Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 06:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe
-
Size
453KB
-
MD5
a9a3bf7ea50a25aacaf724caabf48f40
-
SHA1
c0957404600daf9e4216a297b1d710813c5b54a2
-
SHA256
59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fd
-
SHA512
1077e3103cc859e7bf5b74208046205c07fe1f24d50e8ba6ac6504f4b4487413b2f2b4157fc90df48465e5df83f82d5dadf9948baa74373616d66ea78215df81
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeW:q7Tc2NYHUrAwfMp3CDW
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-372-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2356-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-471-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-647-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1800-646-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2176-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-985-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1724-1030-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2836-1104-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2700 xxflxfx.exe 2824 vdpdd.exe 2720 9xlxxxr.exe 2780 btbntb.exe 1828 1xxrfff.exe 2624 vpddj.exe 1352 1rfxllf.exe 812 pjpvp.exe 2936 vpdpv.exe 3048 tnhtnb.exe 2628 1jpjd.exe 1660 hnntbh.exe 1648 djdpv.exe 2016 nhnthn.exe 2368 dpjpv.exe 1580 pppdp.exe 1676 rrxlfrr.exe 2540 7jjdj.exe 2492 fxrfxfr.exe 1844 1pvdd.exe 1144 rlfllfx.exe 700 ppjvj.exe 2024 9xxfrxl.exe 2156 lfxlrxr.exe 2064 nnhnbb.exe 1756 fxlxxrl.exe 1008 3bbntb.exe 672 vvvjd.exe 1612 3btnhn.exe 2856 1jjvj.exe 1704 hbnthn.exe 2704 ffxxllx.exe 2824 hbthtb.exe 2564 pjdjd.exe 2724 rlxlxfl.exe 2732 nhthnt.exe 2604 nhhtnb.exe 2588 vdvdp.exe 2624 lfxrflf.exe 1112 nbttbt.exe 2944 vpjvp.exe 1716 xrflflr.exe 2936 nthbtn.exe 2616 pdvvv.exe 2356 1ddpv.exe 304 3lxrlrf.exe 992 thbbnn.exe 2020 vvjjd.exe 588 lxxxxxl.exe 2888 rxrxflx.exe 2368 bbthbb.exe 1760 5dpvp.exe 3008 fxxxxrf.exe 1676 hthhnn.exe 2960 nnbhnt.exe 2204 pppjp.exe 2512 llxfrrf.exe 2140 bbbbbh.exe 2496 nhhhtt.exe 908 5vdjv.exe 1744 xffflll.exe 2472 bhbhhn.exe 2380 9djpp.exe 2336 lffxlrf.exe -
resource yara_rule behavioral1/memory/2432-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-646-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2176-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1208-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1flxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2700 2432 59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe 31 PID 2432 wrote to memory of 2700 2432 59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe 31 PID 2432 wrote to memory of 2700 2432 59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe 31 PID 2432 wrote to memory of 2700 2432 59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe 31 PID 2700 wrote to memory of 2824 2700 xxflxfx.exe 32 PID 2700 wrote to memory of 2824 2700 xxflxfx.exe 32 PID 2700 wrote to memory of 2824 2700 xxflxfx.exe 32 PID 2700 wrote to memory of 2824 2700 xxflxfx.exe 32 PID 2824 wrote to memory of 2720 2824 vdpdd.exe 33 PID 2824 wrote to memory of 2720 2824 vdpdd.exe 33 PID 2824 wrote to memory of 2720 2824 vdpdd.exe 33 PID 2824 wrote to memory of 2720 2824 vdpdd.exe 33 PID 2720 wrote to memory of 2780 2720 9xlxxxr.exe 34 PID 2720 wrote to memory of 2780 2720 9xlxxxr.exe 34 PID 2720 wrote to memory of 2780 2720 9xlxxxr.exe 34 PID 