Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe
-
Size
455KB
-
MD5
2a74a74bb38709ce2c79d188f35b77e6
-
SHA1
f128e7d851e3e7d7fcec55fc1de33375f3ed4dc7
-
SHA256
1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700
-
SHA512
ea7bbb896489ee7704d0ee2da4a636782cced0577d53115e6e93b2dc798a369f920cd3b9c8f031e8325a4d491e1750e5b5b3a1ec1abb37d40d7ada589fd80433
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRG:q7Tc2NYHUrAwfMp3CDRG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1172-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-63-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2996-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-112-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/532-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1796-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1484-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-300-0x0000000076DB0000-0x0000000076ECF000-memory.dmp family_blackmoon behavioral1/memory/2000-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-377-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2764-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-579-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-605-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3012-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-688-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-926-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-1043-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2536 bnntht.exe 1984 7dvdp.exe 2976 llxrflr.exe 2840 rxrfrxl.exe 2740 1pdjv.exe 2072 1jdvj.exe 2996 nthhbn.exe 2772 dvjpv.exe 2172 3llxlfr.exe 2744 jjvdp.exe 2460 7rllrxf.exe 2284 tnbbnb.exe 3048 jdjjv.exe 1496 5xllrxf.exe 2932 bbtbnh.exe 1796 lrxxrxl.exe 532 hbnhhn.exe 2188 djppd.exe 2400 5rrxflr.exe 2324 rfrrxfl.exe 976 djppd.exe 1484 xfxfrrf.exe 2580 3jdjv.exe 1068 lflrlxf.exe 1852 hbntnt.exe 556 vvvjv.exe 2668 tbbbht.exe 1884 vjddj.exe 1956 nbbtbt.exe 1684 vvdpv.exe 336 5xrrfxf.exe 1240 bntnbb.exe 2440 rrxflxl.exe 2332 rlfxflx.exe 2000 ttbbhn.exe 1584 bhbhtt.exe 2240 1pjpd.exe 2832 flxfrfr.exe 1976 hbbhhb.exe 2896 bbhbhb.exe 2876 ddpvd.exe 1872 ffllrlr.exe 2784 bttbtt.exe 2568 jjppd.exe 2764 lffxfll.exe 1904 hhttbn.exe 444 3tnnbh.exe 2684 jpvdp.exe 1696 rrflrrf.exe 1952 3bbbhn.exe 2340 nhhhbt.exe 3036 dddjj.exe 3044 xllrflr.exe 2520 7hnhhh.exe 3024 ddpvj.exe 1932 3jdjj.exe 2184 9rxrrxf.exe 2348 bbnbnt.exe 2400 djpjp.exe 2544 llflxfx.exe 2776 xfxrxff.exe 1648 nbnthh.exe 768 ddjvd.exe 1512 5fxxlrf.exe -
resource yara_rule behavioral1/memory/2536-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1796-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-681-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-1056-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-1063-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1172 wrote to memory of 2536 1172 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 30 PID 1172 wrote to memory of 2536 1172 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 30 PID 1172 wrote to memory of 2536 1172 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 30 PID 1172 wrote to memory of 2536 1172 1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe 30 PID 2536 wrote to memory of 1984 2536 bnntht.exe 31 PID 2536 wrote to memory of 1984 2536 bnntht.exe 31 PID 2536 wrote to memory of 1984 2536 bnntht.exe 31 PID 2536 wrote to memory of 1984 2536 bnntht.exe 