Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe
-
Size
454KB
-
MD5
41eb7578cc7fc82e14a32a8875ede202
-
SHA1
db5c4f47082b3ebd99a1e414599a127e29bf7127
-
SHA256
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217
-
SHA512
6e0526104efce0ffed26c02c400cb6eb3feb80b773994e31b357bf02863603702fcbbd199dfe3ce35f706d281fc64f53f72df3058357cd81c7ec03bc4ef2971e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ6:q7Tc2NYHUrAwfMp3CDJ6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2796-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-150-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1240-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-252-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-306-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1940-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1340-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1832-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-444-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-463-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-540-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2620-615-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2280-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-634-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2196-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-739-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2108-840-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2716-856-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-863-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2772-913-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2820 hhtbbt.exe 2852 5pjvj.exe 2872 ddvvd.exe 2720 nnnnhh.exe 2568 pjjvj.exe 2724 3bbnbn.exe 2332 1ppdd.exe 1096 9thnbb.exe 2776 pvpvj.exe 2972 9ffrlrl.exe 836 vpjpj.exe 1780 3bttbh.exe 1832 pdvdp.exe 1496 hnhttt.exe 1892 7vjdp.exe 1240 tnbhnt.exe 2396 pdddd.exe 2424 ttnbbn.exe 2168 vdvpp.exe 2520 bthhnt.exe 1296 btnnht.exe 1600 ttthhb.exe 1320 vvvvj.exe 2444 hhtbhb.exe 1772 9pppv.exe 1752 9btthb.exe 2372 ththnt.exe 2496 vvdjv.exe 2252 3lflllr.exe 1000 5dddj.exe 2904 ffxxxll.exe 2796 9dvdj.exe 2792 xxrxlrx.exe 2672 vvpjd.exe 2224 vjdpd.exe 3020 lxxxffl.exe 2692 bnhnbh.exe 2620 vvpdv.exe 2568 lfrxfrr.exe 2724 tnhbnh.exe 2280 jvpvj.exe 1940 ffxxffr.exe 2860 rrxfffr.exe 3012 lxxfffl.exe 2596 thbtbb.exe 288 vppvj.exe 1340 rrrfxxr.exe 1616 hthnnn.exe 1880 5lxlrrx.exe 1832 nhbbnn.exe 2948 vjdpd.exe 1896 rxlflfr.exe 2244 fxflrxx.exe 2212 bthtbh.exe 2176 jvjvj.exe 440 rlfflrl.exe 1132 thbhnt.exe 2088 dvdjd.exe 2376 lxffllr.exe 1188 lfrrflf.exe 760 7httbb.exe 1072 5jvdj.exe 1320 xlfxfll.exe 1808 xrflrrl.exe -
resource yara_rule behavioral1/memory/2796-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-150-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2396-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-252-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1340-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1832-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-444-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-634-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2196-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-682-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-829-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2716-856-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-864-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-914-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 2820 2796 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 31 PID 2796 wrote