Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 08:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe
-
Size
456KB
-
MD5
d4bbd701cfe6d14657343f224e90567d
-
SHA1
6a920c03d217333936fc09a466ca3566081f141d
-
SHA256
a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c
-
SHA512
b595449d3d2e3c78b8e7d27f7b00e45ce792c8bdbdffc5213ece2b2f572d6a180a4db9fa611158c6d96182cab50c9880f9b990717107c0ec788e8fdabd617632
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 47 IoCs
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-71-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-101-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1296-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-170-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3032-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-263-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2368-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-270-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2236-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1916-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-542-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/852-568-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/3044-575-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2260-582-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/780-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-590-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2904-605-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2080-871-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-978-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-1004-0x0000000000270000-0x000000000029A000-memory.dmp family_blackmoon behavioral1/memory/2540-1017-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2388 lfrxlrl.exe 1404 tnbbnn.exe 2020 jjddv.exe 2768 llrrfrx.exe 2856 jvjdj.exe 2820 frflrrr.exe 3056 btbhtn.exe 2652 thnntt.exe 2624 xlrlllr.exe 1296 3vjdp.exe 2632 5fxrxxf.exe 2728 bnbhnn.exe 2980 5xllllr.exe 2688 tnbhhh.exe 2956 vpvvd.exe 1072 lfrlllr.exe 1900 nbnhnb.exe 2004 ppdvv.exe 3032 lrrffrr.exe 2344 bntbnn.exe 2304 vjddd.exe 112 xlxffxx.exe 2812 bhbbbt.exe 1984 lfrrflx.exe 2484 fxrrllr.exe 2220 hbhnnt.exe 2368 rfrxflr.exe 2236 ddvdj.exe 1896 xxrrxrf.exe 852 3htnbt.exe 2592 9pjjv.exe 2376 tbnhnh.exe 1808 jdjpv.exe 1724 1frlrrx.exe 2832 3rrrxfr.exe 2772 7tbbhb.exe 2780 vpvvd.exe 2096 lfrflff.exe 2796 frflrrr.exe 2744 bhthtt.exe 2672 1nnntb.exe 2660 jvjjd.exe 2584 1flxxrr.exe 2040 bbbbtn.exe 236 nhbbhh.exe 2032 jjpdp.exe 1140 9pjdj.exe 1204 1lxllfl.exe 2928 hhttbb.exe 1280 ttnntt.exe 2956 dpddj.exe 2716 frlflll.exe 372 rrlrffl.exe 2272 9htnnn.exe 2004 jjvjj.exe 2372 3vpvp.exe 1944 rrlrxxl.exe 2344 bnntnh.exe 2320 9thbnh.exe 1096 pjvdj.exe 2608 7xrfxxf.exe 272 nbnhbb.exe 1916 5thnnn.exe 2356 ppdpd.exe -
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-148-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3032-188-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2344-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-654-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1456-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-750-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-871-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-933-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-979-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2388 3048 a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe 30 PID 3048 wrote to memory of 2388 3048 a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe 30 PID 3048 wrote to