Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe
-
Size
454KB
-
MD5
bf8dd92f65db3a8656792528570d83c3
-
SHA1
9e3e7fcad8132949cf40be9335f45250efc02374
-
SHA256
a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78
-
SHA512
558bd9edc52c79d8625f131248d0a14328296ad0d7aeb314c8faa364d27608e9ae909de1766a548d0de5a79a5d27f82d6ed81cc838800e325f4772418a002ab2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeU:q7Tc2NYHUrAwfMp3CDU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2780-504-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-466-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-228-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-225-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2364-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-152-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2920-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/868-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/612-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1752-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-36-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2836-28-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2836-26-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2720-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-533-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1692-550-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1136-765-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon behavioral1/memory/2896-766-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-843-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 thtbtb.exe 2836 3jvjp.exe 2828 dpjdd.exe 2436 xlrxlll.exe 1752 tnnntt.exe 2568 llflxlx.exe 2240 lxfflxf.exe 612 pvppd.exe 1512 rfxfxfl.exe 3020 ntnnbh.exe 1608 3rrxlfx.exe 1416 hnttbh.exe 868 jjpdd.exe 2920 ntthhn.exe 2452 5htbhh.exe 2472 lxflrff.exe 380 jpddj.exe 2188 rrflxlx.exe 2176 nnttnt.exe 2360 rrlfxlr.exe 2364 9llrflx.exe 2264 pdppd.exe 2152 xrrrlxl.exe 952 hhtbnb.exe 1852 xlxfxlx.exe 2340 hhhbth.exe 656 tnhhtb.exe 2504 5dvdd.exe 1692 flxxlxl.exe 1012 vvdvd.exe 2280 jdddv.exe 2704 tbtntb.exe 2860 dppvd.exe 2856 1fxlrxl.exe 2968 flxxfrx.exe 2716 tnnbbt.exe 2880 ppvjv.exe 2652 xxffllr.exe 2156 5llfflr.exe 2808 ntnntb.exe 2232 jvdjv.exe 3028 ddjjp.exe 1944 lxfxxxf.exe 3020 3tntbt.exe 2636 ddddp.exe 2644 pjvjv.exe 2804 3frlrxr.exe 2796 ntbbhb.exe 1508 hhntbt.exe 2920 vvddp.exe 2452 9rffllr.exe 848 xflrxxf.exe 780 nnbbbh.exe 2440 ppddp.exe 2180 rrxxfll.exe 2388 rfxxrxx.exe 3044 nbntbn.exe 1324 jjppv.exe 2364 jpdjj.exe 2264 flflrxf.exe 1212 bbnnnt.exe 2780 hhhbhn.exe 1688 3dpvj.exe 1288 7rffllx.exe -
resource yara_rule behavioral1/memory/2780-504-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-228-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/612-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-28-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2720-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-533-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1692-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-722-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-815-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-843-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrllxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2008 wrote to memory of 2720 2008 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 2008 wrote to memory of 2720 2008 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 2008 wrote to memory of 2720 2008 