Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe
-
Size
454KB
-
MD5
e0ffaedc42e91881c178e7eecb5d04e0
-
SHA1
3152584cc11edbf79a2b3d66f3c24ab6c6eedea7
-
SHA256
8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0
-
SHA512
45771315fdcf50f06620d1a83d010e1dbfc38a73bc94e896cc63e8a2a8f747e824f03b7c01fdceaa974a34cb9682148fb6da80431f058e26d93371e199d71d02
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-12-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2716-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/688-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2016-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/344-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-402-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3068-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-449-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/448-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-558-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-565-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1324-568-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-625-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-687-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/320-699-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2828 vpdjv.exe 2716 fxxlffx.exe 2960 rrffxxx.exe 2928 hnbhtb.exe 2616 5vjjd.exe 2624 nhbnbh.exe 3048 jjdjp.exe 692 5rrrxfr.exe 2436 bbhhnt.exe 2524 rlxflrl.exe 2108 bhthht.exe 688 fffrlxf.exe 1200 xlrxffl.exe 2744 pjjdd.exe 2944 lrrxllx.exe 380 jdpvj.exe 2016 rlfffll.exe 1100 7ppjv.exe 1932 fflrxxx.exe 1868 dvpvj.exe 1096 jppjd.exe 636 ntthbn.exe 2536 jdpvj.exe 2360 lxllrlx.exe 2932 htnnnt.exe 2336 7pddj.exe 1928 hbnbhn.exe 344 rfllrrr.exe 1828 ntthbn.exe 1816 rxlrllr.exe 2848 xlflxff.exe 1804 vpddd.exe 1040 fxlrxfl.exe 2720 hbnntt.exe 2588 9jvvd.exe 2076 1xrrrrx.exe 2556 tntbnn.exe 2608 ddpvv.exe 3052 1frxlff.exe 2416 frrrffl.exe 3048 tthntt.exe 2164 jvpvd.exe 628 rfxflrx.exe 908 xxllrrf.exe 2788 ttnthn.exe 2888 ddpvj.exe 1404 lxxxfxx.exe 2620 nnhhnt.exe 1576 djjjj.exe 3020 9jvdp.exe 3068 5frxflx.exe 2876 hbnthn.exe 2988 jvjpv.exe 2260 ffxxlfl.exe 2424 bhbnbb.exe 2228 dvjpd.exe 448 ddjvv.exe 1944 flffllr.exe 2512 1bbttn.exe 2348 ddvjv.exe 704 rxlrrrr.exe 2012 hbnbnt.exe 1332 vpjdv.exe 2120 dvjpd.exe -
resource yara_rule behavioral1/memory/2708-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-12-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2716-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/688-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-449-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/448-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1332-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-670-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2828 2708 8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe 31 PID 2708 wrote to memory of 2828 2708 8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe 31 PID 2708 wrote to memory of 2828 2708 8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe 31 PID 2708 wrote to memory of 2828 2708 8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe 31 PID 2828 wrote to memory of 2716 2828 vpdjv.exe 32 PID 2828 wrote to memory of 2716 2828 vpdjv.exe 32 PID 2828 wrote to memory of 2716 2828 vpdjv.exe 32 PID 2828 wrote to memory of 2716 2828 vpdjv.exe 32 PID 2716 wrote to memory of 2960 2716 fxxlffx.exe 33 PID 2716 wrote to memory