Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 14:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe
-
Size
454KB
-
MD5
628693ccd4c90ece9270f66e27bd2a9c
-
SHA1
e483ef841425e9ff206e6b053c17c2898410da04
-
SHA256
dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4
-
SHA512
eb1265ecc8d4935f45eaa3bba9ee91796360a6f5266b55fb5aaa5b99f3a5c3bf0ef47d54601a9b73ffb0deaace1ea121671caa9790163c8852b7b533be3e6335
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2232-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-16-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2928-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-73-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3056-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1424-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-220-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1524-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1008-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-391-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2440-406-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-445-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2272-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-459-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/280-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-716-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1320-812-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2920-855-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 ttbntb.exe 2928 dvppv.exe 2684 jjpdv.exe 2828 bbnbhn.exe 2664 vvpvj.exe 2580 btbnbn.exe 3056 djdvp.exe 1660 btntbb.exe 2220 ppjpd.exe 2104 5jdjp.exe 804 3lxflrx.exe 340 5nhnbh.exe 2860 lrlfrfr.exe 1424 ddjpd.exe 1688 jjpdp.exe 1680 dvpvd.exe 332 jdvdj.exe 2404 1tbtbn.exe 1720 1vpvj.exe 2320 jjvdp.exe 956 9jjvj.exe 712 hnnbtb.exe 2952 jdvdv.exe 1524 3jdjp.exe 848 rxlxrxr.exe 2268 vvjpj.exe 1048 rrrfxff.exe 2452 3pjvd.exe 1008 xfrxlrl.exe 1400 vpdjv.exe 2260 rxrxrxl.exe 1560 9pppd.exe 2660 ffxrflr.exe 2780 ttnbtt.exe 2556 ddvdp.exe 2684 rrlrrxl.exe 2716 ttnnhn.exe 2560 ddvdp.exe 1856 llrfxfx.exe 2724 nnnbtn.exe 2600 djjpv.exe 3052 fxrxlrl.exe 2276 7bnbtt.exe 2732 1pvdj.exe 2308 ddvjv.exe 344 rrrrxfx.exe 2440 1nhnbn.exe 1704 vdvvj.exe 1304 xfffxxx.exe 2760 nhbnbh.exe 380 5jpdp.exe 1932 llrfrxr.exe 1028 llffrrl.exe 2180 tbhtnb.exe 2272 9jjvp.exe 2328 lrxxflx.exe 2472 5bbhbh.exe 1604 vvvjv.exe 2528 1lffxfl.exe 2248 5hbnnn.exe 1780 ddvpj.exe 3068 fxlxflx.exe 1516 9bbbht.exe 2536 pvvdp.exe -
resource yara_rule behavioral1/memory/2232-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1424-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1008-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-558-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-676-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2460-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-797-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nththn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xllrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2232 wrote to memory of 2692 2232 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 30 PID 2232 wrote to memory of 2692 2232 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 30 PID 2232 wrote to memory of 2692 2232 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 30 PID 2232 wrote to memory of 2692 2232 dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe 30 PID 2692 wrote to memory of 2928 2692 