Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24/12/2024, 00:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe
-
Size
453KB
-
MD5
dda859c1e7986cab886e126bdff21813
-
SHA1
391e2761ea9d2ed0f5d83f2c986dfbb393661ab8
-
SHA256
acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582
-
SHA512
2577c49c10aa950b1d2b7c2b6003ee5b5b8ef11b8afdde8ad75a19d1fc5f1876c087db40d11720e2d8a0369c4c1be8e4167c826c94114450bd2a348b27a1706d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-26-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2596-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-114-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2984-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-258-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1284-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-379-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1248-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-393-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2512-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-434-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2432-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-502-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/760-517-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-595-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-655-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/380-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-845-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-858-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/2884-879-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2924 k60240.exe 2928 8246846.exe 2596 bthtbh.exe 2844 xfxxlrf.exe 2672 6028446.exe 2664 486462.exe 2780 0868402.exe 1044 tnbhht.exe 2536 88024.exe 2588 lrrllrx.exe 1736 xxxlrxr.exe 2984 ddvjp.exe 2544 66846.exe 2340 rllrxfx.exe 3004 7frxlrf.exe 1244 hnbhth.exe 2196 26842.exe 2204 a4880.exe 2308 08280.exe 2124 jjdjv.exe 1140 5nbbhn.exe 1504 202844.exe 2896 484628.exe 1612 5lxfxfl.exe 1344 vpdpv.exe 1540 482484.exe 300 ffxlfrf.exe 1708 llxfxxl.exe 1640 o268068.exe 2120 e60206.exe 736 u262004.exe 1284 222462.exe 1040 m4280.exe 2872 bbntnt.exe 1584 60468.exe 2932 a4846.exe 3056 1bhbbb.exe 2892 pjddp.exe 2732 nbthnb.exe 2844 rlrxffx.exe 2496 0408242.exe 2748 lfxlxlf.exe 2568 04884.exe 1248 826206.exe 904 vpvjd.exe 2612 864406.exe 2052 826644.exe 3028 864088.exe 2300 2646880.exe 2984 9tnhhn.exe 2512 9dppd.exe 1916 c484846.exe 2340 08246.exe 1308 dvjjv.exe 2432 s0068.exe 2480 llxflrf.exe 2240 btbbnn.exe 2204 fflrxfl.exe 1792 a2646.exe 1784 rlfrrrf.exe 2492 42406.exe 840 1pjpd.exe 2020 8244068.exe 760 rlfxlrf.exe -
resource yara_rule behavioral1/memory/2876-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1044-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-774-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/1964-781-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-806-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-845-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 208842.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m4280.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 648604.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 008488.