Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe
-
Size
454KB
-
MD5
37c4e6afc1ee892fed3257e783c5b961
-
SHA1
fbb22ac345c9ce2eae1d37996a8119b1c0f3f3bf
-
SHA256
62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa
-
SHA512
a0479bbb155fa605127a4bba8ae740f5136bd0981e5919328ef33fa729f483eef82da94a89065c98c9e5e256fbb396fe74f572eeecd8a6e2cebc4ced06899ae1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAben:q7Tc2NYHUrAwfMp3CDn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2000-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-72-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1396-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-340-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2664-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-406-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/320-420-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-439-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1684-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/704-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1428-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-940-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 1xllffl.exe 2504 ntnhnt.exe 2992 lfxflfr.exe 2648 nhhntt.exe 2752 fxlrxxf.exe 2796 nhbbnn.exe 2920 pjdjd.exe 2728 rfrrlrr.exe 2784 dddvp.exe 2604 pjvdp.exe 3000 bbnnnn.exe 484 3vvpj.exe 2640 rfrrxlr.exe 2356 nbnnbb.exe 2296 lfxrxfr.exe 1608 9lxxxxx.exe 2856 pjvdj.exe 1912 lfllllx.exe 2192 jdpjv.exe 448 rxffxxf.exe 1896 ddpvd.exe 2332 xlxxffl.exe 1396 1nnbtt.exe 920 ddvjd.exe 1540 7nhnth.exe 1704 7djpp.exe 1444 bhhttn.exe 568 dpjpp.exe 2212 rlxflrf.exe 2100 1hhhhn.exe 2056 fxrxllf.exe 1724 dddvd.exe 1652 5vdvv.exe 2348 lfrxllf.exe 1632 nbbntn.exe 2644 vjddj.exe 2688 7jjjd.exe 2648 lfxfffl.exe 2664 tnbhhh.exe 2700 5tnnbb.exe 2564 vpjvp.exe 2720 3xxxxxl.exe 2536 nnhttt.exe 2556 9vjpp.exe 2996 pjdjp.exe 3012 5xffxff.exe 1964 nhnhnt.exe 1948 bbbnnb.exe 1692 jdvdj.exe 320 xlfxffx.exe 332 bbbhnn.exe 1516 3tnntt.exe 1636 ppdjp.exe 892 ffxxxfr.exe 2496 xrffrrf.exe 828 btnhnb.exe 1188 dpdjj.exe 852 frfffff.exe 960 lfllllx.exe 340 htbthb.exe 1684 dvpvj.exe 2580 fxrrxxf.exe 1456 lxxrrxf.exe 2112 nthhtn.exe -
resource yara_rule behavioral1/memory/2000-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-420-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1188-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/704-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-522-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1428-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-816-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-838-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-845-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-889-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-902-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-915-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-1013-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-1020-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-1159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-1262-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-1299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-1324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-1343-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2312 2000 62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe 31 PID 2000 wrote to memory of 2312 2000 62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe 31 PID 2000 wrote to memory of 2312 