Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe
-
Size
454KB
-
MD5
8ce3a6cf2aa5afc0cd0997eab56af00e
-
SHA1
b10cb77e1f7a9dd80320d2a25e4222b39e01421d
-
SHA256
a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255
-
SHA512
f3890e805d647a3005ee27cbd67eb9e622d6dc85dd4ab183fa3ab3198a6503c1cdae8ee70239daf387a584af712aef582614601f42099f61fd33acda0caba982
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-27-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/268-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-181-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2120-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-401-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1708-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-512-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-537-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2612-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-699-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-703-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1632-779-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2792-945-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3024 tnhhnt.exe 268 9pjvj.exe 2396 nbnnbn.exe 1104 dvpjd.exe 2776 1hhhtb.exe 2700 7jvpv.exe 2232 bththn.exe 2108 dvpdj.exe 2732 rlrrrxx.exe 2632 nhtbhh.exe 2420 fxrflrf.exe 1948 nhbhhn.exe 1524 jjjjd.exe 1912 tnbhtb.exe 2628 djjvp.exe 1752 vpjpd.exe 292 pjppd.exe 2804 jdpvj.exe 2932 llxfxfx.exe 2120 tthntb.exe 2936 rlxflrf.exe 1684 bthhhn.exe 964 5djdp.exe 1944 5fxfrxl.exe 1988 nbtbth.exe 1780 jdvpd.exe 872 tnhntb.exe 620 5rfxxxx.exe 2024 nhtbhh.exe 1156 bnbtnn.exe 3012 llfllrx.exe 1772 hbhhhb.exe 636 dpppj.exe 2844 lllrxxx.exe 784 nhtbhn.exe 2768 1hnhnt.exe 2764 pdvpj.exe 2692 fxxxxxr.exe 2960 thhntn.exe 2872 nbnntb.exe 2748 vvdvj.exe 1736 rlrlxff.exe 2104 xxrrfff.exe 2680 9bnhnn.exe 856 tbnntb.exe 1996 xffxrrx.exe 1708 xfffxrr.exe 1164 hthhnn.exe 1800 bnbbbb.exe 1744 jjvjp.exe 1396 flffllx.exe 1072 nbnttt.exe 292 bnbhht.exe 2900 ppddv.exe 2600 xfrxrfl.exe 2412 rlfllfr.exe 3020 tthbnn.exe 3044 tbbbtb.exe 1140 dpdpv.exe 1392 1lxxxxx.exe 1956 hbnnnn.exe 1508 jdpvd.exe 2476 5frffxf.exe 2032 7xlxxrx.exe -
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/784-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-707-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-903-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 3024 2528 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 32 PID 2528 wrote to memory of 3024 2528 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 32 PID 2528 wrote to memory of 3024 2528 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 32 PID 2528 wrote to memory of 3024 2528 a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe 32 PID 3024 wrote to memory of 268 3024 tnhhnt.exe 33 PID 3024 wrote to memory of 268 3024 tnhhnt.exe 33 PID 3024 wrote to memory of 268 3024 tnhhnt.exe 33 PID 3024 wrote to memory of 268 3024 tnhhnt.exe 33 PID 268 wrote to memory of 2396 268 9pjvj.exe 34 PID 268 wrote to memory of 2396 268 9pjvj.exe 34 PID 268 wrote to memory of 2396 268 9pjvj.exe 34 PID 268 wrote to memory of 2396 268 9pjvj.exe 34 PID 2396 wrote to memory of 1104 2396 nbnnbn.exe 35 PID 2396 wrote to memory of 1104 2396 nbnnbn.exe 35 PID 2396 wrote to