Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe
-
Size
455KB
-
MD5
ac145e3d02d8e34ffad4efc21c41a4c6
-
SHA1
8929086b0248db5625e9cb9055eafaa64666c52e
-
SHA256
a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b
-
SHA512
a758146784ee102a06d8ddd6fbc8dd7a0088a4e4c3bfbc6518a342f81e81cfd9fcf8f5dc4ee793b3e7fd29baa69d8edc2dcac3d4938f4438a77cf9f0c2ede085
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTV6:q7Tc2NYHUrAwfMp3CDx6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2700-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-61-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/304-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-206-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1268-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-295-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-442-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1104-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-515-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-522-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-529-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-548-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-589-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-708-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2044-726-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2236-743-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1760-966-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2700 rflflfl.exe 2908 pjjpd.exe 2668 1frxfff.exe 2884 bnhhhb.exe 2664 5lflrfl.exe 2596 3thnnt.exe 2992 5llxxxr.exe 304 5ttbbh.exe 1868 ddvvd.exe 2428 1tnnhh.exe 1824 5jdpp.exe 1308 xxlrxxl.exe 1704 5bthth.exe 2616 1dddd.exe 2836 llfflrf.exe 1928 hhtbhh.exe 1960 1dpdp.exe 576 bttbhh.exe 2052 ddvjv.exe 2400 ttnhnt.exe 2220 7jppj.exe 2156 3llrxfr.exe 1612 bnhnnn.exe 1268 5llxlrx.exe 2284 vjddd.exe 2304 1frllrr.exe 2944 pdpjd.exe 556 fxlrflr.exe 2080 tnhnhh.exe 904 pjvdp.exe 2260 1xrxllx.exe 1584 htnthb.exe 2792 jjdpp.exe 2708 bnthbh.exe 2712 vjdjj.exe 2772 vpdjd.exe 2876 ffrflrx.exe 2740 5ntnnn.exe 2620 3vvpj.exe 2604 rfrrrxf.exe 2988 fxrxlrx.exe 2636 bnbbhh.exe 304 dvjdv.exe 2644 vjvvd.exe 2160 fxrxxrx.exe 2832 9ttbhh.exe 652 bhhtth.exe 2440 dvjpv.exe 2752 frlffxl.exe 1500 9rfxflr.exe 2032 1htbtb.exe 852 7pddd.exe 584 fxrlrrx.exe 824 5rfflrx.exe 2044 hbbtnn.exe 2424 nnhbbt.exe 2016 vpddj.exe 2208 rllxrxl.exe 2224 3hnhhb.exe 1708 5bntnt.exe 1104 dpjdj.exe 944 rflfrfr.exe 2496 thtttb.exe 2628 5hnhtt.exe -
resource yara_rule behavioral1/memory/3060-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/652-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-529-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-697-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1988-708-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2236-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-764-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-861-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lflrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2700 3060 a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe 30 PID 3060 wrote to memory of 2700 3060 a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe 30 PID 3060 wrote to memory of 2700 3060 a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe 30 PID 3060 wrote to memory of 2700 3060 a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe 30 PID 2700 wrote to memory of 2908 2700 rflflfl.exe 31 PID 2700 wrote to