Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 01:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe
-
Size
455KB
-
MD5
93c625ca7c4acb83168b86b0737867a6
-
SHA1
5ed3038241c333282eb27b878c9e6654f8fdfbfc
-
SHA256
a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603
-
SHA512
77635d300ad6dca7ff3ea8e3d142f1001ae2a7cf436406f8929876ce72bb4810bb44f46782edaebc9dd5939ed2d1b044c68a640ee2dd996ff000edcf83fd9cc3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRL:q7Tc2NYHUrAwfMp3CDRL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-25-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2676-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-44-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-104-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1060-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-127-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1960-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1172-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-457-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-609-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2136-612-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/576-672-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-710-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-774-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1404-981-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2904-995-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2904-1016-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/844-1066-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3040 fffflrf.exe 2684 jdjpd.exe 2676 bhtbnt.exe 2656 9httbh.exe 2636 lfrlllr.exe 2572 dvdjp.exe 2500 5xrxllr.exe 2508 dddvj.exe 536 fxlrxxf.exe 1060 hbnbhn.exe 2784 ffxlxxf.exe 2980 bthnnn.exe 1568 llxrxrx.exe 1232 rxflflf.exe 1960 dpjdp.exe 2444 hhhbbb.exe 2808 9dvvd.exe 2288 9thbbt.exe 2388 7rlrxxf.exe 2064 tbthbt.exe 1928 7vpjv.exe 1172 rrlxrfx.exe 444 9dddj.exe 828 lrfxffx.exe 1184 ppvpj.exe 1204 fxrrxxl.exe 1732 pppvj.exe 1936 fflrlxl.exe 1596 hnhnhh.exe 1436 ddpdp.exe 2384 htbbhh.exe 892 9ddjv.exe 2260 flrlrfx.exe 1528 btnnnt.exe 2136 jvpdv.exe 3040 ppjvj.exe 2728 1lxxlxf.exe 2588 1btbnh.exe 2676 pjvpd.exe 2424 ppdpd.exe 2596 flrlflx.exe 2632 bhhnbh.exe 2524 jdpvp.exe 2996 ffxflll.exe 2108 hhthnn.exe 2508 nnnnbh.exe 592 pjvjv.exe 708 rxrflrf.exe 2812 hhhnbh.exe 2784 pjdjd.exe 2976 vvpvv.exe 1656 rxrfrrf.exe 1568 tththt.exe 1548 hbnntb.exe 1856 vddpv.exe 1960 xxxlfrf.exe 1680 hhhtnb.exe 1456 vppvp.exe 2808 flrlflr.exe 2128 1nhhtt.exe 2440 tntbht.exe 2860 ddppd.exe 2120 rllrfrf.exe 2872 tnbhtb.exe -
resource yara_rule behavioral1/memory/2132-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-457-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-612-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/576-672-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-823-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-921-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-1066-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-1074-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 3040 2132 a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe 28 PID 2132 wrote to memory of 3040 2132 a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe 28 PID 2132 wrote to memory of 3040 2132 a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe 28 PID 2132 wrote to memory of 3040 2132 a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe 28 PID 3040 wrote to