Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 06:21
Static task
static1
Behavioral task
behavioral1
Sample
6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe
Resource
win7-20240903-en
General
-
Target
6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe
-
Size
333KB
-
MD5
84c3778c521586e189a19d55923d8720
-
SHA1
d9781d0bb595cc85be56d5c3cbf68e17f76713e0
-
SHA256
6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1
-
SHA512
e12a0c612decaf0862041f94697ae8b9a6a7daeffb01ec4c0cde8bc4a5d74a49edca018cecee87ded7b9bb9a09a480d6d344fe4bc7ac6d3ee065e5a2ab42f72a
-
SSDEEP
6144:3cm7ImGddXsJdJIjaRleL42bL37BoTPkhu9gX5yGsTshQc8R0nxA5ij8+RC7tPhO:F7Tc8JdSjylh2b77BoTMA9gX59sTsuT+
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/1480-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-176-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-301-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2856-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-509-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/736-517-0x00000000002F0000-0x000000000031A000-memory.dmp family_blackmoon behavioral1/memory/3048-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-582-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2604-624-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2756-654-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2092-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-240-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-233-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/328-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-213-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/576-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-170-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-161-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1000-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/328-775-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1616 djvbfpd.exe 2536 hrdlh.exe 2908 fbndb.exe 2740 xrnft.exe 2892 dvlhp.exe 2816 bhjhrt.exe 1036 fhhjhr.exe 2760 nvfrlxh.exe 2608 nxtxjbh.exe 964 xxplj.exe 2576 dnnltl.exe 2956 pdprfxv.exe 2376 dhrxd.exe 2524 fxlrfl.exe 1144 xpbtv.exe 1000 pphhdbv.exe 2772 rfhfdjl.exe 2240 brrdxtb.exe 676 dhbjh.exe 576 xjtlrx.exe 1952 dfxpljn.exe 736 nttfxlp.exe 328 tvppbn.exe 1940 tnfxfxv.exe 1672 lhvxxrx.exe 1968 lbhtnp.exe 592 prbvnv.exe 3036 nbbjp.exe 3048 bttvj.exe 2676 tbtvpvb.exe 2124 vjhxt.exe 1976 xvjdd.exe 1604 vxbtv.exe 2780 lrdln.exe 2540 vbfjpb.exe 2752 dxbrxd.exe 2888 dbfhvl.exe 2304 djlbbvh.exe 2728 xtnph.exe 2764 xlvnt.exe 2912 rvtvr.exe 2808 ljbxbf.exe 3064 xjxxl.exe 2488 hfnnxj.exe 528 nrvrxd.exe 1724 bjlnrb.exe 2376 prtjhd.exe 2092 nlbjvlj.exe 2856 tthnd.exe 2128 djhvt.exe 1180 xpxbv.exe 2924 hptlr.exe 1000 pnnhntd.exe 2212 fvfdht.exe 560 dnltx.exe 2368 dnrrxp.exe 1508 fjptbx.exe 2272 lhpphd.exe 1860 bffxtf.exe 2392 vtxbfx.exe 736 rjfbx.exe 764 jhvxb.exe 1676 drltb.exe 756 njhft.exe -
resource yara_rule behavioral1/memory/1480-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/736-213-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/576-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-170-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-35-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjltj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpjfvjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvppt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfjnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrftbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frjvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxblhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txxnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thrft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phhdhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpbfdnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrdbbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdtbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fbdbvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlvnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxpdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvldh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfbvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvplhxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phvjhjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xptlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnhjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltfpxt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dtjfh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldlpfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhvxxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldbxjnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phvrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdxljn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvvxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhltbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1480 wrote to memory of 1616 1480 6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe 29 PID 1480 wrote to memory of 1616 1480 6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe 29 PID 1480 wrote to memory of 1616 1480 6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe 29 PID 1480 wrote to memory of 1616 1480 6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe 29 PID 1616 wrote to memory of 2536 1616 djvbfpd.exe 30 PID 1616 wrote to memory of 2536 1616 djvbfpd.exe 30 PID 1616 wrote to memory of 2536 1616 djvbfpd.exe 30 PID 1616 wrote to memory of 2536 1616 djvbfpd.exe 30 PID 2536 wrote to memory of 2908 2536 hrdlh.exe 31 PID 2536 wrote to memory of 2908 2536 hrdlh.exe 31 PID 2536 wrote to memory of 2908 2536 hrdlh.exe 31 PID 2536 wrote to memory of 2908 2536 hrdlh.exe 31 PID 2908 wrote to memory of 2740 2908 fbndb.exe 32 PID 2908 wrote to memory of 2740 2908 fbndb.exe 32 PID 2908 wrote to memory of 2740 2908 fbndb.exe 32 PID 2908 wrote to memory of 2740 2908 fbndb.exe 32 PID 2740 wrote to memory of 2892 2740 xrnft.exe 33 PID 2740 wrote to memory of 2892 2740 xrnft.exe 33 PID 2740 wrote to memory of 2892 2740 xrnft.exe 33 PID 2740 wrote to memory of 2892 2740 xrnft.exe 33 PID 2892 wrote to memory of 2816 2892 dvlhp.exe 34 PID 2892 wrote to memory of 2816 2892 dvlhp.exe 34 PID 2892 wrote to memory of 2816 2892 dvlhp.exe 34 PID 2892 wrote to memory of 2816 2892 dvlhp.exe 34 PID 2816 wrote to memory of 1036 2816 bhjhrt.exe 35 PID 2816 wrote to memory of 1036 2816 bhjhrt.exe 35 PID 2816 wrote to memory of 1036 2816 bhjhrt.exe 35 PID 2816 wrote to memory of 1036 2816 bhjhrt.exe 35 PID 1036 wrote to memory of 2760 1036 fhhjhr.exe 36 PID 1036 wrote to memory of 2760 1036 fhhjhr.exe 36 PID 1036 wrote to memory of 2760 1036 fhhjhr.exe 36 PID 1036 wrote to memory of 2760 1036 fhhjhr.exe 36 PID 2760 wrote to memory of 2608 2760 nvfrlxh.exe 37 PID 2760 wrote to memory of 2608 2760 nvfrlxh.exe 37 PID 2760 wrote to memory of 2608 2760 nvfrlxh.exe 37 PID 2760 wrote to memory of 2608 2760 nvfrlxh.exe 37 PID 2608 wrote to memory of 964 2608 nxtxjbh.exe 38 PID 2608 wrote to memory of 964 2608 nxtxjbh.exe 38 PID 2608 wrote to memory of 964 2608 nxtxjbh.exe 38 PID 2608 wrote to memory of 964 2608 nxtxjbh.exe 38 PID 964 wrote to memory of 2576 964 xxplj.exe 39 PID 964 wrote to memory of 2576 964 xxplj.exe 39 PID 964 wrote to memory of 2576 964 xxplj.exe 39 PID 964 wrote to memory of 2576 964 xxplj.exe 39 PID 2576 wrote to memory of 2956 2576 dnnltl.exe 114 PID 2576 wrote to memory of 2956 2576 dnnltl.exe 114 PID 2576 wrote to memory of 2956 2576 dnnltl.exe 114 PID 2576 wrote to memory of 2956 2576 dnnltl.exe 114 PID 2956 wrote to memory of 2376 2956 pdprfxv.exe 75 PID 2956 wrote to memory of 2376 2956 pdprfxv.exe 75 PID 2956 wrote to memory of 2376 2956 pdprfxv.exe 75 PID 2956 wrote to memory of 2376 2956 pdprfxv.exe 75 PID 2376 wrote to memory of 2524 2376 dhrxd.exe 42 PID 2376 wrote to memory of 2524 2376 dhrxd.exe 42 PID 2376 wrote to memory of 2524 2376 dhrxd.exe 42 PID 2376 wrote to memory of 2524 2376 dhrxd.exe 42 PID 2524 wrote to memory of 1144 2524 fxlrfl.exe 43 PID 2524 wrote to memory of 1144 2524 fxlrfl.exe 43 PID 2524 wrote to memory of 1144 2524 fxlrfl.exe 43 PID 2524 wrote to memory of 1144 2524 fxlrfl.exe 43 PID 1144 wrote to memory of 1000 1144 xpbtv.exe 81 PID 1144 wrote to memory of 1000 1144 xpbtv.exe 81 PID 1144 wrote to memory of 1000 1144 xpbtv.exe 81 PID 1144 wrote to memory of 1000 1144 xpbtv.