⤵PID:2900
-
\??\c:\vvjjv.exec:\vvjjv.exe84⤵PID:2624
-
\??\c:\rflrfff.exec:\rflrfff.exe85⤵PID:2336
-
\??\c:\xrllrrx.exec:\xrllrrx.exe86⤵PID:2964
-
\??\c:\7tthnn.exec:\7tthnn.exe87⤵PID:1012
-
\??\c:\vvpjj.exec:\vvpjj.exe88⤵PID:2044
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe89⤵PID:2028
-
\??\c:\nnnnbb.exec:\nnnnbb.exe90⤵PID:2680
-
\??\c:\tnbbbb.exec:\tnbbbb.exe91⤵PID:2944
-
\??\c:\dvjpv.exec:\dvjpv.exe92⤵PID:2940
-
\??\c:\7rlllrf.exec:\7rlllrf.exe93⤵PID:2980
-
\??\c:\3xflrlx.exec:\3xflrlx.exe94⤵PID:2708
-
\??\c:\tnbhhb.exec:\tnbhhb.exe95⤵PID:2580
-
\??\c:\7jvvv.exec:\7jvvv.exe96⤵PID:2072
-
\??\c:\rlllflr.exec:\rlllflr.exe97⤵PID:1488
-
\??\c:\lfrfflf.exec:\lfrfflf.exe98⤵PID:1836
-
\??\c:\bhtttt.exec:\bhtttt.exe99⤵PID:3028
-
\??\c:\7vvpd.exec:\7vvpd.exe100⤵PID:1652
-
\??\c:\jvjpv.exec:\jvjpv.exe101⤵PID:892
-
\??\c:\rlflxfl.exec:\rlflxfl.exe102⤵PID:848
-
\??\c:\thttbh.exec:\thttbh.exe103⤵PID:316
-
\??\c:\9bthnb.exec:\9bthnb.exe104⤵PID:964
-
\??\c:\vjdjp.exec:\vjdjp.exe105⤵PID:1088
-
\??\c:\lllxrxx.exec:\lllxrxx.exe106⤵PID:1328
-
\??\c:\3lffrfx.exec:\3lffrfx.exe107⤵PID:764
-
\??\c:\nhhhnt.exec:\nhhhnt.exe108⤵PID:2276
-
\??\c:\ppjdd.exec:\ppjdd.exe109⤵PID:2424
-
\??\c:\jvjpd.exec:\jvjpd.exe110⤵PID:2552
-
\??\c:\flffrxl.exec:\flffrxl.exe111⤵PID:612
-
\??\c:\thbbhn.exec:\thbbhn.exe112⤵PID:108
-
\??\c:\7vjdj.exec:\7vjdj.exe113⤵PID:1884
-
\??\c:\jdvvd.exec:\jdvvd.exe114⤵PID:2528
-
\??\c:\3rxfllr.exec:\3rxfllr.exe115⤵PID:2352
-
\??\c:\hbttbb.exec:\hbttbb.exe116⤵PID:1520
-
\??\c:\7bnnhh.exec:\7bnnhh.exe117⤵PID:2740
-
\??\c:\dppvd.exec:\dppvd.exe118⤵PID:2764
-
\??\c:\djddd.exec:\djddd.exe119⤵PID:2908
-
\??\c:\rrfrlrf.exec:\rrfrlrf.exe120⤵PID:2888
-
\??\c:\3hbbhh.exec:\3hbbhh.exe121⤵PID:1668
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-