Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe
-
Size
455KB
-
MD5
b588ee8f189011ca5c9fe309622263f8
-
SHA1
ad0a1bfae640136a30661b680b631de3ef577883
-
SHA256
871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e
-
SHA512
7d2bf34afc3538ac3c80fda4162858e85a62e0c50e68413189bac612904dc3983a4e903293620629b28f213ac6700feedb465bb38120823b384d906562fc2a50
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe6U:q7Tc2NYHUrAwfMp3CDD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-56-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2864-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-102-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/3068-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-112-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1924-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-363-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2628-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-387-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1372-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-407-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-542-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-582-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-614-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2872-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-680-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1712-687-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-706-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2808-739-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-762-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2768-863-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-908-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-1068-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2540 bthttb.exe 1664 lrrlrrx.exe 2112 tnbnnn.exe 2316 vjdjv.exe 2980 bbnhbh.exe 2864 htbbhn.exe 2500 7rxxxrf.exe 2876 3bhhtt.exe 2328 dvppv.exe 2648 rlxrfrx.exe 3068 7nbbbh.exe 1440 hbntbb.exe 1924 ffrrflr.exe 1752 1tntbh.exe 1932 1lxrrrr.exe 1072 rlfrrfl.exe 1996 pdjdj.exe 1984 dvjpj.exe 2936 bbnntt.exe 3056 btnthh.exe 1808 fxffllr.exe 3048 llfrffr.exe 776 vjddp.exe 3004 lfxxllr.exe 2228 rlflrxl.exe 1088 jdvvv.exe 1340 lrrrrrf.exe 2520 nnhthn.exe 1224 xlrrlff.exe 2284 xrxxflx.exe 2364 hthhhn.exe 1580 jjjjd.exe 2544 9hbbbb.exe 3024 ttntbb.exe 2360 dvpvj.exe 1156 frllrrf.exe 2468 xrrxxxf.exe 2720 hbhnnn.exe 2820 dpjpj.exe 2976 7vdjp.exe 2892 5xrxrrl.exe 2728 bntttt.exe 2672 jdpvj.exe 2628 vpjjv.exe 2788 xrllxxl.exe 352 hhhhnn.exe 1372 jdppd.exe 544 7vvjv.exe 1900 3fllrff.exe 1444 ntbbbb.exe 2516 hthntt.exe 2452 1jvpp.exe 1624 lfffllx.exe 1996 lfrxxrf.exe 1984 1nbbbb.exe 2920 pdjpv.exe 2480 7rfxfxx.exe 3056 ffrxllr.exe 1808 bhnbnt.exe 2960 jjjpp.exe 1080 jpppj.exe 1268 rlrlrrr.exe 1596 hthbhh.exe 1644 bntnnh.exe -
resource yara_rule behavioral1/memory/2540-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-102-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/3068-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-441-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2480-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-542-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-627-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-844-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-877-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-908-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-1014-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-1027-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-1091-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-1128-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflflxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2540 