Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe
-
Size
453KB
-
MD5
cc4d46815384798476dfe3a17633726f
-
SHA1
da32d8c42958b8c85cc8f98d8b67743c21ac1caa
-
SHA256
c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b
-
SHA512
c8b147afac53acba404e8b00fd1c3a12881e65cbd8f4938b054878429598a7c5631efc758c98dd159728b63dbfd6ed45acd575fd2084324e350206fd08cc4b87
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeM:q7Tc2NYHUrAwfMp3CDM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2180-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-111-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1088-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1300-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1272-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/464-215-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2496-92-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/956-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-370-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2808-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-562-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-598-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-610-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2504-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-714-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-878-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-910-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2216-958-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2600 nnnhtb.exe 2696 jdvjj.exe 2348 rlfflrx.exe 2668 9nttnn.exe 2532 xxlxflx.exe 2564 dpvpv.exe 808 bbnbnt.exe 3048 pvppv.exe 2496 ttnthb.exe 2832 vvvjd.exe 2956 7lflrfl.exe 1300 5pvjp.exe 1088 tttnhn.exe 1632 pvjjv.exe 1684 rrlxrxl.exe 1272 htnntb.exe 1764 jddjj.exe 2848 7hhnbn.exe 2548 9pdpv.exe 1580 rlllrxl.exe 1688 3lllffr.exe 464 rllxrxr.exe 1044 vppvp.exe 1696 vvjvd.exe 1352 7vvvd.exe 956 lllfrrl.exe 1000 bttbhn.exe 2436 5ppdp.exe 2420 lfxlxfr.exe 1980 ddvvj.exe 1508 xxrxllx.exe 2168 htnnbh.exe 2652 3jdjv.exe 2708 fxlrlrr.exe 1708 5btbhn.exe 2612 7dpvd.exe 2348 xxrrflx.exe 2824 lrfrllf.exe 2736 1pjjj.exe 2512 3fxfllx.exe 2056 9bbtbh.exe 2388 vjdvj.exe 632 llllrxf.exe 2808 rrxrffl.exe 2752 bhhnbb.exe 2216 7dvvj.exe 2956 7ntbnn.exe 2252 djvjp.exe 1692 9lflrrf.exe 1728 3thhnt.exe 272 5dvvj.exe 592 rrfrffx.exe 1148 nnbnbt.exe 1272 jjdjv.exe 2196 lfflflf.exe 2148 rrrlflx.exe 444 btntnn.exe 2548 ddvdp.exe 3052 ffflrxf.exe 1624 hbthtb.exe 2280 tbtbbh.exe 464 3vjjv.exe 1044 rxlxrxx.exe 1680 9tnbhn.exe -
resource yara_rule behavioral1/memory/2180-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1272-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-598-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-878-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-923-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-930-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-958-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/1500-969-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2600 2180 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 30 PID 2180 wrote to memory of 2600 2180 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 30 PID 2180 wrote to memory of 2600 2180 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 30 PID 2180 wrote to memory of 2600 2180 c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe 30 PID 2600 wrote to memory of 2696 2600 nnnhtb.exe 31 PID 2600 wrote to memory of 2696 2600 nnnhtb.exe 31 PID 