memory of 2684 3040 fffflrf.exe 29 PID 3040 wrote to memory of 2684 3040 fffflrf.exe 29 PID 3040 wrote to memory of 2684 3040 fffflrf.exe 29 PID 3040 wrote to memory of 2684 3040 fffflrf.exe 29 PID 2684 wrote to memory of 2676 2684 jdjpd.exe 30 PID 2684 wrote to memory of 2676 2684 jdjpd.exe 30 PID 2684 wrote to memory of 2676 2684 jdjpd.exe 30 PID 2684 wrote to memory of 2676 2684 jdjpd.exe 30 PID 2676 wrote to memory of 2656 2676 bhtbnt.exe 31 PID 2676 wrote to memory of 2656 2676 bhtbnt.exe 31 PID 2676 wrote to memory of 2656 2676 bhtbnt.exe 31 PID 2676 wrote to memory of 2656 2676 bhtbnt.exe 31 PID 2656 wrote to memory of 2636 2656 9httbh.exe 32 PID 2656 wrote to memory of 2636 2656 9httbh.exe 32 PID 2656 wrote to memory of 2636 2656 9httbh.exe 32 PID 2656 wrote to memory of 2636 2656 9httbh.exe 32 PID 2636 wrote to memory of 2572 2636 lfrlllr.exe 33 PID 2636 wrote to memory of 2572 2636 lfrlllr.exe 33 PID 2636 wrote to memory of 2572 2636 lfrlllr.exe 33 PID 2636 wrote to memory of 2572 2636 lfrlllr.exe 33 PID 2572 wrote to memory of 2500 2572 dvdjp.exe 34 PID 2572 wrote to memory of 2500 2572 dvdjp.exe 34 PID 2572 wrote to memory of 2500 2572 dvdjp.exe 34 PID 2572 wrote to memory of 2500 2572 dvdjp.exe 34 PID 2500 wrote to memory of 2508 2500 5xrxllr.exe 35 PID 2500 wrote to memory of 2508 2500 5xrxllr.exe 35 PID 2500 wrote to memory of 2508 2500 5xrxllr.exe 35 PID 2500 wrote to memory of 2508 2500 5xrxllr.exe 35 PID 2508 wrote to memory of 536 2508 dddvj.exe 36 PID 2508 wrote to memory of 536 2508 dddvj.exe 36 PID 2508 wrote to memory of 536 2508 dddvj.exe 36 PID 2508 wrote to memory of 536 2508 dddvj.exe 36 PID 536 wrote to memory of 1060 536 fxlrxxf.exe 37 PID 536 wrote to memory of 1060 536 fxlrxxf.exe 37 PID 536 wrote to memory of 1060 536 fxlrxxf.exe 37 PID 536 wrote to memory of 1060 536 fxlrxxf.exe 37 PID 1060 wrote to memory of 2784 1060 hbnbhn.exe 38 PID 1060 wrote to memory of 2784 1060 hbnbhn.exe 38 PID 1060 wrote to memory of 2784 1060 hbnbhn.exe 38 PID 1060 wrote to memory of 2784 1060 hbnbhn.exe 38 PID 2784 wrote to memory of 2980 2784 ffxlxxf.exe 39 PID 2784 wrote to memory of 2980 2784 ffxlxxf.exe 39 PID 2784 wrote to memory of 2980 2784 ffxlxxf.exe 39 PID 2784 wrote to memory of 2980 2784 ffxlxxf.exe 39 PID 2980 wrote to memory of 1568 2980 bthnnn.exe 40 PID 2980 wrote to memory of 1568 2980 bthnnn.exe 40 PID 2980 wrote to memory of 1568 2980 bthnnn.exe 40 PID 2980 wrote to memory of 1568 2980 bthnnn.exe 40 PID 1568 wrote to memory of 1232 1568 llxrxrx.exe 41 PID 1568 wrote to memory of 1232 1568 llxrxrx.exe 41 PID 1568 wrote to memory of 1232 1568 llxrxrx.exe 41 PID 1568 wrote to memory of 1232 1568 llxrxrx.exe 41 PID 1232 wrote to memory of 1960 1232 rxflflf.exe 42 PID 1232 wrote to memory of 1960 1232 rxflflf.exe 42 PID 1232 wrote to memory of 1960 1232 rxflflf.exe 42 PID 1232 wrote to memory of 1960 1232 rxflflf.exe 42 PID 1960 wrote to memory of 2444 1960 dpjdp.exe 43 PID 1960 wrote to memory of 2444 1960 dpjdp.exe 43 PID 1960 wrote to memory of 2444 1960 dpjdp.exe 43 PID 1960 wrote to memory of 2444 1960 dpjdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe"C:\Users\Admin\AppData\Local\Temp\a3bb5a8cdc9d92838f6a8f9886d1e298baf619cf851d90aaa9812991f0038603.