memory of 1104 2396 nbnnbn.exe 35 PID 2396 wrote to memory of 1104 2396 nbnnbn.exe 35 PID 1104 wrote to memory of 2776 1104 dvpjd.exe 36 PID 1104 wrote to memory of 2776 1104 dvpjd.exe 36 PID 1104 wrote to memory of 2776 1104 dvpjd.exe 36 PID 1104 wrote to memory of 2776 1104 dvpjd.exe 36 PID 2776 wrote to memory of 2700 2776 1hhhtb.exe 37 PID 2776 wrote to memory of 2700 2776 1hhhtb.exe 37 PID 2776 wrote to memory of 2700 2776 1hhhtb.exe 37 PID 2776 wrote to memory of 2700 2776 1hhhtb.exe 37 PID 2700 wrote to memory of 2232 2700 7jvpv.exe 38 PID 2700 wrote to memory of 2232 2700 7jvpv.exe 38 PID 2700 wrote to memory of 2232 2700 7jvpv.exe 38 PID 2700 wrote to memory of 2232 2700 7jvpv.exe 38 PID 2232 wrote to memory of 2108 2232 bththn.exe 39 PID 2232 wrote to memory of 2108 2232 bththn.exe 39 PID 2232 wrote to memory of 2108 2232 bththn.exe 39 PID 2232 wrote to memory of 2108 2232 bththn.exe 39 PID 2108 wrote to memory of 2732 2108 dvpdj.exe 40 PID 2108 wrote to memory of 2732 2108 dvpdj.exe 40 PID 2108 wrote to memory of 2732 2108 dvpdj.exe 40 PID 2108 wrote to memory of 2732 2108 dvpdj.exe 40 PID 2732 wrote to memory of 2632 2732 rlrrrxx.exe 41 PID 2732 wrote to memory of 2632 2732 rlrrrxx.exe 41 PID 2732 wrote to memory of 2632 2732 rlrrrxx.exe 41 PID 2732 wrote to memory of 2632 2732 rlrrrxx.exe 41 PID 2632 wrote to memory of 2420 2632 nhtbhh.exe 42 PID 2632 wrote to memory of 2420 2632 nhtbhh.exe 42 PID 2632 wrote to memory of 2420 2632 nhtbhh.exe 42 PID 2632 wrote to memory of 2420 2632 nhtbhh.exe 42 PID 2420 wrote to memory of 1948 2420 fxrflrf.exe 43 PID 2420 wrote to memory of 1948 2420 fxrflrf.exe 43 PID 2420 wrote to memory of 1948 2420 fxrflrf.exe 43 PID 2420 wrote to memory of 1948 2420 fxrflrf.exe 43 PID 1948 wrote to memory of 1524 1948 nhbhhn.exe 44 PID 1948 wrote to memory of 1524 1948 nhbhhn.exe 44 PID 1948 wrote to memory of 1524 1948 nhbhhn.exe 44 PID 1948 wrote to memory of 1524 1948 nhbhhn.exe 44 PID 1524 wrote to memory of 1912 1524 jjjjd.exe 45 PID 1524 wrote to memory of 1912 1524 jjjjd.exe 45 PID 1524 wrote to memory of 1912 1524 jjjjd.exe 45 PID 1524 wrote to memory of 1912 1524 jjjjd.exe 45 PID 1912 wrote to memory of 2628 1912 tnbhtb.exe 46 PID 1912 wrote to memory of 2628 1912 tnbhtb.exe 46 PID 1912 wrote to memory of 2628 1912 tnbhtb.exe 46 PID 1912 wrote to memory of 2628 1912 tnbhtb.exe 46 PID 2628 wrote to memory of 1752 2628 djjvp.exe 47 PID 2628 wrote to memory of 1752 2628 djjvp.exe 47 PID 2628 wrote to memory of 1752 2628 djjvp.exe 47 PID 2628 wrote to memory of 1752 2628 djjvp.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe"C:\Users\Admin\AppData\Local\Temp\a81c5564ee07436f831e8f6bda74784b807372c28bc3998be7b6368acaaa1255.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\tnhhnt.exec:\tnhhnt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\9pjvj.exec:\9pjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:268 -
