Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe
-
Size
455KB
-
MD5
20cd44cb529fe5eba8f7dddc0fc539fe
-
SHA1
4759a40c4925f4fe6ac750ed9465ed1a51c48a24
-
SHA256
afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693
-
SHA512
2b1cd335fdbca4ec9240a921c6c7f9f490126963f87f23d1e5b04e55a18a03d7ce408e3056fcd4e9c9c21bf00d9d2e189df47f3d2202766cffe5626f53f8aa83
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeS:q7Tc2NYHUrAwfMp3CDS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 53 IoCs
resource yara_rule behavioral1/memory/2456-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/880-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-335-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2560-374-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1728-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-406-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1852-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-426-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2420-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-465-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2024-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-479-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1624-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-612-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2704-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-626-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2484-652-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2484-673-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2848-698-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-775-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-788-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-827-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/3000-909-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2024-1002-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1992-1091-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2108-1098-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2816-1111-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2200-1299-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-1306-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2908-1351-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2456 nhbhth.exe 1172 1xrxfrx.exe 2196 5xfxlff.exe 2752 ppjpv.exe 2788 5hbnbh.exe 2692 ddpdj.exe 2564 bbthth.exe 2728 rflrxxl.exe 2600 djdjd.exe 1300 rrlflxl.exe 380 djdpd.exe 2864 3ttthb.exe 880 xlxfxlf.exe 1708 9rlxfrx.exe 2836 jjjvj.exe 628 jvpvv.exe 588 ppdpv.exe 2632 5xlxfxf.exe 2516 lrffffx.exe 348 7nhnbb.exe 2272 rfxfxxl.exe 1256 bthnhb.exe 980 nhnhtb.exe 2132 3jdjp.exe 1796 nnbhbb.exe 1060 7pjvj.exe 2832 lxfrrll.exe 3020 bbtbtb.exe 3032 rrxlxlr.exe 2336 3nnbbn.exe 1904 rlxlxfr.exe 2112 bbhtth.exe 2452 xxrxlrl.exe 1168 tbnbnt.exe 1684 hhthhn.exe 2188 jjpvd.exe 2660 rlfllrf.exe 2736 nhthtn.exe 2396 hhthbh.exe 2664 1vvdv.exe 2560 rrxrxlr.exe 1516 bthtbh.exe 2532 djpjp.exe 2992 xlrrxrl.exe 2512 bbntht.exe 1912 pvvjv.exe 2768 1flfrrx.exe 1728 9rlxlxl.exe 2864 hbnbhh.exe 1852 jjdvj.exe 1944 1fxflrf.exe 1628 bbthnb.exe 2836 pjpvj.exe 628 vdppv.exe 2364 7xxrrlf.exe 2940 tbhhnt.exe 2420 pvdjv.exe 2024 rlxfxll.exe 1896 fflrffl.exe 2092 bhbbbh.exe 1624 3jddd.exe 2028 frxrrrf.exe 1460 bhttht.exe 1640 vpddj.exe -
