Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 22:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe
-
Size
456KB
-
MD5
a03453537332aac2cf2583f7d3231a76
-
SHA1
2f704022dd4c0e3080e8fcd801644de660540697
-
SHA256
26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71
-
SHA512
b9123e847b2e62dd76dca9fb0bd9a38491eb8e4cc4af4af21fd206ae89947e0f4d07cf221c75e612e5e85c1c4dc1e22d654ed42c238c23abedc6cd6fc2163c2e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRs:q7Tc2NYHUrAwfMp3CDRs
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-107-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2012-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-146-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-159-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2212-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-167-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1596-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/888-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/668-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-587-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-643-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2820-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-782-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2312 7flrfrl.exe 932 bnnbth.exe 2236 1thtbn.exe 2948 rfrfllr.exe 2788 pvjdj.exe 2612 bbnbhn.exe 2720 vvdvd.exe 2888 bnbbnt.exe 2780 pdvjv.exe 2864 llxfrxr.exe 2676 thbbbn.exe 2012 hnbnhn.exe 2980 jjvdp.exe 2812 9nhthn.exe 1680 7vvdp.exe 2212 hbtbnn.exe 1752 9dddp.exe 2564 djdpv.exe 1784 lrfxlrf.exe 1492 3jdjv.exe 2108 7xrxlrr.exe 2912 vpddj.exe 2384 3xllrxf.exe 1620 9vjpv.exe 2408 rfrxlrf.exe 1664 ppddj.exe 1596 hntthn.exe 1616 rrfrrxl.exe 1780 tbhnth.exe 2476 ffllrrf.exe 888 flflxfr.exe 1820 ddjpj.exe 2312 flxxffl.exe 2216 ppppv.exe 1604 rlrrrrx.exe 668 bhbhbb.exe 2988 hhnhnt.exe 2876 lrxxlrx.exe 1968 1xrrflx.exe 2700 bbbhtt.exe 2892 1pvpj.exe 2720 rxlrfxr.exe 2636 tbnntt.exe 2856 vdpvp.exe 1772 xxfxrxx.exe 2500 ntbnbt.exe 2504 ddddv.exe 540 1rllrrx.exe 2184 5rfflll.exe 2980 thhnbb.exe 2820 9dvvd.exe 2400 rlfrlrf.exe 1680 3thhht.exe 2028 3thhnn.exe 964 vpvvd.exe 2572 lffxxrr.exe 900 5hbttt.exe 1500 3dppv.exe 916 9pdjp.exe 2960 5xrfrfr.exe 2472 bnbhbn.exe 2100 vvddp.exe 1980 jvdjp.exe 2032 5xrrflx.exe -
resource yara_rule behavioral1/memory/1820-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-24-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2236-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/668-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-587-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-743-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2836-782-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 2312 1820 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 28 PID 1820 wrote to memory of 2312 1820 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 28 PID 1820 wrote to memory of 2312 1820 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 28 PID 1820 wrote to memory of 2312 1820 26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe 28 PID 2312 wrote to memory of 932 2312 7flrfrl.exe 29 PID 2312 wrote to memory of 932 2312 7flrfrl.exe 29 PID 2312 wrote to memory of 932 2312 7flrfrl.exe 29 PID 2312 wrote to memory of 932 2312 7flrfrl.exe 29 PID 932 wrote to memory of 2236 932 bnnbth.exe 