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxxfr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2924 2876 acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe 30 PID 2876 wrote to memory of 2924 2876 acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe 30 PID 2876 wrote to memory of 2924 2876 acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe 30 PID 2876 wrote to memory of 2924 2876 acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe 30 PID 2924 wrote to memory of 2928 2924 k60240.exe 31 PID 2924 wrote to memory of 2928 2924 k60240.exe 31 PID 2924 wrote to memory of 2928 2924 k60240.exe 31 PID 2924 wrote to memory of 2928 2924 k60240.exe 31 PID 2928 wrote to memory of 2596 2928 8246846.exe 32 PID 2928 wrote to memory of 2596 2928 8246846.exe 32 PID 2928 wrote to memory of 2596 2928 8246846.exe 32 PID 2928 wrote to memory of 2596 2928 8246846.exe 32 PID 2596 wrote to memory of 2844 2596 bthtbh.exe 33 PID 2596 wrote to memory of 2844 2596 bthtbh.exe 33 PID 2596 wrote to memory of 2844 2596 bthtbh.exe 33 PID 2596 wrote to memory of 2844 2596 bthtbh.exe 33 PID 2844 wrote to memory of 2672 2844 xfxxlrf.exe 34 PID 2844 wrote to memory of 2672 2844 xfxxlrf.exe 34 PID 2844 wrote to memory of 2672 2844 xfxxlrf.exe 34 PID 2844 wrote to memory of 2672 2844 xfxxlrf.exe 34 PID 2672 wrote to memory of 2664 2672 6028446.exe 35 PID 2672 wrote to memory of 2664 2672 6028446.exe 35 PID 2672 wrote to memory of 2664 2672 6028446.exe 35 PID 2672 wrote to memory of 2664 2672 6028446.exe 35 PID 2664 wrote to memory of 2780 2664 486462.exe 36 PID 2664 wrote to memory of 2780 2664 486462.exe 36 PID 2664 wrote to memory of 2780 2664 486462.exe 36 PID 2664 wrote to memory of 2780 2664 486462.exe 36 PID 2780 wrote to memory of 1044 2780 0868402.exe 37 PID 2780 wrote to memory of 1044 2780 0868402.exe 37 PID 2780 wrote to memory of 1044 2780 0868402.exe 37 PID 2780 wrote to memory of 1044 2780 0868402.exe 37 PID 1044 wrote to memory of 2536 1044 tnbhht.exe 38 PID 1044 wrote to memory of 2536 1044 tnbhht.exe 38 PID 1044 wrote to memory of 2536 1044 tnbhht.exe 38 PID 1044 wrote to memory of 2536 1044 tnbhht.exe 38 PID 2536 wrote to memory of 2588 2536 88024.exe 39 PID 2536 wrote to memory of 2588 2536 88024.exe 39 PID 2536 wrote to memory of 2588 2536 88024.exe 39 PID 2536 wrote to memory of 2588 2536 88024.exe 39 PID 2588 wrote to memory of 1736 2588 lrrllrx.exe 40 PID 2588 wrote to memory of 1736 2588 lrrllrx.exe 40 PID 2588 wrote to memory of 1736 2588 lrrllrx.exe 40 PID 2588 wrote to memory of 1736 2588 lrrllrx.exe 40 PID 1736 wrote to memory of 2984 1736 xxxlrxr.exe 41 PID 1736 wrote to memory of 2984 1736 xxxlrxr.exe 41 PID 1736 wrote to memory of 2984 1736 xxxlrxr.exe 41 PID 1736 wrote to memory of 2984 1736 xxxlrxr.exe 41 PID 2984 wrote to memory of 2544 2984 ddvjp.exe 42 PID 2984 wrote to memory of 2544 2984 ddvjp.exe 42 PID 2984 wrote to memory of 2544 2984 ddvjp.exe 42 PID 2984 wrote to memory of 2544 2984 ddvjp.exe 42 PID 2544 wrote to memory of 2340 2544 66846.exe 43 PID 2544 wrote to memory of 2340 2544 66846.exe 43 PID 2544 wrote to memory of 2340 2544 66846.exe 43 PID 2544 wrote to memory of 2340 2544 66846.exe 43 PID 2340 wrote to memory of 3004 2340 rllrxfx.exe 44 PID 2340 wrote to memory of 3004 2340 rllrxfx.exe 44 PID 2340 wrote to memory of 3004 2340 rllrxfx.exe 44 PID 2340 wrote to memory of 3004 2340 rllrxfx.exe 44 PID 3004 wrote to memory of 1244 3004 7frxlrf.exe 45 PID 3004 wrote to memory of 1244 3004 7frxlrf.exe 45 PID 3004 wrote to memory of 1244 3004 7frxlrf.exe 45 PID 3004 wrote to memory of 1244 3004 7frxlrf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe"C:\Users\Admin\AppData\Local\Temp\acf4c30908e3dd4bfa3a7510fef2e33640569555e3b3f05503c3e2e0f2de3582.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\k60240.exec:\k60240.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\8246846.exec:\8246846.