Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe
-
Size
454KB
-
MD5
ddc2edbcfadbf0fba0dfef67551b3dcf
-
SHA1
2f1f1c0037361eeeb20de50ec4fd809166a25e9d
-
SHA256
2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956
-
SHA512
dd0d730ede188ae4222dc43bb03ccd9da40d91e98c143416d411b16b598b65913ad598ae2a415921306e1efec0b1967022546f1b2ce773d3872d9c7e1b0f77a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbey:q7Tc2NYHUrAwfMp3CDy
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-13-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3060-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-54-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2612-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-76-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2596-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/636-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-128-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1116-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/948-248-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/948-250-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1040-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-433-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-441-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1972-643-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-897-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2116-924-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-996-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-1151-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2916-1150-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3060 rrlrrrl.exe 2692 pppvp.exe 1968 5ppvp.exe 2756 xxfrxrr.exe 2536 nbbntn.exe 2612 jdpjd.exe 2116 nnntbh.exe 2596 pdjpv.exe 2364 tntbnb.exe 636 rrlxrlr.exe 2504 bttbtt.exe 2000 bhhhbt.exe 1116 tnhbnb.exe 2164 7vjvj.exe 1500 fxrrfll.exe 2212 9frlxrx.exe 2616 bbhbbb.exe 2192 ffrrfxr.exe 2384 bthtbh.exe 1664 9fxfrxl.exe 1860 nhbnhn.exe 904 bhnhbt.exe 2124 ppjvd.exe 1528 tnhbnb.exe 2500 jppvv.exe 948 hnhbht.exe 1040 ddpvj.exe 2188 nnntnt.exe 888 1pdjd.exe 352 nhhnhh.exe 108 djjvj.exe 3012 3tthnn.exe 2860 vpjpd.exe 2784 tnntnt.exe 2540 9ddpd.exe 2692 vpdjv.exe 2824 9flxlll.exe 2680 5hhnth.exe 2532 vppvp.exe 2432 xxfxxff.exe 2932 ttnbht.exe 1688 vdjdv.exe 2520 vdjvj.exe 2152 llflxfx.exe 3036 9bttbh.exe 1484 jpvdd.exe 1964 rxxxflf.exe 1960 bbbbtn.exe 1504 1vjpv.exe 1432 5llxlxl.exe 836 bhhbnt.exe 1116 pppvp.exe 2880 xxflxlf.exe 2972 nhhhth.exe 2212 pvddv.exe 2456 jjvjd.exe 444 xxlxrrl.exe 1136 hhbntb.exe 2384 dvvvd.exe 2028 xfxxllx.exe 2300 hhhtnt.exe 1052 5pjjd.exe 1616 7rrrflf.exe 1360 tnnhnt.exe -
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-13-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2692-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-433-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1972-643-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-821-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-924-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-967-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-1021-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/900-1105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-1141-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlflfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfrff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 3060 2644 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2644 wrote to memory of 3060 2644 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2644 