Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 00:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe
-
Size
453KB
-
MD5
83b2872cd50c789c1c8ebd47bb626a60
-
SHA1
ec30260d69d7924c1ddcbd3d946f585b537558d7
-
SHA256
d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9
-
SHA512
4a338266ab5f668907725c7b1f04584bddb10905d1495ec3f7c2c902c7c92aa6c2f7f0a70ec9b5fd5e7f61e417c86e60bd644efc778a4073b919bc32d25c05be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbef:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2420-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-809-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2008-896-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-862-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/816-790-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1224-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1500-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-149-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2160-115-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2488-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-1085-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2356 fxxxflr.exe 2412 3nntbn.exe 2348 fxlrflr.exe 2212 3tnhht.exe 2712 pdpvd.exe 2760 hbttbb.exe 2488 dvvvj.exe 2632 rrfrxff.exe 2720 htthhn.exe 2684 jdpvd.exe 2160 rfxrlxf.exe 1568 bnhhnn.exe 2592 ppddj.exe 476 xlrlxrr.exe 1908 1nhnbt.exe 2352 vvpdv.exe 1500 rxrxffr.exe 3048 hbtbbh.exe 2496 xrxxrrf.exe 1224 hhtnbb.exe 1248 dvpdp.exe 2464 xrflrrf.exe 2588 ntnnbt.exe 944 flrxrrx.exe 1800 hhhntt.exe 3000 nhttbh.exe 2304 7rffrfr.exe 2060 nttnhb.exe 2432 1jdpj.exe 1436 frrfrrf.exe 3016 nbtbhn.exe 2520 rxfrfrr.exe 2536 lxlfflr.exe 2372 nhbhtt.exe 2232 dppvp.exe 2688 xrxfrxr.exe 2824 btbbbb.exe 2756 jdpvv.exe 2768 vpdvd.exe 2364 lfxxllx.exe 2660 hbntbh.exe 2856 vjjdd.exe 1756 lrrfxfx.exe 2116 bttnnn.exe 1732 jdddp.exe 2776 pvjdd.exe 2652 flffrfx.exe 1632 hbntbn.exe 568 ttntnn.exe 1736 djdjj.exe 1228 xrrrflx.exe 2344 1tntbh.exe 2900 1nthnh.exe 2440 vvpdv.exe 2200 xrxflrl.exe 1724 ffflffl.exe 1596 nbtnhb.exe 1248 jvvvp.exe 3004 jvppv.exe 2280 xlffrxf.exe 1288 nhtbnt.exe 944 thnbtn.exe 1904 vpdpd.exe 1448 lfxlrfr.exe -
resource yara_rule behavioral1/memory/2420-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-608-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-758-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-870-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-790-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1224-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-1053-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-1066-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2356 2420 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 30 PID 2420 wrote to memory of 2356 2420 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 30 PID 2420 wrote to memory of 2356 2420 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 30 PID 2420 wrote to memory of 2356 2420 d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe 30 PID 2356 wrote to memory of 2412 2356 fxxxflr.exe 101 PID 2356 wrote to memory of 2412 2356 fxxxflr.exe 101 PID 2356 wrote to memory of 2412 2356 fxxxflr.exe 101 PID 2356 wrote to memory of 2412 2356 fxxxflr.exe 101 PID 2412 wrote to memory of 2348 2412 3nntbn.exe 32 PID 2412 wrote to memory of 2348 2412 3nntbn.exe 32 PID 2412 wrote to memory of 