Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe
-
Size
454KB
-
MD5
45858355b85bf9dc53a423f89ccc0add
-
SHA1
4aceff0e0fb5f9a0945a21e9d6123cb9f5b5e077
-
SHA256
ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1
-
SHA512
1ef45b6b3bb93df36a2569e3abaf505445828cba3edfbcaabd937d27226b6c33b7c6c7921e1c323836eb0f38a90cba6f0d7e37676dd11b166b39f2ff517ce34f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2796-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-118-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/352-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-338-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2620-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-802-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2716-862-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/2716-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-870-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2820 bhhttt.exe 2688 5vpjp.exe 2872 bnhnnt.exe 2528 ttnthh.exe 2576 ppjvd.exe 3000 5nhhnt.exe 1848 pjdjp.exe 2624 hbnnbt.exe 2900 pdppj.exe 2388 3vpdj.exe 1824 jdppd.exe 1036 pjdjv.exe 352 7dvjp.exe 1572 jjddp.exe 2944 xrffffx.exe 2068 dvpvd.exe 2248 bnbnnn.exe 1792 lfrfrrl.exe 1216 bnnnbh.exe 960 1lfllxf.exe 1188 5nbnht.exe 1320 lfxxxfr.exe 2952 hthhnn.exe 1804 xxlfrrf.exe 1752 ffrrrrx.exe 1692 7llflrr.exe 2496 tnbbbb.exe 2316 xlrrllr.exe 1988 1frlxxf.exe 876 3dpvd.exe 3024 5ffffll.exe 1584 vpdpp.exe 2404 5pjpp.exe 2592 1btnnt.exe 2584 hbthnn.exe 2612 dpddj.exe 2572 lfrrllr.exe 2620 hbbhnt.exe 2328 vpddp.exe 3000 lxrxffr.exe 1536 xxlflfl.exe 2768 tbnnnn.exe 2624 3jjdd.exe 1328 flflrrf.exe 616 7lxxfll.exe 2388 tntbhb.exe 1176 vvjvp.exe 2064 7xrlllr.exe 1080 hbhbbb.exe 1944 ppppd.exe 2340 vpjdj.exe 2932 7lflrxx.exe 2400 hbhbnh.exe 2312 dvjpd.exe 764 flllrrx.exe 404 btbntt.exe 1436 9tnhbb.exe 2112 jvpjp.exe 2532 xxllrrf.exe 1976 nbhnnt.exe 1188 thtthb.exe 1532 dvjpj.exe 1380 frllrrf.exe 812 nnhnnt.exe -
resource yara_rule behavioral1/memory/2796-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-107-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1824-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-863-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1fllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2820 2796 ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe 31 PID 2796 wrote to memory of 2820 2796 ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe 31 PID 2796 wrote to memory of 2820 2796 ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe 31 PID 2796 wrote to memory of 2820 2796 ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe 31 PID 2820 wrote to memory of 2688 2820 bhhttt.exe 32 PID 2820 wrote to memory of 2688 2820 bhhttt.exe 32 PID 2820 wrote to memory of 2688 2820 bhhttt.exe 32 PID 2820 wrote to memory of 2688 2820 bhhttt.exe 32 PID 2688 wrote to memory of 2872 2688 5vpjp.exe 33 PID 2688 wrote to memory of 2872 2688 5vpjp.exe 33 PID 2688 wrote to memory of 2872 2688 5vpjp.exe 33 PID 2688 wrote to memory of 2872 2688 5vpjp.exe 33 PID 2872 wrote to memory of 2528 2872 bnhnnt.exe 34 PID 2872 wrote to memory of 2528 2872 bnhnnt.exe 34 PID 2872 wrote to memory of 2528 2872 bnhnnt.exe 34 PID 2872 wrote to memory of 2528 2872 bnhnnt.exe 34 PID 2528 wrote to memory of 2576 2528 ttnthh.exe 35 PID 2528 wrote to memory of 2576 2528 ttnthh.exe 35 PID 2528 