wrote to memory of 3060 2644 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 2644 wrote to memory of 3060 2644 2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe 30 PID 3060 wrote to memory of 2692 3060 rrlrrrl.exe 31 PID 3060 wrote to memory of 2692 3060 rrlrrrl.exe 31 PID 3060 wrote to memory of 2692 3060 rrlrrrl.exe 31 PID 3060 wrote to memory of 2692 3060 rrlrrrl.exe 31 PID 2692 wrote to memory of 1968 2692 pppvp.exe 32 PID 2692 wrote to memory of 1968 2692 pppvp.exe 32 PID 2692 wrote to memory of 1968 2692 pppvp.exe 32 PID 2692 wrote to memory of 1968 2692 pppvp.exe 32 PID 1968 wrote to memory of 2756 1968 5ppvp.exe 33 PID 1968 wrote to memory of 2756 1968 5ppvp.exe 33 PID 1968 wrote to memory of 2756 1968 5ppvp.exe 33 PID 1968 wrote to memory of 2756 1968 5ppvp.exe 33 PID 2756 wrote to memory of 2536 2756 xxfrxrr.exe 34 PID 2756 wrote to memory of 2536 2756 xxfrxrr.exe 34 PID 2756 wrote to memory of 2536 2756 xxfrxrr.exe 34 PID 2756 wrote to memory of 2536 2756 xxfrxrr.exe 34 PID 2536 wrote to memory of 2612 2536 nbbntn.exe 35 PID 2536 wrote to memory of 2612 2536 nbbntn.exe 35 PID 2536 wrote to memory of 2612 2536 nbbntn.exe 35 PID 2536 wrote to memory of 2612 2536 nbbntn.exe 35 PID 2612 wrote to memory of 2116 2612 jdpjd.exe 36 PID 2612 wrote to memory of 2116 2612 jdpjd.exe 36 PID 2612 wrote to memory of 2116 2612 jdpjd.exe 36 PID 2612 wrote to memory of 2116 2612 jdpjd.exe 36 PID 2116 wrote to memory of 2596 2116 nnntbh.exe 37 PID 2116 wrote to memory of 2596 2116 nnntbh.exe 37 PID 2116 wrote to memory of 2596 2116 nnntbh.exe 37 PID 2116 wrote to memory of 2596 2116 nnntbh.exe 37 PID 2596 wrote to memory of 2364 2596 pdjpv.exe 38 PID 2596 wrote to memory of 2364 2596 pdjpv.exe 38 PID 2596 wrote to memory of 2364 2596 pdjpv.exe 38 PID 2596 wrote to memory of 2364 2596 pdjpv.exe 38 PID 2364 wrote to memory of 636 2364 tntbnb.exe 39 PID 2364 wrote to memory of 636 2364 tntbnb.exe 39 PID 2364 wrote to memory of 636 2364 tntbnb.exe 39 PID 2364 wrote to memory of 636 2364 tntbnb.exe 39 PID 636 wrote to memory of 2504 636 rrlxrlr.exe 40 PID 636 wrote to memory of 2504 636 rrlxrlr.exe 40 PID 636 wrote to memory of 2504 636 rrlxrlr.exe 40 PID 636 wrote to memory of 2504 636 rrlxrlr.exe 40 PID 2504 wrote to memory of 2000 2504 bttbtt.exe 41 PID 2504 wrote to memory of 2000 2504 bttbtt.exe 41 PID 2504 wrote to memory of 2000 2504 bttbtt.exe 41 PID 2504 wrote to memory of 2000 2504 bttbtt.exe 41 PID 2000 wrote to memory of 1116 2000 bhhhbt.exe 42 PID 2000 wrote to memory of 1116 2000 bhhhbt.exe 42 PID 2000 wrote to memory of 1116 2000 bhhhbt.exe 42 PID 2000 wrote to memory of 1116 2000 bhhhbt.exe 42 PID 1116 wrote to memory of 2164 1116 tnhbnb.exe 43 PID 1116 wrote to memory of 2164 1116 tnhbnb.exe 43 PID 1116 wrote to memory of 2164 1116 tnhbnb.exe 43 PID 1116 wrote to memory of 2164 1116 tnhbnb.exe 43 PID 2164 wrote to memory of 1500 2164 7vjvj.exe 44 PID 2164 wrote to memory of 1500 2164 7vjvj.exe 44 PID 2164 wrote to memory of 1500 2164 7vjvj.exe 44 PID 2164 wrote to memory of 1500 2164 7vjvj.exe 44 PID 1500 wrote to memory of 2212 1500 fxrrfll.exe 45 PID 1500 wrote to memory of 2212 1500 fxrrfll.exe 45 PID 1500 wrote to memory of 2212 1500 fxrrfll.exe 45 PID 1500 wrote to memory of 2212 1500 fxrrfll.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe"C:\Users\Admin\AppData\Local\Temp\2540835520d4d3024cbc3074a61ab8c91b5314b207771a5e75d3230c7cc72956.