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe"C:\Users\Admin\AppData\Local\Temp\6165bcc27e21c5ee5a7d23aeec66436bd0111a99aafe77367970972b060d97d1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\djvbfpd.exec:\djvbfpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hrdlh.exec:\hrdlh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\fbndb.exec:\fbndb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\xrnft.exec:\xrnft.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dvlhp.exec:\dvlhp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\bhjhrt.exec:\bhjhrt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fhhjhr.exec:\fhhjhr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\nvfrlxh.exec:\nvfrlxh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nxtxjbh.exec:\nxtxjbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xxplj.exec:\xxplj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\dnnltl.exec:\dnnltl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pdprfxv.exec:\pdprfxv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\dhrxd.exec:\dhrxd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\fxlrfl.exec:\fxlrfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\xpbtv.exec:\xpbtv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\pphhdbv.exec:\pphhdbv.exe17⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rfhfdjl.exec:\rfhfdjl.exe18⤵
- Executes dropped EXE
PID:2772 -
\??\c:\brrdxtb.exec:\brrdxtb.exe19⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dhbjh.exec:\dhbjh.exe20⤵
- Executes dropped EXE
PID:676 -
\??\c:\xjtlrx.exec:\xjtlrx.exe21⤵
- Executes dropped EXE
PID:576 -
\??\c:\dfxpljn.exec:\dfxpljn.exe22⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nttfxlp.exec:\nttfxlp.exe23⤵
- Executes dropped EXE
PID:736 -
\??\c:\tvppbn.exec:\tvppbn.exe24⤵
- Executes dropped EXE
PID:328 -
\??\c:\tnfxfxv.exec:\tnfxfxv.exe25⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lhvxxrx.exec:\lhvxxrx.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1672 -
\??\c:\lbhtnp.exec:\lbhtnp.exe27⤵
- Executes dropped EXE
PID:1968 -
\??\c:\prbvnv.exec:\prbvnv.exe28⤵
- Executes dropped EXE
PID:592 -
\??\c:\nbbjp.exec:\nbbjp.exe29⤵
- Executes dropped EXE
PID:3036 -
\??\c:\bttvj.exec:\bttvj.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tbtvpvb.exec:\tbtvpvb.exe31⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vjhxt.exec:\vjhxt.exe32⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xvjdd.exec:\xvjdd.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\vxbtv.exec:\vxbtv.exe34⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lrdln.exec:\lrdln.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vbfjpb.exec:\vbfjpb.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dxbrxd.exec:\dxbrxd.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\dbfhvl.exec:\dbfhvl.exe38⤵
- Executes dropped EXE
PID:2888 -
\??\c:\djlbbvh.exec:\djlbbvh.exe39⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xtnph.exec:\xtnph.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xlvnt.exec:\xlvnt.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2764 -
\??\c:\rvtvr.exec:\rvtvr.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ljbxbf.exec:\ljbxbf.exe43⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xjxxl.exec:\xjxxl.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hfnnxj.exec:\hfnnxj.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nrvrxd.exec:\nrvrxd.exe46⤵
- Executes dropped EXE
PID:528 -
\??\c:\bjlnrb.exec:\bjlnrb.exe47⤵