2600 wrote to memory of 2696 2600 nnnhtb.exe 31 PID 2600 wrote to memory of 2696 2600 nnnhtb.exe 31 PID 2696 wrote to memory of 2348 2696 jdvjj.exe 32 PID 2696 wrote to memory of 2348 2696 jdvjj.exe 32 PID 2696 wrote to memory of 2348 2696 jdvjj.exe 32 PID 2696 wrote to memory of 2348 2696 jdvjj.exe 32 PID 2348 wrote to memory of 2668 2348 rlfflrx.exe 33 PID 2348 wrote to memory of 2668 2348 rlfflrx.exe 33 PID 2348 wrote to memory of 2668 2348 rlfflrx.exe 33 PID 2348 wrote to memory of 2668 2348 rlfflrx.exe 33 PID 2668 wrote to memory of 2532 2668 9nttnn.exe 34 PID 2668 wrote to memory of 2532 2668 9nttnn.exe 34 PID 2668 wrote to memory of 2532 2668 9nttnn.exe 34 PID 2668 wrote to memory of 2532 2668 9nttnn.exe 34 PID 2532 wrote to memory of 2564 2532 xxlxflx.exe 35 PID 2532 wrote to memory of 2564 2532 xxlxflx.exe 35 PID 2532 wrote to memory of 2564 2532 xxlxflx.exe 35 PID 2532 wrote to memory of 2564 2532 xxlxflx.exe 35 PID 2564 wrote to memory of 808 2564 dpvpv.exe 36 PID 2564 wrote to memory of 808 2564 dpvpv.exe 36 PID 2564 wrote to memory of 808 2564 dpvpv.exe 36 PID 2564 wrote to memory of 808 2564 dpvpv.exe 36 PID 808 wrote to memory of 3048 808 bbnbnt.exe 37 PID 808 wrote to memory of 3048 808 bbnbnt.exe 37 PID 808 wrote to memory of 3048 808 bbnbnt.exe 37 PID 808 wrote to memory of 3048 808 bbnbnt.exe 37 PID 3048 wrote to memory of 2496 3048 pvppv.exe 38 PID 3048 wrote to memory of 2496 3048 pvppv.exe 38 PID 3048 wrote to memory of 2496 3048 pvppv.exe 38 PID 3048 wrote to memory of 2496 3048 pvppv.exe 38 PID 2496 wrote to memory of 2832 2496 ttnthb.exe 39 PID 2496 wrote to memory of 2832 2496 ttnthb.exe 39 PID 2496 wrote to memory of 2832 2496 ttnthb.exe 39 PID 2496 wrote to memory of 2832 2496 ttnthb.exe 39 PID 2832 wrote to memory of 2956 2832 vvvjd.exe 40 PID 2832 wrote to memory of 2956 2832 vvvjd.exe 40 PID 2832 wrote to memory of 2956 2832 vvvjd.exe 40 PID 2832 wrote to memory of 2956 2832 vvvjd.exe 40 PID 2956 wrote to memory of 1300 2956 7lflrfl.exe 41 PID 2956 wrote to memory of 1300 2956 7lflrfl.exe 41 PID 2956 wrote to memory of 1300 2956 7lflrfl.exe 41 PID 2956 wrote to memory of 1300 2956 7lflrfl.exe 41 PID 1300 wrote to memory of 1088 1300 5pvjp.exe 42 PID 1300 wrote to memory of 1088 1300 5pvjp.exe 42 PID 1300 wrote to memory of 1088 1300 5pvjp.exe 42 PID 1300 wrote to memory of 1088 1300 5pvjp.exe 42 PID 1088 wrote to memory of 1632 1088 tttnhn.exe 43 PID 1088 wrote to memory of 1632 1088 tttnhn.exe 43 PID 1088 wrote to memory of 1632 1088 tttnhn.exe 43 PID 1088 wrote to memory of 1632 1088 tttnhn.exe 43 PID 1632 wrote to memory of 1684 1632 pvjjv.exe 44 PID 1632 wrote to memory of 1684 1632 pvjjv.exe 44 PID 1632 wrote to memory of 1684 1632 pvjjv.exe 44 PID 1632 wrote to memory of 1684 1632 pvjjv.exe 44 PID 1684 wrote to memory of 1272 1684 rrlxrxl.exe 45 PID 1684 wrote to memory of 1272 1684 rrlxrxl.exe 45 PID 1684 wrote to memory of 1272 1684 rrlxrxl.exe 45 PID 1684 wrote to memory of 1272 1684 rrlxrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe"C:\Users\Admin\AppData\Local\Temp\c05f68db062e5fac78518762a9456b52f5f99365faaf51aee7f722587d1b539b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\nnnhtb.exec:\nnnhtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\jdvjj.exec:\jdvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rlfflrx.exec:\rlfflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\9nttnn.exec:\9nttnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\xxlxflx.exec:\xxlxflx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