\??\c:\nbnnbn.exec:\nbnnbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dvpjd.exec:\dvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\1hhhtb.exec:\1hhhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7jvpv.exec:\7jvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\bththn.exec:\bththn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\dvpdj.exec:\dvpdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\nhtbhh.exec:\nhtbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\fxrflrf.exec:\fxrflrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nhbhhn.exec:\nhbhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\jjjjd.exec:\jjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\tnbhtb.exec:\tnbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\djjvp.exec:\djjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vpjpd.exec:\vpjpd.exe17⤵
- Executes dropped EXE
PID:1752 -
\??\c:\pjppd.exec:\pjppd.exe18⤵
- Executes dropped EXE
PID:292 -
\??\c:\jdpvj.exec:\jdpvj.exe19⤵
- Executes dropped EXE
PID:2804 -
\??\c:\llxfxfx.exec:\llxfxfx.exe20⤵
- Executes dropped EXE
PID:2932 -
\??\c:\tthntb.exec:\tthntb.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlxflrf.exec:\rlxflrf.exe22⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bthhhn.exec:\bthhhn.exe23⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5djdp.exec:\5djdp.exe24⤵
- Executes dropped EXE
PID:964 -
\??\c:\5fxfrxl.exec:\5fxfrxl.exe25⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nbtbth.exec:\nbtbth.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jdvpd.exec:\jdvpd.exe27⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnhntb.exec:\tnhntb.exe28⤵
- Executes dropped EXE
PID:872 -
\??\c:\5rfxxxx.exec:\5rfxxxx.exe29⤵
- Executes dropped EXE
PID:620 -
\??\c:\nhtbhh.exec:\nhtbhh.exe30⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bnbtnn.exec:\bnbtnn.exe31⤵
- Executes dropped EXE
PID:1156 -
\??\c:\llfllrx.exec:\llfllrx.exe32⤵
- Executes dropped EXE
PID:3012 -
\??\c:\hbhhhb.exec:\hbhhhb.exe33⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dpppj.exec:\dpppj.exe34⤵
- Executes dropped EXE
PID:636 -
\??\c:\lllrxxx.exec:\lllrxxx.exe35⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nhtbhn.exec:\nhtbhn.exe36⤵
- Executes dropped EXE
PID:784 -
\??\c:\1hnhnt.exec:\1hnhnt.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\pdvpj.exec:\pdvpj.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thhntn.exec:\thhntn.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nbnntb.exec:\nbnntb.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvdvj.exec:\vvdvj.exe42⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlrlxff.exec:\rlrlxff.exe43⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xxrrfff.exec:\xxrrfff.exe44⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9bnhnn.exec:\9bnhnn.exe45⤵
- Executes dropped EXE
PID:2680 -
\??\c:\tbnntb.exec:\tbnntb.exe46⤵
- Executes dropped EXE
PID:856 -
\??\c:\xffxrrx.exec:\xffxrrx.exe47⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xfffxrr.exec:\xfffxrr.exe48⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hthhnn.exec:\hthhnn.exe49⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bnbbbb.exec:\bnbbbb.exe50⤵
- Executes dropped EXE
PID:1800 -
\??\c:\jjvjp.exec:\jjvjp.exe51⤵
- Executes dropped EXE
PID:1744 -
\??\c:\flffllx.exec:\flffllx.exe52⤵
- Executes dropped EXE
PID:1396 -
\??\c:\nbnttt.exec:\nbnttt.exe53⤵
- Executes dropped EXE
PID:1072 -
\??\c:\bnbhht.exec:\bnbhht.exe54⤵
- Executes dropped EXE
PID:292 -