2236 871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe 30 PID 2236 wrote to memory of 2540 2236 871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe 30 PID 2236 wrote to memory of 2540 2236 871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe 30 PID 2236 wrote to memory of 2540 2236 871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe 30 PID 2540 wrote to memory of 1664 2540 bthttb.exe 31 PID 2540 wrote to memory of 1664 2540 bthttb.exe 31 PID 2540 wrote to memory of 1664 2540 bthttb.exe 31 PID 2540 wrote to memory of 1664 2540 bthttb.exe 31 PID 1664 wrote to memory of 2112 1664 lrrlrrx.exe 32 PID 1664 wrote to memory of 2112 1664 lrrlrrx.exe 32 PID 1664 wrote to memory of 2112 1664 lrrlrrx.exe 32 PID 1664 wrote to memory of 2112 1664 lrrlrrx.exe 32 PID 2112 wrote to memory of 2316 2112 tnbnnn.exe 33 PID 2112 wrote to memory of 2316 2112 tnbnnn.exe 33 PID 2112 wrote to memory of 2316 2112 tnbnnn.exe 33 PID 2112 wrote to memory of 2316 2112 tnbnnn.exe 33 PID 2316 wrote to memory of 2980 2316 vjdjv.exe 34 PID 2316 wrote to memory of 2980 2316 vjdjv.exe 34 PID 2316 wrote to memory of 2980 2316 vjdjv.exe 34 PID 2316 wrote to memory of 2980 2316 vjdjv.exe 34 PID 2980 wrote to memory of 2864 2980 bbnhbh.exe 35 PID 2980 wrote to memory of 2864 2980 bbnhbh.exe 35 PID 2980 wrote to memory of 2864 2980 bbnhbh.exe 35 PID 2980 wrote to memory of 2864 2980 bbnhbh.exe 35 PID 2864 wrote to memory of 2500 2864 htbbhn.exe 36 PID 2864 wrote to memory of 2500 2864 htbbhn.exe 36 PID 2864 wrote to memory of 2500 2864 htbbhn.exe 36 PID 2864 wrote to memory of 2500 2864 htbbhn.exe 36 PID 2500 wrote to memory of 2876 2500 7rxxxrf.exe 37 PID 2500 wrote to memory of 2876 2500 7rxxxrf.exe 37 PID 2500 wrote to memory of 2876 2500 7rxxxrf.exe 37 PID 2500 wrote to memory of 2876 2500 7rxxxrf.exe 37 PID 2876 wrote to memory of 2328 2876 3bhhtt.exe 38 PID 2876 wrote to memory of 2328 2876 3bhhtt.exe 38 PID 2876 wrote to memory of 2328 2876 3bhhtt.exe 38 PID 2876 wrote to memory of 2328 2876 3bhhtt.exe 38 PID 2328 wrote to memory of 2648 2328 dvppv.exe 39 PID 2328 wrote to memory of 2648 2328 dvppv.exe 39 PID 2328 wrote to memory of 2648 2328 dvppv.exe 39 PID 2328 wrote to memory of 2648 2328 dvppv.exe 39 PID 2648 wrote to memory of 3068 2648 rlxrfrx.exe 40 PID 2648 wrote to memory of 3068 2648 rlxrfrx.exe 40 PID 2648 wrote to memory of 3068 2648 rlxrfrx.exe 40 PID 2648 wrote to memory of 3068 2648 rlxrfrx.exe 40 PID 3068 wrote to memory of 1440 3068 7nbbbh.exe 41 PID 3068 wrote to memory of 1440 3068 7nbbbh.exe 41 PID 3068 wrote to memory of 1440 3068 7nbbbh.exe 41 PID 3068 wrote to memory of 1440 3068 7nbbbh.exe 41 PID 1440 wrote to memory of 1924 1440 hbntbb.exe 42 PID 1440 wrote to memory of 1924 1440 hbntbb.exe 42 PID 1440 wrote to memory of 1924 1440 hbntbb.exe 42 PID 1440 wrote to memory of 1924 1440 hbntbb.exe 42 PID 1924 wrote to memory of 1752 1924 ffrrflr.exe 43 PID 1924 wrote to memory of 1752 1924 ffrrflr.exe 43 PID 1924 wrote to memory of 1752 1924 ffrrflr.exe 43 PID 1924 wrote to memory of 1752 1924 ffrrflr.exe 43 PID 1752 wrote to memory of 1932 1752 1tntbh.exe 44 PID 1752 wrote to memory of 1932 1752 1tntbh.exe 44 PID 1752 wrote to memory of 1932 1752 1tntbh.exe 44 PID 1752 wrote to memory of 1932 1752 1tntbh.exe 44 PID 1932 wrote to memory of 1072 1932 1lxrrrr.exe 45 PID 1932 wrote to memory of 1072 1932 1lxrrrr.exe 45 PID 1932 wrote to memory of 1072 1932 1lxrrrr.exe 45 PID 1932 wrote to memory of 1072 1932 1lxrrrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe"C:\Users\Admin\AppData\Local\Temp\871b46dc11fc586a27d689ffe5f9bbfd047c3a3bee746b9088ea0bca07bdfd0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\bthttb.exec:\bthttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lrrlrrx.exec:\lrrlrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\tnbnnn.exec:\tnbnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\vjdjv.exec:\vjdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\bbnhbh.exec:\bbnhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\htbbhn.exec:\htbbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\7rxxxrf.exec:\7rxxxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\3bhhtt.exec:\3bhhtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\dvppv.exec:\dvppv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\rlxrfrx.exec:\rlxrfrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\7nbbbh.exec:\7nbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\hbntbb.exec:\hbntbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\ffrrflr.exec:\ffrrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\1tntbh.exec:\1tntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\1lxrrrr.exec:\1lxrrrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rlfrrfl.exec:\rlfrrfl.exe17⤵
- Executes dropped EXE
PID:1072 -
\??\c:\pdjdj.exec:\pdjdj.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvjpj.exec:\dvjpj.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1984 -
\??\c:\bbnntt.exec:\bbnntt.exe20⤵
- Executes dropped EXE
PID:2936 -
\??\c:\btnthh.exec:\btnthh.exe21⤵
- Executes dropped EXE
PID:3056 -
\??\c:\fxffllr.exec:\fxffllr.exe22⤵
- Executes dropped EXE
PID:1808 -
\??\c:\llfrffr.exec:\llfrffr.exe23⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vjddp.exec:\vjddp.exe24⤵
- Executes dropped EXE
PID:776 -
\??\c:\lfxxllr.exec:\lfxxllr.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlflrxl.exec:\rlflrxl.exe26⤵
- Executes dropped EXE
PID:2228 -
\??\c:\jdvvv.exec:\jdvvv.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\lrrrrrf.exec:\lrrrrrf.exe28⤵
- Executes dropped EXE
PID:1340 -
\??\c:\nnhthn.exec:\nnhthn.exe29⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xlrrlff.exec:\xlrrlff.exe30⤵
- Executes dropped EXE
PID:1224 -
\??\c:\xrxxflx.exec:\xrxxflx.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\hthhhn.exec:\hthhhn.exe32⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jjjjd.exec:\jjjjd.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\9hbbbb.exec:\9hbbbb.exe34⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ttntbb.exec:\ttntbb.exe35⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dvpvj.exec:\dvpvj.exe36⤵
- Executes dropped EXE
PID:2360 -
\??\c:\frllrrf.exec:\frllrrf.exe37⤵
- Executes dropped EXE
PID:1156 -
\??\c:\xrrxxxf.exec:\xrrxxxf.exe38⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbhnnn.exec:\hbhnnn.exe39⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dpjpj.exec:\dpjpj.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7vdjp.exec:\7vdjp.exe41⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5xrxrrl.exec:\5xrxrrl.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bntttt.exec:\bntttt.exe43⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jdpvj.exec:\jdpvj.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vpjjv.exec:\vpjjv.exe45⤵
- Executes dropped EXE
PID:2628 -
\??\c:\xrllxxl.exec:\xrllxxl.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hhhhnn.exec:\hhhhnn.exe47⤵
- Executes dropped EXE
PID:352 -
\??\c:\jdppd.exec:\jdppd.exe48⤵
- Executes dropped EXE
PID:1372 -
\??\c:\7vvjv.exec:\7vvjv.exe49⤵
- Executes dropped EXE
PID:544 -
\??\c:\3fllrff.exec:\3fllrff.exe50⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ntbbbb.exec:\ntbbbb.exe51⤵
