Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe
-
Size
453KB
-
MD5
0fe2187cb558d7370cf21c3d181fce54
-
SHA1
d0e83b3b3278cb34ca72d963c9e25274f89e3790
-
SHA256
facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb
-
SHA512
2f5fc673b3ef95ee5c3ccc6f0524eab6f34a456a3bfe2a100f84e6e74a4d7bd6ac96aa93d0b5043505428c9b42555847a3ceb3351ad4df54b14b4051c0d8b892
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2844-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-32-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-23-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/532-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-596-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-808-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2776-860-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2268-1014-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2216-1041-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1940 7vjjj.exe 2768 bnnbhn.exe 2696 vvpvj.exe 2800 xrlflfl.exe 532 1nhbbh.exe 2564 nhbbnn.exe 1860 vpdjp.exe 2580 ffxrxxl.exe 2072 tnbbtb.exe 2880 vjjpj.exe 2944 xxlrxxl.exe 2320 tbtttb.exe 2312 pjpdp.exe 476 rrrfxfr.exe 1944 7hbbhh.exe 572 1dpvj.exe 1996 1lxflxl.exe 1520 5rrxffx.exe 2192 bthhbh.exe 3020 pdpdp.exe 2984 frrlrrf.exe 860 vjvjv.exe 1656 nhtbhn.exe 1676 ppjjv.exe 788 fxllllr.exe 3008 bbtthh.exe 1268 ppjpv.exe 2352 9lrrxxf.exe 1528 3bnntt.exe 2520 vpdjv.exe 1444 3xffrxf.exe 1040 xxllxxf.exe 1512 vdpdj.exe 2704 9flrrrf.exe 1940 9ntbnt.exe 2152 dvpdj.exe 2768 7rffrrf.exe 2800 nhhnbb.exe 2728 pjdjp.exe 2584 ppdjj.exe 2276 1lxxrxx.exe 644 nhtttb.exe 1228 hnhnbh.exe 2552 vpddp.exe 2856 rlllrxf.exe 2880 1bhtbh.exe 600 3vjjj.exe 2860 pjdpd.exe 2124 llrxffl.exe 764 nnnntn.exe 1944 tnnnbb.exe 1608 vvpdp.exe 1996 3fflrxx.exe 1260 fxlrffr.exe 1704 hbtbnh.exe 2432 ddvdp.exe 2976 ffxxlxl.exe 2436 7tnhnn.exe 860 btnntb.exe 2528 vpjpd.exe 1052 ffflrrf.exe 2988 ttnntt.exe 316 tnhnbb.exe 1716 jjdjp.exe -
resource yara_rule behavioral1/memory/2844-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-23-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1528-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-808-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/1340-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-860-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2008-945-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-1016-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-1014-0x0000000000230000-0x000000000025A000-memory.dmp upx behavioral1/memory/2216-1041-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-1097-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-1112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-1187-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ttbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1940 2844 facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe 31 PID 2844 wrote to memory of 1940 2844 facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe 31 PID 2844 wrote to memory of 1940 2844 facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe 31 PID 2844 wrote to memory of 1940 2844 facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe 31 PID 1940 wrote to memory of 2768 1940 7vjjj.exe 32 PID 1940 wrote to memory of 2768 1940 7vjjj.exe 32 PID 1940 wrote to memory of 2768 1940 7vjjj.exe 32 PID 1940 wrote to memory of 2768 1940 7vjjj.exe 