Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 21:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe
-
Size
454KB
-
MD5
b08059df499c6b915ba8fe6e31f29e72
-
SHA1
f2745afbd5e4062b79c5c14fcc39dc17ce9027be
-
SHA256
2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e
-
SHA512
1cf2b7329b9a4e9ed497a0d774fd772f621550f38b173e31dd7096ca49e3cd15f0b53457d00afd78a60f9dfe8f66f9c8e755d4804c22b1f1510d27d98a306b12
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-40-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2576-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-170-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2076-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/520-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-273-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-347-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/584-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-390-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1872-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-604-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-612-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2936-654-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1716-701-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-729-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-776-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2516-783-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 912 xtbphn.exe 756 xvflldv.exe 2572 jtnbpp.exe 2576 pvhdxd.exe 2932 pdvtpfp.exe 2856 pnvpx.exe 3048 rrrblf.exe 816 rpfnn.exe 2348 fdtrxf.exe 2708 hlnlrt.exe 2324 hfdrll.exe 1884 frlbxrd.exe 2812 tfbbdd.exe 1584 jjfprf.exe 2140 blbth.exe 2112 xpjjr.exe 848 xxhjx.exe 2076 bprhdt.exe 1116 pnrvb.exe 2492 nrpxf.exe 1720 bdhnj.exe 520 thjjd.exe 1708 pbrhnlh.exe 2412 ppnpvpd.exe 1448 dxdth.exe 2524 bpllf.exe 2440 dflfflr.exe 2504 ljflbpb.exe 1960 vdxjvnh.exe 1028 dvjrvxj.exe 1732 jtbnfpr.exe 2184 xpthvhp.exe 2096 tjfhh.exe 1476 tfftft.exe 1056 xntrrjn.exe 2292 dntpjl.exe 2380 fblfj.exe 2828 vdlvt.exe 2948 rtjrl.exe 584 lvvdr.exe 2992 tdxpf.exe 2732 jfjrj.exe 3048 nnrbtb.exe 2956 pdbxfjt.exe 2344 fljnx.exe 1632 jfjffp.exe 1740 hvhpxb.exe 1872 ddbbplx.exe 1660 fjdlv.exe 1348 rhxtxh.exe 1932 dpvptfj.exe 2124 ftxnlnd.exe 2216 hrnlbhf.exe 2340 hlbfld.exe 1952 lpvdxr.exe 2424 nppbdv.exe 1908 vpdhdrp.exe 2076 rlpbh.exe 2512 hlrvxv.exe 976 bhbxnhh.exe 2244 tptflhj.exe 1720 fdxdnrb.exe 1500 vrdvr.exe 832 dlbdd.exe -
resource yara_rule behavioral1/memory/2100-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/520-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-273-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-604-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-669-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1884-709-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-708-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/3060-716-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-776-0x0000000000230000-0x000000000025A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhthdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxlxlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxtdpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdltdtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttvjhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjrpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fthhxvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttlvhjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdlvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hltlbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhrdvlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnxddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrnrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bltnpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvdxldx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnhvdxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftlhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjttf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdlfxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjjlprf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llpdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbrbdjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lldrlvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxvxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjrrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrpfptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 912 2100 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 30 PID 2100 wrote to memory of 912 2100 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 30 PID 2100 wrote to memory of 912 2100 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 30 PID 2100 wrote to memory of 912 2100 2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe 30 PID 912 wrote to memory of 756 912 xtbphn.exe 31 PID 912 wrote to memory of 756 912 xtbphn.exe 31 PID 912 wrote to memory of 756 912 xtbphn.exe 31 PID 912 wrote to memory of 756 912 xtbphn.exe 31 PID 756 wrote to memory of 2572 756 xvflldv.exe 32 PID 756 wrote to memory of 2572 756 xvflldv.exe 32 PID 756 wrote to memory of 2572 756 xvflldv.exe 32 PID 756 wrote to memory of 2572 756 xvflldv.exe 32 PID 2572 wrote to memory of 2576 2572 jtnbpp.exe 33 PID 2572 wrote to memory of 2576 2572 jtnbpp.exe 33 PID 2572 wrote to memory of 2576 2572 jtnbpp.exe 33 PID 2572 wrote to memory of 2576 2572 jtnbpp.exe 33 PID 2576 wrote to memory of 2932 2576 pvhdxd.exe 34 PID 2576 wrote to memory of 2932 2576 pvhdxd.exe 34 PID 2576 wrote to memory of 2932 2576 pvhdxd.exe 34 PID 2576 wrote to memory of 2932 2576 pvhdxd.exe 34 PID 2932 wrote to memory of 2856 2932 pdvtpfp.exe 35 PID 2932 wrote to memory of 2856 2932 pdvtpfp.exe 35 PID 2932 wrote to memory of 2856 2932 pdvtpfp.exe 35 PID 2932 wrote to memory of 2856 2932 pdvtpfp.exe 35 PID 2856 wrote to memory of 3048 2856 pnvpx.exe 36 PID 2856 wrote to memory of 3048 2856 pnvpx.exe 36 PID 2856 wrote to memory of 3048 2856 pnvpx.exe 36 PID 2856 wrote to memory of 3048 2856 pnvpx.exe 36 PID 3048 wrote to memory of 816 3048 rrrblf.exe 37 PID 3048 wrote to memory of 816 3048 rrrblf.exe 37 PID 3048 wrote to memory of 816 3048 rrrblf.exe 37 PID 3048 wrote to memory of 816 3048 rrrblf.exe 37 PID 816 wrote to memory of 2348 816 rpfnn.exe 38 PID 816 wrote to memory of 2348 816 rpfnn.exe 38 PID 816 wrote to memory of 2348 816 rpfnn.exe 38 PID 816 wrote to memory of 2348 816 rpfnn.exe 38 PID 2348 wrote to memory of 2708 2348 fdtrxf.exe 39 PID 2348 wrote to memory of 2708 2348 fdtrxf.exe 39 PID 2348 wrote to memory of 2708 2348 fdtrxf.exe 39 PID 2348 wrote to memory of 2708 2348 fdtrxf.exe 39 PID 2708 wrote to memory of 2324 2708 hlnlrt.exe 40 PID 2708 wrote to memory of 2324 2708 hlnlrt.exe 40 PID 2708 wrote to memory of 2324 2708 hlnlrt.exe 40 PID 2708 wrote to memory of 2324 2708 hlnlrt.exe 40 PID 2324 wrote to memory of 1884 2324 hfdrll.exe 41 PID 2324 wrote to memory of 1884 2324 hfdrll.exe 41 PID 2324 wrote to memory of 1884 2324 hfdrll.exe 41 PID 2324 wrote to memory of 1884 2324 hfdrll.exe 41 PID 1884 wrote to memory of 2812 1884 frlbxrd.exe 42 PID 1884 wrote to memory of 2812 1884 frlbxrd.exe 42 PID 1884 wrote to memory of 2812 1884 frlbxrd.exe 42 PID 1884 wrote to memory of 2812 1884 frlbxrd.exe 42 PID 2812 wrote to memory of 1584 2812 tfbbdd.exe 43 PID 2812 wrote to memory of 1584 2812 tfbbdd.exe 43 PID 2812 wrote to memory of 1584 2812 tfbbdd.exe 43 PID 2812 wrote to memory of 1584 2812 tfbbdd.exe 43 PID 1584 wrote to memory of 2140 1584 jjfprf.exe 44 PID 1584 wrote to memory of 2140 1584 jjfprf.exe 44 PID 1584 wrote to memory of 2140 1584 jjfprf.exe 44 PID 1584 