wrote to memory of 2576 2528 ttnthh.exe 35 PID 2528 wrote to memory of 2576 2528 ttnthh.exe 35 PID 2576 wrote to memory of 3000 2576 ppjvd.exe 36 PID 2576 wrote to memory of 3000 2576 ppjvd.exe 36 PID 2576 wrote to memory of 3000 2576 ppjvd.exe 36 PID 2576 wrote to memory of 3000 2576 ppjvd.exe 36 PID 3000 wrote to memory of 1848 3000 5nhhnt.exe 37 PID 3000 wrote to memory of 1848 3000 5nhhnt.exe 37 PID 3000 wrote to memory of 1848 3000 5nhhnt.exe 37 PID 3000 wrote to memory of 1848 3000 5nhhnt.exe 37 PID 1848 wrote to memory of 2624 1848 pjdjp.exe 38 PID 1848 wrote to memory of 2624 1848 pjdjp.exe 38 PID 1848 wrote to memory of 2624 1848 pjdjp.exe 38 PID 1848 wrote to memory of 2624 1848 pjdjp.exe 38 PID 2624 wrote to memory of 2900 2624 hbnnbt.exe 39 PID 2624 wrote to memory of 2900 2624 hbnnbt.exe 39 PID 2624 wrote to memory of 2900 2624 hbnnbt.exe 39 PID 2624 wrote to memory of 2900 2624 hbnnbt.exe 39 PID 2900 wrote to memory of 2388 2900 pdppj.exe 40 PID 2900 wrote to memory of 2388 2900 pdppj.exe 40 PID 2900 wrote to memory of 2388 2900 pdppj.exe 40 PID 2900 wrote to memory of 2388 2900 pdppj.exe 40 PID 2388 wrote to memory of 1824 2388 3vpdj.exe 41 PID 2388 wrote to memory of 1824 2388 3vpdj.exe 41 PID 2388 wrote to memory of 1824 2388 3vpdj.exe 41 PID 2388 wrote to memory of 1824 2388 3vpdj.exe 41 PID 1824 wrote to memory of 1036 1824 jdppd.exe 42 PID 1824 wrote to memory of 1036 1824 jdppd.exe 42 PID 1824 wrote to memory of 1036 1824 jdppd.exe 42 PID 1824 wrote to memory of 1036 1824 jdppd.exe 42 PID 1036 wrote to memory of 352 1036 pjdjv.exe 43 PID 1036 wrote to memory of 352 1036 pjdjv.exe 43 PID 1036 wrote to memory of 352 1036 pjdjv.exe 43 PID 1036 wrote to memory of 352 1036 pjdjv.exe 43 PID 352 wrote to memory of 1572 352 7dvjp.exe 44 PID 352 wrote to memory of 1572 352 7dvjp.exe 44 PID 352 wrote to memory of 1572 352 7dvjp.exe 44 PID 352 wrote to memory of 1572 352 7dvjp.exe 44 PID 1572 wrote to memory of 2944 1572 jjddp.exe 45 PID 1572 wrote to memory of 2944 1572 jjddp.exe 45 PID 1572 wrote to memory of 2944 1572 jjddp.exe 45 PID 1572 wrote to memory of 2944 1572 jjddp.exe 45 PID 2944 wrote to memory of 2068 2944 xrffffx.exe 46 PID 2944 wrote to memory of 2068 2944 xrffffx.exe 46 PID 2944 wrote to memory of 2068 2944 xrffffx.exe 46 PID 2944 wrote to memory of 2068 2944 xrffffx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe"C:\Users\Admin\AppData\Local\Temp\ad399a5aa03ad40a4bc6fe48e2cfc8a512dd7f6cab8a354fe2f879faf599b0f1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bhhttt.exec:\bhhttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5vpjp.exec:\5vpjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bnhnnt.exec:\bnhnnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\ttnthh.exec:\ttnthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ppjvd.exec:\ppjvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5nhhnt.exec:\5nhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\pjdjp.exec:\pjdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\hbnnbt.exec:\hbnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pdppj.exec:\pdppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\3vpdj.exec:\3vpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\jdppd.exec:\jdppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\pjdjv.exec:\pjdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