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\bthtbh.exec:\bthtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xfxxlrf.exec:\xfxxlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\6028446.exec:\6028446.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\486462.exec:\486462.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\0868402.exec:\0868402.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\tnbhht.exec:\tnbhht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\88024.exec:\88024.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\lrrllrx.exec:\lrrllrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xxxlrxr.exec:\xxxlrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\ddvjp.exec:\ddvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\66846.exec:\66846.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\rllrxfx.exec:\rllrxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\7frxlrf.exec:\7frxlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hnbhth.exec:\hnbhth.exe17⤵
- Executes dropped EXE
PID:1244 -
\??\c:\26842.exec:\26842.exe18⤵
- Executes dropped EXE
PID:2196 -
\??\c:\a4880.exec:\a4880.exe19⤵
- Executes dropped EXE
PID:2204 -
\??\c:\08280.exec:\08280.exe20⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jjdjv.exec:\jjdjv.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5nbbhn.exec:\5nbbhn.exe22⤵
- Executes dropped EXE
PID:1140 -
\??\c:\202844.exec:\202844.exe23⤵
- Executes dropped EXE
PID:1504 -
\??\c:\484628.exec:\484628.exe24⤵
- Executes dropped EXE
PID:2896 -
\??\c:\5lxfxfl.exec:\5lxfxfl.exe25⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vpdpv.exec:\vpdpv.exe26⤵
- Executes dropped EXE
PID:1344 -
\??\c:\482484.exec:\482484.exe27⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ffxlfrf.exec:\ffxlfrf.exe28⤵
- Executes dropped EXE
PID:300 -
\??\c:\llxfxxl.exec:\llxfxxl.exe29⤵
- Executes dropped EXE
PID:1708 -
\??\c:\o268068.exec:\o268068.exe30⤵
- Executes dropped EXE
PID:1640 -
\??\c:\e60206.exec:\e60206.exe31⤵
- Executes dropped EXE
PID:2120 -
\??\c:\u262004.exec:\u262004.exe32⤵
- Executes dropped EXE
PID:736 -
\??\c:\222462.exec:\222462.exe33⤵
- Executes dropped EXE
PID:1284 -
\??\c:\m4280.exec:\m4280.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040 -
\??\c:\bbntnt.exec:\bbntnt.exe35⤵
- Executes dropped EXE
PID:2872 -
\??\c:\60468.exec:\60468.exe36⤵
- Executes dropped EXE
PID:1584 -
\??\c:\a4846.exec:\a4846.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1bhbbb.exec:\1bhbbb.exe38⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjddp.exec:\pjddp.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nbthnb.exec:\nbthnb.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\rlrxffx.exec:\rlrxffx.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\0408242.exec:\0408242.exe42⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lfxlxlf.exec:\lfxlxlf.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2748 -
\??\c:\04884.exec:\04884.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\826206.exec:\826206.exe45⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vpvjd.exec:\vpvjd.exe46⤵
- Executes dropped EXE
PID:904 -
\??\c:\864406.exec:\864406.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\826644.exec:\826644.exe48⤵
- Executes dropped EXE
PID:2052 -
\??\c:\864088.exec:\864088.exe49⤵
- Executes dropped EXE
PID:3028 -
\??\c:\2646880.exec:\2646880.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9tnhhn.exec:\9tnhhn.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\9dppd.exec:\9dppd.exe52⤵
- Executes dropped EXE
