Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe
-
Size
455KB
-
MD5
df49e5098926c5e122d3aa4d06dfdd56
-
SHA1
b5073c1965017ff223826c3f8703556a756ea3bd
-
SHA256
5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87
-
SHA512
8f10c20640bef0143579ccf7348b8015611b6228580167390b9379037c7ce5771d9696d780fd095dc574ce9158087b63cc00d745f200685af22c0fb81ee4767e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRI/:q7Tc2NYHUrAwfMp3CDRy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/3052-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1368-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3008-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-446-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/580-447-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-672-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1580-675-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2764-859-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-1187-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2984-1196-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2984-1218-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2656 ttbhtn.exe 2812 pjpdj.exe 2784 7hnhhb.exe 2188 7xllflr.exe 2712 3dppv.exe 2564 hnhnbt.exe 2592 dpddj.exe 1952 7nnnth.exe 3000 hnbbnh.exe 2416 ppdjv.exe 2064 bnhntt.exe 2088 flfrflf.exe 484 1htbbb.exe 1636 9vppj.exe 2852 1xlfxff.exe 1736 nhtttn.exe 1648 fxxlllr.exe 1488 bthhtn.exe 2296 pjpjj.exe 448 hbhbbb.exe 1316 dpjdp.exe 1368 hnhbnn.exe 968 vjjdd.exe 2424 ffxfrfr.exe 1132 1nbbbt.exe 1772 rlffrrf.exe 696 tthnhn.exe 1796 dpjjv.exe 352 llfrlrf.exe 3008 dvjjj.exe 1700 xflrrxf.exe 2224 vpjpj.exe 2676 llflxlx.exe 1728 bbntbt.exe 1276 nhtthb.exe 2804 pjvpv.exe 2688 5frlxfl.exe 2756 tthntt.exe 2748 jdvdv.exe 324 5vpjj.exe 2616 5rrxfll.exe 2984 5nbhhn.exe 1044 1pjjv.exe 2972 9fffxxr.exe 2880 7frxllr.exe 2108 hbhtbt.exe 2360 7pvpp.exe 328 9rrllrr.exe 2312 fxflffl.exe 584 tthhhh.exe 868 dvdvd.exe 2012 xlxrrlr.exe 2836 rfrflfl.exe 1664 thbbnn.exe 580 thbhnh.exe 2916 pdvvv.exe 2908 frfflfl.exe 1860 1hnnnn.exe 820 5djjv.exe 1692 vpjjv.exe 2116 frlllfl.exe 2168 tnttbt.exe 2516 1bbtbn.exe 1764 pjddj.exe -
resource yara_rule behavioral1/memory/3052-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3008-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-937-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/696-1083-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-1169-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2656 3052 5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe 31 PID 3052 wrote to memory of 2656 3052 5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe 31 PID 3052 wrote to memory of 2656 3052 5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe 31 PID 3052 wrote to memory of 2656 3052 5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe 31 PID 2656 wrote to memory of 2812 2656 ttbhtn.exe 32 PID 2656 wrote to memory of 2812 2656 ttbhtn.exe 32 PID 2656 wrote to memory of 2812 2656 ttbhtn.exe 32 PID 2656 wrote to memory of 2812 2656 ttbhtn.exe 32 PID 2812 wrote to memory of 2784 2812 pjpdj.exe 33 PID 2812 wrote to memory of 2784 2812 pjpdj.exe 33 PID 2812 wrote to memory of 2784 2812 pjpdj.exe 33 PID 2812 wrote to memory of 2784 2812 pjpdj.exe 33 PID 2784 wrote to memory of 2188 2784 7hnhhb.exe 34 PID 2784 wrote to memory