2720 wrote to memory of 2780 2720 9xlxxxr.exe 34 PID 2780 wrote to memory of 1828 2780 btbntb.exe 35 PID 2780 wrote to memory of 1828 2780 btbntb.exe 35 PID 2780 wrote to memory of 1828 2780 btbntb.exe 35 PID 2780 wrote to memory of 1828 2780 btbntb.exe 35 PID 1828 wrote to memory of 2624 1828 1xxrfff.exe 36 PID 1828 wrote to memory of 2624 1828 1xxrfff.exe 36 PID 1828 wrote to memory of 2624 1828 1xxrfff.exe 36 PID 1828 wrote to memory of 2624 1828 1xxrfff.exe 36 PID 2624 wrote to memory of 1352 2624 vpddj.exe 37 PID 2624 wrote to memory of 1352 2624 vpddj.exe 37 PID 2624 wrote to memory of 1352 2624 vpddj.exe 37 PID 2624 wrote to memory of 1352 2624 vpddj.exe 37 PID 1352 wrote to memory of 812 1352 1rfxllf.exe 38 PID 1352 wrote to memory of 812 1352 1rfxllf.exe 38 PID 1352 wrote to memory of 812 1352 1rfxllf.exe 38 PID 1352 wrote to memory of 812 1352 1rfxllf.exe 38 PID 812 wrote to memory of 2936 812 pjpvp.exe 39 PID 812 wrote to memory of 2936 812 pjpvp.exe 39 PID 812 wrote to memory of 2936 812 pjpvp.exe 39 PID 812 wrote to memory of 2936 812 pjpvp.exe 39 PID 2936 wrote to memory of 3048 2936 vpdpv.exe 40 PID 2936 wrote to memory of 3048 2936 vpdpv.exe 40 PID 2936 wrote to memory of 3048 2936 vpdpv.exe 40 PID 2936 wrote to memory of 3048 2936 vpdpv.exe 40 PID 3048 wrote to memory of 2628 3048 tnhtnb.exe 41 PID 3048 wrote to memory of 2628 3048 tnhtnb.exe 41 PID 3048 wrote to memory of 2628 3048 tnhtnb.exe 41 PID 3048 wrote to memory of 2628 3048 tnhtnb.exe 41 PID 2628 wrote to memory of 1660 2628 1jpjd.exe 42 PID 2628 wrote to memory of 1660 2628 1jpjd.exe 42 PID 2628 wrote to memory of 1660 2628 1jpjd.exe 42 PID 2628 wrote to memory of 1660 2628 1jpjd.exe 42 PID 1660 wrote to memory of 1648 1660 hnntbh.exe 43 PID 1660 wrote to memory of 1648 1660 hnntbh.exe 43 PID 1660 wrote to memory of 1648 1660 hnntbh.exe 43 PID 1660 wrote to memory of 1648 1660 hnntbh.exe 43 PID 1648 wrote to memory of 2016 1648 djdpv.exe 44 PID 1648 wrote to memory of 2016 1648 djdpv.exe 44 PID 1648 wrote to memory of 2016 1648 djdpv.exe 44 PID 1648 wrote to memory of 2016 1648 djdpv.exe 44 PID 2016 wrote to memory of 2368 2016 nhnthn.exe 45 PID 2016 wrote to memory of 2368 2016 nhnthn.exe 45 PID 2016 wrote to memory of 2368 2016 nhnthn.exe 45 PID 2016 wrote to memory of 2368 2016 nhnthn.exe 45 PID 2368 wrote to memory of 1580 2368 dpjpv.exe 46 PID 2368 wrote to memory of 1580 2368 dpjpv.exe 46 PID 2368 wrote to memory of 1580 2368 dpjpv.exe 46 PID 2368 wrote to memory of 1580 2368 dpjpv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe"C:\Users\Admin\AppData\Local\Temp\59c5f8df0e322c415f2ab1b58460094d05660e2fbef766e6820f65fc8ecb88fdN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xxflxfx.exec:\xxflxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vdpdd.exec:\vdpdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9xlxxxr.exec:\9xlxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\btbntb.exec:\btbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\1xxrfff.exec:\1xxrfff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\vpddj.exec:\vpddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\1rfxllf.exec:\1rfxllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\pjpvp.exec:\pjpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\vpdpv.exec:\vpdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\tnhtnb.exec:\tnhtnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\1jpjd.exec:\1jpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\hnntbh.exec:\hnntbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\djdpv.exec:\djdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\nhnthn.exec:\nhnthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dpjpv.exec:\dpjpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\pppdp.exec:\pppdp.exe17⤵