30 PID 932 wrote to memory of 2236 932 bnnbth.exe 30 PID 932 wrote to memory of 2236 932 bnnbth.exe 30 PID 932 wrote to memory of 2236 932 bnnbth.exe 30 PID 2236 wrote to memory of 2948 2236 1thtbn.exe 31 PID 2236 wrote to memory of 2948 2236 1thtbn.exe 31 PID 2236 wrote to memory of 2948 2236 1thtbn.exe 31 PID 2236 wrote to memory of 2948 2236 1thtbn.exe 31 PID 2948 wrote to memory of 2788 2948 rfrfllr.exe 32 PID 2948 wrote to memory of 2788 2948 rfrfllr.exe 32 PID 2948 wrote to memory of 2788 2948 rfrfllr.exe 32 PID 2948 wrote to memory of 2788 2948 rfrfllr.exe 32 PID 2788 wrote to memory of 2612 2788 pvjdj.exe 33 PID 2788 wrote to memory of 2612 2788 pvjdj.exe 33 PID 2788 wrote to memory of 2612 2788 pvjdj.exe 33 PID 2788 wrote to memory of 2612 2788 pvjdj.exe 33 PID 2612 wrote to memory of 2720 2612 bbnbhn.exe 34 PID 2612 wrote to memory of 2720 2612 bbnbhn.exe 34 PID 2612 wrote to memory of 2720 2612 bbnbhn.exe 34 PID 2612 wrote to memory of 2720 2612 bbnbhn.exe 34 PID 2720 wrote to memory of 2888 2720 vvdvd.exe 35 PID 2720 wrote to memory of 2888 2720 vvdvd.exe 35 PID 2720 wrote to memory of 2888 2720 vvdvd.exe 35 PID 2720 wrote to memory of 2888 2720 vvdvd.exe 35 PID 2888 wrote to memory of 2780 2888 bnbbnt.exe 36 PID 2888 wrote to memory of 2780 2888 bnbbnt.exe 36 PID 2888 wrote to memory of 2780 2888 bnbbnt.exe 36 PID 2888 wrote to memory of 2780 2888 bnbbnt.exe 36 PID 2780 wrote to memory of 2864 2780 pdvjv.exe 37 PID 2780 wrote to memory of 2864 2780 pdvjv.exe 37 PID 2780 wrote to memory of 2864 2780 pdvjv.exe 37 PID 2780 wrote to memory of 2864 2780 pdvjv.exe 37 PID 2864 wrote to memory of 2676 2864 llxfrxr.exe 38 PID 2864 wrote to memory of 2676 2864 llxfrxr.exe 38 PID 2864 wrote to memory of 2676 2864 llxfrxr.exe 38 PID 2864 wrote to memory of 2676 2864 llxfrxr.exe 38 PID 2676 wrote to memory of 2012 2676 thbbbn.exe 39 PID 2676 wrote to memory of 2012 2676 thbbbn.exe 39 PID 2676 wrote to memory of 2012 2676 thbbbn.exe 39 PID 2676 wrote to memory of 2012 2676 thbbbn.exe 39 PID 2012 wrote to memory of 2980 2012 hnbnhn.exe 40 PID 2012 wrote to memory of 2980 2012 hnbnhn.exe 40 PID 2012 wrote to memory of 2980 2012 hnbnhn.exe 40 PID 2012 wrote to memory of 2980 2012 hnbnhn.exe 40 PID 2980 wrote to memory of 2812 2980 jjvdp.exe 41 PID 2980 wrote to memory of 2812 2980 jjvdp.exe 41 PID 2980 wrote to memory of 2812 2980 jjvdp.exe 41 PID 2980 wrote to memory of 2812 2980 jjvdp.exe 41 PID 2812 wrote to memory of 1680 2812 9nhthn.exe 42 PID 2812 wrote to memory of 1680 2812 9nhthn.exe 42 PID 2812 wrote to memory of 1680 2812 9nhthn.exe 42 PID 2812 wrote to memory of 1680 2812 9nhthn.exe 42 PID 1680 wrote to memory of 2212 1680 7vvdp.exe 43 PID 1680 wrote to memory of 2212 1680 7vvdp.exe 43 PID 1680 wrote to memory of 2212 1680 7vvdp.exe 43 PID 1680 wrote to memory of 2212 1680 7vvdp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe"C:\Users\Admin\AppData\Local\Temp\26b4bbe783d77b1d5f2a039c546c1d72d42ba38e8e5e56f55a251af72982bb71.