resource yara_rule behavioral1/memory/2456-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/880-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1168-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-335-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2664-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-367-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2992-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/388-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-612-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2704-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-626-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/2484-645-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-652-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-890-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2860-928-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-1021-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-1111-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2428-1238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-1306-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2908-1351-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrfxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2456 2120 afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe 31 PID 2120 wrote to memory of 2456 2120 afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe 31 PID 2120 wrote to memory of 2456 2120 afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe 31 PID 2120 wrote to memory of 2456 2120 afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe 31 PID 2456 wrote to memory of 1172 2456 nhbhth.exe 32 PID 2456 wrote to memory of 1172 2456 nhbhth.exe 32 PID 2456 wrote to memory of 1172 2456 nhbhth.exe 32 PID 2456 wrote to memory of 1172 2456 nhbhth.exe 32 PID 1172 wrote to memory of 2196 1172 1xrxfrx.exe 33 PID 1172 wrote to memory of 2196 1172 1xrxfrx.exe 33 PID 1172 wrote to memory of 2196 1172 1xrxfrx.exe 33 PID 1172 wrote to memory of 2196 1172 1xrxfrx.exe 33 PID 2196 wrote to memory of 2752 2196 5xfxlff.exe 34 PID 2196 wrote to memory of 2752 2196 5xfxlff.exe 34 PID 2196 wrote to memory of 2752 2196 5xfxlff.exe 34 PID 2196 wrote to memory of 2752 2196 5xfxlff.exe 34 PID 2752 wrote to memory of 2788 2752 ppjpv.exe 35 PID 2752 wrote to memory of 2788 2752 ppjpv.exe 35 PID 2752 wrote to memory of 2788 2752 ppjpv.exe 35 PID 2752 wrote to memory of 2788 2752 ppjpv.exe 35 PID 2788 wrote to memory of 2692 2788 5hbnbh.exe 36 PID 2788 wrote to memory of 2692 2788 5hbnbh.exe 36 PID 2788 wrote to memory of 2692 2788 5hbnbh.exe 36 PID 2788 wrote to memory of 2692 2788 5hbnbh.exe 36 PID 2692 wrote to memory of 2564 2692 ddpdj.exe 37 PID 2692 wrote to memory of 2564 2692 ddpdj.exe 37 PID 2692 wrote to memory of 2564 2692 ddpdj.exe 37 PID 2692 wrote to memory of 2564 2692 ddpdj.exe 37 PID 2564 wrote to memory of 2728 2564 bbthth.exe 38 PID 2564 wrote to memory of 2728 2564 bbthth.exe 38 PID 2564 wrote to memory of 2728 2564 bbthth.exe 38 PID 2564 wrote to memory of 2728 2564 bbthth.exe 38 PID 2728 wrote to memory of 2600 2728 rflrxxl.exe 39 PID 2728 wrote to memory of 2600 2728 rflrxxl.exe 39 PID 2728 wrote to memory of 2600 2728 rflrxxl.exe 39 PID 2728 wrote to memory of 2600 2728 rflrxxl.exe 39 PID 2600 wrote to memory of 1300 2600 djdjd.exe 40 PID 2600 wrote to memory of 1300 2600 djdjd.exe 40 PID 2600 wrote to memory of 1300 2600 djdjd.exe 40 PID 2600 wrote to memory of 1300 2600 djdjd.exe 40 PID 1300 wrote to memory of 380 1300 rrlflxl.exe 41 PID 1300 wrote to memory of 380 1300 rrlflxl.exe 41 PID 1300 wrote to memory of 380 1300 rrlflxl.exe 41 PID 1300 wrote to memory of 380 1300 rrlflxl.exe 41 PID 380 wrote to memory of 2864 380 djdpd.exe 42 PID 380 wrote to memory of 2864 380 djdpd.exe 42 PID 380 wrote to memory of 2864 380 djdpd.exe 42 PID 380 wrote to memory of 2864 380 djdpd.exe 42 PID 2864 wrote to memory of 880 2864 3ttthb.exe 43 PID 2864 wrote to memory of 880 2864 3ttthb.exe 43 PID 2864 wrote to memory of 880 2864 3ttthb.exe 43 PID 2864 wrote to memory of 880 2864 3ttthb.exe 43 PID 880 wrote to memory of 1708 880 xlxfxlf.exe 44 PID 880 wrote to memory of 1708 880 xlxfxlf.exe 44 PID 880 wrote to memory of 1708 880 xlxfxlf.exe 44 PID 880 wrote to memory of 1708 880 xlxfxlf.exe 44 PID 1708 wrote to memory of 2836 1708 9rlxfrx.exe 45 PID 1708 wrote to memory of 2836 1708 9rlxfrx.exe 45 PID 1708 wrote to memory of 2836 1708 9rlxfrx.exe 45 PID 1708 wrote to memory of 2836 1708 9rlxfrx.exe 45 PID 2836 wrote to memory of 628 2836 jjjvj.exe 46 PID 2836 wrote to memory of 628 2836 jjjvj.exe 46 PID 2836 wrote to memory of 628 2836 jjjvj.exe 46 PID 2836 wrote to memory of 628 2836 jjjvj.