of 2188 2784 7hnhhb.exe 34 PID 2784 wrote to memory of 2188 2784 7hnhhb.exe 34 PID 2784 wrote to memory of 2188 2784 7hnhhb.exe 34 PID 2188 wrote to memory of 2712 2188 7xllflr.exe 35 PID 2188 wrote to memory of 2712 2188 7xllflr.exe 35 PID 2188 wrote to memory of 2712 2188 7xllflr.exe 35 PID 2188 wrote to memory of 2712 2188 7xllflr.exe 35 PID 2712 wrote to memory of 2564 2712 3dppv.exe 36 PID 2712 wrote to memory of 2564 2712 3dppv.exe 36 PID 2712 wrote to memory of 2564 2712 3dppv.exe 36 PID 2712 wrote to memory of 2564 2712 3dppv.exe 36 PID 2564 wrote to memory of 2592 2564 hnhnbt.exe 37 PID 2564 wrote to memory of 2592 2564 hnhnbt.exe 37 PID 2564 wrote to memory of 2592 2564 hnhnbt.exe 37 PID 2564 wrote to memory of 2592 2564 hnhnbt.exe 37 PID 2592 wrote to memory of 1952 2592 dpddj.exe 38 PID 2592 wrote to memory of 1952 2592 dpddj.exe 38 PID 2592 wrote to memory of 1952 2592 dpddj.exe 38 PID 2592 wrote to memory of 1952 2592 dpddj.exe 38 PID 1952 wrote to memory of 3000 1952 7nnnth.exe 39 PID 1952 wrote to memory of 3000 1952 7nnnth.exe 39 PID 1952 wrote to memory of 3000 1952 7nnnth.exe 39 PID 1952 wrote to memory of 3000 1952 7nnnth.exe 39 PID 3000 wrote to memory of 2416 3000 hnbbnh.exe 40 PID 3000 wrote to memory of 2416 3000 hnbbnh.exe 40 PID 3000 wrote to memory of 2416 3000 hnbbnh.exe 40 PID 3000 wrote to memory of 2416 3000 hnbbnh.exe 40 PID 2416 wrote to memory of 2064 2416 ppdjv.exe 41 PID 2416 wrote to memory of 2064 2416 ppdjv.exe 41 PID 2416 wrote to memory of 2064 2416 ppdjv.exe 41 PID 2416 wrote to memory of 2064 2416 ppdjv.exe 41 PID 2064 wrote to memory of 2088 2064 bnhntt.exe 42 PID 2064 wrote to memory of 2088 2064 bnhntt.exe 42 PID 2064 wrote to memory of 2088 2064 bnhntt.exe 42 PID 2064 wrote to memory of 2088 2064 bnhntt.exe 42 PID 2088 wrote to memory of 484 2088 flfrflf.exe 43 PID 2088 wrote to memory of 484 2088 flfrflf.exe 43 PID 2088 wrote to memory of 484 2088 flfrflf.exe 43 PID 2088 wrote to memory of 484 2088 flfrflf.exe 43 PID 484 wrote to memory of 1636 484 1htbbb.exe 44 PID 484 wrote to memory of 1636 484 1htbbb.exe 44 PID 484 wrote to memory of 1636 484 1htbbb.exe 44 PID 484 wrote to memory of 1636 484 1htbbb.exe 44 PID 1636 wrote to memory of 2852 1636 9vppj.exe 45 PID 1636 wrote to memory of 2852 1636 9vppj.exe 45 PID 1636 wrote to memory of 2852 1636 9vppj.exe 45 PID 1636 wrote to memory of 2852 1636 9vppj.exe 45 PID 2852 wrote to memory of 1736 2852 1xlfxff.exe 46 PID 2852 wrote to memory of 1736 2852 1xlfxff.exe 46 PID 2852 wrote to memory of 1736 2852 1xlfxff.exe 46 PID 2852 wrote to memory of 1736 2852 1xlfxff.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe"C:\Users\Admin\AppData\Local\Temp\5b7740186f46d4fe8ce1ff809ea3c6f3a54e2ea36cda230fc621464b0384ec87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\ttbhtn.exec:\ttbhtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pjpdj.exec:\pjpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\7hnhhb.exec:\7hnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\7xllflr.exec:\7xllflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\3dppv.exec:\3dppv.