- Executes dropped EXE
PID:1724 -
\??\c:\prtjhd.exec:\prtjhd.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nlbjvlj.exec:\nlbjvlj.exe49⤵
- Executes dropped EXE
PID:2092 -
\??\c:\tthnd.exec:\tthnd.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\djhvt.exec:\djhvt.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xpxbv.exec:\xpxbv.exe52⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hptlr.exec:\hptlr.exe53⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pnnhntd.exec:\pnnhntd.exe54⤵
- Executes dropped EXE
PID:1000 -
\??\c:\fvfdht.exec:\fvfdht.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\dnltx.exec:\dnltx.exe56⤵
- Executes dropped EXE
PID:560 -
\??\c:\dnrrxp.exec:\dnrrxp.exe57⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fjptbx.exec:\fjptbx.exe58⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lhpphd.exec:\lhpphd.exe59⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bffxtf.exec:\bffxtf.exe60⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vtxbfx.exec:\vtxbfx.exe61⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rjfbx.exec:\rjfbx.exe62⤵
- Executes dropped EXE
PID:736 -
\??\c:\jhvxb.exec:\jhvxb.exe63⤵
- Executes dropped EXE
PID:764 -
\??\c:\drltb.exec:\drltb.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\njhft.exec:\njhft.exe65⤵
- Executes dropped EXE
PID:756 -
\??\c:\nrpht.exec:\nrpht.exe66⤵PID:1968
-
\??\c:\jljxbn.exec:\jljxbn.exe67⤵PID:592
-
\??\c:\dbhdxp.exec:\dbhdxp.exe68⤵PID:2980
-
\??\c:\lpjrlff.exec:\lpjrlff.exe69⤵PID:3048
-
\??\c:\hptxphb.exec:\hptxphb.exe70⤵PID:684
-
\??\c:\drjpxdx.exec:\drjpxdx.exe71⤵PID:2904
-
\??\c:\vlddhbx.exec:\vlddhbx.exe72⤵PID:1652
-
\??\c:\ljvrtxx.exec:\ljvrtxx.exe73⤵PID:2332
-
\??\c:\jdbptx.exec:\jdbptx.exe74⤵PID:2148
-
\??\c:\httrtxj.exec:\httrtxj.exe75⤵PID:2688
-
\??\c:\bnnptpj.exec:\bnnptpj.exe76⤵PID:2464
-
\??\c:\vxbjb.exec:\vxbjb.exe77⤵PID:2748
-
\??\c:\fjtth.exec:\fjtth.exe78⤵PID:2988
-
\??\c:\xrfhfvb.exec:\xrfhfvb.exe79⤵PID:2984
-
\??\c:\dfddt.exec:\dfddt.exe80⤵PID:2520
-
\??\c:\xvhjj.exec:\xvhjj.exe81⤵PID:2880
-
\??\c:\lrhhftd.exec:\lrhhftd.exe82⤵PID:2604
-
\??\c:\dpbddv.exec:\dpbddv.exe83⤵PID:2644
-
\??\c:\nhjnl.exec:\nhjnl.exe84⤵PID:2608
-
\??\c:\vnlpdx.exec:\vnlpdx.exe85⤵PID:2808
-
\??\c:\fdxnhb.exec:\fdxnhb.exe86⤵PID:2756
-
\??\c:\hxrddhn.exec:\hxrddhn.exe87⤵PID:2956
-
\??\c:\dhvpx.exec:\dhvpx.exe88⤵PID:528
-
\??\c:\nlbpnrb.exec:\nlbpnrb.exe89⤵PID:2800
-
\??\c:\rhpdlhx.exec:\rhpdlhx.exe90⤵PID:1948
-
\??\c:\pbtrvv.exec:\pbtrvv.exe91⤵PID:2092
-
\??\c:\lvvdl.exec:\lvvdl.exe92⤵PID:2916
-
\??\c:\hrvlttf.exec:\hrvlttf.exe93⤵PID:2820
-
\??\c:\pfbdhd.exec:\pfbdhd.exe94⤵PID:2844
-
\??\c:\ntbvt.exec:\ntbvt.exe95⤵PID:2408
-
\??\c:\pdfxn.exec:\pdfxn.exe96⤵PID:2420
-
\??\c:\nrnxnbd.exec:\nrnxnbd.exe97⤵PID:2252
-
\??\c:\djprlp.exec:\djprlp.exe98⤵PID:1944
-
\??\c:\tndtxlx.exec:\tndtxlx.exe99⤵PID:1312
-
\??\c:\jldljh.exec:\jldljh.exe100⤵PID:2788
-
\??\c:\hxxhp.exec:\hxxhp.exe101⤵PID:1272
-
\??\c:\vxdrr.exec:\vxdrr.exe102⤵PID:460
-
\??\c:\ftlrf.exec:\ftlrf.exe103⤵PID:2280
-
\??\c:\vjrbdp.exec:\vjrbdp.exe104⤵PID:328
-
\??\c:\vxhddrb.exec:\vxhddrb.exe105⤵PID:1672
-
\??\c:\tvbnl.exec:\tvbnl.exe106⤵PID:3028
-
\??\c:\rjjvtxd.exec:\rjjvtxd.exe107⤵PID:1968
-
\??\c:\tvxfjhx.exec:\tvxfjhx.exe108⤵PID:592
-
\??\c:\fpbfdnv.exec:\fpbfdnv.exe109⤵
- System Location Discovery: System Language Discovery
PID:868 -
\??\c:\bxbldjx.exec:\bxbldjx.exe110⤵PID:1840
-
\??\c:\nxblhp.exec:\nxblhp.exe111⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\jtdtrr.exec:\jtdtrr.exe112⤵PID:2336
-
\??\c:\plhvp.exec:\plhvp.exe113⤵PID:1856
-
\??\c:\vrjxjj.exec:\vrjxjj.exe114⤵PID:1604
-
\??\c:\hrrjd.exec:\hrrjd.exe115⤵PID:2908
-
\??\c:\nfbldh.exec:\nfbldh.exe116⤵PID:2292
-
\??\c:\vjbvb.exec:\vjbvb.exe117⤵PID:2540
-
\??\c:\pxtndnd.exec:\pxtndnd.exe118⤵PID:2248
-
\??\c:\jvtxhj.exec:\jvtxhj.exe119⤵PID:1084
-
\??\c:\bfrdf.exec:\bfrdf.exe120⤵PID:2620
-
\??\c:\fpxfhfh.exec:\fpxfhfh.exe121⤵PID:1324
-
\??\c:\xvvntvx.exec:\xvvntvx.exe122⤵PID:2764
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-