wrote to memory of 2140 1584 jjfprf.exe 44 PID 2140 wrote to memory of 2112 2140 blbth.exe 45 PID 2140 wrote to memory of 2112 2140 blbth.exe 45 PID 2140 wrote to memory of 2112 2140 blbth.exe 45 PID 2140 wrote to memory of 2112 2140 blbth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe"C:\Users\Admin\AppData\Local\Temp\2b3ffc75e4e9262cd784ceef21575be7cf3bfd99bd364adeeedb960e8ad6626e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\xtbphn.exec:\xtbphn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\xvflldv.exec:\xvflldv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jtnbpp.exec:\jtnbpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\pvhdxd.exec:\pvhdxd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\pdvtpfp.exec:\pdvtpfp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pnvpx.exec:\pnvpx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rrrblf.exec:\rrrblf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rpfnn.exec:\rpfnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\fdtrxf.exec:\fdtrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\hlnlrt.exec:\hlnlrt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\hfdrll.exec:\hfdrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\frlbxrd.exec:\frlbxrd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\tfbbdd.exec:\tfbbdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jjfprf.exec:\jjfprf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\blbth.exec:\blbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\xpjjr.exec:\xpjjr.exe17⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xxhjx.exec:\xxhjx.exe18⤵
- Executes dropped EXE
PID:848 -
\??\c:\bprhdt.exec:\bprhdt.exe19⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pnrvb.exec:\pnrvb.exe20⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nrpxf.exec:\nrpxf.exe21⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bdhnj.exec:\bdhnj.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\thjjd.exec:\thjjd.exe23⤵
- Executes dropped EXE
PID:520 -
\??\c:\pbrhnlh.exec:\pbrhnlh.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ppnpvpd.exec:\ppnpvpd.exe25⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dxdth.exec:\dxdth.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\bpllf.exec:\bpllf.exe27⤵
- Executes dropped EXE
PID:2524 -
\??\c:\dflfflr.exec:\dflfflr.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\ljflbpb.exec:\ljflbpb.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vdxjvnh.exec:\vdxjvnh.exe30⤵
- Executes dropped EXE
PID:1960 -
\??\c:\dvjrvxj.exec:\dvjrvxj.exe31⤵
- Executes dropped EXE
PID:1028 -
\??\c:\jtbnfpr.exec:\jtbnfpr.exe32⤵
- Executes dropped EXE
PID:1732 -
\??\c:\xpthvhp.exec:\xpthvhp.exe33⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tjfhh.exec:\tjfhh.exe34⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tfftft.exec:\tfftft.exe35⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xntrrjn.exec:\xntrrjn.exe36⤵
- Executes dropped EXE
PID:1056 -
\??\c:\dntpjl.exec:\dntpjl.exe37⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fblfj.exec:\fblfj.exe38⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vdlvt.exec:\vdlvt.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\rtjrl.exec:\rtjrl.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lvvdr.exec:\lvvdr.exe41⤵
- Executes dropped EXE
PID:584 -
\??\c:\tdxpf.exec:\tdxpf.exe42⤵
- Executes dropped EXE
PID:2992 -
\??\c:\jfjrj.exec:\jfjrj.exe43⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nnrbtb.exec:\nnrbtb.exe44⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pdbxfjt.exec:\pdbxfjt.exe45⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fljnx.exec:\fljnx.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jfjffp.exec:\jfjffp.exe47⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hvhpxb.exec:\hvhpxb.exe48⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ddbbplx.exec:\ddbbplx.exe49⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fjdlv.exec:\fjdlv.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rhxtxh.exec:\rhxtxh.exe51⤵