2348 2412 3nntbn.exe 32 PID 2412 wrote to memory of 2348 2412 3nntbn.exe 32 PID 2348 wrote to memory of 2212 2348 fxlrflr.exe 33 PID 2348 wrote to memory of 2212 2348 fxlrflr.exe 33 PID 2348 wrote to memory of 2212 2348 fxlrflr.exe 33 PID 2348 wrote to memory of 2212 2348 fxlrflr.exe 33 PID 2212 wrote to memory of 2712 2212 3tnhht.exe 34 PID 2212 wrote to memory of 2712 2212 3tnhht.exe 34 PID 2212 wrote to memory of 2712 2212 3tnhht.exe 34 PID 2212 wrote to memory of 2712 2212 3tnhht.exe 34 PID 2712 wrote to memory of 2760 2712 pdpvd.exe 35 PID 2712 wrote to memory of 2760 2712 pdpvd.exe 35 PID 2712 wrote to memory of 2760 2712 pdpvd.exe 35 PID 2712 wrote to memory of 2760 2712 pdpvd.exe 35 PID 2760 wrote to memory of 2488 2760 hbttbb.exe 36 PID 2760 wrote to memory of 2488 2760 hbttbb.exe 36 PID 2760 wrote to memory of 2488 2760 hbttbb.exe 36 PID 2760 wrote to memory of 2488 2760 hbttbb.exe 36 PID 2488 wrote to memory of 2632 2488 dvvvj.exe 37 PID 2488 wrote to memory of 2632 2488 dvvvj.exe 37 PID 2488 wrote to memory of 2632 2488 dvvvj.exe 37 PID 2488 wrote to memory of 2632 2488 dvvvj.exe 37 PID 2632 wrote to memory of 2720 2632 rrfrxff.exe 38 PID 2632 wrote to memory of 2720 2632 rrfrxff.exe 38 PID 2632 wrote to memory of 2720 2632 rrfrxff.exe 38 PID 2632 wrote to memory of 2720 2632 rrfrxff.exe 38 PID 2720 wrote to memory of 2684 2720 htthhn.exe 113 PID 2720 wrote to memory of 2684 2720 htthhn.exe 113 PID 2720 wrote to memory of 2684 2720 htthhn.exe 113 PID 2720 wrote to memory of 2684 2720 htthhn.exe 113 PID 2684 wrote to memory of 2160 2684 jdpvd.exe 40 PID 2684 wrote to memory of 2160 2684 jdpvd.exe 40 PID 2684 wrote to memory of 2160 2684 jdpvd.exe 40 PID 2684 wrote to memory of 2160 2684 jdpvd.exe 40 PID 2160 wrote to memory of 1568 2160 rfxrlxf.exe 41 PID 2160 wrote to memory of 1568 2160 rfxrlxf.exe 41 PID 2160 wrote to memory of 1568 2160 rfxrlxf.exe 41 PID 2160 wrote to memory of 1568 2160 rfxrlxf.exe 41 PID 1568 wrote to memory of 2592 1568 bnhhnn.exe 42 PID 1568 wrote to memory of 2592 1568 bnhhnn.exe 42 PID 1568 wrote to memory of 2592 1568 bnhhnn.exe 42 PID 1568 wrote to memory of 2592 1568 bnhhnn.exe 42 PID 2592 wrote to memory of 476 2592 ppddj.exe 43 PID 2592 wrote to memory of 476 2592 ppddj.exe 43 PID 2592 wrote to memory of 476 2592 ppddj.exe 43 PID 2592 wrote to memory of 476 2592 ppddj.exe 43 PID 476 wrote to memory of 1908 476 xlrlxrr.exe 44 PID 476 wrote to memory of 1908 476 xlrlxrr.exe 44 PID 476 wrote to memory of 1908 476 xlrlxrr.exe 44 PID 476 wrote to memory of 1908 476 xlrlxrr.exe 44 PID 1908 wrote to memory of 2352 1908 1nhnbt.exe 45 PID 1908 wrote to memory of 2352 1908 1nhnbt.exe 45 PID 1908 wrote to memory of 2352 1908 1nhnbt.exe 45 PID 1908 wrote to memory of 2352 1908 1nhnbt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe"C:\Users\Admin\AppData\Local\Temp\d67f249fac60128582ce8f38163ccdda86ce19d64abb58602a91a591c3c493d9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\fxxxflr.exec:\fxxxflr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\3nntbn.exec:\3nntbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\fxlrflr.exec:\fxlrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\3tnhht.exec:\3tnhht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\pdpvd.exec:\pdpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hbttbb.exec:\hbttbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\dvvvj.exec:\dvvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\rrfrxff.exec:\rrfrxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\htthhn.exec:\htthhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\jdpvd.exec:\jdpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rfxrlxf.exec:\rfxrlxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\bnhhnn.exec:\bnhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\ppddj.exec:\ppddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xlrlxrr.exec:\xlrlxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\1nhnbt.exec:\1nhnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vvpdv.exec:\vvpdv.exe17⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rxrxffr.exec:\rxrxffr.exe18⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hbtbbh.exec:\hbtbbh.exe19⤵
- Executes dropped EXE
PID:3048 -
\??\c:\xrxxrrf.exec:\xrxxrrf.exe20⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hhtnbb.exec:\hhtnbb.exe21⤵
- Executes dropped EXE
PID:1224 -
\??\c:\dvpdp.exec:\dvpdp.exe22⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xrflrrf.exec:\xrflrrf.exe23⤵
- Executes dropped EXE
PID:2464 -
\??\c:\ntnnbt.exec:\ntnnbt.exe24⤵
- Executes dropped EXE
PID:2588 -
\??\c:\flrxrrx.exec:\flrxrrx.exe25⤵
- Executes dropped EXE
PID:944 -
\??\c:\hhhntt.exec:\hhhntt.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhttbh.exec:\nhttbh.exe27⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7rffrfr.exec:\7rffrfr.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nttnhb.exec:\nttnhb.exe29⤵
- Executes dropped EXE
PID:2060 -
\??\c:\1jdpj.exec:\1jdpj.exe30⤵
- Executes dropped EXE
PID:2432 -
\??\c:\frrfrrf.exec:\frrfrrf.exe31⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nbtbhn.exec:\nbtbhn.exe32⤵
- Executes dropped EXE
PID:3016 -
\??\c:\rxfrfrr.exec:\rxfrfrr.exe33⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lxlfflr.exec:\lxlfflr.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\nhbhtt.exec:\nhbhtt.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dppvp.exec:\dppvp.exe36⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xrxfrxr.exec:\xrxfrxr.exe37⤵
- Executes dropped EXE
PID:2688 -
\??\c:\btbbbb.exec:\btbbbb.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jdpvv.exec:\jdpvv.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vpdvd.exec:\vpdvd.exe40⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lfxxllx.exec:\lfxxllx.exe41⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hbntbh.exec:\hbntbh.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vjjdd.exec:\vjjdd.exe43⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lrrfxfx.exec:\lrrfxfx.exe44⤵
- Executes dropped EXE
PID:1756 -
\??\c:\bttnnn.exec:\bttnnn.exe45⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jdddp.exec:\jdddp.exe46⤵
- Executes dropped EXE
PID:1732 -
\??\c:\pvjdd.exec:\pvjdd.exe47⤵
- Executes dropped EXE
PID:2776 -
\??\c:\flffrfx.exec:\flffrfx.exe48⤵
- Executes dropped EXE
PID:2652 -
\??\c:\hbntbn.exec:\hbntbn.exe49⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ttntnn.exec:\ttntnn.exe50⤵
- Executes dropped EXE
PID:568 -
\??\c:\djdjj.exec:\djdjj.exe51⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrrrflx.exec:\xrrrflx.exe52⤵
- Executes dropped EXE
PID:1228 -
\??\c:\1tntbh.exec:\1tntbh.exe53⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1nthnh.exec:\1nthnh.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vvpdv.exec:\vvpdv.exe55⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrxflrl.exec:\xrxflrl.exe56⤵