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\7flrfrl.exec:\7flrfrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\bnnbth.exec:\bnnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\1thtbn.exec:\1thtbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\rfrfllr.exec:\rfrfllr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\pvjdj.exec:\pvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bbnbhn.exec:\bbnbhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vvdvd.exec:\vvdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bnbbnt.exec:\bnbbnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pdvjv.exec:\pdvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\llxfrxr.exec:\llxfrxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\thbbbn.exec:\thbbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hnbnhn.exec:\hnbnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jjvdp.exec:\jjvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\9nhthn.exec:\9nhthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\7vvdp.exec:\7vvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\hbtbnn.exec:\hbtbnn.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\9dddp.exec:\9dddp.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\djdpv.exec:\djdpv.exe19⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lrfxlrf.exec:\lrfxlrf.exe20⤵
- Executes dropped EXE
PID:1784 -
\??\c:\3jdjv.exec:\3jdjv.exe21⤵
- Executes dropped EXE
PID:1492 -
\??\c:\7xrxlrr.exec:\7xrxlrr.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\vpddj.exec:\vpddj.exe23⤵
- Executes dropped EXE
PID:2912 -
\??\c:\3xllrxf.exec:\3xllrxf.exe24⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9vjpv.exec:\9vjpv.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppddj.exec:\ppddj.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\hntthn.exec:\hntthn.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rrfrrxl.exec:\rrfrrxl.exe29⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tbhnth.exec:\tbhnth.exe30⤵
- Executes dropped EXE
PID:1780 -
\??\c:\ffllrrf.exec:\ffllrrf.exe31⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flflxfr.exec:\flflxfr.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\ddjpj.exec:\ddjpj.exe33⤵
- Executes dropped EXE
PID:1820 -
\??\c:\flxxffl.exec:\flxxffl.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ppppv.exec:\ppppv.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe36⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bhbhbb.exec:\bhbhbb.exe37⤵
- Executes dropped EXE
PID:668 -
\??\c:\hhnhnt.exec:\hhnhnt.exe38⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrxxlrx.exec:\lrxxlrx.exe39⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1xrrflx.exec:\1xrrflx.exe40⤵
- Executes dropped EXE
PID:1968 -
\??\c:\bbbhtt.exec:\bbbhtt.exe41⤵
- Executes dropped EXE
PID:2700 -
\??\c:\1pvpj.exec:\1pvpj.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rxlrfxr.exec:\rxlrfxr.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tbnntt.exec:\tbnntt.exe44⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vdpvp.exec:\vdpvp.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe46⤵
- Executes dropped EXE
PID:1772 -
\??\c:\ntbnbt.exec:\ntbnbt.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ddddv.exec:\ddddv.exe48⤵
- Executes dropped EXE
PID:2504 -
\??\c:\1rllrrx.exec:\1rllrrx.exe49⤵
- Executes dropped EXE
PID:540 -
\??\c:\5rfflll.exec:\5rfflll.exe50⤵
- Executes dropped EXE
PID:2184 -
\??\c:\thhnbb.exec:\thhnbb.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\9dvvd.exec:\9dvvd.exe52⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rlfrlrf.exec:\rlfrlrf.exe53⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3thhht.exec:\3thhht.exe54⤵
- Executes dropped EXE
PID:1680 -