to memory of 2820 2796 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 31 PID 2796 wrote to memory of 2820 2796 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 31 PID 2796 wrote to memory of 2820 2796 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 31 PID 2820 wrote to memory of 2852 2820 hhtbbt.exe 32 PID 2820 wrote to memory of 2852 2820 hhtbbt.exe 32 PID 2820 wrote to memory of 2852 2820 hhtbbt.exe 32 PID 2820 wrote to memory of 2852 2820 hhtbbt.exe 32 PID 2852 wrote to memory of 2872 2852 5pjvj.exe 33 PID 2852 wrote to memory of 2872 2852 5pjvj.exe 33 PID 2852 wrote to memory of 2872 2852 5pjvj.exe 33 PID 2852 wrote to memory of 2872 2852 5pjvj.exe 33 PID 2872 wrote to memory of 2720 2872 ddvvd.exe 34 PID 2872 wrote to memory of 2720 2872 ddvvd.exe 34 PID 2872 wrote to memory of 2720 2872 ddvvd.exe 34 PID 2872 wrote to memory of 2720 2872 ddvvd.exe 34 PID 2720 wrote to memory of 2568 2720 nnnnhh.exe 35 PID 2720 wrote to memory of 2568 2720 nnnnhh.exe 35 PID 2720 wrote to memory of 2568 2720 nnnnhh.exe 35 PID 2720 wrote to memory of 2568 2720 nnnnhh.exe 35 PID 2568 wrote to memory of 2724 2568 pjjvj.exe 36 PID 2568 wrote to memory of 2724 2568 pjjvj.exe 36 PID 2568 wrote to memory of 2724 2568 pjjvj.exe 36 PID 2568 wrote to memory of 2724 2568 pjjvj.exe 36 PID 2724 wrote to memory of 2332 2724 3bbnbn.exe 37 PID 2724 wrote to memory of 2332 2724 3bbnbn.exe 37 PID 2724 wrote to memory of 2332 2724 3bbnbn.exe 37 PID 2724 wrote to memory of 2332 2724 3bbnbn.exe 37 PID 2332 wrote to memory of 1096 2332 1ppdd.exe 38 PID 2332 wrote to memory of 1096 2332 1ppdd.exe 38 PID 2332 wrote to memory of 1096 2332 1ppdd.exe 38 PID 2332 wrote to memory of 1096 2332 1ppdd.exe 38 PID 1096 wrote to memory of 2776 1096 9thnbb.exe 39 PID 1096 wrote to memory of 2776 1096 9thnbb.exe 39 PID 1096 wrote to memory of 2776 1096 9thnbb.exe 39 PID 1096 wrote to memory of 2776 1096 9thnbb.exe 39 PID 2776 wrote to memory of 2972 2776 pvpvj.exe 40 PID 2776 wrote to memory of 2972 2776 pvpvj.exe 40 PID 2776 wrote to memory of 2972 2776 pvpvj.exe 40 PID 2776 wrote to memory of 2972 2776 pvpvj.exe 40 PID 2972 wrote to memory of 836 2972 9ffrlrl.exe 41 PID 2972 wrote to memory of 836 2972 9ffrlrl.exe 41 PID 2972 wrote to memory of 836 2972 9ffrlrl.exe 41 PID 2972 wrote to memory of 836 2972 9ffrlrl.exe 41 PID 836 wrote to memory of 1780 836 vpjpj.exe 42 PID 836 wrote to memory of 1780 836 vpjpj.exe 42 PID 836 wrote to memory of 1780 836 vpjpj.exe 42 PID 836 wrote to memory of 1780 836 vpjpj.exe 42 PID 1780 wrote to memory of 1832 1780 3bttbh.exe 43 PID 1780 wrote to memory of 1832 1780 3bttbh.exe 43 PID 1780 wrote to memory of 1832 1780 3bttbh.exe 43 PID 1780 wrote to memory of 1832 1780 3bttbh.exe 43 PID 1832 wrote to memory of 1496 1832 pdvdp.exe 44 PID 1832 wrote to memory of 1496 1832 pdvdp.exe 44 PID 1832 wrote to memory of 1496 1832 pdvdp.exe 44 PID 1832 wrote to memory of 1496 1832 pdvdp.exe 44 PID 1496 wrote to memory of 1892 1496 hnhttt.exe 45 PID 1496 wrote to memory of 1892 1496 hnhttt.exe 45 PID 1496 wrote to memory of 1892 1496 hnhttt.exe 45 PID 1496 wrote to memory of 1892 1496 hnhttt.exe 45 PID 1892 wrote to memory of 1240 1892 7vjdp.exe 46 PID 1892 wrote to memory of 1240 1892 7vjdp.exe 46 PID 1892 wrote to memory of 1240 1892 7vjdp.exe 46 PID 1892 wrote to memory of 1240 1892 7vjdp.