Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 13:19
Static task
static1
Behavioral task
behavioral1
Sample
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe
Resource
win7-20240903-en
General
-
Target
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe
-
Size
74KB
-
MD5
c9cc7f43112a69992bd5c7adc86f70ef
-
SHA1
24bcfef4c7440ae54398e9915ee3c9643da57ca6
-
SHA256
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e
-
SHA512
569d4305f4fc15aecd0475c7e5b03207567508aa3366d62e6939d60794084f48dc9232bf44e6d1e8e85bb70043b0df34b2cac08299d0f9b813842dbd91064444
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3eD:ymb3NkkiQ3mdBjFWXkj7afo6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3156-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1320-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfflrfr.exehbhhnh.exejvppd.exeddvpj.exerrxxrrl.exebtthhh.exe9jppd.exefrxxxfx.exe1btnhh.exeddjvv.exepppjd.exelxfxrxf.exehhhhhh.exeddjjd.exexrfrfxl.exe3ttnnn.exennhhbn.exepvdjv.exenhhbtn.exeppppj.exe7bbhth.exenbbttt.exejpvvj.exexrrlxfx.exelrrrlrf.exenbhbtt.exetnnhbb.exedppdv.exexxfrxff.exebhtttt.exebhbttn.exepjvdj.exevdjdv.exe7xfxxxr.exebtnnht.exepjddd.exepvdvj.exefxfxxrr.exehbbbtb.exettnnhh.exevjvvp.exexffxlll.exexlrllll.exenhhhbn.exebbnhbt.exejjjdv.exejvvvj.exerxffrrr.exelrxxxfx.exehhnnhn.exebttthh.exejjvvj.exedvvpd.exelxxxxxx.exefxrrrrl.exebtbtnn.exehttnth.exedjddv.exerrrrlll.exexrrrllx.exebhhhtt.exenbtnhh.exe9vdvj.exefrlfxff.exepid process 648 xfflrfr.exe 2372 hbhhnh.exe 3344 jvppd.exe 1884 ddvpj.exe 2824 rrxxrrl.exe 2304 btthhh.exe 4800 9jppd.exe 636 frxxxfx.exe 3000 1btnhh.exe 1320 ddjvv.exe 3936 pppjd.exe 4876 lxfxrxf.exe 4444 hhhhhh.exe 5104 ddjjd.exe 3704 xrfrfxl.exe 220 3ttnnn.exe 712 nnhhbn.exe 3720 pvdjv.exe 3060 nhhbtn.exe 4236 ppppj.exe 1436 7bbhth.exe 2632 nbbttt.exe 1016 jpvvj.exe 4264 xrrlxfx.exe 3480 lrrrlrf.exe 2548 nbhbtt.exe 920 tnnhbb.exe 2504 dppdv.exe 4688 xxfrxff.exe 1464 bhtttt.exe 4524 bhbttn.exe 4072 pjvdj.exe 540 vdjdv.exe 1696 7xfxxxr.exe 2688 btnnht.exe 4960 pjddd.exe 1800 pvdvj.exe 1184 fxfxxrr.exe 2076 hbbbtb.exe 2908 ttnnhh.exe 1136 vjvvp.exe 2096 xffxlll.exe 2700 xlrllll.exe 1968 nhhhbn.exe 3716 bbnhbt.exe 4708 jjjdv.exe 3484 jvvvj.exe 4608 rxffrrr.exe 4400 lrxxxfx.exe 2368 hhnnhn.exe 4792 bttthh.exe 4804 jjvvj.exe 4976 dvvpd.exe 840 lxxxxxx.exe 3876 fxrrrrl.exe 1336 btbtnn.exe 4808 httnth.exe 2640 djddv.exe 2736 rrrrlll.exe 1484 xrrrllx.exe 2540 bhhhtt.exe 4824 nbtnhh.exe 4024 9vdvj.exe 3044 frlfxff.exe -
Processes:
