Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 23:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e4139af8432476340c8bdeb9fa666d0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
6e4139af8432476340c8bdeb9fa666d0N.exe
-
Size
332KB
-
MD5
6e4139af8432476340c8bdeb9fa666d0
-
SHA1
487630b5ef0ff37ba62964e868ebebf7857c1b21
-
SHA256
8420a5edbff96330ea9e470a2211a039d7a472ad28457c354d1585d91cf0315e
-
SHA512
c31c2180256b739bfbd715a64a64c86ca84e2e5ec1099bc472bdbe0abf59b8e953ab245e7522d1cc3fbdfd7301b8232fbe57d9fc89d7f3ff7c336821697a702a
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhp:F7Tc8JdSjylh2b77BoTMA9gX59sTsuT5
Malware Config
Signatures
-
Detect Blackmoon payload 49 IoCs
resource yara_rule behavioral1/memory/2760-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-25-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/3040-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1476-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-102-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/236-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2424-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-188-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1656-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-277-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-410-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2720-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-497-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2056-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-589-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1280-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-706-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-718-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2892-720-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2060-732-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/408-761-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1792-788-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1536-801-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2760 xxlxllf.exe 2696 ddpdp.exe 3040 xrxxlrf.exe 2840 dvjpd.exe 2580 rlfxllx.exe 2552 vvjvj.exe 2964 5nbhth.exe 1476 hbttnb.exe 2944 vpdjv.exe 2364 hhtnbh.exe 1904 3llfxxx.exe 1268 bthntt.exe 236 ddjpd.exe 2424 tnbhtt.exe 2828 5vjvp.exe 1624 bbnbhn.exe 1748 jjdvj.exe 2896 rffxxrf.exe 2232 vvppp.exe 3020 ffxrxxf.exe 2916 pjvvd.exe 1656 xrlxflr.exe 2008 nhtntb.exe 2492 5xfflrf.exe 1040 hbnthn.exe 1848 pjdpp.exe 2508 3htbbb.exe 2208 pppvv.exe 1000 5htttb.exe 1212 pvppd.exe 2692 lfxrxxf.exe 1548 5pjpv.exe 2800 lrlfrrx.exe 2756 btnbnn.exe 2704 tnbhbb.exe 2852 ddvpd.exe 2840 1lxxffl.exe 2548 5htttt.exe 2604 jjppj.exe 2960 lrlrrrf.exe 1712 9tttbb.exe 1476 pjvjd.exe 1264 jjdjv.exe 2360 7lxflrx.exe 2388 tbtbnt.exe 1832 pjvvd.exe 620 5frxrxf.exe 1248 5btbht.exe 584 bbhnbb.exe 1088 pvpdv.exe 2720 xrxxflr.exe 796 9bhtnt.exe 696 nnhthh.exe 1592 xrfxrxl.exe 1400 xxrrffr.exe 3016 btntnt.exe 3036 vvpdp.exe 1452 rrlrxxl.exe 2464 hhhtth.exe 2136 htnntt.exe 1656 pjppv.exe 2600 rxrxflx.exe 1792 tnttth.exe 948 dpjjv.exe -
