Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe
-
Size
454KB
-
MD5
878a3e07e54382b2059a998baaec2dd0
-
SHA1
4d549a873687338ab5bb59188e4d51009957535a
-
SHA256
1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4
-
SHA512
cc0bdac47dba100c1ac5f36c5aedf57cec07839a242dc8f49af3d4e6c07adbe0c212f2d7b2f3549856f7e476dd4164a9d81863edbfcf7c717ca76681defe12e6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbePY:q7Tc2NYHUrAwfMp3CDPY
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2636-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-76-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/640-96-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/640-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-116-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2428-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-157-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1792-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/976-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1460-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-312-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1588-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-480-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/544-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1332-518-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/980-574-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2468-581-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-609-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1692-623-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-641-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2220 3jvpv.exe 2772 xrxlfxf.exe 2832 1jvdv.exe 2704 7fffllf.exe 2716 1pjpd.exe 2556 bbntbh.exe 3040 1vjjp.exe 2804 bnnbbh.exe 640 jvddj.exe 3060 hbthnn.exe 2428 pdjjp.exe 1432 hthnhn.exe 2604 dvddd.exe 2376 hthhnn.exe 2848 3vvjp.exe 1792 nnhbnn.exe 2964 3rlrxxf.exe 1292 jvjjp.exe 844 7fllxfl.exe 684 5vjvj.exe 344 7xrrfrr.exe 1528 pjddp.exe 976 3xrxllx.exe 1600 hbbbhn.exe 2488 9jvvj.exe 2216 nnhhtt.exe 1564 vvpjd.exe 2464 hbntbh.exe 1460 jdppd.exe 2068 lxlflfr.exe 2300 bbnnbb.exe 2740 1lfrxxf.exe 1588 1nhtht.exe 2012 3vjjp.exe 2676 9xlrxxf.exe 2184 nhhhbh.exe 2680 vvvpd.exe 2656 ffxlxfr.exe 2608 fxrxrxf.exe 2556 nnntnt.exe 2780 pjvvj.exe 476 xlllxfr.exe 920 fxlxxxl.exe 3068 9bntbb.exe 2436 1jvvd.exe 1776 xxrxffr.exe 808 7xxxlrr.exe 2808 nnbnbn.exe 2864 jdddd.exe 2604 pjpjp.exe 1916 3fxfffl.exe 2008 ttnbht.exe 2800 vvpvd.exe 2460 fxrxflx.exe 2272 rrlrfrl.exe 2172 hbtnhn.exe 2244 5jdvd.exe 544 xxrfxfl.exe 2644 7tntbb.exe 1592 vvdpj.exe 1896 pjvdj.exe 1332 xrffrrf.exe 1768 9tbntt.exe 1684 vppvd.exe -
resource yara_rule behavioral1/memory/2636-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/976-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-286-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-312-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-453-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1592-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-581-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-631-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2220 2636 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2636 wrote to memory of 2220 2636 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2636 wrote to memory of 2220 2636 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2636 wrote to memory of 2220 2636 