resource yara_rule behavioral2/memory/3156-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vpjpj.exerlxxxlx.exejjjvj.exe7vvvj.exerllfrrl.exetbbttt.exelrrlllr.exexrxffff.exehhnntn.exefflxxff.exejdvpp.exebnttnn.exenbhhtb.exefrrxrxr.exeddjdd.exetnnntt.exebtnnnn.exehbbbtb.exe7flfxrr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flfxrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exexfflrfr.exehbhhnh.exejvppd.exeddvpj.exerrxxrrl.exebtthhh.exe9jppd.exefrxxxfx.exe1btnhh.exeddjvv.exepppjd.exelxfxrxf.exehhhhhh.exeddjjd.exexrfrfxl.exe3ttnnn.exennhhbn.exepvdjv.exenhhbtn.exeppppj.exe7bbhth.exedescription pid process target process PID 3156 wrote to memory of 648 3156 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe xfflrfr.exe PID 3156 wrote to memory of 648 3156 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe xfflrfr.exe PID 3156 wrote to memory of 648 3156 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe xfflrfr.exe PID 648 wrote to memory of 2372 648 xfflrfr.exe hbhhnh.exe PID 648 wrote to memory of 2372 648 xfflrfr.exe hbhhnh.exe PID 648 wrote to memory of 2372 648 xfflrfr.exe hbhhnh.exe PID 2372 wrote to memory of 3344 2372 hbhhnh.exe jvppd.exe PID 2372 wrote to memory of 3344 2372 hbhhnh.exe jvppd.exe PID 2372 wrote to memory of 3344 2372 hbhhnh.exe jvppd.exe PID 3344 wrote to memory of 1884 3344 jvppd.exe ddvpj.exe PID 3344 wrote to memory of 1884 3344 jvppd.exe ddvpj.exe PID 3344 wrote to memory of 1884 3344 jvppd.exe ddvpj.exe PID 1884 wrote to memory of 2824 1884 ddvpj.exe rrxxrrl.exe PID 1884 wrote to memory of 2824 1884 ddvpj.exe rrxxrrl.exe PID 1884 wrote to memory of 2824 1884 ddvpj.exe rrxxrrl.exe PID 2824 wrote to memory of 2304 2824 rrxxrrl.exe btthhh.exe PID 2824 wrote to memory of 2304 2824 rrxxrrl.exe btthhh.exe PID 2824 wrote to memory of 2304 2824 rrxxrrl.exe btthhh.exe PID 2304 wrote to memory of 4800 2304 btthhh.exe 9jppd.exe PID 2304 wrote to memory of 4800 2304 btthhh.exe 9jppd.exe PID 2304 wrote to memory of 4800 2304 btthhh.exe 9jppd.exe PID 4800 wrote to memory of 636 4800 9jppd.exe frxxxfx.exe PID 4800 wrote to memory of 636 4800 9jppd.exe frxxxfx.exe PID 4800 wrote to memory of 636 4800 9jppd.exe frxxxfx.exe PID 636 wrote to memory of 3000 636 frxxxfx.exe 1btnhh.exe PID 636 wrote to memory of 3000 636 frxxxfx.exe 1btnhh.exe PID 636 wrote to memory of 3000 636 frxxxfx.exe 1btnhh.exe PID 3000 wrote to memory of 1320 3000 1btnhh.exe ddjvv.exe PID 3000 wrote to memory of 1320 3000 1btnhh.exe ddjvv.exe PID 3000 wrote to memory of 1320 3000 1btnhh.exe ddjvv.exe PID 1320 wrote to memory of 3936 1320 ddjvv.exe pppjd.exe PID 1320 wrote to memory of 3936 1320 ddjvv.exe pppjd.exe PID 1320 wrote to memory of 3936 1320 ddjvv.exe pppjd.exe PID 3936 wrote to memory of 4876 3936 pppjd.exe lxfxrxf.exe PID 3936 wrote to memory of 4876 3936 pppjd.exe lxfxrxf.exe PID 3936 wrote to memory of 4876 3936 pppjd.exe lxfxrxf.exe PID 4876 wrote to memory of 4444 4876 lxfxrxf.exe hhhhhh.exe PID 4876 wrote to memory of 4444 4876 lxfxrxf.exe hhhhhh.exe PID 4876 wrote to memory of 4444 4876 lxfxrxf.exe hhhhhh.exe PID 4444 wrote to memory of 5104 4444 hhhhhh.exe ddjjd.exe PID 4444 wrote to memory of 5104 4444 hhhhhh.exe ddjjd.exe PID 4444 wrote to memory of 5104 4444 hhhhhh.exe