resource yara_rule behavioral1/memory/2760-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/236-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-277-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-504-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2056-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-691-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2648 wrote to memory of 2760 2648 6e4139af8432476340c8bdeb9fa666d0N.exe 31 PID 2648 wrote to memory of 2760 2648 6e4139af8432476340c8bdeb9fa666d0N.exe 31 PID 2648 wrote to memory of 2760 2648 6e4139af8432476340c8bdeb9fa666d0N.exe 31 PID 2648 wrote to memory of 2760 2648 6e4139af8432476340c8bdeb9fa666d0N.exe 31 PID 2760 wrote to memory of 2696 2760 xxlxllf.exe 32 PID 2760 wrote to memory of 2696 2760 xxlxllf.exe 32 PID 2760 wrote to memory of 2696 2760 xxlxllf.exe 32 PID 2760 wrote to memory of 2696 2760 xxlxllf.exe 32 PID 2696 wrote to memory of 3040 2696 ddpdp.exe 33 PID 2696 wrote to memory of 3040 2696 ddpdp.exe 33 PID 2696 wrote to memory of 3040 2696 ddpdp.exe 33 PID 2696 wrote to memory of 3040 2696 ddpdp.exe 33 PID 3040 wrote to memory of 2840 3040 xrxxlrf.exe 34 PID 3040 wrote to memory of 2840 3040 xrxxlrf.exe 34 PID 3040 wrote to memory of 2840 3040 xrxxlrf.exe 34 PID 3040 wrote to memory of 2840 3040 xrxxlrf.exe 34 PID 2840 wrote to memory of 2580 2840 dvjpd.exe 35 PID 2840 wrote to memory of 2580 2840 dvjpd.exe 35 PID 2840 wrote to memory of 2580 2840 dvjpd.exe 35 PID 2840 wrote to memory of 2580 2840 dvjpd.exe 35 PID 2580 wrote to memory of 2552 2580 rlfxllx.exe 36 PID 2580 wrote to memory of 2552 2580 rlfxllx.exe 36 PID 2580 wrote to memory of 2552 2580 rlfxllx.exe 36 PID 2580 wrote to memory of 2552 2580 rlfxllx.exe 36 PID 2552 wrote to memory of 2964 2552 vvjvj.exe 37 PID 2552 wrote to memory of 2964 2552 vvjvj.exe 37 PID 2552 wrote to memory of 2964 2552 vvjvj.exe 37 PID 2552 wrote to memory of 2964 2552 vvjvj.exe 37 PID 2964 wrote to memory of 1476 2964 5nbhth.exe 38 PID 2964 wrote to memory of 1476 2964 5nbhth.exe 38 PID 2964 wrote to memory of 1476 2964 5nbhth.exe 38 PID 2964 wrote to memory of 1476 2964 5nbhth.exe 38 PID 1476 wrote to memory of 2944 1476 hbttnb.exe 39 PID 1476 wrote to memory of 2944 1476 hbttnb.exe 39 PID 1476 wrote to memory of 2944 1476 hbttnb.exe 39 PID 1476 wrote to memory of 2944 1476 hbttnb.exe 39 PID 2944 wrote to memory of 2364 2944 vpdjv.exe 40 PID 2944 wrote to memory of 2364 2944 vpdjv.exe 40 PID 2944 wrote to memory of 2364 2944 vpdjv.exe 40 PID 2944 wrote to memory of 2364 2944 vpdjv.exe 40 PID 2364 wrote to memory of 1904 2364 hhtnbh.exe 41 PID 2364 wrote to memory of 1904 2364 hhtnbh.exe 41 PID 2364 wrote to memory of 1904 2364 hhtnbh.exe 41 PID 2364 wrote to memory of 1904 2364 hhtnbh.exe 41 PID 1904 wrote to memory of 1268 1904 3llfxxx.exe 42 PID 1904 wrote to memory of 1268 1904 3llfxxx.exe 42 PID 1904 wrote to memory of 1268 1904 3llfxxx.exe 42 PID 1904 wrote to memory of 1268 1904 3llfxxx.exe 42 PID 1268 wrote to memory of 236 1268 bthntt.exe 43 PID 1268 wrote to memory of 236 1268 bthntt.exe 43 PID 1268 wrote to memory of 236 1268 bthntt.exe 43 PID 1268 wrote to memory of 236 1268 bthntt.exe 43 PID 236 wrote to memory of 2424 236 ddjpd.exe 44 PID 236 wrote to memory of 2424 236 ddjpd.exe 44 PID 236 wrote to memory of 2424 236 ddjpd.exe 44 PID 236 wrote to memory of 2424 236 ddjpd.exe 44 PID 2424 wrote to memory of 2828 2424 tnbhtt.exe 45 PID 2424 wrote to memory of 2828 2424 tnbhtt.exe 45 PID 2424 wrote to memory of 2828 2424 tnbhtt.exe 45 PID 2424 wrote to memory of 2828 2424 tnbhtt.exe 45 PID 2828 wrote to memory of 1624 2828 5vjvp.exe 46 PID 2828 wrote to memory of 1624 2828 5vjvp.exe 46 PID 2828 wrote to memory of 1624 2828 5vjvp.exe 46 PID 2828 wrote to memory of 1624 2828 5vjvp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e4139af8432476340c8bdeb9fa666d0N.exe"C:\Users\Admin\AppData\Local\Temp\6e4139af8432476340c8bdeb9fa666d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xxlxllf.exec:\xxlxllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\ddpdp.exec:\ddpdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrxxlrf.exec:\xrxxlrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\dvjpd.exec:\dvjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rlfxllx.exec:\rlfxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\vvjvj.exec:\vvjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5nbhth.exec:\5nbhth.