32 PID 2768 wrote to memory of 2696 2768 bnnbhn.exe 33 PID 2768 wrote to memory of 2696 2768 bnnbhn.exe 33 PID 2768 wrote to memory of 2696 2768 bnnbhn.exe 33 PID 2768 wrote to memory of 2696 2768 bnnbhn.exe 33 PID 2696 wrote to memory of 2800 2696 vvpvj.exe 34 PID 2696 wrote to memory of 2800 2696 vvpvj.exe 34 PID 2696 wrote to memory of 2800 2696 vvpvj.exe 34 PID 2696 wrote to memory of 2800 2696 vvpvj.exe 34 PID 2800 wrote to memory of 532 2800 xrlflfl.exe 35 PID 2800 wrote to memory of 532 2800 xrlflfl.exe 35 PID 2800 wrote to memory of 532 2800 xrlflfl.exe 35 PID 2800 wrote to memory of 532 2800 xrlflfl.exe 35 PID 532 wrote to memory of 2564 532 1nhbbh.exe 36 PID 532 wrote to memory of 2564 532 1nhbbh.exe 36 PID 532 wrote to memory of 2564 532 1nhbbh.exe 36 PID 532 wrote to memory of 2564 532 1nhbbh.exe 36 PID 2564 wrote to memory of 1860 2564 nhbbnn.exe 37 PID 2564 wrote to memory of 1860 2564 nhbbnn.exe 37 PID 2564 wrote to memory of 1860 2564 nhbbnn.exe 37 PID 2564 wrote to memory of 1860 2564 nhbbnn.exe 37 PID 1860 wrote to memory of 2580 1860 vpdjp.exe 38 PID 1860 wrote to memory of 2580 1860 vpdjp.exe 38 PID 1860 wrote to memory of 2580 1860 vpdjp.exe 38 PID 1860 wrote to memory of 2580 1860 vpdjp.exe 38 PID 2580 wrote to memory of 2072 2580 ffxrxxl.exe 39 PID 2580 wrote to memory of 2072 2580 ffxrxxl.exe 39 PID 2580 wrote to memory of 2072 2580 ffxrxxl.exe 39 PID 2580 wrote to memory of 2072 2580 ffxrxxl.exe 39 PID 2072 wrote to memory of 2880 2072 tnbbtb.exe 40 PID 2072 wrote to memory of 2880 2072 tnbbtb.exe 40 PID 2072 wrote to memory of 2880 2072 tnbbtb.exe 40 PID 2072 wrote to memory of 2880 2072 tnbbtb.exe 40 PID 2880 wrote to memory of 2944 2880 vjjpj.exe 41 PID 2880 wrote to memory of 2944 2880 vjjpj.exe 41 PID 2880 wrote to memory of 2944 2880 vjjpj.exe 41 PID 2880 wrote to memory of 2944 2880 vjjpj.exe 41 PID 2944 wrote to memory of 2320 2944 xxlrxxl.exe 42 PID 2944 wrote to memory of 2320 2944 xxlrxxl.exe 42 PID 2944 wrote to memory of 2320 2944 xxlrxxl.exe 42 PID 2944 wrote to memory of 2320 2944 xxlrxxl.exe 42 PID 2320 wrote to memory of 2312 2320 tbtttb.exe 43 PID 2320 wrote to memory of 2312 2320 tbtttb.exe 43 PID 2320 wrote to memory of 2312 2320 tbtttb.exe 43 PID 2320 wrote to memory of 2312 2320 tbtttb.exe 43 PID 2312 wrote to memory of 476 2312 pjpdp.exe 44 PID 2312 wrote to memory of 476 2312 pjpdp.exe 44 PID 2312 wrote to memory of 476 2312 pjpdp.exe 44 PID 2312 wrote to memory of 476 2312 pjpdp.exe 44 PID 476 wrote to memory of 1944 476 rrrfxfr.exe 45 PID 476 wrote to memory of 1944 476 rrrfxfr.exe 45 PID 476 wrote to memory of 1944 476 rrrfxfr.exe 45 PID 476 wrote to memory of 1944 476 rrrfxfr.exe 45 PID 1944 wrote to memory of 572 1944 7hbbhh.exe 46 PID 1944 wrote to memory of 572 1944 7hbbhh.exe 46 PID 1944 wrote to memory of 572 1944 7hbbhh.exe 46 PID 1944 wrote to memory of 572 1944 7hbbhh.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe"C:\Users\Admin\AppData\Local\Temp\facb57411b3685914525d0e7afa0fd974987faebd1d91aed2ab1cff47fad3eeb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\7vjjj.exec:\7vjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\bnnbhn.exec:\bnnbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vvpvj.exec:\vvpvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\xrlflfl.exec:\xrlflfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1nhbbh.exec:\1nhbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