ddjjd.exe PID 5104 wrote to memory of 3704 5104 ddjjd.exe xrfrfxl.exe PID 5104 wrote to memory of 3704 5104 ddjjd.exe xrfrfxl.exe PID 5104 wrote to memory of 3704 5104 ddjjd.exe xrfrfxl.exe PID 3704 wrote to memory of 220 3704 xrfrfxl.exe 3ttnnn.exe PID 3704 wrote to memory of 220 3704 xrfrfxl.exe 3ttnnn.exe PID 3704 wrote to memory of 220 3704 xrfrfxl.exe 3ttnnn.exe PID 220 wrote to memory of 712 220 3ttnnn.exe nnhhbn.exe PID 220 wrote to memory of 712 220 3ttnnn.exe nnhhbn.exe PID 220 wrote to memory of 712 220 3ttnnn.exe nnhhbn.exe PID 712 wrote to memory of 3720 712 nnhhbn.exe pvdjv.exe PID 712 wrote to memory of 3720 712 nnhhbn.exe pvdjv.exe PID 712 wrote to memory of 3720 712 nnhhbn.exe pvdjv.exe PID 3720 wrote to memory of 3060 3720 pvdjv.exe nhhbtn.exe PID 3720 wrote to memory of 3060 3720 pvdjv.exe nhhbtn.exe PID 3720 wrote to memory of 3060 3720 pvdjv.exe nhhbtn.exe PID 3060 wrote to memory of 4236 3060 nhhbtn.exe ppppj.exe PID 3060 wrote to memory of 4236 3060 nhhbtn.exe ppppj.exe PID 3060 wrote to memory of 4236 3060 nhhbtn.exe ppppj.exe PID 4236 wrote to memory of 1436 4236 ppppj.exe 7bbhth.exe PID 4236 wrote to memory of 1436 4236 ppppj.exe 7bbhth.exe PID 4236 wrote to memory of 1436 4236 ppppj.exe 7bbhth.exe PID 1436 wrote to memory of 2632 1436 7bbhth.exe nbbttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe"C:\Users\Admin\AppData\Local\Temp\7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\xfflrfr.exec:\xfflrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\hbhhnh.exec:\hbhhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jvppd.exec:\jvppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\ddvpj.exec:\ddvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\btthhh.exec:\btthhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9jppd.exec:\9jppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\frxxxfx.exec:\frxxxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\1btnhh.exec:\1btnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ddjvv.exec:\ddjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\pppjd.exec:\pppjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\lxfxrxf.exec:\lxfxrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\hhhhhh.exec:\hhhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\ddjjd.exec:\ddjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xrfrfxl.exec:\xrfrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\3ttnnn.exec:\3ttnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\nnhhbn.exec:\nnhhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\pvdjv.exec:\pvdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\nhhbtn.exec:\nhhbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\ppppj.exec:\ppppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\7bbhth.exec:\7bbhth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\nbbttt.exec:\nbbttt.exe23⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jpvvj.exec:\jpvvj.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe25⤵
