Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe
-
Size
453KB
-
MD5
c5b5de336ea7eef236a9288b6b151c58
-
SHA1
cddfbc4f2a763e854eab6c59a006e5cfa9112f2b
-
SHA256
fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0
-
SHA512
5b5f8fc1d03318b05da3d5d3aefdc320d98a3c880f50c0706c66b404acb0bff96f13e590ea2ee19fd6af50f96dc5a81eec3f75add2e13913eb1667f1cbf8e81e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe+:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2688-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1592-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-76-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2752-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2432-135-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2128-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/900-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-224-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-230-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2344-232-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/600-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1988-279-0x0000000077440000-0x000000007755F000-memory.dmp family_blackmoon behavioral1/memory/1988-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1116-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/952-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-555-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2164-643-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2352-673-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-692-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 jjvvj.exe 2692 hbnbhh.exe 2248 3xrrxxl.exe 2900 5dpdp.exe 2712 lfrrxxl.exe 2584 hthtbb.exe 2600 3dpjp.exe 1592 5xllxrf.exe 2876 pvddd.exe 2928 xlrlrxx.exe 2376 3btbhh.exe 2752 jdppd.exe 2432 tnbbhh.exe 2292 3jvdd.exe 2880 bnnhnn.exe 2128 pvvvv.exe 812 thnthh.exe 1556 hbbnbb.exe 900 ffxfrrx.exe 2356 5hbhnb.exe 2252 xrfxlfl.exe 2200 7pdjp.exe 2344 rlflrxl.exe 1620 hbnnbb.exe 600 9xrlxxl.exe 1660 hthbhb.exe 276 7dpdp.exe 2440 vpvdp.exe 1988 lxlrrlx.exe 2416 pjdjj.exe 2760 dvjvd.exe 2756 xrfxxxf.exe 2804 thbthb.exe 2544 7flflfl.exe 2616 hthhtb.exe 2148 httntb.exe 2360 djvpp.exe 1172 1xlxrll.exe 1116 tnbhnn.exe 2812 tthhtb.exe 2272 3vjpv.exe 2368 rxlfrlr.exe 336 nbhhtn.exe 1432 9djjj.exe 1428 3pjdd.exe 1900 xrrrffr.exe 664 xrrxrff.exe 1912 htbbbb.exe 1488 vpjdj.exe 1848 rfflfxx.exe 1852 5lrrxrr.exe 2144 thbntt.exe 1156 1jppp.exe 2204 1jjjj.exe 1884 rfrxffl.exe 1696 btbhhn.exe 268 vppvd.exe 1192 5vjvj.exe 1776 7xrfxrx.exe 952 7xlfffl.exe 1772 httnnh.exe 2500 vjppp.exe 1152 3djjj.exe 348 lxlrfxf.exe -
resource yara_rule behavioral1/memory/2688-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-74-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1592-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1116-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-446-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2204-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-640-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-673-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-719-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2772 2688 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 31 PID 2688 wrote to memory of 2772 2688 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 31 PID 2688 wrote to memory of 2772 2688 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 31 PID 2688 wrote to memory of 2772 2688 fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe 31 PID 2772 wrote to memory of 2692 2772 jjvvj.exe 32 PID 2772 wrote to memory of 2692 2772 jjvvj.exe 32 PID 2772 wrote to memory of 2692 2772 jjvvj.exe 32 PID 2772 wrote to memory of 2692 2772 jjvvj.exe 32 PID 2692 wrote to memory of 2248 2692 hbnbhh.exe 33 PID 2692 wrote to memory of 2248 2692 hbnbhh.exe 33 PID 2692 wrote to memory of 2248 2692 hbnbhh.exe 33 PID 2692 wrote to memory of 2248 2692 hbnbhh.exe 33 PID 2248 wrote to memory of 2900 2248 3xrrxxl.exe 34 PID 2248 wrote to memory of 2900 2248 3xrrxxl.exe 34 PID 2248 wrote to memory of 2900 2248 3xrrxxl.exe 34 PID 2248 wrote to memory of 2900 2248 3xrrxxl.exe 34 PID 2900 wrote to memory of 2712 2900 5dpdp.exe 35 PID 2900 wrote to memory of 2712 2900 5dpdp.exe 35 PID 2900 wrote to memory of 2712 2900 5dpdp.exe 35 PID 2900 wrote to memory of 2712 2900 5dpdp.exe 35 PID 2712 wrote to memory of 2584 2712 lfrrxxl.exe 36 PID 2712 wrote to memory of 2584 2712 lfrrxxl.exe 36 PID 2712 wrote to memory of 2584 2712 lfrrxxl.exe 36 PID 2712 wrote to memory of 2584 2712 lfrrxxl.exe 36 PID 2584 wrote to memory of 2600 2584 hthtbb.exe 37 PID 2584 wrote to memory of 2600 2584 hthtbb.exe 37 PID 2584 wrote to memory of 2600 2584 hthtbb.exe 37 PID 2584 wrote to memory of 2600 2584 hthtbb.exe 37 PID 2600 wrote to memory of 1592 2600 3dpjp.exe 38 PID 2600 wrote to memory of 1592 2600 3dpjp.exe 38 PID 2600 wrote to memory of 1592 2600 3dpjp.exe 38 PID 2600 wrote to memory of 1592 2600 3dpjp.exe 38 PID 1592 wrote to memory of 2876 1592 5xllxrf.exe 39 PID 1592 wrote to memory of 2876 1592 5xllxrf.exe 39 PID 1592 wrote to memory of 2876 1592 5xllxrf.exe 39 PID 1592 wrote to memory of 2876 1592 5xllxrf.exe 39 PID 2876 wrote to memory of 2928 2876 pvddd.exe 40 PID 2876 wrote to memory of 2928 2876 pvddd.exe 40 PID 2876 wrote to memory of 2928 2876 pvddd.exe 40 PID 2876 wrote to memory of 2928 2876 pvddd.exe 40 PID 2928 wrote to memory of 2376 2928 xlrlrxx.exe 41 PID 2928 wrote to memory of 2376 2928 xlrlrxx.exe 41 PID 2928 wrote to memory of 2376 2928 xlrlrxx.exe 41 PID 2928 wrote to memory of 2376 2928 xlrlrxx.exe 41 PID 2376 wrote to memory of 2752 2376 3btbhh.exe 42 PID 2376 wrote to memory of 2752 2376 3btbhh.exe 42 PID 2376 wrote to memory of 2752 2376 3btbhh.exe 42 PID 2376 wrote to memory of 2752 2376 3btbhh.exe 42 PID 2752 wrote to memory of 2432 2752 jdppd.exe 43 PID 2752 wrote to memory of 2432 2752 jdppd.exe 43 PID 2752 wrote to memory of 2432 2752 jdppd.exe 43 PID 2752 wrote to memory of 2432 2752 jdppd.exe 43 PID 2432 wrote to memory of 2292 2432 tnbbhh.exe 44 PID 2432 wrote to memory of 2292 2432 tnbbhh.exe 44 PID 2432 wrote to memory of 2292 2432 tnbbhh.exe 44 PID 2432 wrote to memory of 2292 2432 tnbbhh.exe 44 PID 2292 wrote to memory of 2880 2292 3jvdd.exe 45 PID 2292 wrote to memory of 2880 2292 3jvdd.exe 45 PID 2292 wrote to memory of 2880 2292 3jvdd.exe 45 PID 2292 wrote to memory of 2880 2292 3jvdd.exe 45 PID 2880 wrote to memory of 2128 2880 bnnhnn.exe 46 PID 2880 wrote to memory of 2128 2880 bnnhnn.exe 46 PID 2880 wrote to memory of 2128 2880 bnnhnn.exe 46 PID 2880 wrote to memory of 2128 2880 