1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe 30 PID 2220 wrote to memory of 2772 2220 3jvpv.exe 31 PID 2220 wrote to memory of 2772 2220 3jvpv.exe 31 PID 2220 wrote to memory of 2772 2220 3jvpv.exe 31 PID 2220 wrote to memory of 2772 2220 3jvpv.exe 31 PID 2772 wrote to memory of 2832 2772 xrxlfxf.exe 32 PID 2772 wrote to memory of 2832 2772 xrxlfxf.exe 32 PID 2772 wrote to memory of 2832 2772 xrxlfxf.exe 32 PID 2772 wrote to memory of 2832 2772 xrxlfxf.exe 32 PID 2832 wrote to memory of 2704 2832 1jvdv.exe 33 PID 2832 wrote to memory of 2704 2832 1jvdv.exe 33 PID 2832 wrote to memory of 2704 2832 1jvdv.exe 33 PID 2832 wrote to memory of 2704 2832 1jvdv.exe 33 PID 2704 wrote to memory of 2716 2704 7fffllf.exe 34 PID 2704 wrote to memory of 2716 2704 7fffllf.exe 34 PID 2704 wrote to memory of 2716 2704 7fffllf.exe 34 PID 2704 wrote to memory of 2716 2704 7fffllf.exe 34 PID 2716 wrote to memory of 2556 2716 1pjpd.exe 35 PID 2716 wrote to memory of 2556 2716 1pjpd.exe 35 PID 2716 wrote to memory of 2556 2716 1pjpd.exe 35 PID 2716 wrote to memory of 2556 2716 1pjpd.exe 35 PID 2556 wrote to memory of 3040 2556 bbntbh.exe 36 PID 2556 wrote to memory of 3040 2556 bbntbh.exe 36 PID 2556 wrote to memory of 3040 2556 bbntbh.exe 36 PID 2556 wrote to memory of 3040 2556 bbntbh.exe 36 PID 3040 wrote to memory of 2804 3040 1vjjp.exe 37 PID 3040 wrote to memory of 2804 3040 1vjjp.exe 37 PID 3040 wrote to memory of 2804 3040 1vjjp.exe 37 PID 3040 wrote to memory of 2804 3040 1vjjp.exe 37 PID 2804 wrote to memory of 640 2804 bnnbbh.exe 38 PID 2804 wrote to memory of 640 2804 bnnbbh.exe 38 PID 2804 wrote to memory of 640 2804 bnnbbh.exe 38 PID 2804 wrote to memory of 640 2804 bnnbbh.exe 38 PID 640 wrote to memory of 3060 640 jvddj.exe 39 PID 640 wrote to memory of 3060 640 jvddj.exe 39 PID 640 wrote to memory of 3060 640 jvddj.exe 39 PID 640 wrote to memory of 3060 640 jvddj.exe 39 PID 3060 wrote to memory of 2428 3060 hbthnn.exe 40 PID 3060 wrote to memory of 2428 3060 hbthnn.exe 40 PID 3060 wrote to memory of 2428 3060 hbthnn.exe 40 PID 3060 wrote to memory of 2428 3060 hbthnn.exe 40 PID 2428 wrote to memory of 1432 2428 pdjjp.exe 41 PID 2428 wrote to memory of 1432 2428 pdjjp.exe 41 PID 2428 wrote to memory of 1432 2428 pdjjp.exe 41 PID 2428 wrote to memory of 1432 2428 pdjjp.exe 41 PID 1432 wrote to memory of 2604 1432 hthnhn.exe 42 PID 1432 wrote to memory of 2604 1432 hthnhn.exe 42 PID 1432 wrote to memory of 2604 1432 hthnhn.exe 42 PID 1432 wrote to memory of 2604 1432 hthnhn.exe 42 PID 2604 wrote to memory of 2376 2604 dvddd.exe 43 PID 2604 wrote to memory of 2376 2604 dvddd.exe 43 PID 2604 wrote to memory of 2376 2604 dvddd.exe 43 PID 2604 wrote to memory of 2376 2604 dvddd.exe 43 PID 2376 wrote to memory of 2848 2376 hthhnn.exe 44 PID 2376 wrote to memory of 2848 2376 hthhnn.exe 44 PID 2376 wrote to memory of 2848 2376 hthhnn.exe 44 PID 2376 wrote to memory of 2848 2376 hthhnn.exe 44 PID 2848 wrote to memory of 1792 2848 3vvjp.exe 45 PID 2848 wrote to memory of 1792 2848 3vvjp.exe 45 PID 2848 wrote to memory of 1792 2848 3vvjp.exe 45 PID 2848 wrote to memory of 1792 2848 3vvjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe"C:\Users\Admin\AppData\Local\Temp\1a2a0dfc0ff30b979161b12e9852d490c51c92bdc92b75e7e78af58be9fe81d4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\3jvpv.exec:\3jvpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xrxlfxf.exec:\xrxlfxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\1jvdv.exec:\1jvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\7fffllf.exec:\7fffllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1pjpd.exec:\1pjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\bbntbh.exec:\bbntbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\1vjjp.exec:\1vjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\bnnbbh.exec:\bnnbbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\jvddj.exec:\jvddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\hbthnn.exec:\hbthnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pdjjp.exec:\pdjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hthnhn.exec:\hthnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\dvddd.exec:\dvddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hthhnn.exec:\hthhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\3vvjp.exec:\3vvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nnhbnn.exec:\nnhbnn.exe17⤵
- Executes dropped EXE
PID:1792 -
\??\c:\3rlrxxf.exec:\3rlrxxf.exe18⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jvjjp.exec:\jvjjp.exe19⤵
- Executes dropped EXE
PID:1292 -
\??\c:\7fllxfl.exec:\7fllxfl.exe20⤵
- Executes dropped EXE
PID:844 -
\??\c:\5vjvj.exec:\5vjvj.exe21⤵
- Executes dropped EXE
PID:684 -
\??\c:\7xrrfrr.exec:\7xrrfrr.exe22⤵
- Executes dropped EXE
PID:344 -
\??\c:\pjddp.exec:\pjddp.exe23⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3xrxllx.exec:\3xrxllx.exe24⤵
- Executes dropped EXE
PID:976 -
\??\c:\hbbbhn.exec:\hbbbhn.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9jvvj.exec:\9jvvj.exe26⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nnhhtt.exec:\nnhhtt.exe27⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvpjd.exec:\vvpjd.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hbntbh.exec:\hbntbh.exe29⤵
- Executes dropped EXE
PID:2464 -
\??\c:\jdppd.exec:\jdppd.exe30⤵
- Executes dropped EXE
PID:1460 -
\??\c:\lxlflfr.exec:\lxlflfr.exe31⤵
- Executes dropped EXE
PID:2068 -
\??\c:\bbnnbb.exec:\bbnnbb.exe32⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1lfrxxf.exec:\1lfrxxf.exe33⤵
- Executes dropped EXE
PID:2740 -
\??\c:\1nhtht.exec:\1nhtht.exe34⤵
- Executes dropped EXE
PID:1588 -
\??\c:\3vjjp.exec:\3vjjp.exe35⤵
- Executes dropped EXE
PID:2012 -
\??\c:\9xlrxxf.exec:\9xlrxxf.exe36⤵
- Executes dropped EXE
PID:2676 -
\??\c:\nhhhbh.exec:\nhhhbh.exe37⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vvvpd.exec:\vvvpd.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe39⤵
- Executes dropped EXE
PID:2656 -
\??\c:\fxrxrxf.exec:\fxrxrxf.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nnntnt.exec:\nnntnt.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pjvvj.exec:\pjvvj.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xlllxfr.exec:\xlllxfr.exe43⤵
- Executes dropped EXE
PID:476 -
\??\c:\fxlxxxl.exec:\fxlxxxl.exe44⤵
- Executes dropped EXE
PID:920 -
\??\c:\9bntbb.exec:\9bntbb.exe45⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1jvvd.exec:\1jvvd.exe46⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xxrxffr.exec:\xxrxffr.exe47⤵
- Executes dropped EXE
PID:1776 -
\??\c:\7xxxlrr.exec:\7xxxlrr.exe48⤵
- Executes dropped EXE
PID:808 -
\??\c:\nnbnbn.exec:\nnbnbn.exe49⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jdddd.exec:\jdddd.exe50⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjpjp.exec:\pjpjp.exe51⤵
- Executes dropped EXE
PID:2604 -
\??\c:\3fxfffl.exec:\3fxfffl.exe52⤵
- Executes dropped EXE
PID:1916 -