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe"C:\Users\Admin\AppData\Local\Temp\b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\hhtbbt.exec:\hhtbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5pjvj.exec:\5pjvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ddvvd.exec:\ddvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\nnnnhh.exec:\nnnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\pjjvj.exec:\pjjvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\3bbnbn.exec:\3bbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\1ppdd.exec:\1ppdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\9thnbb.exec:\9thnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\pvpvj.exec:\pvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\9ffrlrl.exec:\9ffrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vpjpj.exec:\vpjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\3bttbh.exec:\3bttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\pdvdp.exec:\pdvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\hnhttt.exec:\hnhttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\7vjdp.exec:\7vjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\tnbhnt.exec:\tnbhnt.exe17⤵
- Executes dropped EXE
PID:1240 -
\??\c:\pdddd.exec:\pdddd.exe18⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ttnbbn.exec:\ttnbbn.exe19⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vdvpp.exec:\vdvpp.exe20⤵
- Executes dropped EXE
PID:2168 -
\??\c:\bthhnt.exec:\bthhnt.exe21⤵
- Executes dropped EXE
PID:2520 -
\??\c:\btnnht.exec:\btnnht.exe22⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ttthhb.exec:\ttthhb.exe23⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vvvvj.exec:\vvvvj.exe24⤵
- Executes dropped EXE
PID:1320 -
\??\c:\hhtbhb.exec:\hhtbhb.exe25⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9pppv.exec:\9pppv.exe26⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9btthb.exec:\9btthb.exe27⤵
- Executes dropped EXE
PID:1752 -
\??\c:\ththnt.exec:\ththnt.exe28⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vvdjv.exec:\vvdjv.exe29⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3lflllr.exec:\3lflllr.exe30⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5dddj.exec:\5dddj.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\ffxxxll.exec:\ffxxxll.exe32⤵
- Executes dropped EXE
PID:2904 -
\??\c:\9dvdj.exec:\9dvdj.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xxrxlrx.exec:\xxrxlrx.exe34⤵
- Executes dropped EXE
PID:2792 -
\??\c:\vvpjd.exec:\vvpjd.exe35⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vjdpd.exec:\vjdpd.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lxxxffl.exec:\lxxxffl.exe37⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bnhnbh.exec:\bnhnbh.exe38⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vvpdv.exec:\vvpdv.exe39⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lfrxfrr.exec:\lfrxfrr.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\tnhbnh.exec:\tnhbnh.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jvpvj.exec:\jvpvj.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ffxxffr.exec:\ffxxffr.exe43⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrxfffr.exec:\rrxfffr.exe44⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lxxfffl.exec:\lxxfffl.exe45⤵
- Executes dropped EXE
PID:3012 -
\??\c:\thbtbb.exec:\thbtbb.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vppvj.exec:\vppvj.exe47⤵
- Executes dropped EXE
PID:288 -
\??\c:\rrrfxxr.exec:\rrrfxxr.exe48⤵
- Executes dropped EXE
PID:1340 -
\??\c:\hthnnn.exec:\hthnnn.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\5lxlrrx.exec:\5lxlrrx.exe50⤵
- Executes dropped EXE
PID:1880 -
\??\c:\nhbbnn.exec:\nhbbnn.exe51⤵
- Executes dropped EXE
PID:1832 -
\??\c:\vjdpd.exec:\vjdpd.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rxlflfr.exec:\rxlflfr.exe53⤵