- Executes dropped EXE
PID:4264 -
\??\c:\lrrrlrf.exec:\lrrrlrf.exe26⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nbhbtt.exec:\nbhbtt.exe27⤵
- Executes dropped EXE
PID:2548 -
\??\c:\tnnhbb.exec:\tnnhbb.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\dppdv.exec:\dppdv.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xxfrxff.exec:\xxfrxff.exe30⤵
- Executes dropped EXE
PID:4688 -
\??\c:\bhtttt.exec:\bhtttt.exe31⤵
- Executes dropped EXE
PID:1464 -
\??\c:\bhbttn.exec:\bhbttn.exe32⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pjvdj.exec:\pjvdj.exe33⤵
- Executes dropped EXE
PID:4072 -
\??\c:\vdjdv.exec:\vdjdv.exe34⤵
- Executes dropped EXE
PID:540 -
\??\c:\7xfxxxr.exec:\7xfxxxr.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\btnnht.exec:\btnnht.exe36⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pjddd.exec:\pjddd.exe37⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pvdvj.exec:\pvdvj.exe38⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe39⤵
- Executes dropped EXE
PID:1184 -
\??\c:\hbbbtb.exec:\hbbbtb.exe40⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ttnnhh.exec:\ttnnhh.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vjvvp.exec:\vjvvp.exe42⤵
- Executes dropped EXE
PID:1136 -
\??\c:\xffxlll.exec:\xffxlll.exe43⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xlrllll.exec:\xlrllll.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nhhhbn.exec:\nhhhbn.exe45⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bbnhbt.exec:\bbnhbt.exe46⤵
- Executes dropped EXE
PID:3716 -
\??\c:\jjjdv.exec:\jjjdv.exe47⤵
- Executes dropped EXE
PID:4708 -
\??\c:\jvvvj.exec:\jvvvj.exe48⤵
- Executes dropped EXE
PID:3484 -
\??\c:\rxffrrr.exec:\rxffrrr.exe49⤵
- Executes dropped EXE
PID:4608 -
\??\c:\lrxxxfx.exec:\lrxxxfx.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\hhnnhn.exec:\hhnnhn.exe51⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bttthh.exec:\bttthh.exe52⤵
- Executes dropped EXE
PID:4792 -
\??\c:\jjvvj.exec:\jjvvj.exe53⤵
- Executes dropped EXE
PID:4804 -
\??\c:\dvvpd.exec:\dvvpd.exe54⤵
- Executes dropped EXE
PID:4976 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe55⤵
- Executes dropped EXE
PID:840 -
\??\c:\fxrrrrl.exec:\fxrrrrl.exe56⤵
- Executes dropped EXE
PID:3876 -
\??\c:\btbtnn.exec:\btbtnn.exe57⤵
- Executes dropped EXE
PID:1336 -
\??\c:\httnth.exec:\httnth.exe58⤵
- Executes dropped EXE
PID:4808 -
\??\c:\djddv.exec:\djddv.exe59⤵
- Executes dropped EXE
PID:2640 -
\??\c:\rrrrlll.exec:\rrrrlll.exe60⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrrrllx.exec:\xrrrllx.exe61⤵
- Executes dropped EXE
PID:1484 -
\??\c:\bhhhtt.exec:\bhhhtt.exe62⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nbtnhh.exec:\nbtnhh.exe63⤵
- Executes dropped EXE