2000 62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe 31 PID 2000 wrote to memory of 2312 2000 62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe 31 PID 2312 wrote to memory of 2504 2312 1xllffl.exe 32 PID 2312 wrote to memory of 2504 2312 1xllffl.exe 32 PID 2312 wrote to memory of 2504 2312 1xllffl.exe 32 PID 2312 wrote to memory of 2504 2312 1xllffl.exe 32 PID 2504 wrote to memory of 2992 2504 ntnhnt.exe 33 PID 2504 wrote to memory of 2992 2504 ntnhnt.exe 33 PID 2504 wrote to memory of 2992 2504 ntnhnt.exe 33 PID 2504 wrote to memory of 2992 2504 ntnhnt.exe 33 PID 2992 wrote to memory of 2648 2992 lfxflfr.exe 34 PID 2992 wrote to memory of 2648 2992 lfxflfr.exe 34 PID 2992 wrote to memory of 2648 2992 lfxflfr.exe 34 PID 2992 wrote to memory of 2648 2992 lfxflfr.exe 34 PID 2648 wrote to memory of 2752 2648 nhhntt.exe 35 PID 2648 wrote to memory of 2752 2648 nhhntt.exe 35 PID 2648 wrote to memory of 2752 2648 nhhntt.exe 35 PID 2648 wrote to memory of 2752 2648 nhhntt.exe 35 PID 2752 wrote to memory of 2796 2752 fxlrxxf.exe 36 PID 2752 wrote to memory of 2796 2752 fxlrxxf.exe 36 PID 2752 wrote to memory of 2796 2752 fxlrxxf.exe 36 PID 2752 wrote to memory of 2796 2752 fxlrxxf.exe 36 PID 2796 wrote to memory of 2920 2796 nhbbnn.exe 37 PID 2796 wrote to memory of 2920 2796 nhbbnn.exe 37 PID 2796 wrote to memory of 2920 2796 nhbbnn.exe 37 PID 2796 wrote to memory of 2920 2796 nhbbnn.exe 37 PID 2920 wrote to memory of 2728 2920 pjdjd.exe 38 PID 2920 wrote to memory of 2728 2920 pjdjd.exe 38 PID 2920 wrote to memory of 2728 2920 pjdjd.exe 38 PID 2920 wrote to memory of 2728 2920 pjdjd.exe 38 PID 2728 wrote to memory of 2784 2728 rfrrlrr.exe 39 PID 2728 wrote to memory of 2784 2728 rfrrlrr.exe 39 PID 2728 wrote to memory of 2784 2728 rfrrlrr.exe 39 PID 2728 wrote to memory of 2784 2728 rfrrlrr.exe 39 PID 2784 wrote to memory of 2604 2784 dddvp.exe 40 PID 2784 wrote to memory of 2604 2784 dddvp.exe 40 PID 2784 wrote to memory of 2604 2784 dddvp.exe 40 PID 2784 wrote to memory of 2604 2784 dddvp.exe 40 PID 2604 wrote to memory of 3000 2604 pjvdp.exe 41 PID 2604 wrote to memory of 3000 2604 pjvdp.exe 41 PID 2604 wrote to memory of 3000 2604 pjvdp.exe 41 PID 2604 wrote to memory of 3000 2604 pjvdp.exe 41 PID 3000 wrote to memory of 484 3000 bbnnnn.exe 42 PID 3000 wrote to memory of 484 3000 bbnnnn.exe 42 PID 3000 wrote to memory of 484 3000 bbnnnn.exe 42 PID 3000 wrote to memory of 484 3000 bbnnnn.exe 42 PID 484 wrote to memory of 2640 484 3vvpj.exe 43 PID 484 wrote to memory of 2640 484 3vvpj.exe 43 PID 484 wrote to memory of 2640 484 3vvpj.exe 43 PID 484 wrote to memory of 2640 484 3vvpj.exe 43 PID 2640 wrote to memory of 2356 2640 rfrrxlr.exe 44 PID 2640 wrote to memory of 2356 2640 rfrrxlr.exe 44 PID 2640 wrote to memory of 2356 2640 rfrrxlr.exe 44 PID 2640 wrote to memory of 2356 2640 rfrrxlr.exe 44 PID 2356 wrote to memory of 2296 2356 nbnnbb.exe 45 PID 2356 wrote to memory of 2296 2356 nbnnbb.exe 45 PID 2356 wrote to memory of 2296 2356 nbnnbb.exe 45 PID 2356 wrote to memory of 2296 2356 nbnnbb.exe 45 PID 2296 wrote to memory of 1608 2296 lfxrxfr.exe 46 PID 2296 wrote to memory of 1608 2296 lfxrxfr.exe 46 PID 2296 wrote to memory of 1608 2296 lfxrxfr.exe 46 PID 2296 wrote to memory of 1608 2296 