\7dvjp.exec:\7dvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\jjddp.exec:\jjddp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xrffffx.exec:\xrffffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\dvpvd.exec:\dvpvd.exe17⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bnbnnn.exec:\bnbnnn.exe18⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfrfrrl.exec:\lfrfrrl.exe19⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bnnnbh.exec:\bnnnbh.exe20⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1lfllxf.exec:\1lfllxf.exe21⤵
- Executes dropped EXE
PID:960 -
\??\c:\5nbnht.exec:\5nbnht.exe22⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lfxxxfr.exec:\lfxxxfr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1320 -
\??\c:\hthhnn.exec:\hthhnn.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xxlfrrf.exec:\xxlfrrf.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe26⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7llflrr.exec:\7llflrr.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\tnbbbb.exec:\tnbbbb.exe28⤵
- Executes dropped EXE
PID:2496 -
\??\c:\xlrrllr.exec:\xlrrllr.exe29⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1frlxxf.exec:\1frlxxf.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\3dpvd.exec:\3dpvd.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\5ffffll.exec:\5ffffll.exe32⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vpdpp.exec:\vpdpp.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5pjpp.exec:\5pjpp.exe34⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1btnnt.exec:\1btnnt.exe35⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hbthnn.exec:\hbthnn.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\dpddj.exec:\dpddj.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfrrllr.exec:\lfrrllr.exe38⤵
- Executes dropped EXE
PID:2572 -
\??\c:\hbbhnt.exec:\hbbhnt.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vpddp.exec:\vpddp.exe40⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lxrxffr.exec:\lxrxffr.exe41⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xxlflfl.exec:\xxlflfl.exe42⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tbnnnn.exec:\tbnnnn.exe43⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3jjdd.exec:\3jjdd.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\flflrrf.exec:\flflrrf.exe45⤵
- Executes dropped EXE
PID:1328 -
\??\c:\7lxxfll.exec:\7lxxfll.exe46⤵
- Executes dropped EXE
PID:616 -
\??\c:\tntbhb.exec:\tntbhb.exe47⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vvjvp.exec:\vvjvp.exe48⤵
- Executes dropped EXE
PID:1176 -
\??\c:\7xrlllr.exec:\7xrlllr.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hbhbbb.exec:\hbhbbb.exe50⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ppppd.exec:\ppppd.exe51⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpjdj.exec:\vpjdj.exe52⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7lflrxx.exec:\7lflrxx.exe53⤵
- Executes dropped EXE
PID:2932 -
\??\c:\hbhbnh.exec:\hbhbnh.exe54⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dvjpd.exec:\dvjpd.exe55⤵
- Executes dropped EXE
PID:2312 -
\??\c:\flllrrx.exec:\flllrrx.exe56⤵
- Executes dropped EXE
PID:764 -
\??\c:\btbntt.exec:\btbntt.exe57⤵
- Executes dropped EXE
PID:404 -
\??\c:\9tnhbb.exec:\9tnhbb.exe58⤵
- Executes dropped EXE
PID:1436 -