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe"C:\Users\Admin\AppData\Local\Temp\afa36566a1b38e4a0092e3593bb301162daee224e6b2c6f5be216038c6fad693.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\nhbhth.exec:\nhbhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\1xrxfrx.exec:\1xrxfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\5xfxlff.exec:\5xfxlff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\ppjpv.exec:\ppjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\5hbnbh.exec:\5hbnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\ddpdj.exec:\ddpdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\bbthth.exec:\bbthth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\rflrxxl.exec:\rflrxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\djdjd.exec:\djdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rrlflxl.exec:\rrlflxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\djdpd.exec:\djdpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\3ttthb.exec:\3ttthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\xlxfxlf.exec:\xlxfxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\9rlxfrx.exec:\9rlxfrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\jjjvj.exec:\jjjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jvpvv.exec:\jvpvv.exe17⤵
- Executes dropped EXE
PID:628 -
\??\c:\ppdpv.exec:\ppdpv.exe18⤵
- Executes dropped EXE
PID:588 -
\??\c:\5xlxfxf.exec:\5xlxfxf.exe19⤵
- Executes dropped EXE
PID:2632 -
\??\c:\lrffffx.exec:\lrffffx.exe20⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7nhnbb.exec:\7nhnbb.exe21⤵
- Executes dropped EXE
PID:348 -
\??\c:\rfxfxxl.exec:\rfxfxxl.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bthnhb.exec:\bthnhb.exe23⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhnhtb.exec:\nhnhtb.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\3jdjp.exec:\3jdjp.exe25⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnbhbb.exec:\nnbhbb.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\7pjvj.exec:\7pjvj.exe27⤵
- Executes dropped EXE
PID:1060 -
\??\c:\lxfrrll.exec:\lxfrrll.exe28⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bbtbtb.exec:\bbtbtb.exe29⤵
- Executes dropped EXE
PID:3020 -
\??\c:\rrxlxlr.exec:\rrxlxlr.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3nnbbn.exec:\3nnbbn.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe32⤵
- Executes dropped EXE
PID:1904 -
\??\c:\bbhtth.exec:\bbhtth.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2112 -
\??\c:\xxrxlrl.exec:\xxrxlrl.exe34⤵
- Executes dropped EXE
PID:2452 -
\??\c:\tbnbnt.exec:\tbnbnt.exe35⤵
- Executes dropped EXE
PID:1168 -
\??\c:\hhthhn.exec:\hhthhn.exe36⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jjpvd.exec:\jjpvd.exe37⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rlfllrf.exec:\rlfllrf.exe38⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nhthtn.exec:\nhthtn.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hhthbh.exec:\hhthbh.exe40⤵
- Executes dropped EXE
PID:2396 -
\??\c:\1vvdv.exec:\1vvdv.exe41⤵
- Executes dropped EXE
PID:2664 -
\??\c:\rrxrxlr.exec:\rrxrxlr.exe42⤵
- Executes dropped EXE
PID:2560 -
\??\c:\bthtbh.exec:\bthtbh.exe43⤵
- Executes dropped EXE
PID:1516 -
\??\c:\djpjp.exec:\djpjp.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xlrrxrl.exec:\xlrrxrl.exe45⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bbntht.exec:\bbntht.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\pvvjv.exec:\pvvjv.exe47⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1flfrrx.exec:\1flfrrx.exe48⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9rlxlxl.exec:\9rlxlxl.exe49⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbnbhh.exec:\hbnbhh.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jjdvj.exec:\jjdvj.exe51⤵