- Executes dropped EXE
PID:1896 -
\??\c:\fxflrxx.exec:\fxflrxx.exe54⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bthtbh.exec:\bthtbh.exe55⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jvjvj.exec:\jvjvj.exe56⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlfflrl.exec:\rlfflrl.exe57⤵
- Executes dropped EXE
PID:440 -
\??\c:\thbhnt.exec:\thbhnt.exe58⤵
- Executes dropped EXE
PID:1132 -
\??\c:\dvdjd.exec:\dvdjd.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\lxffllr.exec:\lxffllr.exe60⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lfrrflf.exec:\lfrrflf.exe61⤵
- Executes dropped EXE
PID:1188 -
\??\c:\7httbb.exec:\7httbb.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\5jvdj.exec:\5jvdj.exe63⤵
- Executes dropped EXE
PID:1072 -
\??\c:\xlfxfll.exec:\xlfxfll.exe64⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xrflrrl.exec:\xrflrrl.exe65⤵
- Executes dropped EXE
PID:1808 -
\??\c:\bthnbt.exec:\bthnbt.exe66⤵PID:1624
-
\??\c:\1pdpv.exec:\1pdpv.exe67⤵PID:2152
-
\??\c:\xlfxffl.exec:\xlfxffl.exe68⤵PID:2056
-
\??\c:\lxllffr.exec:\lxllffr.exe69⤵PID:1040
-
\??\c:\hhhntt.exec:\hhhntt.exe70⤵PID:2368
-
\??\c:\dvjpv.exec:\dvjpv.exe71⤵PID:1920
-
\??\c:\9jdpd.exec:\9jdpd.exe72⤵PID:888
-
\??\c:\1frxffl.exec:\1frxffl.exe73⤵PID:2980
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe74⤵PID:2824
-
\??\c:\1htthn.exec:\1htthn.exe75⤵PID:2924
-
\??\c:\pjvjp.exec:\pjvjp.exe76⤵PID:2404
-
\??\c:\1xllllr.exec:\1xllllr.exe77⤵PID:2848
-
\??\c:\hhnnbb.exec:\hhnnbb.exe78⤵PID:2644
-
\??\c:\9thbhh.exec:\9thbhh.exe79⤵PID:2612
-
\??\c:\3vddj.exec:\3vddj.exe80⤵PID:2720
-
\??\c:\llfrrxl.exec:\llfrrxl.exe81⤵PID:2324
-
\??\c:\5nbntt.exec:\5nbntt.exe82⤵PID:2620
-
\??\c:\nhbhbb.exec:\nhbhbb.exe83⤵PID:3000
-
\??\c:\vpjpd.exec:\vpjpd.exe84⤵PID:3004
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe85⤵PID:2280
-
\??\c:\tnhnbb.exec:\tnhnbb.exe86⤵PID:2760
-
\??\c:\jdvvv.exec:\jdvvv.exe87⤵PID:2196
-
\??\c:\7rlfxxf.exec:\7rlfxxf.exe88⤵PID:1328
-
\??\c:\3tnntb.exec:\3tnntb.exe89⤵PID:1176
-
\??\c:\nhnntt.exec:\nhnntt.exe90⤵PID:1204
-
\??\c:\dvppd.exec:\dvppd.exe91⤵PID:1420
-
\??\c:\5rlfllr.exec:\5rlfllr.exe92⤵PID:2360
-
\??\c:\tnbhnn.exec:\tnbhnn.exe93⤵PID:1880
-
\??\c:\5nhhnt.exec:\5nhhnt.exe94⤵PID:2340
-
\??\c:\jjddv.exec:\jjddv.exe95⤵PID:2936
-
\??\c:\llxfxxf.exec:\llxfxxf.exe96⤵
- System Location Discovery: System Language Discovery
PID:1256 -
\??\c:\9hbnth.exec:\9hbnth.exe97⤵PID:2248
-
\??\c:\bthntt.exec:\bthntt.exe98⤵PID:2396
-
\??\c:\dvjpv.exec:\dvjpv.exe99⤵PID:2312
-
\??\c:\xlxxflr.exec:\xlxxflr.exe100⤵PID:440
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe101⤵PID:2112
-
\??\c:\tnhnhn.exec:\tnhnhn.exe102⤵PID:2240
-
\??\c:\9dvdd.exec:\9dvdd.exe103⤵PID:2376
-
\??\c:\tbtbtt.exec:\tbtbtt.exe104⤵PID:1748
-
\??\c:\7jdjj.exec:\7jdjj.exe105⤵PID:1776
-
\??\c:\1lxfrrx.exec:\1lxfrrx.exe106⤵PID:1928
-
\??\c:\thhbhh.exec:\thhbhh.exe107⤵PID:1564
-
\??\c:\xrfxxfl.exec:\xrfxxfl.exe108⤵PID:1688
-
\??\c:\llxfxxl.exec:\llxfxxl.exe109⤵PID:1568
-
\??\c:\nhtttn.exec:\nhtttn.exe110⤵PID:1232
-
\??\c:\dvjdj.exec:\dvjdj.exe111⤵PID:2056
-
\??\c:\dvppd.exec:\dvppd.exe112⤵PID:2968
-
\??\c:\lxxffll.exec:\lxxffll.exe113⤵PID:860
-
\??\c:\bntbhb.exec:\bntbhb.exe114⤵PID:1952
-
\??\c:\pdjpv.exec:\pdjpv.exe115⤵PID:1516
-
\??\c:\jjpdd.exec:\jjpdd.exe116⤵PID:2108
-
\??\c:\5rllllr.exec:\5rllllr.exe117⤵PID:2708
-
\??\c:\bbbhtt.exec:\bbbhtt.exe118⤵PID:2716
-
\??\c:\llxllxr.exec:\llxllxr.exe119⤵PID:2744
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe120⤵PID:2644
-
\??\c:\1htntt.exec:\1htntt.exe121⤵PID:2608
-
\??\c:\jdjpp.exec:\jdjpp.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-