\??\c:\ppddv.exec:\ppddv.exe55⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xfrxrfl.exec:\xfrxrfl.exe56⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rlfllfr.exec:\rlfllfr.exe57⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tthbnn.exec:\tthbnn.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tbbbtb.exec:\tbbbtb.exe59⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dpdpv.exec:\dpdpv.exe60⤵
- Executes dropped EXE
PID:1140 -
\??\c:\1lxxxxx.exec:\1lxxxxx.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hbnnnn.exec:\hbnnnn.exe62⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jdpvd.exec:\jdpvd.exe63⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5frffxf.exec:\5frffxf.exe64⤵
- Executes dropped EXE
PID:2476 -
\??\c:\7xlxxrx.exec:\7xlxxrx.exe65⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ttbhhh.exec:\ttbhhh.exe66⤵PID:1312
-
\??\c:\vdvvd.exec:\vdvvd.exe67⤵PID:536
-
\??\c:\dpvdd.exec:\dpvdd.exe68⤵PID:2488
-
\??\c:\rlrllff.exec:\rlrllff.exe69⤵PID:3016
-
\??\c:\xrfxxff.exec:\xrfxxff.exe70⤵PID:2012
-
\??\c:\9nhhnn.exec:\9nhhnn.exe71⤵PID:1712
-
\??\c:\1vjdv.exec:\1vjdv.exe72⤵PID:2264
-
\??\c:\lxxrrlx.exec:\lxxrrlx.exe73⤵PID:2284
-
\??\c:\xrffffl.exec:\xrffffl.exe74⤵PID:2200
-
\??\c:\bntntn.exec:\bntntn.exe75⤵PID:2132
-
\??\c:\ddvdd.exec:\ddvdd.exe76⤵PID:2664
-
\??\c:\xrxrfxx.exec:\xrxrfxx.exe77⤵PID:2708
-
\??\c:\xrllxxl.exec:\xrllxxl.exe78⤵PID:2272
-
\??\c:\bthntn.exec:\bthntn.exe79⤵PID:2836
-
\??\c:\5thbhh.exec:\5thbhh.exe80⤵PID:2232
-
\??\c:\vjpdj.exec:\vjpdj.exe81⤵PID:2672
-
\??\c:\xlrlfxf.exec:\xlrlfxf.exe82⤵PID:2880
-
\??\c:\btbnbb.exec:\btbnbb.exe83⤵PID:2732
-
\??\c:\3hbhhn.exec:\3hbhhn.exe84⤵PID:2612
-
\??\c:\pjppv.exec:\pjppv.exe85⤵PID:2088
-
\??\c:\llffllr.exec:\llffllr.exe86⤵PID:2632
-
\??\c:\5lrrrxx.exec:\5lrrrxx.exe87⤵PID:856
-
\??\c:\5hnhnh.exec:\5hnhnh.exe88⤵PID:296
-
\??\c:\pjppv.exec:\pjppv.exe89⤵PID:1500
-
\??\c:\rrxrrrx.exec:\rrxrrrx.exe90⤵PID:2000
-
\??\c:\5frxflr.exec:\5frxflr.exe91⤵PID:1328
-
\??\c:\nbbbbn.exec:\nbbbbn.exe92⤵PID:2876
-
\??\c:\7jvpp.exec:\7jvpp.exe93⤵PID:2800
-
\??\c:\ppvvv.exec:\ppvvv.exe94⤵PID:1072
-
\??\c:\rflfffl.exec:\rflfffl.exe95⤵PID:1756
-
\??\c:\bbhbbt.exec:\bbhbbt.exe96⤵PID:2140
-
\??\c:\1vddd.exec:\1vddd.exe97⤵PID:2600
-
\??\c:\7dvpv.exec:\7dvpv.exe98⤵PID:3032
-
\??\c:\rrflllf.exec:\rrflllf.exe99⤵PID:3020
-
\??\c:\rfrxlff.exec:\rfrxlff.exe100⤵PID:288
-
\??\c:\bbntbb.exec:\bbntbb.exe101⤵PID:1352
-
\??\c:\jdjdp.exec:\jdjdp.exe102⤵PID:2040
-
\??\c:\frlffxf.exec:\frlffxf.exe103⤵PID:1656
-
\??\c:\rfxxffl.exec:\rfxxffl.exe104⤵PID:2512
-
\??\c:\bbhttt.exec:\bbhttt.exe105⤵PID:1632
-
\??\c:\hthnnh.exec:\hthnnh.exe106⤵PID:2476
-
\??\c:\7jvvd.exec:\7jvvd.exe107⤵PID:2376
-
\??\c:\lrffffr.exec:\lrffffr.exe108⤵PID:1300
-
\??\c:\nhnttb.exec:\nhnttb.exe109⤵PID:1004
-
\??\c:\9bhbhh.exec:\9bhbhh.exe110⤵PID:2488
-
\??\c:\jdjpv.exec:\jdjpv.exe111⤵PID:2192
-
\??\c:\fxrffff.exec:\fxrffff.exe112⤵
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\htbbnh.exec:\htbbnh.exe113⤵PID:2160
-
\??\c:\hthnnn.exec:\hthnnn.exe114⤵PID:2264
-
\??\c:\vpdjp.exec:\vpdjp.exe115⤵PID:1644
-
\??\c:\frxxfrx.exec:\frxxfrx.exe116⤵PID:2396
-
\??\c:\3lxrxxx.exec:\3lxrxxx.exe117⤵PID:2840
-
\??\c:\1hnntt.exec:\1hnntt.exe118⤵PID:2780
-
\??\c:\ddppp.exec:\ddppp.exe119⤵PID:2772
-
\??\c:\dppjj.exec:\dppjj.exe120⤵PID:2720
-
\??\c:\lflflff.exec:\lflflff.exe121⤵PID:2596
-
\??\c:\tthnnn.exec:\tthnnn.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-