of 2960 2716 fxxlffx.exe 33 PID 2716 wrote to memory of 2960 2716 fxxlffx.exe 33 PID 2716 wrote to memory of 2960 2716 fxxlffx.exe 33 PID 2960 wrote to memory of 2928 2960 rrffxxx.exe 34 PID 2960 wrote to memory of 2928 2960 rrffxxx.exe 34 PID 2960 wrote to memory of 2928 2960 rrffxxx.exe 34 PID 2960 wrote to memory of 2928 2960 rrffxxx.exe 34 PID 2928 wrote to memory of 2616 2928 hnbhtb.exe 35 PID 2928 wrote to memory of 2616 2928 hnbhtb.exe 35 PID 2928 wrote to memory of 2616 2928 hnbhtb.exe 35 PID 2928 wrote to memory of 2616 2928 hnbhtb.exe 35 PID 2616 wrote to memory of 2624 2616 5vjjd.exe 36 PID 2616 wrote to memory of 2624 2616 5vjjd.exe 36 PID 2616 wrote to memory of 2624 2616 5vjjd.exe 36 PID 2616 wrote to memory of 2624 2616 5vjjd.exe 36 PID 2624 wrote to memory of 3048 2624 nhbnbh.exe 37 PID 2624 wrote to memory of 3048 2624 nhbnbh.exe 37 PID 2624 wrote to memory of 3048 2624 nhbnbh.exe 37 PID 2624 wrote to memory of 3048 2624 nhbnbh.exe 37 PID 3048 wrote to memory of 692 3048 jjdjp.exe 38 PID 3048 wrote to memory of 692 3048 jjdjp.exe 38 PID 3048 wrote to memory of 692 3048 jjdjp.exe 38 PID 3048 wrote to memory of 692 3048 jjdjp.exe 38 PID 692 wrote to memory of 2436 692 5rrrxfr.exe 39 PID 692 wrote to memory of 2436 692 5rrrxfr.exe 39 PID 692 wrote to memory of 2436 692 5rrrxfr.exe 39 PID 692 wrote to memory of 2436 692 5rrrxfr.exe 39 PID 2436 wrote to memory of 2524 2436 bbhhnt.exe 40 PID 2436 wrote to memory of 2524 2436 bbhhnt.exe 40 PID 2436 wrote to memory of 2524 2436 bbhhnt.exe 40 PID 2436 wrote to memory of 2524 2436 bbhhnt.exe 40 PID 2524 wrote to memory of 2108 2524 rlxflrl.exe 41 PID 2524 wrote to memory of 2108 2524 rlxflrl.exe 41 PID 2524 wrote to memory of 2108 2524 rlxflrl.exe 41 PID 2524 wrote to memory of 2108 2524 rlxflrl.exe 41 PID 2108 wrote to memory of 688 2108 bhthht.exe 42 PID 2108 wrote to memory of 688 2108 bhthht.exe 42 PID 2108 wrote to memory of 688 2108 bhthht.exe 42 PID 2108 wrote to memory of 688 2108 bhthht.exe 42 PID 688 wrote to memory of 1200 688 fffrlxf.exe 43 PID 688 wrote to memory of 1200 688 fffrlxf.exe 43 PID 688 wrote to memory of 1200 688 fffrlxf.exe 43 PID 688 wrote to memory of 1200 688 fffrlxf.exe 43 PID 1200 wrote to memory of 2744 1200 xlrxffl.exe 44 PID 1200 wrote to memory of 2744 1200 xlrxffl.exe 44 PID 1200 wrote to memory of 2744 1200 xlrxffl.exe 44 PID 1200 wrote to memory of 2744 1200 xlrxffl.exe 44 PID 2744 wrote to memory of 2944 2744 pjjdd.exe 45 PID 2744 wrote to memory of 2944 2744 pjjdd.exe 45 PID 2744 wrote to memory of 2944 2744 pjjdd.exe 45 PID 2744 wrote to memory of 2944 2744 pjjdd.exe 45 PID 2944 wrote to memory of 380 2944 lrrxllx.exe 46 PID 2944 wrote to memory of 380 2944 lrrxllx.exe 46 PID 2944 wrote to memory of 380 2944 lrrxllx.exe 46 PID 2944 wrote to memory of 380 2944 lrrxllx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe"C:\Users\Admin\AppData\Local\Temp\8667bac38c9ae32c2273b9e6899acd2cf1378c77a45846d1b77ae631fd2d5cd0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\vpdjv.exec:\vpdjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxxlffx.exec:\fxxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rrffxxx.exec:\rrffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hnbhtb.exec:\hnbhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\5vjjd.exec:\5vjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nhbnbh.exec:\nhbnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\jjdjp.exec:\jjdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\5rrrxfr.exec:\5rrrxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\bbhhnt.exec:\bbhhnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\rlxflrl.exec:\rlxflrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bhthht.exec:\bhthht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\fffrlxf.exec:\fffrlxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\xlrxffl.exec:\xlrxffl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\pjjdd.exec:\pjjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\lrrxllx.exec:\lrrxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\jdpvj.exec:\jdpvj.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\rlfffll.exec:\rlfffll.exe18⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7ppjv.exec:\7ppjv.exe19⤵
- Executes dropped EXE
PID:1100 -
\??\c:\fflrxxx.exec:\fflrxxx.exe20⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dvpvj.exec:\dvpvj.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jppjd.exec:\jppjd.exe22⤵
- Executes dropped EXE
PID:1096 -
\??\c:\ntthbn.exec:\ntthbn.exe23⤵
- Executes dropped EXE
PID:636 -
\??\c:\jdpvj.exec:\jdpvj.exe24⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lxllrlx.exec:\lxllrlx.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\htnnnt.exec:\htnnnt.exe26⤵
- Executes dropped EXE
PID:2932 -
\??\c:\7pddj.exec:\7pddj.exe27⤵
- Executes dropped EXE
PID:2336 -
\??\c:\hbnbhn.exec:\hbnbhn.exe28⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rfllrrr.exec:\rfllrrr.exe29⤵
- Executes dropped EXE
PID:344 -
\??\c:\ntthbn.exec:\ntthbn.exe30⤵
- Executes dropped EXE
PID:1828 -
\??\c:\rxlrllr.exec:\rxlrllr.exe31⤵
- Executes dropped EXE
PID:1816 -
\??\c:\xlflxff.exec:\xlflxff.exe32⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vpddd.exec:\vpddd.exe33⤵
- Executes dropped EXE
PID:1804 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe34⤵
- Executes dropped EXE
PID:1040 -
\??\c:\hbnntt.exec:\hbnntt.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9jvvd.exec:\9jvvd.exe36⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1xrrrrx.exec:\1xrrrrx.exe37⤵
- Executes dropped EXE
PID:2076 -
\??\c:\tntbnn.exec:\tntbnn.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ddpvv.exec:\ddpvv.exe39⤵
- Executes dropped EXE
PID:2608 -
\??\c:\1frxlff.exec:\1frxlff.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\frrrffl.exec:\frrrffl.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\tthntt.exec:\tthntt.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\jvpvd.exec:\jvpvd.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\rfxflrx.exec:\rfxflrx.exe44⤵
- Executes dropped EXE
PID:628 -
\??\c:\xxllrrf.exec:\xxllrrf.exe45⤵
- Executes dropped EXE
PID:908 -
\??\c:\ttnthn.exec:\ttnthn.exe46⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ddpvj.exec:\ddpvj.exe47⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lxxxfxx.exec:\lxxxfxx.exe48⤵
- Executes dropped EXE
PID:1404 -
\??\c:\nnhhnt.exec:\nnhhnt.exe49⤵
- Executes dropped EXE
PID:2620 -
\??\c:\djjjj.exec:\djjjj.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\9jvdp.exec:\9jvdp.exe51⤵
- Executes dropped EXE
PID:3020 -
\??\c:\5frxflx.exec:\5frxflx.exe52⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbnthn.exec:\hbnthn.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\jvjpv.exec:\jvjpv.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ffxxlfl.exec:\ffxxlfl.exe55⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bhbnbb.exec:\bhbnbb.exe56⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dvjpd.exec:\dvjpd.exe57⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ddjvv.exec:\ddjvv.exe58⤵