lfxrxfr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe"C:\Users\Admin\AppData\Local\Temp\62b1c114efa89f56dd1674f9053c0789b7f5da9ede566af0d9deda37540805fa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\1xllffl.exec:\1xllffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\ntnhnt.exec:\ntnhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lfxflfr.exec:\lfxflfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\nhhntt.exec:\nhhntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nhbbnn.exec:\nhbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\pjdjd.exec:\pjdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\dddvp.exec:\dddvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\pjvdp.exec:\pjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\bbnnnn.exec:\bbnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3vvpj.exec:\3vvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\rfrrxlr.exec:\rfrrxlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\nbnnbb.exec:\nbnnbb.exe15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\lfxrxfr.exec:\lfxrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\9lxxxxx.exec:\9lxxxxx.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\pjvdj.exec:\pjvdj.exe18⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lfllllx.exec:\lfllllx.exe19⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jdpjv.exec:\jdpjv.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\rxffxxf.exec:\rxffxxf.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\ddpvd.exec:\ddpvd.exe22⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xlxxffl.exec:\xlxxffl.exe23⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1nnbtt.exec:\1nnbtt.exe24⤵
- Executes dropped EXE
PID:1396 -
\??\c:\ddvjd.exec:\ddvjd.exe25⤵
- Executes dropped EXE
PID:920 -
\??\c:\7nhnth.exec:\7nhnth.exe26⤵
- Executes dropped EXE
PID:1540 -
\??\c:\7djpp.exec:\7djpp.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\bhhttn.exec:\bhhttn.exe28⤵
- Executes dropped EXE
PID:1444 -
\??\c:\dpjpp.exec:\dpjpp.exe29⤵
- Executes dropped EXE
PID:568 -
\??\c:\rlxflrf.exec:\rlxflrf.exe30⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1hhhhn.exec:\1hhhhn.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\fxrxllf.exec:\fxrxllf.exe32⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dddvd.exec:\dddvd.exe33⤵
- Executes dropped EXE
PID:1724 -
\??\c:\5vdvv.exec:\5vdvv.exe34⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lfrxllf.exec:\lfrxllf.exe35⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nbbntn.exec:\nbbntn.exe36⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vjddj.exec:\vjddj.exe37⤵
- Executes dropped EXE
PID:2644 -
\??\c:\7jjjd.exec:\7jjjd.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\lfxfffl.exec:\lfxfffl.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnbhhh.exec:\tnbhhh.exe40⤵
- Executes dropped EXE
PID:2664 -
\??\c:\5tnnbb.exec:\5tnnbb.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpjvp.exec:\vpjvp.exe42⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3xxxxxl.exec:\3xxxxxl.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\nnhttt.exec:\nnhttt.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\9vjpp.exec:\9vjpp.exe45⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjdjp.exec:\pjdjp.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\5xffxff.exec:\5xffxff.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhnhnt.exec:\nhnhnt.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bbbnnb.exec:\bbbnnb.exe49⤵
- Executes dropped EXE
PID:1948 -
\??\c:\jdvdj.exec:\jdvdj.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xlfxffx.exec:\xlfxffx.exe51⤵
- Executes dropped EXE
PID:320 -
\??\c:\bbbhnn.exec:\bbbhnn.exe52⤵
- Executes dropped EXE
PID:332 -
\??\c:\3tnntt.exec:\3tnntt.exe53⤵
- Executes dropped EXE