- Executes dropped EXE
PID:1444 -
\??\c:\hthntt.exec:\hthntt.exe52⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1jvpp.exec:\1jvpp.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\lfffllx.exec:\lfffllx.exe54⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lfrxxrf.exec:\lfrxxrf.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1nbbbb.exec:\1nbbbb.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pdjpv.exec:\pdjpv.exe57⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7rfxfxx.exec:\7rfxfxx.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\ffrxllr.exec:\ffrxllr.exe59⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bhnbnt.exec:\bhnbnt.exe60⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jjjpp.exec:\jjjpp.exe61⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jpppj.exec:\jpppj.exe62⤵
- Executes dropped EXE
PID:1080 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe63⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hthbhh.exec:\hthbhh.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\bntnnh.exec:\bntnnh.exe65⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vvpvd.exec:\vvpvd.exe66⤵PID:916
-
\??\c:\fffllrf.exec:\fffllrf.exe67⤵PID:1792
-
\??\c:\lfxfffr.exec:\lfxfffr.exe68⤵PID:2288
-
\??\c:\bhbnbh.exec:\bhbnbh.exe69⤵PID:2584
-
\??\c:\pjppd.exec:\pjppd.exe70⤵PID:1632
-
\??\c:\jddvd.exec:\jddvd.exe71⤵PID:884
-
\??\c:\xrllllx.exec:\xrllllx.exe72⤵PID:2252
-
\??\c:\frrffxx.exec:\frrffxx.exe73⤵PID:2984
-
\??\c:\nbhnnn.exec:\nbhnnn.exe74⤵PID:1552
-
\??\c:\vvvpp.exec:\vvvpp.exe75⤵PID:1580
-
\??\c:\jdvvd.exec:\jdvvd.exe76⤵PID:2544
-
\??\c:\3rxfrfr.exec:\3rxfrfr.exe77⤵PID:2204
-
\??\c:\frfflrf.exec:\frfflrf.exe78⤵PID:2968
-
\??\c:\hbhhnt.exec:\hbhhnt.exe79⤵PID:2404
-
\??\c:\9dppv.exec:\9dppv.exe80⤵PID:2756
-
\??\c:\ddppp.exec:\ddppp.exe81⤵PID:2824
-
\??\c:\rrxfllx.exec:\rrxfllx.exe82⤵PID:2652
-
\??\c:\tttthh.exec:\tttthh.exe83⤵PID:2976
-
\??\c:\pdpjv.exec:\pdpjv.exe84⤵PID:2872
-
\??\c:\9xrrrlx.exec:\9xrrrlx.exe85⤵PID:2668
-
\??\c:\9fllxxf.exec:\9fllxxf.exe86⤵PID:2672
-
\??\c:\9bbbtn.exec:\9bbbtn.exe87⤵PID:2504
-
\??\c:\pjpjp.exec:\pjpjp.exe88⤵PID:1600
-
\??\c:\3ffflrf.exec:\3ffflrf.exe89⤵PID:1484
-
\??\c:\5nnhbh.exec:\5nnhbh.exe90⤵
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\btbbhb.exec:\btbbhb.exe91⤵PID:1656
-
\??\c:\pdvpv.exec:\pdvpv.exe92⤵PID:1712
-
\??\c:\fxxffrf.exec:\fxxffrf.exe93⤵PID:1848
-
\??\c:\xxxxxxl.exec:\xxxxxxl.exe94⤵PID:1720
-
\??\c:\nbhbtt.exec:\nbhbtt.exe95⤵PID:2060
-
\??\c:\djvvd.exec:\djvvd.exe96⤵PID:296
-
\??\c:\vpppp.exec:\vpppp.exe97⤵PID:1612
-
\??\c:\xrllxxl.exec:\xrllxxl.exe98⤵PID:2676
-
\??\c:\bbntbt.exec:\bbntbt.exe99⤵PID:1508
-
\??\c:\tnbbbb.exec:\tnbbbb.exe100⤵PID:2808
-
\??\c:\jjvpp.exec:\jjvpp.exe101⤵PID:3056
-
\??\c:\9rlrxfl.exec:\9rlrxfl.exe102⤵PID:1824
-
\??\c:\rlrrxrr.exec:\rlrrxrr.exe103⤵PID:2960
-
\??\c:\nhtttt.exec:\nhtttt.exe104⤵PID:1080
-
\??\c:\jpdvd.exec:\jpdvd.exe105⤵PID:1520
-
\??\c:\dvpvd.exec:\dvpvd.exe106⤵PID:1716
-
\??\c:\rlxllfl.exec:\rlxllfl.exe107⤵PID:1096
-
\??\c:\tthnnn.exec:\tthnnn.exe108⤵PID:1704
-
\??\c:\jjdjj.exec:\jjdjj.exe109⤵PID:2764
-
\??\c:\vjppj.exec:\vjppj.exe110⤵PID:2288
-
\??\c:\lxlfllr.exec:\lxlfllr.exe111⤵PID:1976
-
\??\c:\ttnntb.exec:\ttnntb.exe112⤵PID:1740
-
\??\c:\pdjdj.exec:\pdjdj.exe113⤵PID:2428
-
\??\c:\5vjdj.exec:\5vjdj.exe114⤵PID:2364
-
\??\c:\1fllxxl.exec:\1fllxxl.exe115⤵PID:2984
-
\??\c:\hbnnth.exec:\hbnnth.exe116⤵PID:2076
-
\??\c:\bbnhnn.exec:\bbnhnn.exe117⤵PID:1580
-
\??\c:\9pjjj.exec:\9pjjj.exe118⤵PID:2244
-
\??\c:\3rlllxx.exec:\3rlllxx.exe119⤵PID:2360
-
\??\c:\frxxxrx.exec:\frxxxrx.exe120⤵PID:1664
-
\??\c:\1hbtbt.exec:\1hbtbt.exe121⤵PID:2768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-