PID:4824 -
\??\c:\9vdvj.exec:\9vdvj.exe64⤵
- Executes dropped EXE
PID:4024 -
\??\c:\frlfxff.exec:\frlfxff.exe65⤵
- Executes dropped EXE
PID:3044 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe66⤵PID:1320
-
\??\c:\bbbbtb.exec:\bbbbtb.exe67⤵PID:1076
-
\??\c:\hthhbb.exec:\hthhbb.exe68⤵PID:2856
-
\??\c:\vdjdd.exec:\vdjdd.exe69⤵PID:832
-
\??\c:\rlxxlfx.exec:\rlxxlfx.exe70⤵PID:208
-
\??\c:\xrlllfx.exec:\xrlllfx.exe71⤵PID:3680
-
\??\c:\9nhbtt.exec:\9nhbtt.exe72⤵PID:32
-
\??\c:\hbbthh.exec:\hbbthh.exe73⤵PID:264
-
\??\c:\vjjjv.exec:\vjjjv.exe74⤵PID:2536
-
\??\c:\9vdvj.exec:\9vdvj.exe75⤵PID:3144
-
\??\c:\9xfxrlf.exec:\9xfxrlf.exe76⤵PID:4080
-
\??\c:\hnnntb.exec:\hnnntb.exe77⤵PID:560
-
\??\c:\nhhbbb.exec:\nhhbbb.exe78⤵PID:2052
-
\??\c:\pvdvd.exec:\pvdvd.exe79⤵PID:3060
-
\??\c:\rrlffff.exec:\rrlffff.exe80⤵PID:3736
-
\??\c:\vpvpv.exec:\vpvpv.exe81⤵PID:1460
-
\??\c:\xrfrxrl.exec:\xrfrxrl.exe82⤵PID:2816
-
\??\c:\1lffxrl.exec:\1lffxrl.exe83⤵PID:5052
-
\??\c:\5bhhbb.exec:\5bhhbb.exe84⤵PID:1576
-
\??\c:\bnhnhh.exec:\bnhnhh.exe85⤵PID:404
-
\??\c:\7jvpd.exec:\7jvpd.exe86⤵PID:4936
-
\??\c:\9dpjp.exec:\9dpjp.exe87⤵PID:1468
-
\??\c:\lxxlrrr.exec:\lxxlrrr.exe88⤵PID:5032
-
\??\c:\5nttnn.exec:\5nttnn.exe89⤵PID:2384
-
\??\c:\tnhbtb.exec:\tnhbtb.exe90⤵PID:3080
-
\??\c:\9jjdv.exec:\9jjdv.exe91⤵PID:1732
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe92⤵PID:4912
-
\??\c:\frrfrlx.exec:\frrfrlx.exe93⤵PID:1464
-
\??\c:\tnnhtt.exec:\tnnhtt.exe94⤵PID:1672
-
\??\c:\hbnnbn.exec:\hbnnbn.exe95⤵PID:3224
-
\??\c:\pddjv.exec:\pddjv.exe96⤵PID:3468
-
\??\c:\jjvpd.exec:\jjvpd.exe97⤵PID:540
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe98⤵PID:3824
-
\??\c:\btbbbb.exec:\btbbbb.exe99⤵PID:1628
-
\??\c:\nbhhtb.exec:\nbhhtb.exe100⤵
- System Location Discovery: System Language Discovery
PID:1684 -
\??\c:\vpdpv.exec:\vpdpv.exe101⤵PID:4948
-
\??\c:\rrrxlxf.exec:\rrrxlxf.exe102⤵PID:2288
-
\??\c:\xlrlffx.exec:\xlrlffx.exe103⤵PID:5100
-
\??\c:\htnnhh.exec:\htnnhh.exe104⤵PID:952
-
\??\c:\bhhtth.exec:\bhhtth.exe105⤵PID:1136
-
\??\c:\jdpdv.exec:\jdpdv.exe106⤵PID:4816
-
\??\c:\rllfrlf.exec:\rllfrlf.exe107⤵PID:4128
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe108⤵PID:2976
-
\??\c:\bthbhb.exec:\bthbhb.exe109⤵PID:3668
-
\??\c:\nhnhtn.exec:\nhnhtn.exe110⤵PID:4504
-
\??\c:\vjpjd.exec:\vjpjd.exe111⤵PID:3384
-
\??\c:\ddjjd.exec:\ddjjd.exe112⤵PID:4552
-
\??\c:\ffrrrxr.exec:\ffrrrxr.exe113⤵PID:2708
-
\??\c:\lxffxfr.exec:\lxffxfr.exe114⤵PID:4372
-
\??\c:\bbnhbb.exec:\bbnhbb.exe115⤵PID:4940
-
\??\c:\ppjjj.exec:\ppjjj.exe116⤵PID:1376
-
\??\c:\jvpjp.exec:\jvpjp.exe117⤵PID:2752
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe118⤵PID:4180
-
\??\c:\9ffxfff.exec:\9ffxfff.exe119⤵PID:3488
-
\??\c:\nhntbb.exec:\nhntbb.exe120⤵PID:380
-
\??\c:\vdpjv.exec:\vdpjv.exe121⤵PID:5008
-
\??\c:\lxxrllf.exec:\lxxrllf.exe122⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-