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 2008 wrote to memory of 2720 2008 a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe 30 PID 2720 wrote to memory of 2836 2720 thtbtb.exe 31 PID 2720 wrote to memory of 2836 2720 thtbtb.exe 31 PID 2720 wrote to memory of 2836 2720 thtbtb.exe 31 PID 2720 wrote to memory of 2836 2720 thtbtb.exe 31 PID 2836 wrote to memory of 2828 2836 3jvjp.exe 32 PID 2836 wrote to memory of 2828 2836 3jvjp.exe 32 PID 2836 wrote to memory of 2828 2836 3jvjp.exe 32 PID 2836 wrote to memory of 2828 2836 3jvjp.exe 32 PID 2828 wrote to memory of 2436 2828 dpjdd.exe 33 PID 2828 wrote to memory of 2436 2828 dpjdd.exe 33 PID 2828 wrote to memory of 2436 2828 dpjdd.exe 33 PID 2828 wrote to memory of 2436 2828 dpjdd.exe 33 PID 2436 wrote to memory of 1752 2436 xlrxlll.exe 34 PID 2436 wrote to memory of 1752 2436 xlrxlll.exe 34 PID 2436 wrote to memory of 1752 2436 xlrxlll.exe 34 PID 2436 wrote to memory of 1752 2436 xlrxlll.exe 34 PID 1752 wrote to memory of 2568 1752 tnnntt.exe 35 PID 1752 wrote to memory of 2568 1752 tnnntt.exe 35 PID 1752 wrote to memory of 2568 1752 tnnntt.exe 35 PID 1752 wrote to memory of 2568 1752 tnnntt.exe 35 PID 2568 wrote to memory of 2240 2568 llflxlx.exe 36 PID 2568 wrote to memory of 2240 2568 llflxlx.exe 36 PID 2568 wrote to memory of 2240 2568 llflxlx.exe 36 PID 2568 wrote to memory of 2240 2568 llflxlx.exe 36 PID 2240 wrote to memory of 612 2240 lxfflxf.exe 37 PID 2240 wrote to memory of 612 2240 lxfflxf.exe 37 PID 2240 wrote to memory of 612 2240 lxfflxf.exe 37 PID 2240 wrote to memory of 612 2240 lxfflxf.exe 37 PID 612 wrote to memory of 1512 612 pvppd.exe 38 PID 612 wrote to memory of 1512 612 pvppd.exe 38 PID 612 wrote to memory of 1512 612 pvppd.exe 38 PID 612 wrote to memory of 1512 612 pvppd.exe 38 PID 1512 wrote to memory of 3020 1512 rfxfxfl.exe 39 PID 1512 wrote to memory of 3020 1512 rfxfxfl.exe 39 PID 1512 wrote to memory of 3020 1512 rfxfxfl.exe 39 PID 1512 wrote to memory of 3020 1512 rfxfxfl.exe 39 PID 3020 wrote to memory of 1608 3020 ntnnbh.exe 40 PID 3020 wrote to memory of 1608 3020 ntnnbh.exe 40 PID 3020 wrote to memory of 1608 3020 ntnnbh.exe 40 PID 3020 wrote to memory of 1608 3020 ntnnbh.exe 40 PID 1608 wrote to memory of 1416 1608 3rrxlfx.exe 41 PID 1608 wrote to memory of 1416 1608 3rrxlfx.exe 41 PID 1608 wrote to memory of 1416 1608 3rrxlfx.exe 41 PID 1608 wrote to memory of 1416 1608 3rrxlfx.exe 41 PID 1416 wrote to memory of 868 1416 hnttbh.exe 42 PID 1416 wrote to memory of 868 1416 hnttbh.exe 42 PID 1416 wrote to memory of 868 1416 hnttbh.exe 42 PID 1416 wrote to memory of 868 1416 hnttbh.exe 42 PID 868 wrote to memory of 2920 868 jjpdd.exe 43 PID 868 wrote to memory of 2920 868 jjpdd.exe 43 PID 868 wrote to memory of 2920 868 jjpdd.exe 43 PID 868 wrote to memory of 2920 868 jjpdd.exe 43 PID 2920 wrote to memory of 2452 2920 ntthhn.exe 44 PID 2920 wrote to memory of 2452 2920 ntthhn.exe 44 PID 2920 wrote to memory of 2452 2920 ntthhn.exe 44 PID 2920 wrote to memory of 2452 2920 ntthhn.exe 44 PID 2452 wrote to memory of 2472 2452 5htbhh.exe 45 PID 2452 wrote to memory of 2472 2452 5htbhh.exe 45 PID 2452 wrote to memory of 2472 2452 5htbhh.exe 45 PID 2452 wrote to memory of 2472 2452 5htbhh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe"C:\Users\Admin\AppData\Local\Temp\a03e31161177fad3e588ed064a4d90fc8a3ba57cb78f92d54ff28db3f5f45f78.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\thtbtb.exec:\thtbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3jvjp.exec:\3jvjp.