\??\c:\3thhnn.exec:\3thhnn.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\vpvvd.exec:\vpvvd.exe56⤵
- Executes dropped EXE
PID:964 -
\??\c:\lffxxrr.exec:\lffxxrr.exe57⤵
- Executes dropped EXE
PID:2572 -
\??\c:\5hbttt.exec:\5hbttt.exe58⤵
- Executes dropped EXE
PID:900 -
\??\c:\3dppv.exec:\3dppv.exe59⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9pdjp.exec:\9pdjp.exe60⤵
- Executes dropped EXE
PID:916 -
\??\c:\5xrfrfr.exec:\5xrfrfr.exe61⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bnbhbn.exec:\bnbhbn.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vvddp.exec:\vvddp.exe63⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jvdjp.exec:\jvdjp.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\5xrrflx.exec:\5xrrflx.exe65⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnhnbn.exec:\bnhnbn.exe66⤵PID:1848
-
\??\c:\vvjpd.exec:\vvjpd.exe67⤵PID:1708
-
\??\c:\lfxllxl.exec:\lfxllxl.exe68⤵PID:1640
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe69⤵PID:940
-
\??\c:\hntbnb.exec:\hntbnb.exe70⤵PID:1652
-
\??\c:\jvvdj.exec:\jvvdj.exe71⤵PID:1560
-
\??\c:\3xfrffl.exec:\3xfrffl.exe72⤵PID:2916
-
\??\c:\ttnbht.exec:\ttnbht.exe73⤵PID:1780
-
\??\c:\nthhtb.exec:\nthhtb.exe74⤵PID:2372
-
\??\c:\djvpd.exec:\djvpd.exe75⤵PID:3056
-
\??\c:\7xrlrrf.exec:\7xrlrrf.exe76⤵PID:1280
-
\??\c:\3tnnbb.exec:\3tnnbb.exe77⤵PID:2432
-
\??\c:\jpvjj.exec:\jpvjj.exe78⤵PID:2312
-
\??\c:\7jppv.exec:\7jppv.exe79⤵PID:2220
-
\??\c:\9rffllr.exec:\9rffllr.exe80⤵PID:2928
-
\??\c:\hnnntn.exec:\hnnntn.exe81⤵PID:1160
-
\??\c:\hhtbbh.exec:\hhtbbh.exe82⤵PID:2784
-
\??\c:\jvdvj.exec:\jvdvj.exe83⤵PID:2596
-
\??\c:\fxrxflx.exec:\fxrxflx.exe84⤵PID:2788
-
\??\c:\hhhhhh.exec:\hhhhhh.exe85⤵PID:2708
-
\??\c:\5vjpv.exec:\5vjpv.exe86⤵PID:2648
-
\??\c:\1jddd.exec:\1jddd.exe87⤵PID:3048
-
\??\c:\1rlffff.exec:\1rlffff.exe88⤵PID:2720
-
\??\c:\hhnntb.exec:\hhnntb.exe89⤵PID:2888
-
\??\c:\pjvdj.exec:\pjvdj.exe90⤵PID:2856
-
\??\c:\lrxffxf.exec:\lrxffxf.exe91⤵PID:1772
-
\??\c:\hhtbbb.exec:\hhtbbb.exe92⤵PID:2500
-
\??\c:\dppdd.exec:\dppdd.exe93⤵PID:2068
-
\??\c:\jdppv.exec:\jdppv.exe94⤵PID:1644
-
\??\c:\xxrlrxx.exec:\xxrlrxx.exe95⤵PID:1624
-
\??\c:\nnttbh.exec:\nnttbh.exe96⤵PID:2980
-
\??\c:\ppjjv.exec:\ppjjv.exe97⤵PID:2820
-
\??\c:\xxllrrf.exec:\xxllrrf.exe98⤵PID:1528
-
\??\c:\5bttbn.exec:\5bttbn.exe99⤵PID:840
-
\??\c:\hhttbh.exec:\hhttbh.exe100⤵PID:2844
-
\??\c:\djjjj.exec:\djjjj.exe101⤵PID:112
-
\??\c:\flrrrxf.exec:\flrrrxf.exe102⤵PID:2572
-
\??\c:\3bttbb.exec:\3bttbb.exe103⤵PID:2008
-
\??\c:\pvjjp.exec:\pvjjp.exe104⤵PID:1032
-
\??\c:\xxlxrfx.exec:\xxlxrfx.exe105⤵PID:2836
-
\??\c:\tttttt.exec:\tttttt.exe106⤵PID:2108
-
\??\c:\9vdpv.exec:\9vdpv.exe107⤵PID:844
-
\??\c:\5fxflrf.exec:\5fxflrf.exe108⤵PID:1992
-
\??\c:\9fxrffr.exec:\9fxrffr.exe109⤵PID:2288
-
\??\c:\bbnntb.exec:\bbnntb.exe110⤵PID:1344
-
\??\c:\pvvpp.exec:\pvvpp.exe111⤵PID:2408
-
\??\c:\9pjpd.exec:\9pjpd.exe112⤵PID:1760
-
\??\c:\ffrlflr.exec:\ffrlflr.exe113⤵PID:1648
-
\??\c:\tbnnbn.exec:\tbnnbn.exe114⤵PID:1880
-
\??\c:\hhtthn.exec:\hhtthn.exe115⤵PID:1652
-
\??\c:\dvdvp.exec:\dvdvp.exe116⤵PID:1888
-
\??\c:\rrflrxf.exec:\rrflrxf.exe117⤵PID:3064
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe118⤵PID:1940
-
\??\c:\bbbhtb.exec:\bbbhtb.exe119⤵PID:876
-
\??\c:\5vjjv.exec:\5vjjv.exe120⤵PID:1688
-
\??\c:\7fxfrxl.exec:\7fxfrxl.exe121⤵PID:1808
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-