memory of 2908 2700 rflflfl.exe 31 PID 2700 wrote to memory of 2908 2700 rflflfl.exe 31 PID 2700 wrote to memory of 2908 2700 rflflfl.exe 31 PID 2908 wrote to memory of 2668 2908 pjjpd.exe 32 PID 2908 wrote to memory of 2668 2908 pjjpd.exe 32 PID 2908 wrote to memory of 2668 2908 pjjpd.exe 32 PID 2908 wrote to memory of 2668 2908 pjjpd.exe 32 PID 2668 wrote to memory of 2884 2668 1frxfff.exe 33 PID 2668 wrote to memory of 2884 2668 1frxfff.exe 33 PID 2668 wrote to memory of 2884 2668 1frxfff.exe 33 PID 2668 wrote to memory of 2884 2668 1frxfff.exe 33 PID 2884 wrote to memory of 2664 2884 bnhhhb.exe 34 PID 2884 wrote to memory of 2664 2884 bnhhhb.exe 34 PID 2884 wrote to memory of 2664 2884 bnhhhb.exe 34 PID 2884 wrote to memory of 2664 2884 bnhhhb.exe 34 PID 2664 wrote to memory of 2596 2664 5lflrfl.exe 35 PID 2664 wrote to memory of 2596 2664 5lflrfl.exe 35 PID 2664 wrote to memory of 2596 2664 5lflrfl.exe 35 PID 2664 wrote to memory of 2596 2664 5lflrfl.exe 35 PID 2596 wrote to memory of 2992 2596 3thnnt.exe 36 PID 2596 wrote to memory of 2992 2596 3thnnt.exe 36 PID 2596 wrote to memory of 2992 2596 3thnnt.exe 36 PID 2596 wrote to memory of 2992 2596 3thnnt.exe 36 PID 2992 wrote to memory of 304 2992 5llxxxr.exe 37 PID 2992 wrote to memory of 304 2992 5llxxxr.exe 37 PID 2992 wrote to memory of 304 2992 5llxxxr.exe 37 PID 2992 wrote to memory of 304 2992 5llxxxr.exe 37 PID 304 wrote to memory of 1868 304 5ttbbh.exe 38 PID 304 wrote to memory of 1868 304 5ttbbh.exe 38 PID 304 wrote to memory of 1868 304 5ttbbh.exe 38 PID 304 wrote to memory of 1868 304 5ttbbh.exe 38 PID 1868 wrote to memory of 2428 1868 ddvvd.exe 39 PID 1868 wrote to memory of 2428 1868 ddvvd.exe 39 PID 1868 wrote to memory of 2428 1868 ddvvd.exe 39 PID 1868 wrote to memory of 2428 1868 ddvvd.exe 39 PID 2428 wrote to memory of 1824 2428 1tnnhh.exe 40 PID 2428 wrote to memory of 1824 2428 1tnnhh.exe 40 PID 2428 wrote to memory of 1824 2428 1tnnhh.exe 40 PID 2428 wrote to memory of 1824 2428 1tnnhh.exe 40 PID 1824 wrote to memory of 1308 1824 5jdpp.exe 41 PID 1824 wrote to memory of 1308 1824 5jdpp.exe 41 PID 1824 wrote to memory of 1308 1824 5jdpp.exe 41 PID 1824 wrote to memory of 1308 1824 5jdpp.exe 41 PID 1308 wrote to memory of 1704 1308 xxlrxxl.exe 42 PID 1308 wrote to memory of 1704 1308 xxlrxxl.exe 42 PID 1308 wrote to memory of 1704 1308 xxlrxxl.exe 42 PID 1308 wrote to memory of 1704 1308 xxlrxxl.exe 42 PID 1704 wrote to memory of 2616 1704 5bthth.exe 43 PID 1704 wrote to memory of 2616 1704 5bthth.exe 43 PID 1704 wrote to memory of 2616 1704 5bthth.exe 43 PID 1704 wrote to memory of 2616 1704 5bthth.exe 43 PID 2616 wrote to memory of 2836 2616 1dddd.exe 44 PID 2616 wrote to memory of 2836 2616 1dddd.exe 44 PID 2616 wrote to memory of 2836 2616 1dddd.exe 44 PID 2616 wrote to memory of 2836 2616 1dddd.exe 44 PID 2836 wrote to memory of 1928 2836 llfflrf.exe 45 PID 2836 wrote to memory of 1928 2836 llfflrf.exe 45 PID 2836 wrote to memory of 1928 2836 llfflrf.exe 45 PID 2836 wrote to memory of 1928 2836 llfflrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe"C:\Users\Admin\AppData\Local\Temp\a16f6057e5fc9de4fc5b98570bcb3c4be2f88f9257ab72d872fca3c562efa32b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\rflflfl.exec:\rflflfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pjjpd.exec:\pjjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\1frxfff.exec:\1frxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bnhhhb.exec:\bnhhhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\5lflrfl.exec:\5lflrfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3thnnt.exec:\3thnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\5llxxxr.exec:\5llxxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5ttbbh.exec:\5ttbbh.