- Executes dropped EXE
PID:1580 -
\??\c:\rrxlfrr.exec:\rrxlfrr.exe18⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7jjdj.exec:\7jjdj.exe19⤵
- Executes dropped EXE
PID:2540 -
\??\c:\fxrfxfr.exec:\fxrfxfr.exe20⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1pvdd.exec:\1pvdd.exe21⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rlfllfx.exec:\rlfllfx.exe22⤵
- Executes dropped EXE
PID:1144 -
\??\c:\ppjvj.exec:\ppjvj.exe23⤵
- Executes dropped EXE
PID:700 -
\??\c:\9xxfrxl.exec:\9xxfrxl.exe24⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfxlrxr.exec:\lfxlrxr.exe25⤵
- Executes dropped EXE
PID:2156 -
\??\c:\nnhnbb.exec:\nnhnbb.exe26⤵
- Executes dropped EXE
PID:2064 -
\??\c:\fxlxxrl.exec:\fxlxxrl.exe27⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3bbntb.exec:\3bbntb.exe28⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vvvjd.exec:\vvvjd.exe29⤵
- Executes dropped EXE
PID:672 -
\??\c:\3btnhn.exec:\3btnhn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1612 -
\??\c:\1jjvj.exec:\1jjvj.exe31⤵
- Executes dropped EXE
PID:2856 -
\??\c:\hbnthn.exec:\hbnthn.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ffxxllx.exec:\ffxxllx.exe33⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hbthtb.exec:\hbthtb.exe34⤵
- Executes dropped EXE
PID:2824 -
\??\c:\pjdjd.exec:\pjdjd.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\rlxlxfl.exec:\rlxlxfl.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nhthnt.exec:\nhthnt.exe37⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nhhtnb.exec:\nhhtnb.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\vdvdp.exec:\vdvdp.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lfxrflf.exec:\lfxrflf.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbttbt.exec:\nbttbt.exe41⤵
- Executes dropped EXE
PID:1112 -
\??\c:\vpjvp.exec:\vpjvp.exe42⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xrflflr.exec:\xrflflr.exe43⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nthbtn.exec:\nthbtn.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\pdvvv.exec:\pdvvv.exe45⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1ddpv.exec:\1ddpv.exe46⤵
- Executes dropped EXE
PID:2356 -
\??\c:\3lxrlrf.exec:\3lxrlrf.exe47⤵
- Executes dropped EXE
PID:304 -
\??\c:\thbbnn.exec:\thbbnn.exe48⤵
- Executes dropped EXE
PID:992 -
\??\c:\vvjjd.exec:\vvjjd.exe49⤵
- Executes dropped EXE
PID:2020 -
\??\c:\lxxxxxl.exec:\lxxxxxl.exe50⤵
- Executes dropped EXE
PID:588 -
\??\c:\rxrxflx.exec:\rxrxflx.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bbthbb.exec:\bbthbb.exe52⤵
- Executes dropped EXE
PID:2368 -
\??\c:\5dpvp.exec:\5dpvp.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\fxxxxrf.exec:\fxxxxrf.exe54⤵
- Executes dropped EXE
PID:3008 -
\??\c:\hthhnn.exec:\hthhnn.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1676 -