PID:2512 -
\??\c:\c484846.exec:\c484846.exe53⤵
- Executes dropped EXE
PID:1916 -
\??\c:\08246.exec:\08246.exe54⤵
- Executes dropped EXE
PID:2340 -
\??\c:\dvjjv.exec:\dvjjv.exe55⤵
- Executes dropped EXE
PID:1308 -
\??\c:\s0068.exec:\s0068.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llxflrf.exec:\llxflrf.exe57⤵
- Executes dropped EXE
PID:2480 -
\??\c:\btbbnn.exec:\btbbnn.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fflrxfl.exec:\fflrxfl.exe59⤵
- Executes dropped EXE
PID:2204 -
\??\c:\a2646.exec:\a2646.exe60⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rlfrrrf.exec:\rlfrrrf.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\42406.exec:\42406.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1pjpd.exec:\1pjpd.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\8244068.exec:\8244068.exe64⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rlfxlrf.exec:\rlfxlrf.exe65⤵
- Executes dropped EXE
PID:760 -
\??\c:\xfxxxfr.exec:\xfxxxfr.exe66⤵
- System Location Discovery: System Language Discovery
PID:2636 -
\??\c:\48060.exec:\48060.exe67⤵PID:800
-
\??\c:\26464.exec:\26464.exe68⤵PID:1684
-
\??\c:\5dvvj.exec:\5dvvj.exe69⤵PID:284
-
\??\c:\5bthht.exec:\5bthht.exe70⤵PID:604
-
\??\c:\ppddj.exec:\ppddj.exe71⤵PID:1952
-
\??\c:\rrrfrrx.exec:\rrrfrrx.exe72⤵PID:1640
-
\??\c:\hhbhnt.exec:\hhbhnt.exe73⤵PID:1772
-
\??\c:\8600266.exec:\8600266.exe74⤵PID:1600
-
\??\c:\ddvdr.exec:\ddvdr.exe75⤵PID:888
-
\??\c:\6604628.exec:\6604628.exe76⤵PID:2332
-
\??\c:\rlflrxf.exec:\rlflrxf.exe77⤵PID:2880
-
\??\c:\xrrrxxf.exec:\xrrrxxf.exe78⤵PID:2924
-
\??\c:\c868400.exec:\c868400.exe79⤵PID:2956
-
\??\c:\0824624.exec:\0824624.exe80⤵PID:2712
-
\??\c:\pjvjd.exec:\pjvjd.exe81⤵PID:3064
-
\??\c:\82068.exec:\82068.exe82⤵PID:2472
-
\??\c:\dddpd.exec:\dddpd.exe83⤵PID:2852
-
\??\c:\rxrxflx.exec:\rxrxflx.exe84⤵PID:2692
-
\??\c:\1tnhbt.exec:\1tnhbt.exe85⤵PID:2628
-
\??\c:\26882.exec:\26882.exe86⤵PID:2528
-
\??\c:\1hhbnh.exec:\1hhbnh.exe87⤵PID:708
-
\??\c:\nnhnbh.exec:\nnhnbh.exe88⤵PID:264
-
\??\c:\2640846.exec:\2640846.exe89⤵PID:380
-
\??\c:\1xxlrrl.exec:\1xxlrrl.exe90⤵PID:2364
-
\??\c:\5bthbh.exec:\5bthbh.exe91⤵PID:2580
-
\??\c:\nhbbhn.exec:\nhbbhn.exe92⤵PID:2764
-
\??\c:\3ffrfxx.exec:\3ffrfxx.exe93⤵PID:2552
-
\??\c:\dvjvd.exec:\dvjvd.exe94⤵PID:2424
-
\??\c:\vpdjv.exec:\vpdjv.exe95⤵PID:1968
-
\??\c:\dddjp.exec:\dddjp.exe96⤵PID:2144
-
\??\c:\1tbtht.exec:\1tbtht.exe97⤵PID:552
-
\??\c:\c640880.exec:\c640880.exe98⤵PID:1032
-
\??\c:\26284.exec:\26284.exe99⤵PID:1576
-
\??\c:\264028.exec:\264028.exe100⤵PID:2456
-
\??\c:\tthnth.exec:\tthnth.exe101⤵PID:2420
-
\??\c:\2640284.exec:\2640284.exe102⤵PID:1316
-
\??\c:\6044680.exec:\6044680.exe103⤵PID:1944
-
\??\c:\w42406.exec:\w42406.exe104⤵PID:2160
-
\??\c:\7hbbhn.exec:\7hbbhn.exe105⤵PID:1784
-
\??\c:\9tthnh.exec:\9tthnh.exe106⤵PID:1964
-
\??\c:\bthhtn.exec:\bthhtn.exe107⤵PID:2188
-
\??\c:\djpvp.exec:\djpvp.exe108⤵PID:2000
-
\??\c:\260240.exec:\260240.exe109⤵PID:2380
-
\??\c:\9rflllx.exec:\9rflllx.exe110⤵PID:2636
-
\??\c:\404244.exec:\404244.exe111⤵PID:1540
-
\??\c:\c644464.exec:\c644464.exe112⤵PID:1532
-
\??\c:\08062.exec:\08062.exe113⤵PID:2320
-
\??\c:\bnnnnn.exec:\bnnnnn.exe114⤵PID:2908
-
\??\c:\8202002.exec:\8202002.exe115⤵PID:1856
-
\??\c:\m8444.exec:\m8444.exe116⤵PID:2044
-
\??\c:\4684668.exec:\4684668.exe117⤵PID:1288
-
\??\c:\xrffrrx.exec:\xrffrrx.exe118⤵PID:1776
-
\??\c:\pjvdp.exec:\pjvdp.exe119⤵PID:328
-
\??\c:\thtnth.exec:\thtnth.exe120⤵PID:2876
-
\??\c:\vpdjp.exec:\vpdjp.exe121⤵PID:2884
-
\??\c:\82224.exec:\82224.exe122⤵PID:2244
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-