31 PID 1984 wrote to memory of 2976 1984 7dvdp.exe 32 PID 1984 wrote to memory of 2976 1984 7dvdp.exe 32 PID 1984 wrote to memory of 2976 1984 7dvdp.exe 32 PID 1984 wrote to memory of 2976 1984 7dvdp.exe 32 PID 2976 wrote to memory of 2840 2976 llxrflr.exe 33 PID 2976 wrote to memory of 2840 2976 llxrflr.exe 33 PID 2976 wrote to memory of 2840 2976 llxrflr.exe 33 PID 2976 wrote to memory of 2840 2976 llxrflr.exe 33 PID 2840 wrote to memory of 2740 2840 rxrfrxl.exe 34 PID 2840 wrote to memory of 2740 2840 rxrfrxl.exe 34 PID 2840 wrote to memory of 2740 2840 rxrfrxl.exe 34 PID 2840 wrote to memory of 2740 2840 rxrfrxl.exe 34 PID 2740 wrote to memory of 2072 2740 1pdjv.exe 35 PID 2740 wrote to memory of 2072 2740 1pdjv.exe 35 PID 2740 wrote to memory of 2072 2740 1pdjv.exe 35 PID 2740 wrote to memory of 2072 2740 1pdjv.exe 35 PID 2072 wrote to memory of 2996 2072 1jdvj.exe 36 PID 2072 wrote to memory of 2996 2072 1jdvj.exe 36 PID 2072 wrote to memory of 2996 2072 1jdvj.exe 36 PID 2072 wrote to memory of 2996 2072 1jdvj.exe 36 PID 2996 wrote to memory of 2772 2996 nthhbn.exe 37 PID 2996 wrote to memory of 2772 2996 nthhbn.exe 37 PID 2996 wrote to memory of 2772 2996 nthhbn.exe 37 PID 2996 wrote to memory of 2772 2996 nthhbn.exe 37 PID 2772 wrote to memory of 2172 2772 dvjpv.exe 38 PID 2772 wrote to memory of 2172 2772 dvjpv.exe 38 PID 2772 wrote to memory of 2172 2772 dvjpv.exe 38 PID 2772 wrote to memory of 2172 2772 dvjpv.exe 38 PID 2172 wrote to memory of 2744 2172 3llxlfr.exe 39 PID 2172 wrote to memory of 2744 2172 3llxlfr.exe 39 PID 2172 wrote to memory of 2744 2172 3llxlfr.exe 39 PID 2172 wrote to memory of 2744 2172 3llxlfr.exe 39 PID 2744 wrote to memory of 2460 2744 jjvdp.exe 40 PID 2744 wrote to memory of 2460 2744 jjvdp.exe 40 PID 2744 wrote to memory of 2460 2744 jjvdp.exe 40 PID 2744 wrote to memory of 2460 2744 jjvdp.exe 40 PID 2460 wrote to memory of 2284 2460 7rllrxf.exe 41 PID 2460 wrote to memory of 2284 2460 7rllrxf.exe 41 PID 2460 wrote to memory of 2284 2460 7rllrxf.exe 41 PID 2460 wrote to memory of 2284 2460 7rllrxf.exe 41 PID 2284 wrote to memory of 3048 2284 tnbbnb.exe 42 PID 2284 wrote to memory of 3048 2284 tnbbnb.exe 42 PID 2284 wrote to memory of 3048 2284 tnbbnb.exe 42 PID 2284 wrote to memory of 3048 2284 tnbbnb.exe 42 PID 3048 wrote to memory of 1496 3048 jdjjv.exe 43 PID 3048 wrote to memory of 1496 3048 jdjjv.exe 43 PID 3048 wrote to memory of 1496 3048 jdjjv.exe 43 PID 3048 wrote to memory of 1496 3048 jdjjv.exe 43 PID 1496 wrote to memory of 2932 1496 5xllrxf.exe 44 PID 1496 wrote to memory of 2932 1496 5xllrxf.exe 44 PID 1496 wrote to memory of 2932 1496 5xllrxf.exe 44 PID 1496 wrote to memory of 2932 1496 5xllrxf.exe 44 PID 2932 wrote to memory of 1796 2932 bbtbnh.exe 45 PID 2932 wrote to memory of 1796 2932 bbtbnh.exe 45 PID 2932 wrote to memory of 1796 2932 bbtbnh.exe 45 PID 2932 wrote to memory of 1796 2932 bbtbnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe"C:\Users\Admin\AppData\Local\Temp\1b20cbb20515a213c4e56ca340320d5dfeddd49c19d7cda489e388d6964cc700.