Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe
-
Size
454KB
-
MD5
41eb7578cc7fc82e14a32a8875ede202
-
SHA1
db5c4f47082b3ebd99a1e414599a127e29bf7127
-
SHA256
b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217
-
SHA512
6e0526104efce0ffed26c02c400cb6eb3feb80b773994e31b357bf02863603702fcbbd199dfe3ce35f706d281fc64f53f72df3058357cd81c7ec03bc4ef2971e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeJ6:q7Tc2NYHUrAwfMp3CDJ6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2688-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-36-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2432-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-90-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/536-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-110-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/772-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-346-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-412-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1464-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2780 rrlrlrx.exe 2676 bthnbb.exe 2664 djdpj.exe 2260 flflffl.exe 2552 lfxlflf.exe 2432 1nbnnt.exe 3020 jdvjv.exe 1668 llxrffl.exe 2880 tnhbnb.exe 3012 pjvdv.exe 536 pvvpp.exe 1620 5thnbb.exe 772 dvpvj.exe 1212 frflllr.exe 2756 jdvjp.exe 292 jdjpp.exe 2116 frlrxfl.exe 2148 jdpjv.exe 2356 lxrrxlf.exe 2376 5nbnhh.exe 1728 pjdjd.exe 904 rlrrxfl.exe 1700 jdpdj.exe 1596 lfrrrrx.exe 1956 vpddd.exe 2524 jddvj.exe 1352 1hnthn.exe 2324 rlflxlr.exe 1720 3bnbht.exe 1452 lllfrxx.exe 1704 nhhtnt.exe 2772 ffxfrrr.exe 2516 rlxxlrr.exe 2748 pdpvd.exe 2128 vjdvj.exe 2948 xrrxlrf.exe 2684 nnhnbh.exe 2260 ppdpj.exe 2744 fxlrxfr.exe 3016 bbtthn.exe 2592 jdjvj.exe 2344 llfrlrl.exe 2724 1htbtb.exe 2920 jdppp.exe 2488 7jpjv.exe 2384 xlxrrrx.exe 1988 5nbhnt.exe 2052 dvvdj.exe 1004 fxxrrlx.exe 664 hbtbbb.exe 1844 9jdvv.exe 2616 jjjvd.exe 1924 1xlxlrf.exe 2944 7thhnb.exe 2840 jvjpp.exe 1296 llrxllx.exe 2412 btnnnn.exe 2120 dpjpj.exe 1100 vvppv.exe 1828 7lxllrr.exe 1116 hbnnbb.exe 2236 9dvvv.exe 744 frlrxxf.exe 2388 ffxrlfl.exe -
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-53-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2880-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1212-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-412-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-511-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1464-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-725-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2388-774-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-888-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-1114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-1154-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2780 2688 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 30 PID 2688 wrote to memory of 2780 2688 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 30 PID 2688 wrote to memory of 2780 2688 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 30 PID 2688 wrote to memory of 2780 2688 b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe 30 PID 2780 wrote to memory of 2676 2780 rrlrlrx.exe 31 PID 2780 wrote to memory of 2676 2780 rrlrlrx.exe 31 PID 2780 wrote to memory of 2676 2780 rrlrlrx.exe 31 PID 2780 wrote to memory of 2676 2780 rrlrlrx.exe 31 PID 2676 wrote to memory of 