bnnhnn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe"C:\Users\Admin\AppData\Local\Temp\fae5a57922f30e51062af129e682d364be707a58001ee81ee57467fe3f2675b0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\jjvvj.exec:\jjvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hbnbhh.exec:\hbnbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3xrrxxl.exec:\3xrrxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\5dpdp.exec:\5dpdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lfrrxxl.exec:\lfrrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hthtbb.exec:\hthtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\3dpjp.exec:\3dpjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\5xllxrf.exec:\5xllxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\pvddd.exec:\pvddd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xlrlrxx.exec:\xlrlrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3btbhh.exec:\3btbhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\jdppd.exec:\jdppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\tnbbhh.exec:\tnbbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\3jvdd.exec:\3jvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\bnnhnn.exec:\bnnhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\pvvvv.exec:\pvvvv.exe17⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thnthh.exec:\thnthh.exe18⤵
- Executes dropped EXE
PID:812 -
\??\c:\hbbnbb.exec:\hbbnbb.exe19⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe20⤵
- Executes dropped EXE
PID:900 -
\??\c:\5hbhnb.exec:\5hbhnb.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xrfxlfl.exec:\xrfxlfl.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7pdjp.exec:\7pdjp.exe23⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rlflrxl.exec:\rlflrxl.exe24⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hbnnbb.exec:\hbnnbb.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9xrlxxl.exec:\9xrlxxl.exe26⤵
- Executes dropped EXE
PID:600 -
\??\c:\hthbhb.exec:\hthbhb.exe27⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7dpdp.exec:\7dpdp.exe28⤵
- Executes dropped EXE
PID:276 -
\??\c:\vpvdp.exec:\vpvdp.exe29⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lxlrrlx.exec:\lxlrrlx.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\pdddd.exec:\pdddd.exe31⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\pjdjj.exec:\pjdjj.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvjvd.exec:\dvjvd.exe33⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe34⤵
- Executes dropped EXE
PID:2756 -
\??\c:\thbthb.exec:\thbthb.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\7flflfl.exec:\7flflfl.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hthhtb.exec:\hthhtb.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\httntb.exec:\httntb.exe38⤵
- Executes dropped EXE
PID:2148 -
\??\c:\djvpp.exec:\djvpp.exe39⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1xlxrll.exec:\1xlxrll.exe40⤵
- Executes dropped EXE
PID:1172 -
\??\c:\tnbhnn.exec:\tnbhnn.exe41⤵
- Executes dropped EXE
PID:1116 -
\??\c:\tthhtb.exec:\tthhtb.exe42⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3vjpv.exec:\3vjpv.exe43⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rxlfrlr.exec:\rxlfrlr.exe44⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nbhhtn.exec:\nbhhtn.exe45⤵
- Executes dropped EXE
PID:336 -
\??\c:\9djjj.exec:\9djjj.exe46⤵
- Executes dropped EXE
PID:1432 -
\??\c:\3pjdd.exec:\3pjdd.exe47⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xrrrffr.exec:\xrrrffr.exe48⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xrrxrff.exec:\xrrxrff.exe49⤵
- Executes dropped EXE
PID:664 -
\??\c:\htbbbb.exec:\htbbbb.exe50⤵
- Executes dropped EXE
PID:1912 -
\??\c:\vpjdj.exec:\vpjdj.exe51⤵
- Executes dropped EXE
PID:1488 -
\??\c:\rfflfxx.exec:\rfflfxx.exe52⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5lrrxrr.exec:\5lrrxrr.exe53⤵