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\bnntht.exec:\bnntht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\7dvdp.exec:\7dvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\llxrflr.exec:\llxrflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rxrfrxl.exec:\rxrfrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1pdjv.exec:\1pdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1jdvj.exec:\1jdvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nthhbn.exec:\nthhbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\dvjpv.exec:\dvjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3llxlfr.exec:\3llxlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\jjvdp.exec:\jjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\7rllrxf.exec:\7rllrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\tnbbnb.exec:\tnbbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\jdjjv.exec:\jdjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\5xllrxf.exec:\5xllrxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\bbtbnh.exec:\bbtbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lrxxrxl.exec:\lrxxrxl.exe17⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hbnhhn.exec:\hbnhhn.exe18⤵
- Executes dropped EXE
PID:532 -
\??\c:\djppd.exec:\djppd.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5rrxflr.exec:\5rrxflr.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\djppd.exec:\djppd.exe22⤵
- Executes dropped EXE
PID:976 -
\??\c:\xfxfrrf.exec:\xfxfrrf.exe23⤵
- Executes dropped EXE
PID:1484 -
\??\c:\3jdjv.exec:\3jdjv.exe24⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lflrlxf.exec:\lflrlxf.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\hbntnt.exec:\hbntnt.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vvvjv.exec:\vvvjv.exe27⤵
- Executes dropped EXE
PID:556 -
\??\c:\tbbbht.exec:\tbbbht.exe28⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vjddj.exec:\vjddj.exe29⤵
- Executes dropped EXE
PID:1884 -
\??\c:\nbbtbt.exec:\nbbtbt.exe30⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vvdpv.exec:\vvdpv.exe31⤵
- Executes dropped EXE
PID:1684 -
\??\c:\5xrrfxf.exec:\5xrrfxf.exe32⤵
- Executes dropped EXE
PID:336 -
\??\c:\bntnbb.exec:\bntnbb.exe33⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rrxflxl.exec:\rrxflxl.exe34⤵
- Executes dropped EXE
PID:2440 -
\??\c:\nnnnbb.exec:\nnnnbb.exe35⤵PID:2096
-
\??\c:\rlfxflx.exec:\rlfxflx.exe36⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ttbbhn.exec:\ttbbhn.exe37⤵
- Executes dropped EXE
PID:2000 -
\??\c:\bhbhtt.exec:\bhbhtt.exe38⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1pjpd.exec:\1pjpd.exe39⤵
- Executes dropped EXE
PID:2240 -
\??\c:\flxfrfr.exec:\flxfrfr.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hbbhhb.exec:\hbbhhb.exe41⤵
- Executes dropped EXE
PID:1976 -
\??\c:\bbhbhb.exec:\bbhbhb.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ddpvd.exec:\ddpvd.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\ffllrlr.exec:\ffllrlr.exe44⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bttbtt.exec:\bttbtt.exe45⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jjppd.exec:\jjppd.exe46⤵
- Executes dropped EXE
PID:2568 -
\??\c:\lffxfll.exec:\lffxfll.exe47⤵
- Executes dropped EXE
PID:2764 -
\??\c:\hhttbn.exec:\hhttbn.exe48⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3tnnbh.exec:\3tnnbh.exe49⤵
- Executes dropped EXE
PID:444 -
\??\c:\jpvdp.exec:\jpvdp.exe50⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rrflrrf.exec:\rrflrrf.exe51⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3bbbhn.exec:\3bbbhn.exe52⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nhhhbt.exec:\nhhhbt.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dddjj.exec:\dddjj.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xllrflr.exec:\xllrflr.exe55⤵