2664 2676 bthnbb.exe 32 PID 2676 wrote to memory of 2664 2676 bthnbb.exe 32 PID 2676 wrote to memory of 2664 2676 bthnbb.exe 32 PID 2676 wrote to memory of 2664 2676 bthnbb.exe 32 PID 2664 wrote to memory of 2260 2664 djdpj.exe 33 PID 2664 wrote to memory of 2260 2664 djdpj.exe 33 PID 2664 wrote to memory of 2260 2664 djdpj.exe 33 PID 2664 wrote to memory of 2260 2664 djdpj.exe 33 PID 2260 wrote to memory of 2552 2260 flflffl.exe 34 PID 2260 wrote to memory of 2552 2260 flflffl.exe 34 PID 2260 wrote to memory of 2552 2260 flflffl.exe 34 PID 2260 wrote to memory of 2552 2260 flflffl.exe 34 PID 2552 wrote to memory of 2432 2552 lfxlflf.exe 35 PID 2552 wrote to memory of 2432 2552 lfxlflf.exe 35 PID 2552 wrote to memory of 2432 2552 lfxlflf.exe 35 PID 2552 wrote to memory of 2432 2552 lfxlflf.exe 35 PID 2432 wrote to memory of 3020 2432 1nbnnt.exe 36 PID 2432 wrote to memory of 3020 2432 1nbnnt.exe 36 PID 2432 wrote to memory of 3020 2432 1nbnnt.exe 36 PID 2432 wrote to memory of 3020 2432 1nbnnt.exe 36 PID 3020 wrote to memory of 1668 3020 jdvjv.exe 37 PID 3020 wrote to memory of 1668 3020 jdvjv.exe 37 PID 3020 wrote to memory of 1668 3020 jdvjv.exe 37 PID 3020 wrote to memory of 1668 3020 jdvjv.exe 37 PID 1668 wrote to memory of 2880 1668 llxrffl.exe 38 PID 1668 wrote to memory of 2880 1668 llxrffl.exe 38 PID 1668 wrote to memory of 2880 1668 llxrffl.exe 38 PID 1668 wrote to memory of 2880 1668 llxrffl.exe 38 PID 2880 wrote to memory of 3012 2880 tnhbnb.exe 39 PID 2880 wrote to memory of 3012 2880 tnhbnb.exe 39 PID 2880 wrote to memory of 3012 2880 tnhbnb.exe 39 PID 2880 wrote to memory of 3012 2880 tnhbnb.exe 39 PID 3012 wrote to memory of 536 3012 pjvdv.exe 40 PID 3012 wrote to memory of 536 3012 pjvdv.exe 40 PID 3012 wrote to memory of 536 3012 pjvdv.exe 40 PID 3012 wrote to memory of 536 3012 pjvdv.exe 40 PID 536 wrote to memory of 1620 536 pvvpp.exe 41 PID 536 wrote to memory of 1620 536 pvvpp.exe 41 PID 536 wrote to memory of 1620 536 pvvpp.exe 41 PID 536 wrote to memory of 1620 536 pvvpp.exe 41 PID 1620 wrote to memory of 772 1620 5thnbb.exe 42 PID 1620 wrote to memory of 772 1620 5thnbb.exe 42 PID 1620 wrote to memory of 772 1620 5thnbb.exe 42 PID 1620 wrote to memory of 772 1620 5thnbb.exe 42 PID 772 wrote to memory of 1212 772 dvpvj.exe 43 PID 772 wrote to memory of 1212 772 dvpvj.exe 43 PID 772 wrote to memory of 1212 772 dvpvj.exe 43 PID 772 wrote to memory of 1212 772 dvpvj.exe 43 PID 1212 wrote to memory of 2756 1212 frflllr.exe 44 PID 1212 wrote to memory of 2756 1212 frflllr.exe 44 PID 1212 wrote to memory of 2756 1212 frflllr.exe 44 PID 1212 wrote to memory of 2756 1212 frflllr.exe 44 PID 2756 wrote to memory of 292 2756 jdvjp.exe 45 PID 2756 wrote to memory of 292 2756 jdvjp.exe 45 PID 2756 wrote to memory of 292 2756 jdvjp.exe 45 PID 2756 wrote to memory of 292 2756 jdvjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe"C:\Users\Admin\AppData\Local\Temp\b087d408416b8988357bacf4ff9529f80b93264314f44678d690d56fb5db0217.