\nhbbnn.exec:\nhbbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\vpdjp.exec:\vpdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ffxrxxl.exec:\ffxrxxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\tnbbtb.exec:\tnbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vjjpj.exec:\vjjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tbtttb.exec:\tbtttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\pjpdp.exec:\pjpdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\rrrfxfr.exec:\rrrfxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:476 -
\??\c:\7hbbhh.exec:\7hbbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\1dpvj.exec:\1dpvj.exe17⤵
- Executes dropped EXE
PID:572 -
\??\c:\1lxflxl.exec:\1lxflxl.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5rrxffx.exec:\5rrxffx.exe19⤵
- Executes dropped EXE
PID:1520 -
\??\c:\bthhbh.exec:\bthhbh.exe20⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pdpdp.exec:\pdpdp.exe21⤵
- Executes dropped EXE
PID:3020 -
\??\c:\frrlrrf.exec:\frrlrrf.exe22⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vjvjv.exec:\vjvjv.exe23⤵
- Executes dropped EXE
PID:860 -
\??\c:\nhtbhn.exec:\nhtbhn.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ppjjv.exec:\ppjjv.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\fxllllr.exec:\fxllllr.exe26⤵
- Executes dropped EXE
PID:788 -
\??\c:\bbtthh.exec:\bbtthh.exe27⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ppjpv.exec:\ppjpv.exe28⤵
- Executes dropped EXE
PID:1268 -
\??\c:\9lrrxxf.exec:\9lrrxxf.exe29⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3bnntt.exec:\3bnntt.exe30⤵
- Executes dropped EXE
PID:1528 -
\??\c:\vpdjv.exec:\vpdjv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2520 -
\??\c:\3xffrxf.exec:\3xffrxf.exe32⤵
- Executes dropped EXE
PID:1444 -
\??\c:\xxllxxf.exec:\xxllxxf.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vdpdj.exec:\vdpdj.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\9flrrrf.exec:\9flrrrf.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\9ntbnt.exec:\9ntbnt.exe36⤵
- Executes dropped EXE
PID:1940 -
\??\c:\dvpdj.exec:\dvpdj.exe37⤵
- Executes dropped EXE
PID:2152 -
\??\c:\7rffrrf.exec:\7rffrrf.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nhhnbb.exec:\nhhnbb.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\pjdjp.exec:\pjdjp.exe40⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ppdjj.exec:\ppdjj.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1lxxrxx.exec:\1lxxrxx.exe42⤵
- Executes dropped EXE
PID:2276 -
\??\c:\nhtttb.exec:\nhtttb.exe43⤵
- Executes dropped EXE
PID:644 -
\??\c:\hnhnbh.exec:\hnhnbh.exe44⤵
- Executes dropped EXE
PID:1228 -
\??\c:\vpddp.exec:\vpddp.exe45⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rlllrxf.exec:\rlllrxf.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\1bhtbh.exec:\1bhtbh.exe47⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3vjjj.exec:\3vjjj.exe48⤵
- Executes dropped EXE
PID:600 -
\??\c:\pjdpd.exec:\pjdpd.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\llrxffl.exec:\llrxffl.exe50⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nnnntn.exec:\nnnntn.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\tnnnbb.exec:\tnnnbb.exe52⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vvpdp.exec:\vvpdp.exe53⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3fflrxx.exec:\3fflrxx.exe54⤵