PID:1516 -
\??\c:\ppdjp.exec:\ppdjp.exe54⤵
- Executes dropped EXE
PID:1636 -
\??\c:\ffxxxfr.exec:\ffxxxfr.exe55⤵
- Executes dropped EXE
PID:892 -
\??\c:\xrffrrf.exec:\xrffrrf.exe56⤵
- Executes dropped EXE
PID:2496 -
\??\c:\btnhnb.exec:\btnhnb.exe57⤵
- Executes dropped EXE
PID:828 -
\??\c:\dpdjj.exec:\dpdjj.exe58⤵
- Executes dropped EXE
PID:1188 -
\??\c:\frfffff.exec:\frfffff.exe59⤵
- Executes dropped EXE
PID:852 -
\??\c:\lfllllx.exec:\lfllllx.exe60⤵
- Executes dropped EXE
PID:960 -
\??\c:\htbthb.exec:\htbthb.exe61⤵
- Executes dropped EXE
PID:340 -
\??\c:\dvpvj.exec:\dvpvj.exe62⤵
- Executes dropped EXE
PID:1684 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe63⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lxxrrxf.exec:\lxxrrxf.exe64⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nthhtn.exec:\nthhtn.exe65⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1vvdj.exec:\1vvdj.exe66⤵PID:2932
-
\??\c:\fxrxllr.exec:\fxrxllr.exe67⤵PID:704
-
\??\c:\llxflrx.exec:\llxflrx.exe68⤵PID:2956
-
\??\c:\hbhtbh.exec:\hbhtbh.exe69⤵PID:1984
-
\??\c:\dppjp.exec:\dppjp.exe70⤵PID:3068
-
\??\c:\9llfrxl.exec:\9llfrxl.exe71⤵PID:2212
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe72⤵PID:1428
-
\??\c:\bnnnhn.exec:\bnnnhn.exe73⤵PID:2100
-
\??\c:\jdppv.exec:\jdppv.exe74⤵PID:780
-
\??\c:\xrrlfxf.exec:\xrrlfxf.exe75⤵PID:1524
-
\??\c:\fxflllr.exec:\fxflllr.exe76⤵PID:2288
-
\??\c:\hbttbb.exec:\hbttbb.exe77⤵PID:2080
-
\??\c:\vpvpv.exec:\vpvpv.exe78⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\vjvvp.exec:\vjvvp.exe79⤵PID:2732
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe80⤵PID:2644
-
\??\c:\nhbhhh.exec:\nhbhhh.exe81⤵PID:2804
-
\??\c:\pvjdj.exec:\pvjdj.exe82⤵PID:2648
-
\??\c:\3vjpd.exec:\3vjpd.exe83⤵PID:2664
-
\??\c:\5rffrrr.exec:\5rffrrr.exe84⤵PID:2788
-
\??\c:\bhhtnt.exec:\bhhtnt.exe85⤵PID:1880
-
\??\c:\vvjpv.exec:\vvjpv.exe86⤵PID:1628
-
\??\c:\jdpjv.exec:\jdpjv.exe87⤵PID:2660
-
\??\c:\xrxxllr.exec:\xrxxllr.exe88⤵PID:580
-
\??\c:\ttbhnh.exec:\ttbhnh.exe89⤵PID:3008
-
\??\c:\hbnnbb.exec:\hbnnbb.exe90⤵
- System Location Discovery: System Language Discovery
PID:324 -
\??\c:\jdppv.exec:\jdppv.exe91⤵PID:2600
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe92⤵PID:2832
-
\??\c:\bthnbb.exec:\bthnbb.exe93⤵PID:2640
-
\??\c:\bhthnt.exec:\bhthnt.exe94⤵PID:1404
-
\??\c:\vpvvp.exec:\vpvvp.exe95⤵PID:320
-
\??\c:\lfxfflr.exec:\lfxfflr.exe96⤵PID:588
-
\??\c:\lxxxxxl.exec:\lxxxxxl.exe97⤵PID:1516
-
\??\c:\btnthh.exec:\btnthh.exe98⤵PID:1960
-
\??\c:\dvpjp.exec:\dvpjp.exe99⤵PID:1696
-
\??\c:\5jpvj.exec:\5jpvj.exe100⤵PID:2880
-
\??\c:\fxrrflx.exec:\fxrrflx.exe101⤵PID:2192
-
\??\c:\xlxxflr.exec:\xlxxflr.exe102⤵PID:1152
-
\??\c:\9btttt.exec:\9btttt.exe103⤵PID:448
-
\??\c:\ppjpv.exec:\ppjpv.exe104⤵PID:600
-
\??\c:\llrffrf.exec:\llrffrf.exe105⤵PID:1920
-
\??\c:\xfrrxxx.exec:\xfrrxxx.exe106⤵PID:916
-
\??\c:\hbbhnn.exec:\hbbhnn.exe107⤵PID:1664
-
\??\c:\1vjpj.exec:\1vjpj.exe108⤵PID:616
-
\??\c:\pdddj.exec:\pdddj.exe109⤵PID:2392
-
\??\c:\xrflxxl.exec:\xrflxxl.exe110⤵PID:2396
-
\??\c:\tnbtth.exec:\tnbtth.exe111⤵PID:2460
-
\??\c:\djjpp.exec:\djjpp.exe112⤵PID:2960
-
\??\c:\ppjvj.exec:\ppjvj.exe113⤵PID:2268
-
\??\c:\xxllfrf.exec:\xxllfrf.exe114⤵PID:1004
-
\??\c:\hbtbnn.exec:\hbtbnn.exe115⤵PID:3056
-
\??\c:\7jvvd.exec:\7jvvd.exe116⤵PID:2476
-
\??\c:\vpjvp.exec:\vpjvp.exe117⤵PID:1872
-
\??\c:\7xlxfxx.exec:\7xlxfxx.exe118⤵PID:2256
-
\??\c:\thnhht.exec:\thnhht.exe119⤵PID:2328
-
\??\c:\5bbttt.exec:\5bbttt.exe120⤵PID:1524
-
\??\c:\dddpp.exec:\dddpp.exe121⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-