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hnhnbt.exec:\hnhnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\dpddj.exec:\dpddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\7nnnth.exec:\7nnnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\hnbbnh.exec:\hnbbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ppdjv.exec:\ppdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\bnhntt.exec:\bnhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\flfrflf.exec:\flfrflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\1htbbb.exec:\1htbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\9vppj.exec:\9vppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\1xlfxff.exec:\1xlfxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\nhtttn.exec:\nhtttn.exe17⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fxxlllr.exec:\fxxlllr.exe18⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bthhtn.exec:\bthhtn.exe19⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pjpjj.exec:\pjpjj.exe20⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hbhbbb.exec:\hbhbbb.exe21⤵
- Executes dropped EXE
PID:448 -
\??\c:\dpjdp.exec:\dpjdp.exe22⤵
- Executes dropped EXE
PID:1316 -
\??\c:\hnhbnn.exec:\hnhbnn.exe23⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vjjdd.exec:\vjjdd.exe24⤵
- Executes dropped EXE
PID:968 -
\??\c:\ffxfrfr.exec:\ffxfrfr.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\1nbbbt.exec:\1nbbbt.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rlffrrf.exec:\rlffrrf.exe27⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tthnhn.exec:\tthnhn.exe28⤵
- Executes dropped EXE
PID:696 -
\??\c:\dpjjv.exec:\dpjjv.exe29⤵
- Executes dropped EXE
PID:1796 -
\??\c:\llfrlrf.exec:\llfrlrf.exe30⤵
- Executes dropped EXE
PID:352 -
\??\c:\dvjjj.exec:\dvjjj.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\xflrrxf.exec:\xflrrxf.exe32⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vpjpj.exec:\vpjpj.exe33⤵
- Executes dropped EXE
PID:2224 -
\??\c:\llflxlx.exec:\llflxlx.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\bbntbt.exec:\bbntbt.exe35⤵
- Executes dropped EXE
PID:1728 -
\??\c:\nhtthb.exec:\nhtthb.exe36⤵
- Executes dropped EXE
PID:1276 -
\??\c:\pjvpv.exec:\pjvpv.exe37⤵
- Executes dropped EXE
PID:2804 -
\??\c:\5frlxfl.exec:\5frlxfl.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tthntt.exec:\tthntt.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jdvdv.exec:\jdvdv.exe40⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5vpjj.exec:\5vpjj.exe41⤵
- Executes dropped EXE
PID:324 -
\??\c:\5rrxfll.exec:\5rrxfll.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\5nbhhn.exec:\5nbhhn.exe43⤵
- Executes dropped EXE
PID:2984 -
\??\c:\1pjjv.exec:\1pjjv.exe44⤵
- Executes dropped EXE
PID:1044 -
\??\c:\9fffxxr.exec:\9fffxxr.exe45⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7frxllr.exec:\7frxllr.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\hbhtbt.exec:\hbhtbt.exe47⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7pvpp.exec:\7pvpp.exe48⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9rrllrr.exec:\9rrllrr.exe49⤵
- Executes dropped EXE
PID:328 -
\??\c:\fxflffl.exec:\fxflffl.exe50⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tthhhh.exec:\tthhhh.exe51⤵
- Executes dropped EXE
PID:584 -
\??\c:\dvdvd.exec:\dvdvd.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2012 -
\??\c:\rfrflfl.exec:\rfrflfl.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thbbnn.exec:\thbbnn.exe55⤵
- Executes dropped EXE
PID:1664 -
\??\c:\thbhnh.exec:\thbhnh.exe56⤵