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\dpjdd.exec:\dpjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\xlrxlll.exec:\xlrxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\tnnntt.exec:\tnnntt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\llflxlx.exec:\llflxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lxfflxf.exec:\lxfflxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\pvppd.exec:\pvppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\rfxfxfl.exec:\rfxfxfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\ntnnbh.exec:\ntnnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\3rrxlfx.exec:\3rrxlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\hnttbh.exec:\hnttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\jjpdd.exec:\jjpdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\ntthhn.exec:\ntthhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\5htbhh.exec:\5htbhh.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\lxflrff.exec:\lxflrff.exe17⤵
- Executes dropped EXE
PID:2472 -
\??\c:\jpddj.exec:\jpddj.exe18⤵
- Executes dropped EXE
PID:380 -
\??\c:\rrflxlx.exec:\rrflxlx.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nnttnt.exec:\nnttnt.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rrlfxlr.exec:\rrlfxlr.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9llrflx.exec:\9llrflx.exe22⤵
- Executes dropped EXE
PID:2364 -
\??\c:\pdppd.exec:\pdppd.exe23⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrrrlxl.exec:\xrrrlxl.exe24⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hhtbnb.exec:\hhtbnb.exe25⤵
- Executes dropped EXE
PID:952 -
\??\c:\xlxfxlx.exec:\xlxfxlx.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hhhbth.exec:\hhhbth.exe27⤵
- Executes dropped EXE
PID:2340 -
\??\c:\tnhhtb.exec:\tnhhtb.exe28⤵
- Executes dropped EXE
PID:656 -
\??\c:\5dvdd.exec:\5dvdd.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\flxxlxl.exec:\flxxlxl.exe30⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vvdvd.exec:\vvdvd.exe31⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jdddv.exec:\jdddv.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\tbtntb.exec:\tbtntb.exe33⤵
- Executes dropped EXE
PID:2704 -
\??\c:\dppvd.exec:\dppvd.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1fxlrxl.exec:\1fxlrxl.exe35⤵
- Executes dropped EXE
PID:2856 -
\??\c:\flxxfrx.exec:\flxxfrx.exe36⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tnnbbt.exec:\tnnbbt.exe37⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ppvjv.exec:\ppvjv.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xxffllr.exec:\xxffllr.exe39⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5llfflr.exec:\5llfflr.exe40⤵
- Executes dropped EXE
PID:2156 -
\??\c:\ntnntb.exec:\ntnntb.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jvdjv.exec:\jvdjv.exe42⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ddjjp.exec:\ddjjp.exe43⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxfxxxf.exec:\lxfxxxf.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3tntbt.exec:\3tntbt.exe45⤵
- Executes dropped EXE
PID:3020 -
\??\c:\ddddp.exec:\ddddp.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjvjv.exec:\pjvjv.exe47⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3frlrxr.exec:\3frlrxr.exe48⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ntbbhb.exec:\ntbbhb.exe49⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hhntbt.exec:\hhntbt.exe50⤵
- Executes dropped EXE
PID:1508 -
\??\c:\vvddp.exec:\vvddp.exe51⤵
- Executes dropped EXE
PID:2920 -
\??\c:\9rffllr.exec:\9rffllr.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xflrxxf.exec:\xflrxxf.exe53⤵