- Executes dropped EXE
PID:3044 -
\??\c:\7hnhhh.exec:\7hnhhh.exe56⤵
- Executes dropped EXE
PID:2520 -
\??\c:\ddpvj.exec:\ddpvj.exe57⤵
- Executes dropped EXE
PID:3024 -
\??\c:\3jdjj.exec:\3jdjj.exe58⤵
- Executes dropped EXE
PID:1932 -
\??\c:\9rxrrxf.exec:\9rxrrxf.exe59⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bbnbnt.exec:\bbnbnt.exe60⤵
- Executes dropped EXE
PID:2348 -
\??\c:\djpjp.exec:\djpjp.exe61⤵
- Executes dropped EXE
PID:2400 -
\??\c:\llflxfx.exec:\llflxfx.exe62⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xfxrxff.exec:\xfxrxff.exe63⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nbnthh.exec:\nbnthh.exe64⤵
- Executes dropped EXE
PID:1648 -
\??\c:\ddjvd.exec:\ddjvd.exe65⤵
- Executes dropped EXE
PID:768 -
\??\c:\5fxxlrf.exec:\5fxxlrf.exe66⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lfrrfff.exec:\lfrrfff.exe67⤵PID:1740
-
\??\c:\bthtbb.exec:\bthtbb.exe68⤵PID:1416
-
\??\c:\tthhtb.exec:\tthhtb.exe69⤵PID:1788
-
\??\c:\vdpvv.exec:\vdpvv.exe70⤵PID:2152
-
\??\c:\lrxfffr.exec:\lrxfffr.exe71⤵PID:1020
-
\??\c:\thttnn.exec:\thttnn.exe72⤵
- System Location Discovery: System Language Discovery
PID:1188 -
\??\c:\7jvvv.exec:\7jvvv.exe73⤵PID:1720
-
\??\c:\ddddv.exec:\ddddv.exe74⤵PID:2500
-
\??\c:\flxfffl.exec:\flxfffl.exe75⤵PID:608
-
\??\c:\ntbhtb.exec:\ntbhtb.exe76⤵PID:1684
-
\??\c:\9bbnbn.exec:\9bbnbn.exe77⤵PID:548
-
\??\c:\vjvdd.exec:\vjvdd.exe78⤵PID:1964
-
\??\c:\lxlxflx.exec:\lxlxflx.exe79⤵PID:2440
-
\??\c:\ntbbhn.exec:\ntbbhn.exe80⤵PID:2856
-
\??\c:\ntthth.exec:\ntthth.exe81⤵PID:2332
-
\??\c:\7vpvj.exec:\7vpvj.exe82⤵PID:2000
-
\??\c:\rxllxrx.exec:\rxllxrx.exe83⤵PID:2956
-
\??\c:\thbhnb.exec:\thbhnb.exe84⤵PID:3016
-
\??\c:\ttthnt.exec:\ttthnt.exe85⤵PID:2712
-
\??\c:\9jdjj.exec:\9jdjj.exe86⤵PID:3012
-
\??\c:\frllflr.exec:\frllflr.exe87⤵PID:3064
-
\??\c:\hnbhnt.exec:\hnbhnt.exe88⤵PID:2724
-
\??\c:\jpjpd.exec:\jpjpd.exe89⤵PID:2768
-
\??\c:\dvdjp.exec:\dvdjp.exe90⤵PID:2784
-
\??\c:\llrlrrf.exec:\llrlrrf.exe91⤵PID:1700
-
\??\c:\9nhntt.exec:\9nhntt.exe92⤵PID:3052
-
\??\c:\bnhbnn.exec:\bnhbnn.exe93⤵PID:2236
-
\??\c:\djvvj.exec:\djvvj.exe94⤵PID:1380
-
\??\c:\rrrxflr.exec:\rrrxflr.exe95⤵PID:2684
-
\??\c:\tbhttb.exec:\tbhttb.exe96⤵PID:1332
-
\??\c:\ntbhtn.exec:\ntbhtn.exe97⤵PID:1952
-
\??\c:\dvdjv.exec:\dvdjv.exe98⤵PID:2176
-
\??\c:\7xllrxl.exec:\7xllrxl.exe99⤵PID:2524
-
\??\c:\bnbbhn.exec:\bnbbhn.exe100⤵PID:1924
-
\??\c:\htnnhh.exec:\htnnhh.exe101⤵PID:264
-
\??\c:\jpjpp.exec:\jpjpp.exe102⤵PID:2196
-
\??\c:\vdddj.exec:\vdddj.exe103⤵PID:1944
-
\??\c:\xfrxlxf.exec:\xfrxlxf.exe104⤵PID:2364
-
\??\c:\hhnhtb.exec:\hhnhtb.exe105⤵PID:2356
-
\??\c:\bhhhnt.exec:\bhhhnt.exe106⤵PID:2412
-
\??\c:\jdpvd.exec:\jdpvd.exe107⤵PID:2108
-
\??\c:\flxflrf.exec:\flxflrf.exe108⤵PID:976
-
\??\c:\5lfrfrf.exec:\5lfrfrf.exe109⤵PID:2084
-
\??\c:\nntbnt.exec:\nntbnt.exe110⤵PID:2664
-
\??\c:\1pjvj.exec:\1pjvj.exe111⤵PID:1612
-
\??\c:\pvddj.exec:\pvddj.exe112⤵PID:1068
-
\??\c:\xxxlfll.exec:\xxxlfll.exe113⤵PID:1408
-
\??\c:\bhnbnh.exec:\bhnbnh.exe114⤵PID:2432
-
\??\c:\nnttbh.exec:\nnttbh.exe115⤵PID:2040
-
\??\c:\jpdjp.exec:\jpdjp.exe116⤵PID:1020
-
\??\c:\1rfxfxl.exec:\1rfxfxl.exe117⤵PID:1748
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe118⤵PID:1968
-
\??\c:\nbbttt.exec:\nbbttt.exe119⤵PID:1732
-
\??\c:\frrxrff.exec:\frrxrff.exe120⤵PID:2656
-
\??\c:\bnthtb.exec:\bnthtb.exe121⤵PID:2052
-
\??\c:\pvjpv.exec:\pvjpv.exe122⤵PID:2512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-