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rrlrlrx.exec:\rrlrlrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\bthnbb.exec:\bthnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\djdpj.exec:\djdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\flflffl.exec:\flflffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\lfxlflf.exec:\lfxlflf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\1nbnnt.exec:\1nbnnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jdvjv.exec:\jdvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\llxrffl.exec:\llxrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\tnhbnb.exec:\tnhbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pjvdv.exec:\pjvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\pvvpp.exec:\pvvpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\5thnbb.exec:\5thnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\dvpvj.exec:\dvpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\frflllr.exec:\frflllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\jdvjp.exec:\jdvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jdjpp.exec:\jdjpp.exe17⤵
- Executes dropped EXE
PID:292 -
\??\c:\frlrxfl.exec:\frlrxfl.exe18⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jdpjv.exec:\jdpjv.exe19⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lxrrxlf.exec:\lxrrxlf.exe20⤵
- Executes dropped EXE
PID:2356 -
\??\c:\5nbnhh.exec:\5nbnhh.exe21⤵
- Executes dropped EXE
PID:2376 -
\??\c:\pjdjd.exec:\pjdjd.exe22⤵
- Executes dropped EXE
PID:1728 -
\??\c:\rlrrxfl.exec:\rlrrxfl.exe23⤵
- Executes dropped EXE
PID:904 -
\??\c:\jdpdj.exec:\jdpdj.exe24⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe25⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vpddd.exec:\vpddd.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jddvj.exec:\jddvj.exe27⤵
- Executes dropped EXE
PID:2524 -
\??\c:\1hnthn.exec:\1hnthn.exe28⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rlflxlr.exec:\rlflxlr.exe29⤵
- Executes dropped EXE
PID:2324 -
\??\c:\3bnbht.exec:\3bnbht.exe30⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lllfrxx.exec:\lllfrxx.exe31⤵
- Executes dropped EXE
PID:1452 -
\??\c:\nhhtnt.exec:\nhhtnt.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ffxfrrr.exec:\ffxfrrr.exe33⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxxlrr.exec:\rlxxlrr.exe34⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pdpvd.exec:\pdpvd.exe35⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vjdvj.exec:\vjdvj.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xrrxlrf.exec:\xrrxlrf.exe37⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nnhnbh.exec:\nnhnbh.exe38⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ppdpj.exec:\ppdpj.exe39⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bbtthn.exec:\bbtthn.exe41⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jdjvj.exec:\jdjvj.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\llfrlrl.exec:\llfrlrl.exe43⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1htbtb.exec:\1htbtb.exe44⤵
- Executes dropped EXE
PID:2724 -
\??\c:\jdppp.exec:\jdppp.exe45⤵
- Executes dropped EXE
PID:2920 -
\??\c:\7jpjv.exec:\7jpjv.exe46⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5nbhnt.exec:\5nbhnt.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\dvvdj.exec:\dvvdj.exe49⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxxrrlx.exec:\fxxrrlx.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hbtbbb.exec:\hbtbbb.exe51⤵
- Executes dropped EXE
PID:664 -
\??\c:\9jdvv.exec:\9jdvv.exe52⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jjjvd.exec:\jjjvd.exe53⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1xlxlrf.exec:\1xlxlrf.exe54⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7thhnb.exec:\7thhnb.exe55⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jvjpp.exec:\jvjpp.exe56⤵