ttbntb.exe 31 PID 2692 wrote to memory of 2928 2692 ttbntb.exe 31 PID 2692 wrote to memory of 2928 2692 ttbntb.exe 31 PID 2692 wrote to memory of 2928 2692 ttbntb.exe 31 PID 2928 wrote to memory of 2684 2928 dvppv.exe 32 PID 2928 wrote to memory of 2684 2928 dvppv.exe 32 PID 2928 wrote to memory of 2684 2928 dvppv.exe 32 PID 2928 wrote to memory of 2684 2928 dvppv.exe 32 PID 2684 wrote to memory of 2828 2684 jjpdv.exe 33 PID 2684 wrote to memory of 2828 2684 jjpdv.exe 33 PID 2684 wrote to memory of 2828 2684 jjpdv.exe 33 PID 2684 wrote to memory of 2828 2684 jjpdv.exe 33 PID 2828 wrote to memory of 2664 2828 bbnbhn.exe 34 PID 2828 wrote to memory of 2664 2828 bbnbhn.exe 34 PID 2828 wrote to memory of 2664 2828 bbnbhn.exe 34 PID 2828 wrote to memory of 2664 2828 bbnbhn.exe 34 PID 2664 wrote to memory of 2580 2664 vvpvj.exe 35 PID 2664 wrote to memory of 2580 2664 vvpvj.exe 35 PID 2664 wrote to memory of 2580 2664 vvpvj.exe 35 PID 2664 wrote to memory of 2580 2664 vvpvj.exe 35 PID 2580 wrote to memory of 3056 2580 btbnbn.exe 36 PID 2580 wrote to memory of 3056 2580 btbnbn.exe 36 PID 2580 wrote to memory of 3056 2580 btbnbn.exe 36 PID 2580 wrote to memory of 3056 2580 btbnbn.exe 36 PID 3056 wrote to memory of 1660 3056 djdvp.exe 37 PID 3056 wrote to memory of 1660 3056 djdvp.exe 37 PID 3056 wrote to memory of 1660 3056 djdvp.exe 37 PID 3056 wrote to memory of 1660 3056 djdvp.exe 37 PID 1660 wrote to memory of 2220 1660 btntbb.exe 38 PID 1660 wrote to memory of 2220 1660 btntbb.exe 38 PID 1660 wrote to memory of 2220 1660 btntbb.exe 38 PID 1660 wrote to memory of 2220 1660 btntbb.exe 38 PID 2220 wrote to memory of 2104 2220 ppjpd.exe 39 PID 2220 wrote to memory of 2104 2220 ppjpd.exe 39 PID 2220 wrote to memory of 2104 2220 ppjpd.exe 39 PID 2220 wrote to memory of 2104 2220 ppjpd.exe 39 PID 2104 wrote to memory of 804 2104 5jdjp.exe 40 PID 2104 wrote to memory of 804 2104 5jdjp.exe 40 PID 2104 wrote to memory of 804 2104 5jdjp.exe 40 PID 2104 wrote to memory of 804 2104 5jdjp.exe 40 PID 804 wrote to memory of 340 804 3lxflrx.exe 41 PID 804 wrote to memory of 340 804 3lxflrx.exe 41 PID 804 wrote to memory of 340 804 3lxflrx.exe 41 PID 804 wrote to memory of 340 804 3lxflrx.exe 41 PID 340 wrote to memory of 2860 340 5nhnbh.exe 42 PID 340 wrote to memory of 2860 340 5nhnbh.exe 42 PID 340 wrote to memory of 2860 340 5nhnbh.exe 42 PID 340 wrote to memory of 2860 340 5nhnbh.exe 42 PID 2860 wrote to memory of 1424 2860 lrlfrfr.exe 43 PID 2860 wrote to memory of 1424 2860 lrlfrfr.exe 43 PID 2860 wrote to memory of 1424 2860 lrlfrfr.exe 43 PID 2860 wrote to memory of 1424 2860 lrlfrfr.exe 43 PID 1424 wrote to memory of 1688 1424 ddjpd.exe 44 PID 1424 wrote to memory of 1688 1424 ddjpd.exe 44 PID 1424 wrote to memory of 1688 1424 ddjpd.exe 44 PID 1424 wrote to memory of 1688 1424 ddjpd.exe 44 PID 1688 wrote to memory of 1680 1688 jjpdp.exe 45 PID 1688 wrote to memory of 1680 1688 jjpdp.exe 45 PID 1688 wrote to memory of 1680 1688 jjpdp.exe 45 PID 1688 wrote to memory of 1680 1688 jjpdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe"C:\Users\Admin\AppData\Local\Temp\dc8c2bd57155afdd56d847c9369b6d7cf84c2b7ac6de51d03cac80241ac55ee4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\ttbntb.exec:\ttbntb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\dvppv.exec:\dvppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jjpdv.exec:\jjpdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bbnbhn.exec:\bbnbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vvpvj.exec:\vvpvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\btbnbn.exec:\btbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\djdvp.exec:\djdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\btntbb.exec:\btntbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\ppjpd.exec:\ppjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\5jdjp.exec:\5jdjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\3lxflrx.exec:\3lxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\5nhnbh.exec:\5nhnbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:340 -
\??\c:\lrlfrfr.exec:\lrlfrfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\ddjpd.exec:\ddjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\jjpdp.exec:\jjpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\dvpvd.exec:\dvpvd.exe17⤵
- Executes dropped EXE
PID:1680 -
\??\c:\jdvdj.exec:\jdvdj.exe18⤵
- Executes dropped EXE
PID:332 -
\??\c:\1tbtbn.exec:\1tbtbn.exe19⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1vpvj.exec:\1vpvj.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\jjvdp.exec:\jjvdp.exe21⤵
- Executes dropped EXE
PID:2320 -
\??\c:\9jjvj.exec:\9jjvj.exe22⤵
- Executes dropped EXE
PID:956 -
\??\c:\hnnbtb.exec:\hnnbtb.exe23⤵
- Executes dropped EXE
PID:712 -
\??\c:\jdvdv.exec:\jdvdv.exe24⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3jdjp.exec:\3jdjp.exe25⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rxlxrxr.exec:\rxlxrxr.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\vvjpj.exec:\vvjpj.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\rrrfxff.exec:\rrrfxff.exe28⤵
- Executes dropped EXE
PID:1048 -
\??\c:\3pjvd.exec:\3pjvd.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\xfrxlrl.exec:\xfrxlrl.exe30⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vpdjv.exec:\vpdjv.exe31⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rxrxrxl.exec:\rxrxrxl.exe32⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9pppd.exec:\9pppd.exe33⤵
- Executes dropped EXE
PID:1560 -
\??\c:\ffxrflr.exec:\ffxrflr.exe34⤵
- Executes dropped EXE
PID:2660 -
\??\c:\ttnbtt.exec:\ttnbtt.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ddvdp.exec:\ddvdp.exe36⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrlrrxl.exec:\rrlrrxl.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2684 -
\??\c:\ttnnhn.exec:\ttnnhn.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ddvdp.exec:\ddvdp.exe39⤵
- Executes dropped EXE
PID:2560 -
\??\c:\llrfxfx.exec:\llrfxfx.exe40⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nnnbtn.exec:\nnnbtn.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\djjpv.exec:\djjpv.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe43⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7bnbtt.exec:\7bnbtt.exe44⤵
- Executes dropped EXE
PID:2276 -
\??\c:\1pvdj.exec:\1pvdj.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ddvjv.exec:\ddvjv.exe46⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rrrrxfx.exec:\rrrrxfx.exe47⤵
- Executes dropped EXE
PID:344 -
\??\c:\1nhnbn.exec:\1nhnbn.exe48⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vdvvj.exec:\vdvvj.exe49⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xfffxxx.exec:\xfffxxx.exe50⤵
- Executes dropped EXE
PID:1304 -
\??\c:\nhbnbh.exec:\nhbnbh.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5jpdp.exec:\5jpdp.exe52⤵
- Executes dropped EXE
PID:380 -