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\hbttnb.exec:\hbttnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\vpdjv.exec:\vpdjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hhtnbh.exec:\hhtnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\3llfxxx.exec:\3llfxxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\bthntt.exec:\bthntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\ddjpd.exec:\ddjpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\tnbhtt.exec:\tnbhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\5vjvp.exec:\5vjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\bbnbhn.exec:\bbnbhn.exe17⤵
- Executes dropped EXE
PID:1624 -
\??\c:\jjdvj.exec:\jjdvj.exe18⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rffxxrf.exec:\rffxxrf.exe19⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvppp.exec:\vvppp.exe20⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ffxrxxf.exec:\ffxrxxf.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pjvvd.exec:\pjvvd.exe22⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xrlxflr.exec:\xrlxflr.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nhtntb.exec:\nhtntb.exe24⤵
- Executes dropped EXE
PID:2008 -
\??\c:\5xfflrf.exec:\5xfflrf.exe25⤵
- Executes dropped EXE
PID:2492 -
\??\c:\hbnthn.exec:\hbnthn.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjdpp.exec:\pjdpp.exe27⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3htbbb.exec:\3htbbb.exe28⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pppvv.exec:\pppvv.exe29⤵
- Executes dropped EXE
PID:2208 -
\??\c:\5htttb.exec:\5htttb.exe30⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pvppd.exec:\pvppd.exe31⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe32⤵
- Executes dropped EXE
PID:2692 -
\??\c:\5pjpv.exec:\5pjpv.exe33⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lrlfrrx.exec:\lrlfrrx.exe34⤵
- Executes dropped EXE
PID:2800 -
\??\c:\btnbnn.exec:\btnbnn.exe35⤵
- Executes dropped EXE
PID:2756 -
\??\c:\tnbhbb.exec:\tnbhbb.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\ddvpd.exec:\ddvpd.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1lxxffl.exec:\1lxxffl.exe38⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5htttt.exec:\5htttt.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jjppj.exec:\jjppj.exe40⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lrlrrrf.exec:\lrlrrrf.exe41⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9tttbb.exec:\9tttbb.exe42⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pjvjd.exec:\pjvjd.exe43⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jjdjv.exec:\jjdjv.exe44⤵
- Executes dropped EXE
PID:1264 -
\??\c:\7lxflrx.exec:\7lxflrx.exe45⤵
- Executes dropped EXE
PID:2360 -
\??\c:\tbtbnt.exec:\tbtbnt.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjvvd.exec:\pjvvd.exe47⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5frxrxf.exec:\5frxrxf.exe48⤵
- Executes dropped EXE
PID:620 -
\??\c:\5btbht.exec:\5btbht.exe49⤵
- Executes dropped EXE
PID:1248 -
\??\c:\bbhnbb.exec:\bbhnbb.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:584 -
\??\c:\pvpdv.exec:\pvpdv.exe51⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xrxxflr.exec:\xrxxflr.exe52⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9bhtnt.exec:\9bhtnt.exe53⤵