\??\c:\jvpjp.exec:\jvpjp.exe59⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xxllrrf.exec:\xxllrrf.exe60⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nbhnnt.exec:\nbhnnt.exe61⤵
- Executes dropped EXE
PID:1976 -
\??\c:\thtthb.exec:\thtthb.exe62⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dvjpj.exec:\dvjpj.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\frllrrf.exec:\frllrrf.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\nnhnnt.exec:\nnhnnt.exe65⤵
- Executes dropped EXE
PID:812 -
\??\c:\1hhhtt.exec:\1hhhtt.exe66⤵PID:1724
-
\??\c:\1ppvd.exec:\1ppvd.exe67⤵PID:1752
-
\??\c:\5lrxlrr.exec:\5lrxlrr.exe68⤵PID:2372
-
\??\c:\rlflrxf.exec:\rlflrxf.exe69⤵PID:2912
-
\??\c:\nhhhhh.exec:\nhhhhh.exe70⤵PID:2432
-
\??\c:\3jvdj.exec:\3jvdj.exe71⤵PID:1000
-
\??\c:\jdjjd.exec:\jdjjd.exe72⤵PID:1988
-
\??\c:\xrrlrxl.exec:\xrrlrxl.exe73⤵
- System Location Discovery: System Language Discovery
PID:1516 -
\??\c:\btntnt.exec:\btntnt.exe74⤵PID:2888
-
\??\c:\ppdjp.exec:\ppdjp.exe75⤵PID:1560
-
\??\c:\9fllxrx.exec:\9fllxrx.exe76⤵PID:2752
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe77⤵PID:2744
-
\??\c:\hbttbb.exec:\hbttbb.exe78⤵PID:2872
-
\??\c:\vpvvd.exec:\vpvvd.exe79⤵PID:2836
-
\??\c:\rrflrlr.exec:\rrflrlr.exe80⤵PID:2676
-
\??\c:\xrxfrlx.exec:\xrxfrlx.exe81⤵PID:1412
-
\??\c:\9ntttt.exec:\9ntttt.exe82⤵PID:2280
-
\??\c:\vjvdj.exec:\vjvdj.exe83⤵PID:580
-
\??\c:\rrrlrxl.exec:\rrrlrxl.exe84⤵PID:2764
-
\??\c:\tnhbnh.exec:\tnhbnh.exe85⤵PID:3016
-
\??\c:\nhnbhn.exec:\nhnbhn.exe86⤵PID:2196
-
\??\c:\ppvpv.exec:\ppvpv.exe87⤵
- System Location Discovery: System Language Discovery
PID:836 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe88⤵PID:1636
-
\??\c:\tnnnhh.exec:\tnnnhh.exe89⤵PID:344
-
\??\c:\jdddd.exec:\jdddd.exe90⤵PID:1728
-
\??\c:\frxllfl.exec:\frxllfl.exe91⤵PID:2292
-
\??\c:\7xlxrrr.exec:\7xlxrrr.exe92⤵PID:2544
-
\??\c:\tnbbnh.exec:\tnbbnh.exe93⤵PID:1764
-
\??\c:\9vddd.exec:\9vddd.exe94⤵PID:2244
-
\??\c:\9frrlff.exec:\9frrlff.exe95⤵PID:1256
-
\??\c:\1lffrxf.exec:\1lffrxf.exe96⤵PID:1668
-
\??\c:\tnhttt.exec:\tnhttt.exe97⤵PID:1312
-
\??\c:\bnbbhb.exec:\bnbbhb.exe98⤵PID:848
-
\??\c:\vjvpp.exec:\vjvpp.exe99⤵PID:652
-
\??\c:\fxlrxxx.exec:\fxlrxxx.exe100⤵PID:1132
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe101⤵PID:2512
-
\??\c:\1ttbhh.exec:\1ttbhh.exe102⤵PID:2304
-
\??\c:\dvjpv.exec:\dvjpv.exe103⤵
- System Location Discovery: System Language Discovery
PID:2524 -
\??\c:\5xllrll.exec:\5xllrll.exe104⤵PID:956
-
\??\c:\lfrxrxf.exec:\lfrxrxf.exe105⤵PID:1188
-
\??\c:\bnntbb.exec:\bnntbb.exe106⤵PID:1360
-
\??\c:\vjvdp.exec:\vjvdp.exe107⤵PID:1380
-
\??\c:\lxlffff.exec:\lxlffff.exe108⤵PID:612
-
\??\c:\1btbtb.exec:\1btbtb.exe109⤵PID:1724
-
\??\c:\xlrxrlr.exec:\xlrxrlr.exe110⤵PID:568
-
\??\c:\7tnntt.exec:\7tnntt.exe111⤵PID:1968
-
\??\c:\ddpjd.exec:\ddpjd.exe112⤵PID:1812
-
\??\c:\1fxflrx.exec:\1fxflrx.exe113⤵PID:2476
-
\??\c:\xlxxrxl.exec:\xlxxrxl.exe114⤵PID:2904
-
\??\c:\tnhnth.exec:\tnhnth.exe115⤵PID:2824
-
\??\c:\dvjpv.exec:\dvjpv.exe116⤵PID:1596
-
\??\c:\bbtbhn.exec:\bbtbhn.exe117⤵PID:2916
-
\??\c:\ttbhhh.exec:\ttbhhh.exe118⤵
- System Location Discovery: System Language Discovery
PID:2716 -
\??\c:\rrllxxr.exec:\rrllxxr.exe119⤵PID:2752
-
\??\c:\1rlrlxf.exec:\1rlrlxf.exe120⤵PID:2668
-
\??\c:\tnbhtt.exec:\tnbhtt.exe121⤵PID:2612
-
\??\c:\jpddj.exec:\jpddj.exe122⤵PID:2996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-