\??\c:\llrfrxr.exec:\llrfrxr.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\llffrrl.exec:\llffrrl.exe54⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tbhtnb.exec:\tbhtnb.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9jjvp.exec:\9jjvp.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\lrxxflx.exec:\lrxxflx.exe57⤵
- Executes dropped EXE
PID:2328 -
\??\c:\5bbhbh.exec:\5bbhbh.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vvvjv.exec:\vvvjv.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1lffxfl.exec:\1lffxfl.exe60⤵
- Executes dropped EXE
PID:2528 -
\??\c:\5hbnnn.exec:\5hbnnn.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ddvpj.exec:\ddvpj.exe62⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fxlxflx.exec:\fxlxflx.exe63⤵
- Executes dropped EXE
PID:3068 -
\??\c:\9bbbht.exec:\9bbbht.exe64⤵
- Executes dropped EXE
PID:1516 -
\??\c:\pvvdp.exec:\pvvdp.exe65⤵
- Executes dropped EXE
PID:2536 -
\??\c:\xrflxlx.exec:\xrflxlx.exe66⤵PID:2268
-
\??\c:\tbbtbt.exec:\tbbtbt.exe67⤵PID:280
-
\??\c:\dvdjv.exec:\dvdjv.exe68⤵PID:272
-
\??\c:\fflrxfx.exec:\fflrxfx.exe69⤵PID:1964
-
\??\c:\nnhntt.exec:\nnhntt.exe70⤵PID:2980
-
\??\c:\ppjpp.exec:\ppjpp.exe71⤵PID:1752
-
\??\c:\dvpvd.exec:\dvpvd.exe72⤵PID:3048
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe73⤵PID:2260
-
\??\c:\hnnbnt.exec:\hnnbnt.exe74⤵PID:1560
-
\??\c:\1dppd.exec:\1dppd.exe75⤵PID:2696
-
\??\c:\5xlrffr.exec:\5xlrffr.exe76⤵PID:2752
-
\??\c:\nnnthn.exec:\nnnthn.exe77⤵PID:2916
-
\??\c:\3pvjv.exec:\3pvjv.exe78⤵PID:2776
-
\??\c:\7frrxxl.exec:\7frrxxl.exe79⤵PID:2548
-
\??\c:\llflxfr.exec:\llflxfr.exe80⤵PID:2604
-
\??\c:\3btbnt.exec:\3btbnt.exe81⤵PID:2592
-
\??\c:\jdvdj.exec:\jdvdj.exe82⤵PID:1856
-
\??\c:\rrflrxr.exec:\rrflrxr.exe83⤵PID:2892
-
\??\c:\tnhhbh.exec:\tnhhbh.exe84⤵PID:3056
-
\??\c:\dvpvj.exec:\dvpvj.exe85⤵PID:3052
-
\??\c:\1vpvd.exec:\1vpvd.exe86⤵PID:2220
-
\??\c:\lrrllff.exec:\lrrllff.exe87⤵PID:1724
-
\??\c:\tttbhn.exec:\tttbhn.exe88⤵PID:2308
-
\??\c:\jjdjv.exec:\jjdjv.exe89⤵PID:340
-
\??\c:\xffrllx.exec:\xffrllx.exe90⤵PID:1744
-
\??\c:\hhbhtb.exec:\hhbhtb.exe91⤵PID:484
-
\??\c:\ppjpj.exec:\ppjpj.exe92⤵PID:496
-
\??\c:\xxxxxlx.exec:\xxxxxlx.exe93⤵PID:2768
-
\??\c:\rlflxxr.exec:\rlflxxr.exe94⤵PID:380
-
\??\c:\nntbbb.exec:\nntbbb.exe95⤵PID:540
-
\??\c:\jdvjj.exec:\jdvjj.exe96⤵PID:332
-
\??\c:\7xxfrrx.exec:\7xxfrrx.exe97⤵PID:2460
-
\??\c:\jjdjv.exec:\jjdjv.exe98⤵
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\9ddpj.exec:\9ddpj.exe99⤵PID:2176
-
\??\c:\rrxfxfx.exec:\rrxfxfx.exe100⤵PID:624
-
\??\c:\3nnbhb.exec:\3nnbhb.exe101⤵PID:936
-
\??\c:\ppjjj.exec:\ppjjj.exe102⤵PID:1756
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe103⤵PID:712
-
\??\c:\tbtbnt.exec:\tbtbnt.exe104⤵PID:1824
-
\??\c:\3jjjd.exec:\3jjjd.exe105⤵PID:1524
-
\??\c:\rlxrxrf.exec:\rlxrxrf.exe106⤵PID:2224
-
\??\c:\flflxfr.exec:\flflxfr.exe107⤵PID:2264
-
\??\c:\9btttb.exec:\9btttb.exe108⤵PID:2408
-
\??\c:\ppjjd.exec:\ppjjd.exe109⤵PID:2972
-
\??\c:\llflfrl.exec:\llflfrl.exe110⤵PID:1320
-
\??\c:\3tnbbh.exec:\3tnbbh.exe111⤵PID:1948
-
\??\c:\ntnbtb.exec:\ntnbtb.exe112⤵PID:884
-
\??\c:\vvpjv.exec:\vvpjv.exe113⤵PID:3040
-
\??\c:\rflxrlf.exec:\rflxrlf.exe114⤵PID:2820
-
\??\c:\bbbntt.exec:\bbbntt.exe115⤵PID:3048
-
\??\c:\pjvvj.exec:\pjvvj.exe116⤵PID:2804
-
\??\c:\5xxxxxl.exec:\5xxxxxl.exe117⤵PID:2920
-
\??\c:\hnbbht.exec:\hnbbht.exe118⤵PID:2668
-
\??\c:\vpjjv.exec:\vpjjv.exe119⤵PID:2384
-
\??\c:\fxllrxr.exec:\fxllrxr.exe120⤵PID:2684
-
\??\c:\bttbnt.exec:\bttbnt.exe121⤵PID:2616
-
\??\c:\btthth.exec:\btthth.exe122⤵PID:3008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-