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\fffflrf.exec:\fffflrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\jdjpd.exec:\jdjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bhtbnt.exec:\bhtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9httbh.exec:\9httbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\lfrlllr.exec:\lfrlllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\dvdjp.exec:\dvdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\5xrxllr.exec:\5xrxllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\dddvj.exec:\dddvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hbnbhn.exec:\hbnbhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\ffxlxxf.exec:\ffxlxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bthnnn.exec:\bthnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\llxrxrx.exec:\llxrxrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\rxflflf.exec:\rxflflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\dpjdp.exec:\dpjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\hhhbbb.exec:\hhhbbb.exe17⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9dvvd.exec:\9dvvd.exe18⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9thbbt.exec:\9thbbt.exe19⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7rlrxxf.exec:\7rlrxxf.exe20⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tbthbt.exec:\tbthbt.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\7vpjv.exec:\7vpjv.exe22⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rrlxrfx.exec:\rrlxrfx.exe23⤵
- Executes dropped EXE
PID:1172 -
\??\c:\9dddj.exec:\9dddj.exe24⤵
- Executes dropped EXE
PID:444 -
\??\c:\lrfxffx.exec:\lrfxffx.exe25⤵
- Executes dropped EXE
PID:828 -
\??\c:\ppvpj.exec:\ppvpj.exe26⤵
- Executes dropped EXE
PID:1184 -
\??\c:\fxrrxxl.exec:\fxrrxxl.exe27⤵
- Executes dropped EXE
PID:1204 -
\??\c:\pppvj.exec:\pppvj.exe28⤵
- Executes dropped EXE
PID:1732 -
\??\c:\fflrlxl.exec:\fflrlxl.exe29⤵
- Executes dropped EXE
PID:1936 -
\??\c:\hnhnhh.exec:\hnhnhh.exe30⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddpdp.exec:\ddpdp.exe31⤵
- Executes dropped EXE
PID:1436 -
\??\c:\htbbhh.exec:\htbbhh.exe32⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9ddjv.exec:\9ddjv.exe33⤵
- Executes dropped EXE
PID:892 -
\??\c:\flrlrfx.exec:\flrlrfx.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\btnnnt.exec:\btnnnt.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jvpdv.exec:\jvpdv.exe36⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ppjvj.exec:\ppjvj.exe37⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1lxxlxf.exec:\1lxxlxf.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1btbnh.exec:\1btbnh.exe39⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pjvpd.exec:\pjvpd.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\ppdpd.exec:\ppdpd.exe41⤵
- Executes dropped EXE
PID:2424 -
\??\c:\flrlflx.exec:\flrlflx.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bhhnbh.exec:\bhhnbh.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\jdpvp.exec:\jdpvp.exe44⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ffxflll.exec:\ffxflll.exe45⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hhthnn.exec:\hhthnn.exe46⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nnnnbh.exec:\nnnnbh.exe47⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pjvjv.exec:\pjvjv.exe48⤵
- Executes dropped EXE
PID:592 -
\??\c:\rxrflrf.exec:\rxrflrf.exe49⤵
- Executes dropped EXE
PID:708 -
\??\c:\hhhnbh.exec:\hhhnbh.exe50⤵
- Executes dropped EXE
PID:2812 -
\??\c:\pjdjd.exec:\pjdjd.exe51⤵
- Executes dropped EXE
PID:2784 -