- Executes dropped EXE
PID:2840 -
\??\c:\llrxllx.exec:\llrxllx.exe57⤵
- Executes dropped EXE
PID:1296 -
\??\c:\btnnnn.exec:\btnnnn.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dpjpj.exec:\dpjpj.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vvppv.exec:\vvppv.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7lxllrr.exec:\7lxllrr.exe61⤵
- Executes dropped EXE
PID:1828 -
\??\c:\hbnnbb.exec:\hbnnbb.exe62⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9dvvv.exec:\9dvvv.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\frlrxxf.exec:\frlrxxf.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\ffxrlfl.exec:\ffxrlfl.exe65⤵
- Executes dropped EXE
PID:2388 -
\??\c:\hbtbbt.exec:\hbtbbt.exe66⤵PID:2296
-
\??\c:\dvjvv.exec:\dvjvv.exe67⤵PID:1464
-
\??\c:\3xrlfll.exec:\3xrlfll.exe68⤵PID:2320
-
\??\c:\nhthhn.exec:\nhthhn.exe69⤵PID:1892
-
\??\c:\pjvvv.exec:\pjvvv.exe70⤵PID:984
-
\??\c:\vdpdv.exec:\vdpdv.exe71⤵PID:1420
-
\??\c:\lfxxffx.exec:\lfxxffx.exe72⤵PID:1992
-
\??\c:\htbnbh.exec:\htbnbh.exe73⤵PID:2332
-
\??\c:\jdppj.exec:\jdppj.exe74⤵PID:2692
-
\??\c:\pjdjv.exec:\pjdjv.exe75⤵PID:2788
-
\??\c:\xrflrlr.exec:\xrflrlr.exe76⤵PID:2768
-
\??\c:\hthntb.exec:\hthntb.exe77⤵PID:2748
-
\??\c:\9pjjv.exec:\9pjjv.exe78⤵PID:2100
-
\??\c:\vpjdv.exec:\vpjdv.exe79⤵PID:2936
-
\??\c:\rflfffl.exec:\rflfffl.exe80⤵PID:2708
-
\??\c:\ththtb.exec:\ththtb.exe81⤵PID:2720
-
\??\c:\hbntbt.exec:\hbntbt.exe82⤵PID:2620
-
\??\c:\vvppv.exec:\vvppv.exe83⤵PID:1392
-
\??\c:\rfxxllf.exec:\rfxxllf.exe84⤵PID:1628
-
\??\c:\tnbbnt.exec:\tnbbnt.exe85⤵PID:2344
-
\??\c:\bththh.exec:\bththh.exe86⤵PID:2724
-
\??\c:\vjpvj.exec:\vjpvj.exe87⤵PID:1936
-
\??\c:\9vjpj.exec:\9vjpj.exe88⤵PID:1156
-
\??\c:\lrlflfl.exec:\lrlflfl.exe89⤵PID:1648
-
\??\c:\btnthh.exec:\btnthh.exe90⤵PID:1988
-
\??\c:\3bhnnn.exec:\3bhnnn.exe91⤵PID:1588
-
\??\c:\7dvdp.exec:\7dvdp.exe92⤵PID:476
-
\??\c:\5lxfllx.exec:\5lxfllx.exe93⤵PID:2536
-
\??\c:\fxxfrrx.exec:\fxxfrrx.exe94⤵PID:2836
-
\??\c:\bnhthh.exec:\bnhthh.exe95⤵PID:832
-
\??\c:\ddjpp.exec:\ddjpp.exe96⤵PID:2952
-
\??\c:\5fxxffl.exec:\5fxxffl.exe97⤵PID:2960
-
\??\c:\3xlxfxf.exec:\3xlxfxf.exe98⤵PID:2256
-
\??\c:\3thhhh.exec:\3thhhh.exe99⤵PID:2840
-
\??\c:\7bntbb.exec:\7bntbb.exe100⤵PID:2356
-
\??\c:\rfxrrlr.exec:\rfxrrlr.exe101⤵PID:2176
-
\??\c:\1xflrrf.exec:\1xflrrf.exe102⤵PID:884
-
\??\c:\3bthbb.exec:\3bthbb.exe103⤵PID:1100
-
\??\c:\7tbnhh.exec:\7tbnhh.exe104⤵PID:1272
-
\??\c:\9xrxfrr.exec:\9xrxfrr.exe105⤵PID:1700
-
\??\c:\tnbtnh.exec:\tnbtnh.exe106⤵PID:872
-
\??\c:\thbhtb.exec:\thbhtb.exe107⤵PID:2388
-
\??\c:\ddvjv.exec:\ddvjv.exe108⤵PID:1984
-
\??\c:\9pdjj.exec:\9pdjj.exe109⤵PID:1616
-
\??\c:\rlfrxfr.exec:\rlfrxfr.exe110⤵PID:812
-
\??\c:\9thhtb.exec:\9thhtb.exe111⤵PID:2124
-
\??\c:\ddpjv.exec:\ddpjv.exe112⤵PID:1008
-
\??\c:\pvpdv.exec:\pvpdv.exe113⤵PID:1452
-
\??\c:\xrffrrx.exec:\xrffrrx.exe114⤵PID:1028
-
\??\c:\bthnhn.exec:\bthnhn.exe115⤵PID:2688
-
\??\c:\5nhtnn.exec:\5nhtnn.exe116⤵PID:2784
-
\??\c:\3dvdp.exec:\3dvdp.exe117⤵PID:2780
-
\??\c:\7lrrxxx.exec:\7lrrxxx.exe118⤵PID:2728
-
\??\c:\tnbtnb.exec:\tnbtnb.exe119⤵PID:2764
-
\??\c:\dvpjv.exec:\dvpjv.exe120⤵PID:2912
-
\??\c:\5fxfrxl.exec:\5fxfrxl.exe121⤵PID:2596
-
\??\c:\btnthh.exec:\btnthh.exe122⤵PID:2560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-