- Executes dropped EXE
PID:448 -
\??\c:\flffllr.exec:\flffllr.exe59⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1bbttn.exec:\1bbttn.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ddvjv.exec:\ddvjv.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rxlrrrr.exec:\rxlrrrr.exe62⤵
- Executes dropped EXE
PID:704 -
\??\c:\hbnbnt.exec:\hbnbnt.exe63⤵
- Executes dropped EXE
PID:2012 -
\??\c:\vpjdv.exec:\vpjdv.exe64⤵
- Executes dropped EXE
PID:1332 -
\??\c:\dvjpd.exec:\dvjpd.exe65⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrfrxfl.exec:\xrfrxfl.exe66⤵PID:1064
-
\??\c:\btbbhn.exec:\btbbhn.exe67⤵PID:3016
-
\??\c:\jpvvv.exec:\jpvvv.exe68⤵PID:2516
-
\??\c:\rfrllff.exec:\rfrllff.exe69⤵PID:1324
-
\??\c:\lxflllx.exec:\lxflllx.exe70⤵PID:1688
-
\??\c:\ththth.exec:\ththth.exe71⤵PID:1276
-
\??\c:\hbthnn.exec:\hbthnn.exe72⤵PID:1592
-
\??\c:\jjppd.exec:\jjppd.exe73⤵PID:2300
-
\??\c:\rrffxfr.exec:\rrffxfr.exe74⤵PID:2568
-
\??\c:\btnthh.exec:\btnthh.exe75⤵PID:2816
-
\??\c:\hbbtbh.exec:\hbbtbh.exe76⤵PID:108
-
\??\c:\pjddp.exec:\pjddp.exe77⤵PID:2588
-
\??\c:\rrlxlxr.exec:\rrlxlxr.exe78⤵PID:2604
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe79⤵PID:2680
-
\??\c:\hbnhhb.exec:\hbnhhb.exe80⤵PID:2612
-
\??\c:\jdvvd.exec:\jdvvd.exe81⤵PID:2296
-
\??\c:\rfrxxxf.exec:\rfrxxxf.exe82⤵PID:1556
-
\??\c:\bhbbnt.exec:\bhbbnt.exe83⤵PID:1484
-
\??\c:\nhhhnh.exec:\nhhhnh.exe84⤵PID:1792
-
\??\c:\7pvpp.exec:\7pvpp.exe85⤵PID:860
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe86⤵PID:1496
-
\??\c:\9xllxxf.exec:\9xllxxf.exe87⤵PID:2388
-
\??\c:\bhtnbb.exec:\bhtnbb.exe88⤵PID:2784
-
\??\c:\ddjjp.exec:\ddjjp.exe89⤵PID:2792
-
\??\c:\7vvdj.exec:\7vvdj.exe90⤵
- System Location Discovery: System Language Discovery
PID:1200 -
\??\c:\lflrllx.exec:\lflrllx.exe91⤵PID:2744
-
\??\c:\9nhnbb.exec:\9nhnbb.exe92⤵PID:320
-
\??\c:\vpvvd.exec:\vpvvd.exe93⤵PID:1772
-
\??\c:\jpjjj.exec:\jpjjj.exe94⤵PID:2876
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe95⤵PID:2016
-
\??\c:\9btbtn.exec:\9btbtn.exe96⤵PID:2172
-
\??\c:\3jppp.exec:\3jppp.exe97⤵PID:1680
-
\??\c:\jdvdd.exec:\jdvdd.exe98⤵PID:2452
-
\??\c:\fxlrrxf.exec:\fxlrrxf.exe99⤵PID:2140
-
\??\c:\thbhnn.exec:\thbhnn.exe100⤵PID:840
-
\??\c:\5bnbhn.exec:\5bnbhn.exe101⤵PID:1356
-
\??\c:\pdvvd.exec:\pdvvd.exe102⤵PID:2528
-
\??\c:\9lfxxxf.exec:\9lfxxxf.exe103⤵PID:1656
-
\??\c:\xrxlxfl.exec:\xrxlxfl.exe104⤵PID:1716
-
\??\c:\bthnth.exec:\bthnth.exe105⤵PID:3024
-
\??\c:\ppddd.exec:\ppddd.exe106⤵PID:1952
-
\??\c:\7rlfrfl.exec:\7rlfrfl.exe107⤵PID:2084
-
\??\c:\rlxxfrf.exec:\rlxxfrf.exe108⤵PID:3008
-
\??\c:\7hbhtb.exec:\7hbhtb.exe109⤵PID:284
-
\??\c:\vpvdp.exec:\vpvdp.exe110⤵PID:888
-
\??\c:\xxllrrx.exec:\xxllrrx.exe111⤵PID:2664
-
\??\c:\xlflxxf.exec:\xlflxxf.exe112⤵PID:1572
-
\??\c:\bbnhnn.exec:\bbnhnn.exe113⤵PID:2848
-
\??\c:\1ppjj.exec:\1ppjj.exe114⤵PID:2712
-
\??\c:\jdddj.exec:\jdddj.exe115⤵PID:2152
-
\??\c:\3rlrxfr.exec:\3rlrxfr.exe116⤵PID:2676
-
\??\c:\tnhnbn.exec:\tnhnbn.exe117⤵PID:2584
-
\??\c:\nthnbh.exec:\nthnbh.exe118⤵PID:2892
-
\??\c:\7jppp.exec:\7jppp.exe119⤵PID:2556
-
\??\c:\xlllxxl.exec:\xlllxxl.exe120⤵PID:2624
-
\??\c:\tnhhtt.exec:\tnhhtt.exe121⤵PID:1956
-
\??\c:\jvdjp.exec:\jvdjp.exe122⤵PID:2376
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-