- Executes dropped EXE
PID:1996 -
\??\c:\fxlrffr.exec:\fxlrffr.exe55⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hbtbnh.exec:\hbtbnh.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\ddvdp.exec:\ddvdp.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ffxxlxl.exec:\ffxxlxl.exe58⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7tnhnn.exec:\7tnhnn.exe59⤵
- Executes dropped EXE
PID:2436 -
\??\c:\btnntb.exec:\btnntb.exe60⤵
- Executes dropped EXE
PID:860 -
\??\c:\vpjpd.exec:\vpjpd.exe61⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ffflrrf.exec:\ffflrrf.exe62⤵
- Executes dropped EXE
PID:1052 -
\??\c:\ttnntt.exec:\ttnntt.exe63⤵
- Executes dropped EXE
PID:2988 -
\??\c:\tnhnbb.exec:\tnhnbb.exe64⤵
- Executes dropped EXE
PID:316 -
\??\c:\jjdjp.exec:\jjdjp.exe65⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rfxrxfr.exec:\rfxrxfr.exe66⤵PID:784
-
\??\c:\hbntbn.exec:\hbntbn.exe67⤵PID:1736
-
\??\c:\vpppv.exec:\vpppv.exe68⤵PID:1672
-
\??\c:\frllrlx.exec:\frllrlx.exe69⤵PID:1660
-
\??\c:\5tnnnt.exec:\5tnnnt.exe70⤵PID:744
-
\??\c:\tnhthn.exec:\tnhthn.exe71⤵PID:1528
-
\??\c:\jdppv.exec:\jdppv.exe72⤵PID:900
-
\??\c:\xlllrlf.exec:\xlllrlf.exe73⤵PID:1960
-
\??\c:\hhhhtn.exec:\hhhhtn.exe74⤵PID:2344
-
\??\c:\vpddj.exec:\vpddj.exe75⤵PID:1540
-
\??\c:\jdvdd.exec:\jdvdd.exe76⤵PID:2164
-
\??\c:\flfrxxl.exec:\flfrxxl.exe77⤵PID:2284
-
\??\c:\9bbttb.exec:\9bbttb.exe78⤵PID:2668
-
\??\c:\dvvdj.exec:\dvvdj.exe79⤵PID:2084
-
\??\c:\3pjdd.exec:\3pjdd.exe80⤵PID:2600
-
\??\c:\1frrflr.exec:\1frrflr.exe81⤵PID:2720
-
\??\c:\5bntbb.exec:\5bntbb.exe82⤵PID:2780
-
\??\c:\hthhnt.exec:\hthhnt.exe83⤵PID:2584
-
\??\c:\vjjdj.exec:\vjjdj.exe84⤵PID:3064
-
\??\c:\9frlrrx.exec:\9frlrrx.exe85⤵PID:3060
-
\??\c:\1btttt.exec:\1btttt.exe86⤵PID:1580
-
\??\c:\tbnbhh.exec:\tbnbhh.exe87⤵PID:2652
-
\??\c:\dvpdp.exec:\dvpdp.exe88⤵PID:2916
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe89⤵PID:2908
-
\??\c:\rfxflrf.exec:\rfxflrf.exe90⤵PID:2936
-
\??\c:\nbtbhn.exec:\nbtbhn.exe91⤵PID:2860
-
\??\c:\3dvdj.exec:\3dvdj.exe92⤵PID:2124
-
\??\c:\dvjpp.exec:\dvjpp.exe93⤵PID:1060
-
\??\c:\frrrrrr.exec:\frrrrrr.exe94⤵PID:2320
-
\??\c:\hbhhnt.exec:\hbhhnt.exe95⤵PID:1028
-
\??\c:\1jjvj.exec:\1jjvj.exe96⤵PID:1520
-
\??\c:\3vpjj.exec:\3vpjj.exe97⤵PID:1932
-
\??\c:\1rllxfl.exec:\1rllxfl.exe98⤵PID:2060
-
\??\c:\1bntbh.exec:\1bntbh.exe99⤵PID:2828
-
\??\c:\htnnbt.exec:\htnnbt.exe100⤵PID:2548
-
\??\c:\jdddj.exec:\jdddj.exe101⤵PID:2396
-
\??\c:\fxrxrxf.exec:\fxrxrxf.exe102⤵PID:1316
-
\??\c:\nhbhnn.exec:\nhbhnn.exe103⤵PID:2984
-
\??\c:\nnhhnt.exec:\nnhhnt.exe104⤵PID:1648
-
\??\c:\dddjp.exec:\dddjp.exe105⤵PID:1052
-
\??\c:\ffrxfff.exec:\ffrxfff.exe106⤵PID:2108
-
\??\c:\bbttht.exec:\bbttht.exe107⤵PID:2188
-
\??\c:\pppvd.exec:\pppvd.exe108⤵PID:2404
-
\??\c:\7vdjp.exec:\7vdjp.exe109⤵PID:1752
-
\??\c:\rfrrxfl.exec:\rfrrxfl.exe110⤵PID:1240
-
\??\c:\tthntt.exec:\tthntt.exe111⤵PID:972
-
\??\c:\bnnnbh.exec:\bnnnbh.exe112⤵PID:1660
-
\??\c:\pjjvj.exec:\pjjvj.exe113⤵PID:2500
-
\??\c:\fllfrlr.exec:\fllfrlr.exe114⤵PID:1264
-
\??\c:\tnnthn.exec:\tnnthn.exe115⤵PID:2300
-
\??\c:\9bhhnn.exec:\9bhhnn.exe116⤵PID:1040
-
\??\c:\djddp.exec:\djddp.exe117⤵PID:1340
-
\??\c:\ffrxflr.exec:\ffrxflr.exe118⤵PID:2764
-
\??\c:\xrflflr.exec:\xrflflr.exe119⤵PID:2816
-
\??\c:\tnhnnt.exec:\tnhnnt.exe120⤵PID:2964
-
\??\c:\jvjdj.exec:\jvjdj.exe121⤵PID:2776
-
\??\c:\pdvvj.exec:\pdvvj.exe122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-