- Executes dropped EXE
PID:580 -
\??\c:\pdvvv.exec:\pdvvv.exe57⤵
- Executes dropped EXE
PID:2916 -
\??\c:\frfflfl.exec:\frfflfl.exe58⤵
- Executes dropped EXE
PID:2908 -
\??\c:\1hnnnn.exec:\1hnnnn.exe59⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5djjv.exec:\5djjv.exe60⤵
- Executes dropped EXE
PID:820 -
\??\c:\vpjjv.exec:\vpjjv.exe61⤵
- Executes dropped EXE
PID:1692 -
\??\c:\frlllfl.exec:\frlllfl.exe62⤵
- Executes dropped EXE
PID:2116 -
\??\c:\tnttbt.exec:\tnttbt.exe63⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1bbtbn.exec:\1bbtbn.exe64⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjddj.exec:\pjddj.exe65⤵
- Executes dropped EXE
PID:1764 -
\??\c:\9lrrxxx.exec:\9lrrxxx.exe66⤵PID:2800
-
\??\c:\htbttn.exec:\htbttn.exe67⤵PID:2132
-
\??\c:\jdvpv.exec:\jdvpv.exe68⤵PID:1768
-
\??\c:\jdvvd.exec:\jdvvd.exe69⤵PID:1132
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe70⤵PID:1852
-
\??\c:\thhhhb.exec:\thhhhb.exe71⤵PID:2628
-
\??\c:\vjpjp.exec:\vjpjp.exe72⤵PID:2936
-
\??\c:\xlfflrl.exec:\xlfflrl.exe73⤵PID:1196
-
\??\c:\bnttbb.exec:\bnttbb.exe74⤵PID:1012
-
\??\c:\nbnntt.exec:\nbnntt.exe75⤵PID:824
-
\??\c:\pdjjj.exec:\pdjjj.exe76⤵PID:1268
-
\??\c:\flrfrlf.exec:\flrfrlf.exe77⤵PID:2944
-
\??\c:\5rlfffr.exec:\5rlfffr.exe78⤵
- System Location Discovery: System Language Discovery
PID:1564 -
\??\c:\5bnntt.exec:\5bnntt.exe79⤵PID:2808
-
\??\c:\dpvpd.exec:\dpvpd.exe80⤵PID:2912
-
\??\c:\pddpp.exec:\pddpp.exe81⤵PID:2680
-
\??\c:\rflxfxx.exec:\rflxfxx.exe82⤵PID:2664
-
\??\c:\nbnnnh.exec:\nbnnnh.exe83⤵PID:2572
-
\??\c:\bnbbbt.exec:\bnbbbt.exe84⤵PID:2772
-
\??\c:\3vddd.exec:\3vddd.exe85⤵PID:2596
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe86⤵PID:324
-
\??\c:\rxfflfl.exec:\rxfflfl.exe87⤵PID:2028
-
\??\c:\tntbnn.exec:\tntbnn.exe88⤵PID:1864
-
\??\c:\jdjpv.exec:\jdjpv.exe89⤵PID:1528
-
\??\c:\7lfxfff.exec:\7lfxfff.exe90⤵PID:1516
-
\??\c:\fxxflxf.exec:\fxxflxf.exe91⤵PID:2220
-
\??\c:\btntht.exec:\btntht.exe92⤵PID:3028
-
\??\c:\7htttt.exec:\7htttt.exe93⤵PID:1580
-
\??\c:\jjvpj.exec:\jjvpj.exe94⤵PID:772
-
\??\c:\lfxfrrr.exec:\lfxfrrr.exe95⤵PID:1716
-
\??\c:\bnbbhh.exec:\bnbbhh.exe96⤵PID:2604
-
\??\c:\vdvdv.exec:\vdvdv.exe97⤵PID:2872
-
\??\c:\1jpjj.exec:\1jpjj.exe98⤵PID:2632
-
\??\c:\5llfllx.exec:\5llfllx.exe99⤵PID:1652
-
\??\c:\xxrxfxf.exec:\xxrxfxf.exe100⤵PID:236
-
\??\c:\bbnhnb.exec:\bbnhnb.exe101⤵PID:660
-
\??\c:\vvpvv.exec:\vvpvv.exe102⤵PID:2916
-
\??\c:\1xrrxxl.exec:\1xrrxxl.exe103⤵PID:2404
-
\??\c:\5xlrlrx.exec:\5xlrlrx.exe104⤵PID:1860
-
\??\c:\5thbbb.exec:\5thbbb.exe105⤵PID:2184
-
\??\c:\dvjvd.exec:\dvjvd.exe106⤵PID:448
-
\??\c:\pjddj.exec:\pjddj.exe107⤵PID:848
-
\??\c:\5lfxxxl.exec:\5lfxxxl.exe108⤵PID:916
-
\??\c:\hnnnnb.exec:\hnnnnb.exe109⤵PID:2500
-
\??\c:\nbtttt.exec:\nbtttt.exe110⤵PID:968
-
\??\c:\jdjjv.exec:\jdjjv.exe111⤵PID:2800
-
\??\c:\7xfxffl.exec:\7xfxffl.exe112⤵PID:2180
-
\??\c:\nhnnbh.exec:\nhnnbh.exe113⤵PID:1456
-
\??\c:\nhttbt.exec:\nhttbt.exe114⤵PID:2892
-
\??\c:\vjjjv.exec:\vjjjv.exe115⤵PID:1876
-
\??\c:\xllfllx.exec:\xllfllx.exe116⤵PID:2628
-
\??\c:\rfrxlrx.exec:\rfrxlrx.exe117⤵PID:2336
-
\??\c:\bbnthb.exec:\bbnthb.exe118⤵PID:1196
-
\??\c:\3jdvj.exec:\3jdvj.exe119⤵PID:1012
-
\??\c:\ppjjp.exec:\ppjjp.exe120⤵PID:824
-
\??\c:\xlflxrl.exec:\xlflxrl.exe121⤵PID:2324
-
\??\c:\tnbhhh.exec:\tnbhhh.exe122⤵PID:2944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-