memory of 2388 3048 a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe 30 PID 3048 wrote to memory of 2388 3048 a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe 30 PID 2388 wrote to memory of 1404 2388 lfrxlrl.exe 31 PID 2388 wrote to memory of 1404 2388 lfrxlrl.exe 31 PID 2388 wrote to memory of 1404 2388 lfrxlrl.exe 31 PID 2388 wrote to memory of 1404 2388 lfrxlrl.exe 31 PID 1404 wrote to memory of 2020 1404 tnbbnn.exe 32 PID 1404 wrote to memory of 2020 1404 tnbbnn.exe 32 PID 1404 wrote to memory of 2020 1404 tnbbnn.exe 32 PID 1404 wrote to memory of 2020 1404 tnbbnn.exe 32 PID 2020 wrote to memory of 2768 2020 jjddv.exe 33 PID 2020 wrote to memory of 2768 2020 jjddv.exe 33 PID 2020 wrote to memory of 2768 2020 jjddv.exe 33 PID 2020 wrote to memory of 2768 2020 jjddv.exe 33 PID 2768 wrote to memory of 2856 2768 llrrfrx.exe 34 PID 2768 wrote to memory of 2856 2768 llrrfrx.exe 34 PID 2768 wrote to memory of 2856 2768 llrrfrx.exe 34 PID 2768 wrote to memory of 2856 2768 llrrfrx.exe 34 PID 2856 wrote to memory of 2820 2856 jvjdj.exe 35 PID 2856 wrote to memory of 2820 2856 jvjdj.exe 35 PID 2856 wrote to memory of 2820 2856 jvjdj.exe 35 PID 2856 wrote to memory of 2820 2856 jvjdj.exe 35 PID 2820 wrote to memory of 3056 2820 frflrrr.exe 36 PID 2820 wrote to memory of 3056 2820 frflrrr.exe 36 PID 2820 wrote to memory of 3056 2820 frflrrr.exe 36 PID 2820 wrote to memory of 3056 2820 frflrrr.exe 36 PID 3056 wrote to memory of 2652 3056 btbhtn.exe 37 PID 3056 wrote to memory of 2652 3056 btbhtn.exe 37 PID 3056 wrote to memory of 2652 3056 btbhtn.exe 37 PID 3056 wrote to memory of 2652 3056 btbhtn.exe 37 PID 2652 wrote to memory of 2624 2652 thnntt.exe 38 PID 2652 wrote to memory of 2624 2652 thnntt.exe 38 PID 2652 wrote to memory of 2624 2652 thnntt.exe 38 PID 2652 wrote to memory of 2624 2652 thnntt.exe 38 PID 2624 wrote to memory of 1296 2624 xlrlllr.exe 39 PID 2624 wrote to memory of 1296 2624 xlrlllr.exe 39 PID 2624 wrote to memory of 1296 2624 xlrlllr.exe 39 PID 2624 wrote to memory of 1296 2624 xlrlllr.exe 39 PID 1296 wrote to memory of 2632 1296 3vjdp.exe 40 PID 1296 wrote to memory of 2632 1296 3vjdp.exe 40 PID 1296 wrote to memory of 2632 1296 3vjdp.exe 40 PID 1296 wrote to memory of 2632 1296 3vjdp.exe 40 PID 2632 wrote to memory of 2728 2632 5fxrxxf.exe 41 PID 2632 wrote to memory of 2728 2632 5fxrxxf.exe 41 PID 2632 wrote to memory of 2728 2632 5fxrxxf.exe 41 PID 2632 wrote to memory of 2728 2632 5fxrxxf.exe 41 PID 2728 wrote to memory of 2980 2728 bnbhnn.exe 42 PID 2728 wrote to memory of 2980 2728 bnbhnn.exe 42 PID 2728 wrote to memory of 2980 2728 bnbhnn.exe 42 PID 2728 wrote to memory of 2980 2728 bnbhnn.exe 42 PID 2980 wrote to memory of 2688 2980 5xllllr.exe 43 PID 2980 wrote to memory of 2688 2980 5xllllr.exe 43 PID 2980 wrote to memory of 2688 2980 5xllllr.exe 43 PID 2980 wrote to memory of 2688 2980 5xllllr.exe 43 PID 2688 wrote to memory of 2956 2688 tnbhhh.exe 44 PID 2688 wrote to memory of 2956 2688 tnbhhh.exe 44 PID 2688 wrote to memory of 2956 2688 tnbhhh.exe 44 PID 2688 wrote to memory of 2956 2688 tnbhhh.exe 44 PID 2956 wrote to memory of 1072 2956 vpvvd.exe 45 PID 2956 wrote to memory of 1072 2956 vpvvd.exe 45 PID 2956 wrote to memory of 1072 2956 vpvvd.exe 45 PID 2956 wrote to memory of 1072 2956 