- Executes dropped EXE
PID:796 -
\??\c:\nnhthh.exec:\nnhthh.exe54⤵
- Executes dropped EXE
PID:696 -
\??\c:\xrfxrxl.exec:\xrfxrxl.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\xxrrffr.exec:\xxrrffr.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\btntnt.exec:\btntnt.exe57⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vvpdp.exec:\vvpdp.exe58⤵
- Executes dropped EXE
PID:3036 -
\??\c:\rrlrxxl.exec:\rrlrxxl.exe59⤵
- Executes dropped EXE
PID:1452 -
\??\c:\hhhtth.exec:\hhhtth.exe60⤵
- Executes dropped EXE
PID:2464 -
\??\c:\htnntt.exec:\htnntt.exe61⤵
- Executes dropped EXE
PID:2136 -
\??\c:\pjppv.exec:\pjppv.exe62⤵
- Executes dropped EXE
PID:1656 -
\??\c:\rxrxflx.exec:\rxrxflx.exe63⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tnttth.exec:\tnttth.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792 -
\??\c:\dpjjv.exec:\dpjjv.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\7rrfrxx.exec:\7rrfrxx.exe66⤵PID:2056
-
\??\c:\5tttbb.exec:\5tttbb.exe67⤵PID:1848
-
\??\c:\7nbnnt.exec:\7nbnnt.exe68⤵PID:2508
-
\??\c:\vpjpv.exec:\vpjpv.exe69⤵
- System Location Discovery: System Language Discovery
PID:2728 -
\??\c:\3xrlllr.exec:\3xrlllr.exe70⤵PID:1784
-
\??\c:\tnnbht.exec:\tnnbht.exe71⤵PID:2160
-
\??\c:\vjvvp.exec:\vjvvp.exe72⤵PID:1580
-
\??\c:\jvjjp.exec:\jvjjp.exe73⤵PID:2764
-
\??\c:\7xrxxfl.exec:\7xrxxfl.exe74⤵PID:1548
-
\??\c:\7tbhhh.exec:\7tbhhh.exe75⤵PID:2888
-
\??\c:\jjvdj.exec:\jjvdj.exe76⤵PID:2736
-
\??\c:\lfrrffl.exec:\lfrrffl.exe77⤵PID:2560
-
\??\c:\hhbntt.exec:\hhbntt.exe78⤵PID:3004
-
\??\c:\tnhhtt.exec:\tnhhtt.exe79⤵PID:2528
-
\??\c:\vpjpd.exec:\vpjpd.exe80⤵PID:2576
-
\??\c:\7lrlrrx.exec:\7lrlrrx.exe81⤵PID:2712
-
\??\c:\bbnntn.exec:\bbnntn.exe82⤵PID:2040
-
\??\c:\tnthht.exec:\tnthht.exe83⤵PID:1888
-
\??\c:\7jjpp.exec:\7jjpp.exe84⤵PID:2380
-
\??\c:\jdpvp.exec:\jdpvp.exe85⤵PID:1264
-
\??\c:\xrllxxr.exec:\xrllxxr.exe86⤵PID:2372
-
\??\c:\tbntbn.exec:\tbntbn.exe87⤵PID:2388
-
\??\c:\vvppv.exec:\vvppv.exe88⤵PID:1280
-
\??\c:\9jvvd.exec:\9jvvd.exe89⤵PID:1828
-
\??\c:\rlfflrl.exec:\rlfflrl.exe90⤵PID:1096
-
\??\c:\bthntb.exec:\bthntb.exe91⤵PID:400
-
\??\c:\nhbhhn.exec:\nhbhhn.exe92⤵PID:2932
-
\??\c:\pjjpv.exec:\pjjpv.exe93⤵PID:2744
-
\??\c:\ffxfllx.exec:\ffxfllx.exe94⤵PID:1104
-
\??\c:\rlflrxl.exec:\rlflrxl.exe95⤵PID:2892
-
\??\c:\5bnthb.exec:\5bnthb.exe96⤵PID:1748
-
\??\c:\dvdvj.exec:\dvdvj.exe97⤵PID:2060
-
\??\c:\xfrxlrf.exec:\xfrxlrf.exe98⤵PID:2904
-
\??\c:\xrrlrlx.exec:\xrrlrlx.exe99⤵PID:2080
-
\??\c:\hhtbtb.exec:\hhtbtb.exe100⤵PID:868
-
\??\c:\vvvdv.exec:\vvvdv.exe101⤵PID:408
-
\??\c:\3rfflrr.exec:\3rfflrr.exe102⤵PID:952
-
\??\c:\llxrxrf.exec:\llxrxrf.exe103⤵PID:1656
-
\??\c:\tthnbb.exec:\tthnbb.exe104⤵PID:860
-
\??\c:\5djjp.exec:\5djjp.exe105⤵PID:1792
-
\??\c:\7jvjp.exec:\7jvjp.exe106⤵PID:2076
-
\??\c:\rrllxxl.exec:\rrllxxl.exe107⤵PID:1536
-
\??\c:\bbtthn.exec:\bbtthn.exe108⤵PID:2212
-
\??\c:\nnhhtn.exec:\nnhhtn.exe109⤵PID:1824
-
\??\c:\ppddp.exec:\ppddp.exe110⤵PID:1052
-
\??\c:\3xrrxfr.exec:\3xrrxfr.exe111⤵PID:1032
-
\??\c:\tnhhnt.exec:\tnhhnt.exe112⤵PID:816
-
\??\c:\hhbnbh.exec:\hhbnbh.exe113⤵PID:3052
-
\??\c:\vpdjp.exec:\vpdjp.exe114⤵PID:2668
-
\??\c:\xrllrrl.exec:\xrllrrl.exe115⤵PID:3048
-
\??\c:\rlrxfrr.exec:\rlrxfrr.exe116⤵PID:1548
-
\??\c:\1ththt.exec:\1ththt.exe117⤵PID:3040
-
\??\c:\dvppd.exec:\dvppd.exe118⤵PID:2848
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe119⤵PID:2560
-
\??\c:\hbttht.exec:\hbttht.exe120⤵PID:2532
-
\??\c:\dvppd.exec:\dvppd.exe121⤵PID:2240
-
\??\c:\xrlrxlr.exec:\xrlrxlr.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-