\??\c:\nnbhnt.exec:\nnbhnt.exe56⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pppjp.exec:\pppjp.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\llxfrrf.exec:\llxfrrf.exe58⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bbbbbh.exec:\bbbbbh.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhhhtt.exec:\nhhhtt.exe60⤵
- Executes dropped EXE
PID:2496 -
\??\c:\5vdjv.exec:\5vdjv.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\xffflll.exec:\xffflll.exe62⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bhbhhn.exec:\bhbhhn.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9djpp.exec:\9djpp.exe64⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lffxlrf.exec:\lffxlrf.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nbtbhn.exec:\nbtbhn.exe66⤵PID:3032
-
\??\c:\dvpvj.exec:\dvpvj.exe67⤵PID:2240
-
\??\c:\xxlrxfx.exec:\xxlrxfx.exe68⤵PID:1420
-
\??\c:\hbntnt.exec:\hbntnt.exe69⤵PID:1520
-
\??\c:\9dvjd.exec:\9dvjd.exe70⤵PID:1000
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe71⤵PID:2668
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe72⤵PID:2708
-
\??\c:\bthnbb.exec:\bthnbb.exe73⤵PID:1704
-
\??\c:\jdpdp.exec:\jdpdp.exe74⤵PID:2984
-
\??\c:\xrxfffl.exec:\xrxfffl.exe75⤵PID:2304
-
\??\c:\htbhtn.exec:\htbhtn.exe76⤵PID:2932
-
\??\c:\ppdjv.exec:\ppdjv.exe77⤵PID:2672
-
\??\c:\1vvjd.exec:\1vvjd.exe78⤵
- System Location Discovery: System Language Discovery
PID:2568 -
\??\c:\9llxffr.exec:\9llxffr.exe79⤵PID:2728
-
\??\c:\hbhntt.exec:\hbhntt.exe80⤵PID:2400
-
\??\c:\3hnnbh.exec:\3hnnbh.exe81⤵PID:2248
-
\??\c:\pvjdd.exec:\pvjdd.exe82⤵PID:1484
-
\??\c:\lfrxffr.exec:\lfrxffr.exe83⤵PID:812
-
\??\c:\1bbhtb.exec:\1bbhtb.exe84⤵PID:2952
-
\??\c:\hhbhnt.exec:\hhbhnt.exe85⤵PID:1800
-
\??\c:\pjdjv.exec:\pjdjv.exe86⤵PID:1052
-
\??\c:\fllxxlx.exec:\fllxxlx.exe87⤵PID:2912
-
\??\c:\bbbbtb.exec:\bbbbtb.exe88⤵PID:1660
-
\??\c:\bnnbbh.exec:\bnnbbh.exe89⤵PID:1648
-
\??\c:\3dvvd.exec:\3dvvd.exe90⤵PID:1100
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe91⤵PID:2876
-
\??\c:\3tnbbb.exec:\3tnbbb.exe92⤵PID:588
-
\??\c:\bhnbnb.exec:\bhnbnb.exe93⤵PID:2176
-
\??\c:\5xrrxxl.exec:\5xrrxxl.exe94⤵PID:2792
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe95⤵PID:1864
-
\??\c:\tnnthh.exec:\tnnthh.exe96⤵PID:1072
-
\??\c:\vjvvp.exec:\vjvvp.exe97⤵PID:1416
-
\??\c:\fxrxflx.exec:\fxrxflx.exe98⤵PID:1488
-
\??\c:\9ththn.exec:\9ththn.exe99⤵PID:112
-
\??\c:\5vdjp.exec:\5vdjp.exe100⤵PID:2396
-
\??\c:\pjvdj.exec:\pjvdj.exe101⤵PID:1144
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe102⤵PID:1784
-
\??\c:\thntbt.exec:\thntbt.exe103⤵PID:908
-
\??\c:\tntbnt.exec:\tntbnt.exe104⤵PID:1744
-
\??\c:\pdpdj.exec:\pdpdj.exe105⤵PID:2472
-
\??\c:\9rxlffx.exec:\9rxlffx.exe106⤵PID:620
-
\??\c:\hbttbb.exec:\hbttbb.exe107⤵PID:2336
-
\??\c:\9djjd.exec:\9djjd.exe108⤵PID:2148
-
\??\c:\hbbhtt.exec:\hbbhtt.exe109⤵PID:2104
-
\??\c:\bbnbtt.exec:\bbnbtt.exe110⤵PID:2640
-
\??\c:\vpdpd.exec:\vpdpd.exe111⤵PID:1520
-
\??\c:\fxllffr.exec:\fxllffr.exe112⤵PID:2788
-
\??\c:\bttntt.exec:\bttntt.exe113⤵PID:2764
-
\??\c:\tnttbb.exec:\tnttbb.exe114⤵PID:2692
-
\??\c:\ddvjd.exec:\ddvjd.exe115⤵PID:2776
-
\??\c:\5rlxlrr.exec:\5rlxlrr.exe116⤵PID:2688
-
\??\c:\hbntbn.exec:\hbntbn.exe117⤵PID:2848
-
\??\c:\vvjvv.exec:\vvjvv.exe118⤵PID:2864
-
\??\c:\ppppv.exec:\ppppv.exe119⤵PID:2828
-
\??\c:\rllrxfr.exec:\rllrxfr.exe120⤵PID:1828
-
\??\c:\ttthbb.exec:\ttthbb.exe121⤵PID:2604
-
\??\c:\hnntnb.exec:\hnntnb.exe122⤵PID:2588
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-