- Executes dropped EXE
PID:1852 -
\??\c:\thbntt.exec:\thbntt.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1jppp.exec:\1jppp.exe55⤵
- Executes dropped EXE
PID:1156 -
\??\c:\1jjjj.exec:\1jjjj.exe56⤵
- Executes dropped EXE
PID:2204 -
\??\c:\rfrxffl.exec:\rfrxffl.exe57⤵
- Executes dropped EXE
PID:1884 -
\??\c:\btbhhn.exec:\btbhhn.exe58⤵
- Executes dropped EXE
PID:1696 -
\??\c:\vppvd.exec:\vppvd.exe59⤵
- Executes dropped EXE
PID:268 -
\??\c:\5vjvj.exec:\5vjvj.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\7xrfxrx.exec:\7xrfxrx.exe61⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7xlfffl.exec:\7xlfffl.exe62⤵
- Executes dropped EXE
PID:952 -
\??\c:\httnnh.exec:\httnnh.exe63⤵
- Executes dropped EXE
PID:1772 -
\??\c:\vjppp.exec:\vjppp.exe64⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3djjj.exec:\3djjj.exe65⤵
- Executes dropped EXE
PID:1152 -
\??\c:\lxlrfxf.exec:\lxlrfxf.exe66⤵
- Executes dropped EXE
PID:348 -
\??\c:\1nbttt.exec:\1nbttt.exe67⤵PID:1664
-
\??\c:\9bnhhh.exec:\9bnhhh.exe68⤵PID:1608
-
\??\c:\5dvvv.exec:\5dvvv.exe69⤵PID:2968
-
\??\c:\3lxflrr.exec:\3lxflrr.exe70⤵PID:2836
-
\??\c:\frxrrrx.exec:\frxrrrx.exe71⤵PID:2380
-
\??\c:\9nnbhh.exec:\9nnbhh.exe72⤵PID:2416
-
\??\c:\vjvvv.exec:\vjvvv.exe73⤵PID:2732
-
\??\c:\xxxxxff.exec:\xxxxxff.exe74⤵PID:2680
-
\??\c:\fxrxxrr.exec:\fxrxxrr.exe75⤵PID:2556
-
\??\c:\thbhtb.exec:\thbhtb.exe76⤵PID:2712
-
\??\c:\pdjjp.exec:\pdjjp.exe77⤵PID:2584
-
\??\c:\lxrfffl.exec:\lxrfffl.exe78⤵PID:3052
-
\??\c:\xrflrlx.exec:\xrflrlx.exe79⤵PID:2148
-
\??\c:\nbhntb.exec:\nbhntb.exe80⤵PID:2276
-
\??\c:\7dddd.exec:\7dddd.exe81⤵PID:1172
-
\??\c:\jjddd.exec:\jjddd.exe82⤵PID:2912
-
\??\c:\5fflllr.exec:\5fflllr.exe83⤵PID:2812
-
\??\c:\hbhbbb.exec:\hbhbbb.exe84⤵PID:3048
-
\??\c:\3djjv.exec:\3djjv.exe85⤵PID:2164
-
\??\c:\3frrrrf.exec:\3frrrrf.exe86⤵PID:2528
-
\??\c:\9ffxrll.exec:\9ffxrll.exe87⤵PID:1820
-
\??\c:\bnbbhh.exec:\bnbbhh.exe88⤵PID:1780
-
\??\c:\3vjjj.exec:\3vjjj.exe89⤵PID:2352
-
\??\c:\llxxxxf.exec:\llxxxxf.exe90⤵PID:1632
-
\??\c:\1rxrxxx.exec:\1rxrxxx.exe91⤵PID:1008
-
\??\c:\3htthn.exec:\3htthn.exe92⤵PID:1496
-
\??\c:\9pdvd.exec:\9pdvd.exe93⤵PID:1544
-
\??\c:\lxlfffr.exec:\lxlfffr.exe94⤵PID:1764
-
\??\c:\9xrrrxx.exec:\9xrrrxx.exe95⤵PID:1704
-
\??\c:\nttbnb.exec:\nttbnb.exe96⤵PID:748
-
\??\c:\7pjjd.exec:\7pjjd.exe97⤵PID:1960
-
\??\c:\3dpvj.exec:\3dpvj.exe98⤵PID:2216
-
\??\c:\1rxxflr.exec:\1rxxflr.exe99⤵PID:1832
-
\??\c:\nhbhtb.exec:\nhbhtb.exe100⤵PID:1520
-
\??\c:\jdvdp.exec:\jdvdp.exe101⤵PID:372
-
\??\c:\vjdvj.exec:\vjdvj.exe102⤵PID:1688
-
\??\c:\rllfllr.exec:\rllfllr.exe103⤵PID:680
-
\??\c:\nbnnbb.exec:\nbnnbb.exe104⤵PID:2068
-
\??\c:\nbnnnt.exec:\nbnnnt.exe105⤵PID:3068
-
\??\c:\pjpvj.exec:\pjpvj.exe106⤵
- System Location Discovery: System Language Discovery
PID:1716 -
\??\c:\frllrxl.exec:\frllrxl.exe107⤵PID:1540
-
\??\c:\lflrfxl.exec:\lflrfxl.exe108⤵PID:2700
-
\??\c:\nhhntb.exec:\nhhntb.exe109⤵PID:1504
-
\??\c:\dvpdj.exec:\dvpdj.exe110⤵PID:2696
-
\??\c:\pdppp.exec:\pdppp.exe111⤵PID:2548
-
\??\c:\9rxrrxf.exec:\9rxrrxf.exe112⤵PID:2660
-
\??\c:\1tnnbh.exec:\1tnnbh.exe113⤵PID:2788
-
\??\c:\nnhnht.exec:\nnhnht.exe114⤵PID:2820
-
\??\c:\jdppp.exec:\jdppp.exe115⤵PID:480
-
\??\c:\llllrxf.exec:\llllrxf.exe116⤵PID:2536
-
\??\c:\3xlfllx.exec:\3xlfllx.exe117⤵PID:2168
-
\??\c:\hbnhbb.exec:\hbnhbb.exe118⤵PID:556
-
\??\c:\vvpvd.exec:\vvpvd.exe119⤵PID:2008
-
\??\c:\xxlrflx.exec:\xxlrflx.exe120⤵PID:2720
-
\??\c:\tthnbh.exec:\tthnbh.exe121⤵PID:2896
-
\??\c:\1jddp.exec:\1jddp.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-