\??\c:\vvpvv.exec:\vvpvv.exe52⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rxrfrrf.exec:\rxrfrrf.exe53⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tththt.exec:\tththt.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hbnntb.exec:\hbnntb.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\vddpv.exec:\vddpv.exe56⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe57⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhhtnb.exec:\hhhtnb.exe58⤵
- Executes dropped EXE
PID:1680 -
\??\c:\vppvp.exec:\vppvp.exe59⤵
- Executes dropped EXE
PID:1456 -
\??\c:\flrlflr.exec:\flrlflr.exe60⤵
- Executes dropped EXE
PID:2808 -
\??\c:\1nhhtt.exec:\1nhhtt.exe61⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tntbht.exec:\tntbht.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ddppd.exec:\ddppd.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rllrfrf.exec:\rllrfrf.exe64⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnbhtb.exec:\tnbhtb.exe65⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pdpvd.exec:\pdpvd.exe66⤵PID:2900
-
\??\c:\lfllrlx.exec:\lfllrlx.exe67⤵PID:2164
-
\??\c:\rlxflxl.exec:\rlxflxl.exe68⤵PID:2032
-
\??\c:\5btthn.exec:\5btthn.exe69⤵PID:3052
-
\??\c:\5vpdp.exec:\5vpdp.exe70⤵PID:1200
-
\??\c:\xrxlrfl.exec:\xrxlrfl.exe71⤵PID:1072
-
\??\c:\hthntt.exec:\hthntt.exe72⤵PID:1708
-
\??\c:\jjddp.exec:\jjddp.exe73⤵PID:932
-
\??\c:\9lxfllx.exec:\9lxfllx.exe74⤵PID:1932
-
\??\c:\9rxffrx.exec:\9rxffrx.exe75⤵PID:2372
-
\??\c:\ttnthn.exec:\ttnthn.exe76⤵PID:2360
-
\??\c:\jdpdp.exec:\jdpdp.exe77⤵PID:900
-
\??\c:\frlfrlf.exec:\frlfrlf.exe78⤵PID:1888
-
\??\c:\5nbhnt.exec:\5nbhnt.exe79⤵PID:1652
-
\??\c:\jdjvv.exec:\jdjvv.exe80⤵PID:1632
-
\??\c:\pdpvv.exec:\pdpvv.exe81⤵
- System Location Discovery: System Language Discovery
PID:1528 -
\??\c:\1lfxlrr.exec:\1lfxlrr.exe82⤵PID:2136
-
\??\c:\btnthh.exec:\btnthh.exe83⤵PID:2732
-
\??\c:\pdddj.exec:\pdddj.exe84⤵PID:2576
-
\??\c:\1lflrfx.exec:\1lflrfx.exe85⤵PID:2832
-
\??\c:\xffrfxr.exec:\xffrfxr.exe86⤵PID:2492
-
\??\c:\ttnnbn.exec:\ttnnbn.exe87⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\dpppp.exec:\dpppp.exe88⤵PID:2504
-
\??\c:\ffrrffx.exec:\ffrrffx.exe89⤵PID:2632
-
\??\c:\tbbtbt.exec:\tbbtbt.exe90⤵PID:2932
-
\??\c:\nbtbhn.exec:\nbtbhn.exe91⤵PID:576
-
\??\c:\pjvvj.exec:\pjvvj.exe92⤵PID:2108
-
\??\c:\lffxxxf.exec:\lffxxxf.exe93⤵PID:2508
-
\??\c:\7hthth.exec:\7hthth.exe94⤵PID:1572
-
\??\c:\nhtnbh.exec:\nhtnbh.exe95⤵PID:2772
-
\??\c:\vjvvv.exec:\vjvvv.exe96⤵PID:2796
-
\??\c:\rxxfxrf.exec:\rxxfxrf.exe97⤵PID:2924
-
\??\c:\3htttb.exec:\3htttb.exe98⤵PID:2744
-
\??\c:\tnhntb.exec:\tnhntb.exe99⤵PID:1728
-
\??\c:\jdpdj.exec:\jdpdj.exe100⤵PID:2020
-
\??\c:\rllrxfx.exec:\rllrxfx.exe101⤵PID:2196
-
\??\c:\1nbntt.exec:\1nbntt.exe102⤵PID:2428
-
\??\c:\bnhnnt.exec:\bnhnnt.exe103⤵PID:2520
-
\??\c:\9jdjd.exec:\9jdjd.exe104⤵PID:1680
-
\??\c:\frflrxf.exec:\frflrxf.exe105⤵PID:2068
-
\??\c:\lfxxrrf.exec:\lfxxrrf.exe106⤵PID:2104
-
\??\c:\7htbbh.exec:\7htbbh.exe107⤵PID:2844
-
\??\c:\3htttb.exec:\3htttb.exe108⤵PID:1608
-
\??\c:\dvjdj.exec:\dvjdj.exe109⤵PID:2436
-
\??\c:\xrfllfx.exec:\xrfllfx.exe110⤵PID:2876
-
\??\c:\nhbnbh.exec:\nhbnbh.exe111⤵PID:2872
-
\??\c:\dpjpj.exec:\dpjpj.exe112⤵PID:2900
-
\??\c:\3llrlfx.exec:\3llrlfx.exe113⤵PID:2792
-
\??\c:\3bbbnn.exec:\3bbbnn.exe114⤵PID:2308
-
\??\c:\9jjpv.exec:\9jjpv.exe115⤵PID:2404
-
\??\c:\5lflrrx.exec:\5lflrrx.exe116⤵PID:1200
-
\??\c:\5ddjj.exec:\5ddjj.exe117⤵PID:1072
-
\??\c:\dpjpp.exec:\dpjpp.exe118⤵PID:572
-
\??\c:\frflrll.exec:\frflrll.exe119⤵PID:1936
-
\??\c:\thbtbt.exec:\thbtbt.exe120⤵PID:2396
-
\??\c:\dddpj.exec:\dddpj.exe121⤵PID:2240
-
\??\c:\xlffrlr.exec:\xlffrlr.exe122⤵PID:2384
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-