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\rrlrrrl.exec:\rrlrrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pppvp.exec:\pppvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\5ppvp.exec:\5ppvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\xxfrxrr.exec:\xxfrxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nbbntn.exec:\nbbntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jdpjd.exec:\jdpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\nnntbh.exec:\nnntbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\pdjpv.exec:\pdjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\tntbnb.exec:\tntbnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rrlxrlr.exec:\rrlxrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\bttbtt.exec:\bttbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bhhhbt.exec:\bhhhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\tnhbnb.exec:\tnhbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\7vjvj.exec:\7vjvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\fxrrfll.exec:\fxrrfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\9frlxrx.exec:\9frlxrx.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bbhbbb.exec:\bbhbbb.exe18⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ffrrfxr.exec:\ffrrfxr.exe19⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bthtbh.exec:\bthtbh.exe20⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9fxfrxl.exec:\9fxfrxl.exe21⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nhbnhn.exec:\nhbnhn.exe22⤵
- Executes dropped EXE
PID:1860 -
\??\c:\bhnhbt.exec:\bhnhbt.exe23⤵
- Executes dropped EXE
PID:904 -
\??\c:\ppjvd.exec:\ppjvd.exe24⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tnhbnb.exec:\tnhbnb.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jppvv.exec:\jppvv.exe26⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hnhbht.exec:\hnhbht.exe27⤵
- Executes dropped EXE
PID:948 -
\??\c:\ddpvj.exec:\ddpvj.exe28⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nnntnt.exec:\nnntnt.exe29⤵
- Executes dropped EXE
PID:2188 -
\??\c:\1pdjd.exec:\1pdjd.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\nhhnhh.exec:\nhhnhh.exe31⤵
- Executes dropped EXE
PID:352 -
\??\c:\djjvj.exec:\djjvj.exe32⤵
- Executes dropped EXE
PID:108 -
\??\c:\3tthnn.exec:\3tthnn.exe33⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpjpd.exec:\vpjpd.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\tnntnt.exec:\tnntnt.exe35⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9ddpd.exec:\9ddpd.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpdjv.exec:\vpdjv.exe37⤵
- Executes dropped EXE
PID:2692 -
\??\c:\9flxlll.exec:\9flxlll.exe38⤵
- Executes dropped EXE
PID:2824 -
\??\c:\5hhnth.exec:\5hhnth.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vppvp.exec:\vppvp.exe40⤵
- Executes dropped EXE
PID:2532 -
\??\c:\xxfxxff.exec:\xxfxxff.exe41⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ttnbht.exec:\ttnbht.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vdjdv.exec:\vdjdv.exe43⤵
- Executes dropped EXE
PID:1688 -
\??\c:\vdjvj.exec:\vdjvj.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\llflxfx.exec:\llflxfx.exe45⤵
- Executes dropped EXE
PID:2152 -
\??\c:\9bttbh.exec:\9bttbh.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jpvdd.exec:\jpvdd.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rxxxflf.exec:\rxxxflf.exe48⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bbbbtn.exec:\bbbbtn.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1vjpv.exec:\1vjpv.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5llxlxl.exec:\5llxlxl.exe51⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bhhbnt.exec:\bhhbnt.exe52⤵
- Executes dropped EXE