- Executes dropped EXE
PID:848 -
\??\c:\nnbbbh.exec:\nnbbbh.exe54⤵
- Executes dropped EXE
PID:780 -
\??\c:\ppddp.exec:\ppddp.exe55⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rrxxfll.exec:\rrxxfll.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rfxxrxx.exec:\rfxxrxx.exe57⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nbntbn.exec:\nbntbn.exe58⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jjppv.exec:\jjppv.exe59⤵
- Executes dropped EXE
PID:1324 -
\??\c:\jpdjj.exec:\jpdjj.exe60⤵
- Executes dropped EXE
PID:2364 -
\??\c:\flflrxf.exec:\flflrxf.exe61⤵
- Executes dropped EXE
PID:2264 -
\??\c:\bbnnnt.exec:\bbnnnt.exe62⤵
- Executes dropped EXE
PID:1212 -
\??\c:\hhhbhn.exec:\hhhbhn.exe63⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3dpvj.exec:\3dpvj.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\7rffllx.exec:\7rffllx.exe65⤵
- Executes dropped EXE
PID:1288 -
\??\c:\5xlrxxl.exec:\5xlrxxl.exe66⤵PID:864
-
\??\c:\hntthn.exec:\hntthn.exe67⤵PID:1320
-
\??\c:\pppvj.exec:\pppvj.exe68⤵PID:2536
-
\??\c:\jvjpv.exec:\jvjpv.exe69⤵PID:884
-
\??\c:\7xlrrxl.exec:\7xlrrxl.exe70⤵PID:992
-
\??\c:\ntbhtt.exec:\ntbhtt.exe71⤵PID:1692
-
\??\c:\3pjvj.exec:\3pjvj.exe72⤵PID:1012
-
\??\c:\ffrrrrf.exec:\ffrrrrf.exe73⤵PID:2884
-
\??\c:\7btnbb.exec:\7btnbb.exe74⤵PID:2844
-
\??\c:\llrxflr.exec:\llrxflr.exe75⤵PID:2012
-
\??\c:\5nhhth.exec:\5nhhth.exe76⤵PID:2860
-
\??\c:\nntthh.exec:\nntthh.exe77⤵PID:2740
-
\??\c:\7dddd.exec:\7dddd.exe78⤵PID:2968
-
\??\c:\5xffffr.exec:\5xffffr.exe79⤵PID:2716
-
\??\c:\ppjvd.exec:\ppjvd.exe80⤵PID:1488
-
\??\c:\lrffllr.exec:\lrffllr.exe81⤵PID:2652
-
\??\c:\tthnnt.exec:\tthnnt.exe82⤵PID:1796
-
\??\c:\xfllrxf.exec:\xfllrxf.exe83⤵PID:2096
-
\??\c:\rrlrxxx.exec:\rrlrxxx.exe84⤵PID:2232
-
\??\c:\bbhnbh.exec:\bbhnbh.exe85⤵PID:3036
-
\??\c:\ppvdj.exec:\ppvdj.exe86⤵PID:2168
-
\??\c:\3dpdj.exec:\3dpdj.exe87⤵PID:1632
-
\??\c:\vvjjv.exec:\vvjjv.exe88⤵PID:2212
-
\??\c:\lllxlxl.exec:\lllxlxl.exe89⤵PID:2776
-
\??\c:\nnhbnt.exec:\nnhbnt.exe90⤵PID:2792
-
\??\c:\1jvdj.exec:\1jvdj.exe91⤵PID:1144
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe92⤵PID:1124
-
\??\c:\hbhthn.exec:\hbhthn.exe93⤵PID:1436
-
\??\c:\ppdpv.exec:\ppdpv.exe94⤵PID:2160
-
\??\c:\rlxrxlx.exec:\rlxrxlx.exe95⤵PID:1140
-
\??\c:\ttbthn.exec:\ttbthn.exe96⤵PID:380
-
\??\c:\vdjdd.exec:\vdjdd.exe97⤵PID:1704
-
\??\c:\9xxlrfl.exec:\9xxlrfl.exe98⤵PID:2468
-
\??\c:\tbttth.exec:\tbttth.exe99⤵PID:3052
-
\??\c:\djjjd.exec:\djjjd.exe100⤵PID:2516
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe101⤵PID:2236
-
\??\c:\nbnbbb.exec:\nbnbbb.exe102⤵PID:1280
-
\??\c:\ttnhbn.exec:\ttnhbn.exe103⤵PID:2460
-
\??\c:\ddppv.exec:\ddppv.exe104⤵PID:1136
-
\??\c:\ffrxllf.exec:\ffrxllf.exe105⤵PID:2896
-
\??\c:\ttthbb.exec:\ttthbb.exe106⤵PID:2032
-
\??\c:\ddpjd.exec:\ddpjd.exe107⤵PID:3000
-
\??\c:\jjppd.exec:\jjppd.exe108⤵PID:396
-
\??\c:\rrxlxfr.exec:\rrxlxfr.exe109⤵PID:864
-
\??\c:\bhbhtb.exec:\bhbhtb.exe110⤵PID:1864
-
\??\c:\jjdvp.exec:\jjdvp.exe111⤵PID:2476
-
\??\c:\flrfllx.exec:\flrfllx.exe112⤵PID:1228
-
\??\c:\tntbnn.exec:\tntbnn.exe113⤵PID:1524
-
\??\c:\ddddv.exec:\ddddv.exe114⤵PID:2852
-
\??\c:\3ppjj.exec:\3ppjj.exe115⤵PID:2848
-
\??\c:\fxflflx.exec:\fxflflx.exe116⤵PID:3012
-
\??\c:\ntnnbh.exec:\ntnnbh.exe117⤵PID:2012
-
\??\c:\ppjpv.exec:\ppjpv.exe118⤵PID:2608
-
\??\c:\lrxfffl.exec:\lrxfffl.exe119⤵PID:2740
-
\??\c:\xlxllrf.exec:\xlxllrf.exe120⤵PID:2692
-
\??\c:\7btthn.exec:\7btthn.exe121⤵PID:2716
-
\??\c:\jvjdp.exec:\jvjdp.exe122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-