\dpvpv.exec:\dpvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\bbnbnt.exec:\bbnbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\pvppv.exec:\pvppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\ttnthb.exec:\ttnthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vvvjd.exec:\vvvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7lflrfl.exec:\7lflrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\5pvjp.exec:\5pvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\tttnhn.exec:\tttnhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\pvjjv.exec:\pvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rrlxrxl.exec:\rrlxrxl.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\htnntb.exec:\htnntb.exe17⤵
- Executes dropped EXE
PID:1272 -
\??\c:\jddjj.exec:\jddjj.exe18⤵
- Executes dropped EXE
PID:1764 -
\??\c:\7hhnbn.exec:\7hhnbn.exe19⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9pdpv.exec:\9pdpv.exe20⤵
- Executes dropped EXE
PID:2548 -
\??\c:\rlllrxl.exec:\rlllrxl.exe21⤵
- Executes dropped EXE
PID:1580 -
\??\c:\3lllffr.exec:\3lllffr.exe22⤵
- Executes dropped EXE
PID:1688 -
\??\c:\rllxrxr.exec:\rllxrxr.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464 -
\??\c:\vppvp.exec:\vppvp.exe24⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vvjvd.exec:\vvjvd.exe25⤵
- Executes dropped EXE
PID:1696 -
\??\c:\7vvvd.exec:\7vvvd.exe26⤵
- Executes dropped EXE
PID:1352 -
\??\c:\lllfrrl.exec:\lllfrrl.exe27⤵
- Executes dropped EXE
PID:956 -
\??\c:\bttbhn.exec:\bttbhn.exe28⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5ppdp.exec:\5ppdp.exe29⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lfxlxfr.exec:\lfxlxfr.exe30⤵
- Executes dropped EXE
PID:2420 -
\??\c:\ddvvj.exec:\ddvvj.exe31⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xxrxllx.exec:\xxrxllx.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\htnnbh.exec:\htnnbh.exe33⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3jdjv.exec:\3jdjv.exe34⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxlrlrr.exec:\fxlrlrr.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5btbhn.exec:\5btbhn.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\7dpvd.exec:\7dpvd.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\xxrrflx.exec:\xxrrflx.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lrfrllf.exec:\lrfrllf.exe39⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1pjjj.exec:\1pjjj.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\3fxfllx.exec:\3fxfllx.exe41⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9bbtbh.exec:\9bbtbh.exe42⤵
- Executes dropped EXE
PID:2056 -
\??\c:\vjdvj.exec:\vjdvj.exe43⤵
- Executes dropped EXE
PID:2388 -
\??\c:\llllrxf.exec:\llllrxf.exe44⤵
- Executes dropped EXE
PID:632 -
\??\c:\rrxrffl.exec:\rrxrffl.exe45⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bhhnbb.exec:\bhhnbb.exe46⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7dvvj.exec:\7dvvj.exe47⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7ntbnn.exec:\7ntbnn.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\djvjp.exec:\djvjp.exe49⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9lflrrf.exec:\9lflrrf.exe50⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3thhnt.exec:\3thhnt.exe51⤵
- Executes dropped EXE
PID:1728 -
\??\c:\5dvvj.exec:\5dvvj.exe52⤵
- Executes dropped EXE
PID:272 -
\??\c:\rrfrffx.exec:\rrfrffx.exe53⤵
- Executes dropped EXE
PID:592 -