\??\c:\ttnbht.exec:\ttnbht.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\vvpvd.exec:\vvpvd.exe54⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fxrxflx.exec:\fxrxflx.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\hbtnhn.exec:\hbtnhn.exe57⤵
- Executes dropped EXE
PID:2172 -
\??\c:\5jdvd.exec:\5jdvd.exe58⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxrfxfl.exec:\xxrfxfl.exe59⤵
- Executes dropped EXE
PID:544 -
\??\c:\7tntbb.exec:\7tntbb.exe60⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vvdpj.exec:\vvdpj.exe61⤵
- Executes dropped EXE
PID:1592 -
\??\c:\pjvdj.exec:\pjvdj.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xrffrrf.exec:\xrffrrf.exe63⤵
- Executes dropped EXE
PID:1332 -
\??\c:\9tbntt.exec:\9tbntt.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vppvd.exec:\vppvd.exe65⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jvdpp.exec:\jvdpp.exe66⤵PID:2176
-
\??\c:\xxrxxxl.exec:\xxrxxxl.exe67⤵PID:2216
-
\??\c:\hhhttt.exec:\hhhttt.exe68⤵PID:1980
-
\??\c:\dvjpv.exec:\dvjpv.exe69⤵PID:356
-
\??\c:\llrxllf.exec:\llrxllf.exe70⤵PID:1240
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe71⤵PID:980
-
\??\c:\9ntbtt.exec:\9ntbtt.exe72⤵PID:2468
-
\??\c:\vpjpd.exec:\vpjpd.exe73⤵PID:2408
-
\??\c:\dvdvd.exec:\dvdvd.exe74⤵PID:2696
-
\??\c:\rxlfrrf.exec:\rxlfrrf.exe75⤵PID:1692
-
\??\c:\hbnntt.exec:\hbnntt.exe76⤵PID:2936
-
\??\c:\jddjd.exec:\jddjd.exe77⤵PID:2688
-
\??\c:\jdpvd.exec:\jdpvd.exe78⤵PID:2756
-
\??\c:\1lflxfr.exec:\1lflxfr.exe79⤵PID:2184
-
\??\c:\bthbnn.exec:\bthbnn.exe80⤵PID:2712
-
\??\c:\9jpjp.exec:\9jpjp.exe81⤵PID:2584
-
\??\c:\5vpjp.exec:\5vpjp.exe82⤵PID:2616
-
\??\c:\ffxfrxf.exec:\ffxfrxf.exe83⤵PID:3036
-
\??\c:\5nhhnn.exec:\5nhhnn.exe84⤵PID:776
-
\??\c:\jdddp.exec:\jdddp.exe85⤵PID:476
-
\??\c:\pdvpv.exec:\pdvpv.exe86⤵PID:2096
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe87⤵PID:2152
-
\??\c:\llrxxxf.exec:\llrxxxf.exe88⤵PID:1904
-
\??\c:\1ntttb.exec:\1ntttb.exe89⤵PID:1776
-
\??\c:\pvpvj.exec:\pvpvj.exe90⤵PID:2880
-
\??\c:\pjjjp.exec:\pjjjp.exe91⤵PID:2908
-
\??\c:\fxflrrr.exec:\fxflrrr.exe92⤵PID:1736
-
\??\c:\9hbnhn.exec:\9hbnhn.exe93⤵PID:2376
-
\??\c:\nhtbnh.exec:\nhtbnh.exe94⤵PID:1800
-
\??\c:\5dvdj.exec:\5dvdj.exe95⤵PID:2316
-
\??\c:\5pdjp.exec:\5pdjp.exe96⤵PID:2332
-
\??\c:\lflfflr.exec:\lflfflr.exe97⤵PID:2156
-
\??\c:\1tttbt.exec:\1tttbt.exe98⤵PID:2504
-
\??\c:\hbhhbh.exec:\hbhhbh.exe99⤵PID:2244
-
\??\c:\5pvvd.exec:\5pvvd.exe100⤵PID:544
-
\??\c:\3xrxflr.exec:\3xrxflr.exe101⤵PID:1120
-
\??\c:\frffrrx.exec:\frffrrx.exe102⤵PID:1592
-
\??\c:\ttntbb.exec:\ttntbb.exe103⤵PID:1896
-
\??\c:\7vpvv.exec:\7vpvv.exe104⤵PID:1848
-
\??\c:\3vppp.exec:\3vppp.exe105⤵PID:744
-
\??\c:\llxfxxf.exec:\llxfxxf.exe106⤵PID:1304
-
\??\c:\7hbbnn.exec:\7hbbnn.exe107⤵PID:2488
-
\??\c:\tnhhnn.exec:\tnhhnn.exe108⤵PID:2344
-
\??\c:\pjdjv.exec:\pjdjv.exe109⤵PID:700
-
\??\c:\fxllllr.exec:\fxllllr.exe110⤵PID:2464
-
\??\c:\7frxffr.exec:\7frxffr.exe111⤵PID:1472
-
\??\c:\hhhnnt.exec:\hhhnnt.exe112⤵PID:1708
-
\??\c:\bnbbhh.exec:\bnbbhh.exe113⤵PID:1924
-
\??\c:\dvvdj.exec:\dvvdj.exe114⤵PID:2220
-
\??\c:\xrrfflx.exec:\xrrfflx.exe115⤵PID:1576
-
\??\c:\fxxflff.exec:\fxxflff.exe116⤵PID:2764
-
\??\c:\ttnnhh.exec:\ttnnhh.exe117⤵PID:2700
-
\??\c:\jjdpd.exec:\jjdpd.exe118⤵PID:2948
-
\??\c:\lfxxlfx.exec:\lfxxlfx.exe119⤵PID:2012
-
\??\c:\tnbhnb.exec:\tnbhnb.exe120⤵PID:2820
-
\??\c:\1htttt.exec:\1htttt.exe121⤵PID:2596
-
\??\c:\5jvjj.exec:\5jvjj.exe122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-