vpvvd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe"C:\Users\Admin\AppData\Local\Temp\a88ac9af2c4fd51da933a7bb752f5a9410d24946e28c933a665e2680048a4f6c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\lfrxlrl.exec:\lfrxlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\tnbbnn.exec:\tnbbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\jjddv.exec:\jjddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\llrrfrx.exec:\llrrfrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jvjdj.exec:\jvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\frflrrr.exec:\frflrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\btbhtn.exec:\btbhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\thnntt.exec:\thnntt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xlrlllr.exec:\xlrlllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\3vjdp.exec:\3vjdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\5fxrxxf.exec:\5fxrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\bnbhnn.exec:\bnbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5xllllr.exec:\5xllllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tnbhhh.exec:\tnbhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\vpvvd.exec:\vpvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lfrlllr.exec:\lfrlllr.exe17⤵
- Executes dropped EXE
PID:1072 -
\??\c:\nbnhnb.exec:\nbnhnb.exe18⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ppdvv.exec:\ppdvv.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\lrrffrr.exec:\lrrffrr.exe20⤵
- Executes dropped EXE
PID:3032 -
\??\c:\bntbnn.exec:\bntbnn.exe21⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vjddd.exec:\vjddd.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xlxffxx.exec:\xlxffxx.exe23⤵
- Executes dropped EXE
PID:112 -
\??\c:\bhbbbt.exec:\bhbbbt.exe24⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lfrrflx.exec:\lfrrflx.exe25⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fxrrllr.exec:\fxrrllr.exe26⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbhnnt.exec:\hbhnnt.exe27⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rfrxflr.exec:\rfrxflr.exe28⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddvdj.exec:\ddvdj.exe29⤵
- Executes dropped EXE
PID:2236 -
\??\c:\xxrrxrf.exec:\xxrrxrf.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\3htnbt.exec:\3htnbt.exe31⤵
- Executes dropped EXE
PID:852 -
\??\c:\9pjjv.exec:\9pjjv.exe32⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tbnhnh.exec:\tbnhnh.exe33⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jdjpv.exec:\jdjpv.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\1frlrrx.exec:\1frlrrx.exe35⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3rrrxfr.exec:\3rrrxfr.exe36⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7tbbhb.exec:\7tbbhb.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vpvvd.exec:\vpvvd.exe38⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lfrflff.exec:\lfrflff.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\frflrrr.exec:\frflrrr.exe40⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bhthtt.exec:\bhthtt.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\1nnntb.exec:\1nnntb.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\jvjjd.exec:\jvjjd.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\1flxxrr.exec:\1flxxrr.exe44⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bbbbtn.exec:\bbbbtn.exe45⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nhbbhh.exec:\nhbbhh.exe46⤵
- Executes dropped EXE
PID:236 -
\??\c:\jjpdp.exec:\jjpdp.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\9pjdj.exec:\9pjdj.exe48⤵
- Executes dropped EXE
PID:1140 -
\??\c:\1lxllfl.exec:\1lxllfl.exe49⤵
- Executes dropped EXE
PID:1204 -
\??\c:\hhttbb.exec:\hhttbb.exe50⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ttnntt.exec:\ttnntt.exe51⤵
- Executes dropped EXE
PID:1280 -