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\ddvvd.exec:\ddvvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\1tnnhh.exec:\1tnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\5jdpp.exec:\5jdpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\5bthth.exec:\5bthth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\1dddd.exec:\1dddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\llfflrf.exec:\llfflrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\hhtbhh.exec:\hhtbhh.exe17⤵
- Executes dropped EXE
PID:1928 -
\??\c:\1dpdp.exec:\1dpdp.exe18⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bttbhh.exec:\bttbhh.exe19⤵
- Executes dropped EXE
PID:576 -
\??\c:\ddvjv.exec:\ddvjv.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\ttnhnt.exec:\ttnhnt.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7jppj.exec:\7jppj.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\3llrxfr.exec:\3llrxfr.exe23⤵
- Executes dropped EXE
PID:2156 -
\??\c:\bnhnnn.exec:\bnhnnn.exe24⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5llxlrx.exec:\5llxlrx.exe25⤵
- Executes dropped EXE
PID:1268 -
\??\c:\vjddd.exec:\vjddd.exe26⤵
- Executes dropped EXE
PID:2284 -
\??\c:\1frllrr.exec:\1frllrr.exe27⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pdpjd.exec:\pdpjd.exe28⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fxlrflr.exec:\fxlrflr.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\tnhnhh.exec:\tnhnhh.exe30⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjvdp.exec:\pjvdp.exe31⤵
- Executes dropped EXE
PID:904 -
\??\c:\1xrxllx.exec:\1xrxllx.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\htnthb.exec:\htnthb.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jjdpp.exec:\jjdpp.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bnthbh.exec:\bnthbh.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vjdjj.exec:\vjdjj.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\vpdjd.exec:\vpdjd.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ffrflrx.exec:\ffrflrx.exe38⤵
- Executes dropped EXE
PID:2876 -
\??\c:\5ntnnn.exec:\5ntnnn.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3vvpj.exec:\3vvpj.exe40⤵
- Executes dropped EXE
PID:2620 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\fxrxlrx.exec:\fxrxlrx.exe42⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bnbbhh.exec:\bnbbhh.exe43⤵
- Executes dropped EXE
PID:2636 -
\??\c:\dvjdv.exec:\dvjdv.exe44⤵
- Executes dropped EXE
PID:304 -
\??\c:\vjvvd.exec:\vjvvd.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxrxxrx.exec:\fxrxxrx.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9ttbhh.exec:\9ttbhh.exe47⤵
- Executes dropped EXE
PID:2832 -
\??\c:\bhhtth.exec:\bhhtth.exe48⤵
- Executes dropped EXE
PID:652 -
\??\c:\dvjpv.exec:\dvjpv.exe49⤵
- Executes dropped EXE
PID:2440 -
\??\c:\frlffxl.exec:\frlffxl.exe50⤵
- Executes dropped EXE
PID:2752 -
\??\c:\9rfxflr.exec:\9rfxflr.exe51⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1htbtb.exec:\1htbtb.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\7pddd.exec:\7pddd.exe53⤵
- Executes dropped EXE
PID:852 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe54⤵
- Executes dropped EXE
PID:584 -
\??\c:\5rfflrx.exec:\5rfflrx.exe55⤵