PID:836 -
\??\c:\pppvp.exec:\pppvp.exe53⤵
- Executes dropped EXE
PID:1116 -
\??\c:\xxflxlf.exec:\xxflxlf.exe54⤵
- Executes dropped EXE
PID:2880 -
\??\c:\nhhhth.exec:\nhhhth.exe55⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pvddv.exec:\pvddv.exe56⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jjvjd.exec:\jjvjd.exe57⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xxlxrrl.exec:\xxlxrrl.exe58⤵
- Executes dropped EXE
PID:444 -
\??\c:\hhbntb.exec:\hhbntb.exe59⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dvvvd.exec:\dvvvd.exe60⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xfxxllx.exec:\xfxxllx.exe61⤵
- Executes dropped EXE
PID:2028 -
\??\c:\hhhtnt.exec:\hhhtnt.exe62⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5pjjd.exec:\5pjjd.exe63⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7rrrflf.exec:\7rrrflf.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tnnhnt.exec:\tnnhnt.exe65⤵
- Executes dropped EXE
PID:1360 -
\??\c:\vvppj.exec:\vvppj.exe66⤵PID:1528
-
\??\c:\3xlxffx.exec:\3xlxffx.exe67⤵PID:1036
-
\??\c:\9tnhtb.exec:\9tnhtb.exe68⤵PID:2452
-
\??\c:\ddpdv.exec:\ddpdv.exe69⤵PID:1800
-
\??\c:\jdvpv.exec:\jdvpv.exe70⤵PID:2128
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe71⤵PID:2076
-
\??\c:\hhhnbh.exec:\hhhnbh.exe72⤵PID:1004
-
\??\c:\tthnth.exec:\tthnth.exe73⤵PID:2308
-
\??\c:\jdddv.exec:\jdddv.exe74⤵PID:2228
-
\??\c:\lllrflx.exec:\lllrflx.exe75⤵PID:1792
-
\??\c:\5hbnbn.exec:\5hbnbn.exe76⤵PID:2996
-
\??\c:\3djjp.exec:\3djjp.exe77⤵PID:2780
-
\??\c:\3lllxfl.exec:\3lllxfl.exe78⤵PID:2768
-
\??\c:\bbbhtt.exec:\bbbhtt.exe79⤵PID:2668
-
\??\c:\vvvpd.exec:\vvvpd.exe80⤵PID:2684
-
\??\c:\pvdvv.exec:\pvdvv.exe81⤵PID:2560
-
\??\c:\rllrllf.exec:\rllrllf.exe82⤵PID:2464
-
\??\c:\9nnhth.exec:\9nnhth.exe83⤵PID:2564
-
\??\c:\pjdjd.exec:\pjdjd.exe84⤵PID:2788
-
\??\c:\1lffrxf.exec:\1lffrxf.exe85⤵PID:2924
-
\??\c:\htthbh.exec:\htthbh.exe86⤵PID:1972
-
\??\c:\pppvd.exec:\pppvd.exe87⤵PID:2832
-
\??\c:\rxfxlfl.exec:\rxfxlfl.exe88⤵PID:1556
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe89⤵PID:1600
-
\??\c:\hhhthn.exec:\hhhthn.exe90⤵PID:1632
-
\??\c:\ppdpd.exec:\ppdpd.exe91⤵PID:2216
-
\??\c:\flffxfr.exec:\flffxfr.exe92⤵PID:484
-
\??\c:\9bbbnt.exec:\9bbbnt.exe93⤵PID:1652
-
\??\c:\jjvpd.exec:\jjvpd.exe94⤵PID:2020
-
\??\c:\5xrxfrl.exec:\5xrxfrl.exe95⤵PID:536
-
\??\c:\nttnhh.exec:\nttnhh.exe96⤵PID:1680
-
\??\c:\vdvpd.exec:\vdvpd.exe97⤵PID:2864
-
\??\c:\rrlxfrl.exec:\rrlxfrl.exe98⤵PID:2624
-
\??\c:\pvvdp.exec:\pvvdp.exe99⤵PID:1500
-
\??\c:\3flffll.exec:\3flffll.exe100⤵PID:3024
-
\??\c:\thbtht.exec:\thbtht.exe101⤵PID:2616
-
\??\c:\nntbnt.exec:\nntbnt.exe102⤵PID:3032
-
\??\c:\pppvp.exec:\pppvp.exe103⤵PID:444
-
\??\c:\5frxfxr.exec:\5frxfxr.exe104⤵PID:1136
-
\??\c:\bbtbnt.exec:\bbtbnt.exe105⤵PID:1588
-
\??\c:\vpjpj.exec:\vpjpj.exe106⤵PID:2028
-
\??\c:\rrrffrl.exec:\rrrffrl.exe107⤵PID:1112
-
\??\c:\ntthnt.exec:\ntthnt.exe108⤵PID:1052
-
\??\c:\ppddp.exec:\ppddp.exe109⤵PID:2124
-
\??\c:\rxxlffx.exec:\rxxlffx.exe110⤵PID:1560
-
\??\c:\nbbntb.exec:\nbbntb.exe111⤵PID:2084
-
\??\c:\ddvdp.exec:\ddvdp.exe112⤵PID:1592
-
\??\c:\rfxrfrf.exec:\rfxrfrf.exe113⤵PID:2452
-
\??\c:\7hbnbt.exec:\7hbnbt.exe114⤵PID:1800
-
\??\c:\pvpvj.exec:\pvpvj.exe115⤵PID:1724
-
\??\c:\9jjjp.exec:\9jjjp.exe116⤵PID:2976
-
\??\c:\xxxrxlx.exec:\xxxrxlx.exe117⤵PID:2956
-
\??\c:\ttnbtb.exec:\ttnbtb.exe118⤵PID:1736
-
\??\c:\jppdv.exec:\jppdv.exe119⤵PID:2904
-
\??\c:\rlrfxfx.exec:\rlrfxfx.exe120⤵PID:3012
-
\??\c:\nnhhtb.exec:\nnhhtb.exe121⤵PID:2812
-
\??\c:\pjdjd.exec:\pjdjd.exe122⤵PID:3060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-