- Executes dropped EXE
PID:1348 -
\??\c:\dpvptfj.exec:\dpvptfj.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\ftxnlnd.exec:\ftxnlnd.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\hrnlbhf.exec:\hrnlbhf.exe54⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hlbfld.exec:\hlbfld.exe55⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lpvdxr.exec:\lpvdxr.exe56⤵
- Executes dropped EXE
PID:1952 -
\??\c:\nppbdv.exec:\nppbdv.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\vpdhdrp.exec:\vpdhdrp.exe58⤵
- Executes dropped EXE
PID:1908 -
\??\c:\rlpbh.exec:\rlpbh.exe59⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hlrvxv.exec:\hlrvxv.exe60⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bhbxnhh.exec:\bhbxnhh.exe61⤵
- Executes dropped EXE
PID:976 -
\??\c:\tptflhj.exec:\tptflhj.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fdxdnrb.exec:\fdxdnrb.exe63⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vrdvr.exec:\vrdvr.exe64⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dlbdd.exec:\dlbdd.exe65⤵
- Executes dropped EXE
PID:832 -
\??\c:\bnxrbr.exec:\bnxrbr.exe66⤵PID:2064
-
\??\c:\xffpd.exec:\xffpd.exe67⤵PID:2412
-
\??\c:\ttdxndn.exec:\ttdxndn.exe68⤵PID:1704
-
\??\c:\fjrlt.exec:\fjrlt.exe69⤵PID:108
-
\??\c:\trhfbdh.exec:\trhfbdh.exe70⤵PID:1700
-
\??\c:\jvxjn.exec:\jvxjn.exe71⤵PID:2224
-
\??\c:\dtjltf.exec:\dtjltf.exe72⤵PID:236
-
\??\c:\vbjnrb.exec:\vbjnrb.exe73⤵PID:1548
-
\??\c:\bddhn.exec:\bddhn.exe74⤵PID:532
-
\??\c:\vpvhl.exec:\vpvhl.exe75⤵PID:1736
-
\??\c:\jjtlj.exec:\jjtlj.exe76⤵PID:1732
-
\??\c:\dvvnp.exec:\dvvnp.exe77⤵PID:2660
-
\??\c:\xvllptl.exec:\xvllptl.exe78⤵PID:1892
-
\??\c:\bxjlnhx.exec:\bxjlnhx.exe79⤵PID:3012
-
\??\c:\tjdxdb.exec:\tjdxdb.exe80⤵PID:2656
-
\??\c:\vfdjx.exec:\vfdjx.exe81⤵PID:2864
-
\??\c:\ptrlhp.exec:\ptrlhp.exe82⤵PID:2936
-
\??\c:\tptbdnt.exec:\tptbdnt.exe83⤵PID:2944
-
\??\c:\lxxpn.exec:\lxxpn.exe84⤵PID:2088
-
\??\c:\xbrhjnl.exec:\xbrhjnl.exe85⤵PID:964
-
\??\c:\jxlvtb.exec:\jxlvtb.exe86⤵PID:2992
-
\??\c:\vtnxp.exec:\vtnxp.exe87⤵PID:2732
-
\??\c:\djflnjh.exec:\djflnjh.exe88⤵PID:2332
-
\??\c:\pxdxxd.exec:\pxdxxd.exe89⤵PID:2860
-
\??\c:\htpbxtf.exec:\htpbxtf.exe90⤵PID:956
-
\??\c:\thtjb.exec:\thtjb.exe91⤵PID:2704
-
\??\c:\brlfrp.exec:\brlfrp.exe92⤵PID:1716
-
\??\c:\lfbrv.exec:\lfbrv.exe93⤵PID:3024
-
\??\c:\tjrpp.exec:\tjrpp.exe94⤵
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\nfppphl.exec:\nfppphl.exe95⤵PID:3060
-
\??\c:\fphdvxv.exec:\fphdvxv.exe96⤵PID:1900
-
\??\c:\lxxdvx.exec:\lxxdvx.exe97⤵PID:1676
-
\??\c:\fvfrh.exec:\fvfrh.exe98⤵PID:2160
-
\??\c:\bxvltp.exec:\bxvltp.exe99⤵PID:2340
-
\??\c:\djpbbhh.exec:\djpbbhh.exe100⤵PID:836
-
\??\c:\rxjlljj.exec:\rxjlljj.exe101⤵PID:2372
-
\??\c:\bvrfpnt.exec:\bvrfpnt.exe102⤵PID:2276
-
\??\c:\drpttb.exec:\drpttb.exe103⤵PID:1116
-
\??\c:\lpxtrv.exec:\lpxtrv.exe104⤵PID:2516
-
\??\c:\ptbphdr.exec:\ptbphdr.exe105⤵PID:1912
-
\??\c:\dvnlt.exec:\dvnlt.exe106⤵PID:1880
-
\??\c:\hpfth.exec:\hpfth.exe107⤵PID:272
-
\??\c:\lpflnxj.exec:\lpflnxj.exe108⤵PID:2436
-
\??\c:\jrjxthn.exec:\jrjxthn.exe109⤵PID:2328
-
\??\c:\llvbfvb.exec:\llvbfvb.exe110⤵PID:1788
-
\??\c:\nnpblvr.exec:\nnpblvr.exe111⤵PID:1924
-
\??\c:\vpfvh.exec:\vpfvh.exe112⤵PID:1800
-
\??\c:\ptlvpfh.exec:\ptlvpfh.exe113⤵PID:2416
-
\??\c:\jnbfjr.exec:\jnbfjr.exe114⤵PID:2464
-
\??\c:\bpnrfp.exec:\bpnrfp.exe115⤵PID:2480
-
\??\c:\fbdxnh.exec:\fbdxnh.exe116⤵PID:2664
-
\??\c:\jtfddl.exec:\jtfddl.exe117⤵PID:1036
-
\??\c:\djlrxfh.exec:\djlrxfh.exe118⤵PID:2696
-
\??\c:\lnjlhrn.exec:\lnjlhrn.exe119⤵PID:912
-
\??\c:\lbvvnbj.exec:\lbvvnbj.exe120⤵PID:2096
-
\??\c:\xllfjph.exec:\xllfjph.exe121⤵PID:2200
-
\??\c:\njfltpn.exec:\njfltpn.exe122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-