- Executes dropped EXE
PID:1852 -
\??\c:\1fxflrf.exec:\1fxflrf.exe52⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bbthnb.exec:\bbthnb.exe53⤵
- Executes dropped EXE
PID:1628 -
\??\c:\pjpvj.exec:\pjpvj.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\vdppv.exec:\vdppv.exe55⤵
- Executes dropped EXE
PID:628 -
\??\c:\7xxrrlf.exec:\7xxrrlf.exe56⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tbhhnt.exec:\tbhhnt.exe57⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pvdjv.exec:\pvdjv.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rlxfxll.exec:\rlxfxll.exe59⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fflrffl.exec:\fflrffl.exe60⤵
- Executes dropped EXE
PID:1896 -
\??\c:\bhbbbh.exec:\bhbbbh.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3jddd.exec:\3jddd.exe62⤵
- Executes dropped EXE
PID:1624 -
\??\c:\frxrrrf.exec:\frxrrrf.exe63⤵
- Executes dropped EXE
PID:2028 -
\??\c:\bhttht.exec:\bhttht.exe64⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vpddj.exec:\vpddj.exe65⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lrxfrrx.exec:\lrxfrrx.exe66⤵PID:1796
-
\??\c:\nbhtbn.exec:\nbhtbn.exe67⤵PID:3024
-
\??\c:\7bnhtn.exec:\7bnhtn.exe68⤵PID:388
-
\??\c:\dpdpj.exec:\dpdpj.exe69⤵PID:2212
-
\??\c:\rxffllr.exec:\rxffllr.exe70⤵PID:2244
-
\??\c:\3nthhn.exec:\3nthhn.exe71⤵PID:2968
-
\??\c:\nnbhnt.exec:\nnbhnt.exe72⤵PID:1860
-
\??\c:\5pvvd.exec:\5pvvd.exe73⤵PID:2108
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe74⤵PID:2328
-
\??\c:\bttbtb.exec:\bttbtb.exe75⤵PID:2468
-
\??\c:\5bnnth.exec:\5bnnth.exe76⤵PID:2452
-
\??\c:\vdvvj.exec:\vdvvj.exe77⤵PID:1504
-
\??\c:\3llrflf.exec:\3llrflf.exe78⤵PID:2412
-
\??\c:\ttbhth.exec:\ttbhth.exe79⤵PID:2188
-
\??\c:\9tnhth.exec:\9tnhth.exe80⤵PID:2636
-
\??\c:\jdppj.exec:\jdppj.exe81⤵PID:2736
-
\??\c:\9fllrxf.exec:\9fllrxf.exe82⤵PID:2648
-
\??\c:\tthnnb.exec:\tthnnb.exe83⤵PID:2572
-
\??\c:\pppdv.exec:\pppdv.exe84⤵PID:2704
-
\??\c:\5xxlfrl.exec:\5xxlfrl.exe85⤵PID:2548
-
\??\c:\thhhnn.exec:\thhhnn.exe86⤵PID:2652
-
\??\c:\hhnbnn.exec:\hhnbnn.exe87⤵PID:2204
-
\??\c:\jvdpv.exec:\jvdpv.exe88⤵PID:2484
-
\??\c:\rrrxflr.exec:\rrrxflr.exe89⤵PID:1436
-
\??\c:\ttnhtb.exec:\ttnhtb.exe90⤵PID:1636
-
\??\c:\vpjpp.exec:\vpjpp.exe91⤵PID:2840
-
\??\c:\ffflrrr.exec:\ffflrrr.exe92⤵PID:1960
-
\??\c:\nntbhh.exec:\nntbhh.exe93⤵PID:576
-
\??\c:\9hbnth.exec:\9hbnth.exe94⤵PID:2708
-
\??\c:\dvppd.exec:\dvppd.exe95⤵PID:2848
-
\??\c:\3xlxfrf.exec:\3xlxfrf.exe96⤵PID:288
-
\??\c:\nntthn.exec:\nntthn.exe97⤵PID:564
-
\??\c:\nttbht.exec:\nttbht.exe98⤵PID:2948
-
\??\c:\7vjjp.exec:\7vjjp.exe99⤵PID:2156
-
\??\c:\fxlffrr.exec:\fxlffrr.exe100⤵PID:2424
-
\??\c:\5hbhtn.exec:\5hbhtn.exe101⤵PID:1916
-
\??\c:\dvjpv.exec:\dvjpv.exe102⤵PID:1820
-
\??\c:\xfffllr.exec:\xfffllr.exe103⤵PID:956
-
\??\c:\bhthtb.exec:\bhthtb.exe104⤵PID:1256
-
\??\c:\tnthhn.exec:\tnthhn.exe105⤵PID:1632
-
\??\c:\jpdpd.exec:\jpdpd.exe106⤵PID:1536
-
\??\c:\xxlrxfx.exec:\xxlrxfx.exe107⤵PID:2064
-
\??\c:\5tbhbh.exec:\5tbhbh.exe108⤵PID:1652
-
\??\c:\pppdp.exec:\pppdp.exe109⤵PID:2220
-
\??\c:\9vvjv.exec:\9vvjv.exe110⤵PID:3024
-
\??\c:\3llxrrl.exec:\3llxrrl.exe111⤵PID:2416
-
\??\c:\7nbnhn.exec:\7nbnhn.exe112⤵PID:2212
-
\??\c:\7vpvp.exec:\7vpvp.exe113⤵PID:2244
-
\??\c:\pvdjd.exec:\pvdjd.exe114⤵PID:2336
-
\??\c:\xfrxrrf.exec:\xfrxrrf.exe115⤵PID:1904
-
\??\c:\bhbhbh.exec:\bhbhbh.exe116⤵PID:2892
-
\??\c:\hhhtbh.exec:\hhhtbh.exe117⤵PID:2456
-
\??\c:\1vdjv.exec:\1vdjv.exe118⤵PID:1588
-
\??\c:\7xrxflr.exec:\7xrxflr.exe119⤵PID:2284
-
\??\c:\bhtthh.exec:\bhtthh.exe120⤵PID:2676
-
\??\c:\hthbnt.exec:\hthbnt.exe121⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-