- Executes dropped EXE
PID:2200 -
\??\c:\ffflffl.exec:\ffflffl.exe57⤵
- Executes dropped EXE
PID:1724 -
\??\c:\nbtnhb.exec:\nbtnhb.exe58⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jvvvp.exec:\jvvvp.exe59⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jvppv.exec:\jvppv.exe60⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xlffrxf.exec:\xlffrxf.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nhtbnt.exec:\nhtbnt.exe62⤵
- Executes dropped EXE
PID:1288 -
\??\c:\thnbtn.exec:\thnbtn.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\vpdpd.exec:\vpdpd.exe64⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lfxlrfr.exec:\lfxlrfr.exe65⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xxxfrxl.exec:\xxxfrxl.exe66⤵PID:1124
-
\??\c:\9nhthn.exec:\9nhthn.exe67⤵PID:3024
-
\??\c:\bbtnbn.exec:\bbtnbn.exe68⤵PID:2060
-
\??\c:\jjjpp.exec:\jjjpp.exe69⤵PID:1216
-
\??\c:\fllxflx.exec:\fllxflx.exe70⤵PID:316
-
\??\c:\5lflxxr.exec:\5lflxxr.exe71⤵PID:2408
-
\??\c:\7hbhbn.exec:\7hbhbn.exe72⤵PID:2044
-
\??\c:\nbntbh.exec:\nbntbh.exe73⤵PID:2412
-
\??\c:\jppvp.exec:\jppvp.exe74⤵PID:2316
-
\??\c:\xrlxlrl.exec:\xrlxlrl.exe75⤵PID:1944
-
\??\c:\3bhbth.exec:\3bhbth.exe76⤵PID:2916
-
\??\c:\nhthtn.exec:\nhthtn.exe77⤵PID:2816
-
\??\c:\7pdjv.exec:\7pdjv.exe78⤵PID:1772
-
\??\c:\rrxlfrf.exec:\rrxlfrf.exe79⤵PID:1968
-
\??\c:\rlrfflx.exec:\rlrfflx.exe80⤵PID:2576
-
\??\c:\bnbnbb.exec:\bnbnbb.exe81⤵PID:2880
-
\??\c:\httbbh.exec:\httbbh.exe82⤵PID:2632
-
\??\c:\9dvpv.exec:\9dvpv.exe83⤵PID:2604
-
\??\c:\lflxxxf.exec:\lflxxxf.exe84⤵PID:3056
-
\??\c:\xxlxrfx.exec:\xxlxrfx.exe85⤵PID:2684
-
\??\c:\9bnthn.exec:\9bnthn.exe86⤵PID:2940
-
\??\c:\pppvj.exec:\pppvj.exe87⤵PID:1412
-
\??\c:\5dvdp.exec:\5dvdp.exe88⤵PID:2708
-
\??\c:\9rxfrxl.exec:\9rxfrxl.exe89⤵PID:2624
-
\??\c:\bbntnt.exec:\bbntnt.exe90⤵PID:1144
-
\??\c:\pppdj.exec:\pppdj.exe91⤵PID:1364
-
\??\c:\dvjvd.exec:\dvjvd.exe92⤵PID:1468
-
\??\c:\9lllrxl.exec:\9lllrxl.exe93⤵PID:1588
-
\??\c:\hbnhnt.exec:\hbnhnt.exe94⤵PID:1072
-
\??\c:\ttnbnh.exec:\ttnbnh.exe95⤵PID:1900
-
\??\c:\jdvjj.exec:\jdvjj.exe96⤵PID:2852
-
\??\c:\5xlxlrf.exec:\5xlxlrf.exe97⤵PID:852
-
\??\c:\xrlxfrf.exec:\xrlxfrf.exe98⤵PID:1584
-
\??\c:\ttntnb.exec:\ttntnb.exe99⤵PID:576
-
\??\c:\pjjvp.exec:\pjjvp.exe100⤵PID:1836
-
\??\c:\7pvdp.exec:\7pvdp.exe101⤵PID:2132
-
\??\c:\rllrxxr.exec:\rllrxxr.exe102⤵PID:304
-
\??\c:\hnbtnn.exec:\hnbtnn.exe103⤵PID:2384
-
\??\c:\bbbnht.exec:\bbbnht.exe104⤵PID:2036
-
\??\c:\pvjdp.exec:\pvjdp.exe105⤵PID:2952
-
\??\c:\1fxlllr.exec:\1fxlllr.exe106⤵PID:1052
-
\??\c:\9rxrrrl.exec:\9rxrrrl.exe107⤵PID:2120
-
\??\c:\nbbhth.exec:\nbbhth.exe108⤵PID:816
-
\??\c:\jjjpd.exec:\jjjpd.exe109⤵PID:2276
-
\??\c:\7dpdd.exec:\7dpdd.exe110⤵PID:2948
-
\??\c:\xxxffrf.exec:\xxxffrf.exe111⤵PID:3032
-
\??\c:\7ntttn.exec:\7ntttn.exe112⤵PID:2192
-
\??\c:\nhthhh.exec:\nhthhh.exe113⤵PID:2544
-
\??\c:\pvvjj.exec:\pvvjj.exe114⤵PID:2004
-
\??\c:\jpppv.exec:\jpppv.exe115⤵PID:2532
-
\??\c:\rrrlrxl.exec:\rrrlrxl.exe116⤵PID:2044
-
\??\c:\nhnthb.exec:\nhnthb.exe117⤵PID:2104
-
\??\c:\7pvpj.exec:\7pvpj.exe118⤵PID:2308
-
\??\c:\vvjvv.exec:\vvjvv.exe119⤵PID:2240
-
\??\c:\xlxxllr.exec:\xlxxllr.exe120⤵PID:2084
-
\??\c:\thtbhn.exec:\thtbhn.exe121⤵PID:2980
-
\??\c:\ntnbbt.exec:\ntnbbt.exe122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-