\??\c:\nnbnbt.exec:\nnbnbt.exe54⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jjdjv.exec:\jjdjv.exe55⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lfflflf.exec:\lfflflf.exe56⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rrrlflx.exec:\rrrlflx.exe57⤵
- Executes dropped EXE
PID:2148 -
\??\c:\btntnn.exec:\btntnn.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\ddvdp.exec:\ddvdp.exe59⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ffflrxf.exec:\ffflrxf.exe60⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hbthtb.exec:\hbthtb.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tbtbbh.exec:\tbtbbh.exe62⤵
- Executes dropped EXE
PID:2280 -
\??\c:\3vjjv.exec:\3vjjv.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:464 -
\??\c:\rxlxrxx.exec:\rxlxrxx.exe64⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9tnbhn.exec:\9tnbhn.exe65⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1vjjp.exec:\1vjjp.exe66⤵PID:2184
-
\??\c:\lxxfrrf.exec:\lxxfrrf.exe67⤵PID:1352
-
\??\c:\thhnnb.exec:\thhnnb.exe68⤵PID:1792
-
\??\c:\hbnnbn.exec:\hbnnbn.exe69⤵PID:784
-
\??\c:\vvpvd.exec:\vvpvd.exe70⤵PID:2464
-
\??\c:\rrlffll.exec:\rrlffll.exe71⤵PID:2340
-
\??\c:\bnbhhn.exec:\bnbhhn.exe72⤵PID:1004
-
\??\c:\nhhntb.exec:\nhhntb.exe73⤵PID:3004
-
\??\c:\rrfxxxl.exec:\rrfxxxl.exe74⤵PID:2308
-
\??\c:\llllrfr.exec:\llllrfr.exe75⤵PID:2168
-
\??\c:\hbthtb.exec:\hbthtb.exe76⤵
- System Location Discovery: System Language Discovery
PID:1576 -
\??\c:\vddpd.exec:\vddpd.exe77⤵
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\7xlrlrl.exec:\7xlrlrl.exe78⤵PID:2700
-
\??\c:\bhbbnb.exec:\bhbbnb.exe79⤵PID:2888
-
\??\c:\ddvdj.exec:\ddvdj.exe80⤵PID:2536
-
\??\c:\djpvd.exec:\djpvd.exe81⤵PID:2672
-
\??\c:\1lllffl.exec:\1lllffl.exe82⤵PID:2508
-
\??\c:\nnbnhn.exec:\nnbnhn.exe83⤵PID:2504
-
\??\c:\1jvvj.exec:\1jvvj.exe84⤵PID:2584
-
\??\c:\rrrfxfr.exec:\rrrfxfr.exe85⤵PID:2960
-
\??\c:\nnnhth.exec:\nnnhth.exe86⤵PID:2596
-
\??\c:\nhbbhn.exec:\nhbbhn.exe87⤵PID:2860
-
\??\c:\1vdjp.exec:\1vdjp.exe88⤵PID:2828
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe89⤵PID:1652
-
\??\c:\htnnbb.exec:\htnnbb.exe90⤵PID:2816
-
\??\c:\pdpjp.exec:\pdpjp.exe91⤵PID:1560
-
\??\c:\7jjvp.exec:\7jjvp.exe92⤵PID:1724
-
\??\c:\lrfxxrx.exec:\lrfxxrx.exe93⤵PID:1936
-
\??\c:\nnnhbn.exec:\nnnhbn.exe94⤵PID:1756
-
\??\c:\1jjdv.exec:\1jjdv.exe95⤵PID:272
-
\??\c:\xfrflrf.exec:\xfrflrf.exe96⤵PID:2568
-
\??\c:\lxxxlff.exec:\lxxxlff.exe97⤵PID:2332
-
\??\c:\nnntht.exec:\nnntht.exe98⤵PID:1764
-
\??\c:\ddvjj.exec:\ddvjj.exe99⤵PID:1796
-
\??\c:\lflrrxr.exec:\lflrrxr.exe100⤵PID:892
-
\??\c:\tbhtbt.exec:\tbhtbt.exe101⤵PID:2452
-
\??\c:\pddjv.exec:\pddjv.exe102⤵PID:2372
-
\??\c:\9pddp.exec:\9pddp.exe103⤵PID:3052
-
\??\c:\xllfrlr.exec:\xllfrlr.exe104⤵PID:1136
-
\??\c:\vpjvj.exec:\vpjvj.exe105⤵PID:1996
-
\??\c:\xfxlfxx.exec:\xfxlfxx.exe106⤵PID:564
-
\??\c:\rlfxrxf.exec:\rlfxrxf.exe107⤵PID:1556
-
\??\c:\dpvpp.exec:\dpvpp.exe108⤵PID:1592
-
\??\c:\llxfrfx.exec:\llxfrfx.exe109⤵PID:752
-
\??\c:\tbtbnt.exec:\tbtbnt.exe110⤵PID:1352
-
\??\c:\1hnnbh.exec:\1hnnbh.exe111⤵PID:1792
-
\??\c:\jdjjv.exec:\jdjjv.exe112⤵PID:784
-
\??\c:\rrrflrf.exec:\rrrflrf.exe113⤵PID:2256
-
\??\c:\7bnbhn.exec:\7bnbhn.exe114⤵PID:1748
-
\??\c:\ddvdd.exec:\ddvdd.exe115⤵PID:1004
-
\??\c:\1xlfxrl.exec:\1xlfxrl.exe116⤵PID:1544
-
\??\c:\llrfxlf.exec:\llrfxlf.exe117⤵PID:1512
-
\??\c:\bhntht.exec:\bhntht.exe118⤵PID:1780
-
\??\c:\ppjpd.exec:\ppjpd.exe119⤵PID:2652
-
\??\c:\xffllxr.exec:\xffllxr.exe120⤵PID:1576
-
\??\c:\5xxxxlf.exec:\5xxxxlf.exe121⤵PID:3064
-
\??\c:\ttthth.exec:\ttthth.exe122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-