\??\c:\dpddj.exec:\dpddj.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\frlflll.exec:\frlflll.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rrlrffl.exec:\rrlrffl.exe54⤵
- Executes dropped EXE
PID:372 -
\??\c:\9htnnn.exec:\9htnnn.exe55⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jjvjj.exec:\jjvjj.exe56⤵
- Executes dropped EXE
PID:2004 -
\??\c:\3vpvp.exec:\3vpvp.exe57⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe58⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bnntnh.exec:\bnntnh.exe59⤵
- Executes dropped EXE
PID:2344 -
\??\c:\9thbnh.exec:\9thbnh.exe60⤵
- Executes dropped EXE
PID:2320 -
\??\c:\pjvdj.exec:\pjvdj.exe61⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7xrfxxf.exec:\7xrfxxf.exe62⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nbnhbb.exec:\nbnhbb.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:272 -
\??\c:\5thnnn.exec:\5thnnn.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ppdpd.exec:\ppdpd.exe65⤵
- Executes dropped EXE
PID:2356 -
\??\c:\llfxflr.exec:\llfxflr.exe66⤵PID:1256
-
\??\c:\xrfxffl.exec:\xrfxffl.exe67⤵PID:1652
-
\??\c:\3httbb.exec:\3httbb.exe68⤵PID:784
-
\??\c:\vpvvj.exec:\vpvvj.exe69⤵PID:2960
-
\??\c:\ppppp.exec:\ppppp.exe70⤵PID:2236
-
\??\c:\rrllffx.exec:\rrllffx.exe71⤵PID:2520
-
\??\c:\hhbnbh.exec:\hhbnbh.exe72⤵PID:1876
-
\??\c:\vpppv.exec:\vpppv.exe73⤵PID:852
-
\??\c:\jvjjj.exec:\jvjjj.exe74⤵PID:3044
-
\??\c:\3rlrxxf.exec:\3rlrxxf.exe75⤵PID:2260
-
\??\c:\nbtttn.exec:\nbtttn.exe76⤵PID:780
-
\??\c:\vjvdd.exec:\vjvdd.exe77⤵PID:2732
-
\??\c:\jvjjp.exec:\jvjjp.exe78⤵PID:2776
-
\??\c:\rfxfrrr.exec:\rfxfrrr.exe79⤵PID:2904
-
\??\c:\nnbtbh.exec:\nnbtbh.exe80⤵PID:2760
-
\??\c:\dvjjd.exec:\dvjjd.exe81⤵PID:2788
-
\??\c:\lfllrlf.exec:\lfllrlf.exe82⤵PID:2820
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe83⤵PID:3056
-
\??\c:\7bntbh.exec:\7bntbh.exe84⤵PID:2908
-
\??\c:\dvjpp.exec:\dvjpp.exe85⤵PID:2748
-
\??\c:\lxflfrl.exec:\lxflfrl.exe86⤵PID:2680
-
\??\c:\fxrrxrx.exec:\fxrrxrx.exe87⤵PID:1624
-
\??\c:\nnntbh.exec:\nnntbh.exe88⤵PID:1048
-
\??\c:\jvddd.exec:\jvddd.exe89⤵PID:1112
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe90⤵PID:1488
-
\??\c:\llxrxrx.exec:\llxrxrx.exe91⤵PID:2880
-
\??\c:\nhnnnt.exec:\nhnnnt.exe92⤵PID:2976
-
\??\c:\9djjj.exec:\9djjj.exe93⤵PID:2952
-
\??\c:\rrllrrf.exec:\rrllrrf.exe94⤵PID:2932
-
\??\c:\frfllll.exec:\frfllll.exe95⤵PID:2804
-
\??\c:\bbntbh.exec:\bbntbh.exe96⤵PID:2460
-
\??\c:\djvdp.exec:\djvdp.exe97⤵PID:1456
-
\??\c:\5dpvv.exec:\5dpvv.exe98⤵PID:2168
-
\??\c:\fxllllr.exec:\fxllllr.exe99⤵PID:2140
-
\??\c:\hnhnhh.exec:\hnhnhh.exe100⤵PID:2540
-
\??\c:\3btthn.exec:\3btthn.exe101⤵PID:2156
-
\??\c:\vjdjv.exec:\vjdjv.exe102⤵PID:1712
-
\??\c:\9frrrrr.exec:\9frrrrr.exe103⤵PID:1000
-
\??\c:\thtttn.exec:\thtttn.exe104⤵PID:2184
-
\??\c:\tnbhhh.exec:\tnbhhh.exe105⤵PID:1408
-
\??\c:\dvjjv.exec:\dvjjv.exe106⤵PID:708
-
\??\c:\jvdvv.exec:\jvdvv.exe107⤵PID:1528
-
\??\c:\lfxxffr.exec:\lfxxffr.exe108⤵PID:3008
-
\??\c:\hhnnnn.exec:\hhnnnn.exe109⤵PID:2196
-
\??\c:\5vjjd.exec:\5vjjd.exe110⤵PID:2368
-
\??\c:\vjvvp.exec:\vjvvp.exe111⤵PID:2116
-
\??\c:\7lrlffl.exec:\7lrlffl.exe112⤵PID:1908
-
\??\c:\bnbbhh.exec:\bnbbhh.exe113⤵PID:2420
-
\??\c:\bhtbnn.exec:\bhtbnn.exe114⤵PID:1744
-
\??\c:\ppddd.exec:\ppddd.exe115⤵PID:2256
-
\??\c:\xlfflfr.exec:\xlfflfr.exe116⤵PID:852
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe117⤵PID:1600
-
\??\c:\bhbhhh.exec:\bhbhhh.exe118⤵PID:2020
-
\??\c:\pvpdv.exec:\pvpdv.exe119⤵PID:1724
-
\??\c:\ffrrxfl.exec:\ffrrxfl.exe120⤵PID:2080
-
\??\c:\5rlrflx.exec:\5rlrflx.exe121⤵PID:2900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-