- Executes dropped EXE
PID:824 -
\??\c:\hbbtnn.exec:\hbbtnn.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nnhbbt.exec:\nnhbbt.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vpddj.exec:\vpddj.exe58⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rllxrxl.exec:\rllxrxl.exe59⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3hnhhb.exec:\3hnhhb.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\5bntnt.exec:\5bntnt.exe61⤵
- Executes dropped EXE
PID:1708 -
\??\c:\dpjdj.exec:\dpjdj.exe62⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rflfrfr.exec:\rflfrfr.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\thtttb.exec:\thtttb.exe64⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5hnhtt.exec:\5hnhtt.exe65⤵
- Executes dropped EXE
PID:2628 -
\??\c:\djjjp.exec:\djjjp.exe66⤵PID:1400
-
\??\c:\xxlxfxl.exec:\xxlxfxl.exe67⤵PID:1672
-
\??\c:\5fllfxf.exec:\5fllfxf.exe68⤵PID:2300
-
\??\c:\bhhtht.exec:\bhhtht.exe69⤵PID:1460
-
\??\c:\jvppp.exec:\jvppp.exe70⤵PID:2340
-
\??\c:\lfxrlll.exec:\lfxrlll.exe71⤵PID:2356
-
\??\c:\3xrlrlx.exec:\3xrlrlx.exe72⤵PID:1016
-
\??\c:\bthhnn.exec:\bthhnn.exe73⤵PID:904
-
\??\c:\pjvdp.exec:\pjvdp.exe74⤵PID:2260
-
\??\c:\ffrxlrl.exec:\ffrxlrl.exe75⤵PID:1588
-
\??\c:\rfrlxxl.exec:\rfrlxxl.exe76⤵PID:2912
-
\??\c:\hbttnb.exec:\hbttnb.exe77⤵PID:2108
-
\??\c:\1vppv.exec:\1vppv.exe78⤵
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\lrfrflx.exec:\lrfrflx.exe79⤵
- System Location Discovery: System Language Discovery
PID:2688 -
\??\c:\1lrrrxf.exec:\1lrrrxf.exe80⤵PID:2592
-
\??\c:\bhnntt.exec:\bhnntt.exe81⤵PID:2808
-
\??\c:\3nhttb.exec:\3nhttb.exe82⤵PID:2720
-
\??\c:\jdvdp.exec:\jdvdp.exe83⤵PID:2008
-
\??\c:\rfflrrx.exec:\rfflrrx.exe84⤵PID:1368
-
\??\c:\bbbhhn.exec:\bbbhhn.exe85⤵PID:3004
-
\??\c:\thbhnn.exec:\thbhnn.exe86⤵PID:2584
-
\??\c:\jdpvv.exec:\jdpvv.exe87⤵PID:2152
-
\??\c:\rfxxfxx.exec:\rfxxfxx.exe88⤵PID:1172
-
\??\c:\lfxlrxl.exec:\lfxlrxl.exe89⤵PID:1624
-
\??\c:\nhtbnt.exec:\nhtbnt.exe90⤵PID:1700
-
\??\c:\ppdjp.exec:\ppdjp.exe91⤵PID:2028
-
\??\c:\fxrlxxx.exec:\fxrlxxx.exe92⤵PID:2864
-
\??\c:\9lrxlxf.exec:\9lrxlxf.exe93⤵PID:2648
-
\??\c:\1ttttn.exec:\1ttttn.exe94⤵PID:2860
-
\??\c:\9nttbb.exec:\9nttbb.exe95⤵PID:1988
-
\??\c:\ppjpv.exec:\ppjpv.exe96⤵PID:1372
-
\??\c:\fxllxfl.exec:\fxllxfl.exe97⤵PID:824
-
\??\c:\rfxffxl.exec:\rfxffxl.exe98⤵PID:2044
-
\??\c:\ntnhtt.exec:\ntnhtt.exe99⤵PID:2424
-
\??\c:\dvjjj.exec:\dvjjj.exe100⤵PID:2236
-
\??\c:\vpdvv.exec:\vpdvv.exe101⤵PID:2960
-
\??\c:\rxlfllr.exec:\rxlfllr.exe102⤵PID:2224
-
\??\c:\hhtnnh.exec:\hhtnnh.exe103⤵PID:1708
-
\??\c:\9thbtt.exec:\9thbtt.exe104⤵PID:1084
-
\??\c:\vdppv.exec:\vdppv.exe105⤵PID:820
-
\??\c:\3xrrrlr.exec:\3xrrrlr.exe106⤵PID:1548
-
\??\c:\3bttnt.exec:\3bttnt.exe107⤵PID:376
-
\??\c:\hthnnt.exec:\hthnnt.exe108⤵PID:2332
-
\??\c:\1pjjj.exec:\1pjjj.exe109⤵PID:1216
-
\??\c:\fxffffl.exec:\fxffffl.exe110⤵PID:2124
-
\??\c:\lfffflr.exec:\lfffflr.exe111⤵PID:2896
-
\??\c:\thttbb.exec:\thttbb.exe112⤵PID:2340
-
\??\c:\pjvpv.exec:\pjvpv.exe113⤵PID:2516
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe114⤵PID:1016
-
\??\c:\9xffllr.exec:\9xffllr.exe115⤵PID:3060
-
\??\c:\btntnt.exec:\btntnt.exe116⤵PID:2260
-
\??\c:\jpdvv.exec:\jpdvv.exe117⤵PID:1560
-
\??\c:\llfrrxl.exec:\llfrrxl.exe118⤵PID:2776
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe119⤵PID:2572
-
\??\c:\btnhhh.exec:\btnhhh.exe120⤵PID:1336
-
\??\c:\5bbhht.exec:\5bbhht.exe121⤵PID:2716
-
\??\c:\3pjpv.exec:\3pjpv.exe122⤵PID:2576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-