Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 16:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe
-
Size
454KB
-
MD5
0a89748e243f601b1128f7725b4944d0
-
SHA1
12f2e4a1b67e1ce2375f8b866e36c8a49dab3ca1
-
SHA256
7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046
-
SHA512
63ce7a9b8fa0282cf377a18124ad4604a4c29ed06cf9cb0d4aaa8cbfb9c9d776b7e2cc296612de9f1545b1ee754a9e39745e0664e65f01062f4eb2c680e2a257
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1WH:q7Tc2NYHUrAwfMp3CD1WH
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2472-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-63-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2608-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-469-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-648-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-885-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2744 pdjjv.exe 2888 frffllr.exe 3024 jvppj.exe 2940 lxlflxr.exe 2772 tnnntn.exe 2608 9rffrxf.exe 1920 tnbhnn.exe 2688 5rfffxx.exe 2060 7ntnnh.exe 2512 7djdd.exe 2976 7xllflr.exe 2988 hbhntt.exe 1508 pdppp.exe 2836 bbtntb.exe 2436 bnbnnn.exe 2848 fxlxffx.exe 1900 3httnn.exe 1488 ddddp.exe 2480 xrffllr.exe 2200 jjddj.exe 3048 jvdvp.exe 2576 3htbbb.exe 2368 9jpjj.exe 1448 9bbhhh.exe 2452 ththnt.exe 1960 pdvvp.exe 564 htbbbb.exe 1940 jdjdd.exe 1740 lfrllff.exe 1860 jdvpv.exe 2756 flflrrx.exe 2884 hthttn.exe 2728 9pvdv.exe 2920 lffxrlf.exe 2620 lrxrrrx.exe 2980 pdjdv.exe 2736 5dpvd.exe 2600 fxlxxrr.exe 2304 bbtbnh.exe 2564 jvddd.exe 1948 pjdpj.exe 1772 lxxrrfx.exe 1928 thtbtt.exe 1944 pdjpj.exe 2936 jpdjd.exe 2320 rflfxrx.exe 2972 bntthb.exe 2956 pdjjp.exe 1508 pdjjp.exe 2696 frrllff.exe 2488 thtnbt.exe 492 thtntt.exe 1904 jdppp.exe 1752 xflfxrl.exe 1008 hbhtnb.exe 2424 bhhbtn.exe 2412 dvjjv.exe 2220 7lfffxx.exe 832 bnbntt.exe 852 1hnhtt.exe 1952 7vddv.exe 2556 3fxxfrr.exe 956 hbhnhn.exe 840 tnbbbt.exe -
resource yara_rule behavioral1/memory/2472-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-443-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2424-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-751-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-805-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1680-832-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-940-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 2744 2472 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 30 PID 2472 wrote to memory of 2744 2472 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 30 PID 2472 wrote to memory of 2744 2472 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 30 PID 2472 wrote to memory of 2744 2472 7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe 30 PID 2744 wrote to memory of 2888 2744 pdjjv.exe 31 PID 2744 wrote to memory of 2888 2744 pdjjv.exe 31 PID 2744 wrote to memory of 2888 2744 pdjjv.exe 31 PID 2744 wrote to memory of 2888 2744 pdjjv.exe 31 PID 2888 wrote to memory of 3024 2888 frffllr.exe 32 PID 2888 wrote to memory of 3024 2888 frffllr.exe 32 PID 2888 wrote to memory of 3024 2888 frffllr.exe 32 PID 2888 wrote to memory of 3024 2888 frffllr.exe 32 PID 3024 wrote to memory of 2940 3024 jvppj.exe 33 PID 3024 wrote to memory of 2940 3024 jvppj.exe 33 PID 3024 wrote to memory of 2940 3024 jvppj.exe 33 PID 3024 wrote to memory of 2940 3024 jvppj.exe 33 PID 2940 wrote to memory of 2772 2940 lxlflxr.exe 34 PID 2940 wrote to memory of 2772 2940 lxlflxr.exe 34 PID 2940 wrote to memory of 2772 2940 lxlflxr.exe 34 PID 2940 wrote to memory of 2772 2940 lxlflxr.exe 34 PID 2772 wrote to memory of 2608 2772 tnnntn.exe 35 PID 2772 wrote to memory of 2608 2772 tnnntn.exe 35 PID 2772 wrote to memory of 2608 2772 tnnntn.exe 35 PID 2772 wrote to memory of 2608 2772 tnnntn.exe 35 PID 2608 wrote to memory of 1920 2608 9rffrxf.exe 36 PID 2608 wrote to memory of 1920 2608 9rffrxf.exe 36 PID 2608 wrote to memory of 1920 2608 9rffrxf.exe 36 PID 2608 wrote to memory of 1920 2608 9rffrxf.exe 36 PID 1920 wrote to memory of 2688 1920 tnbhnn.exe 37 PID 1920 wrote to memory of 2688 1920 tnbhnn.exe 37 PID 1920 wrote to memory of 2688 1920 tnbhnn.exe 37 PID 1920 wrote to memory of 2688 1920 tnbhnn.exe 37 PID 2688 wrote to memory of 2060 2688 5rfffxx.exe 38 PID 2688 wrote to memory of 2060 2688 5rfffxx.exe 38 PID 2688 wrote to memory of 2060 2688 5rfffxx.exe 38 PID 2688 wrote to memory of 2060 2688 5rfffxx.exe 38 PID 2060 wrote to memory of 2512 2060 7ntnnh.exe 39 PID 2060 wrote to memory of 2512 2060 7ntnnh.exe 39 PID 2060 wrote to memory of 2512 2060 7ntnnh.exe 39 PID 2060 wrote to memory of 2512 2060 7ntnnh.exe 39 PID 2512 wrote to memory of 2976 2512 7djdd.exe 40 PID 2512 wrote to memory of 2976 2512 7djdd.exe 40 PID 2512 wrote to memory of 2976 2512 7djdd.exe 40 PID 2512 wrote to memory of 2976 2512 7djdd.exe 40 PID 2976 wrote to memory of 2988 2976 7xllflr.exe 41 PID 2976 wrote to memory of 2988 2976 7xllflr.exe 41 PID 2976 wrote to memory of 2988 2976 7xllflr.exe 41 PID 2976 wrote to memory of 2988 2976 7xllflr.exe 41 PID 2988 wrote to memory of 1508 2988 hbhntt.exe 42 PID 2988 wrote to memory of 1508 2988 hbhntt.exe 42 PID 2988 wrote to memory of 1508 2988 hbhntt.exe 42 PID 2988 wrote to memory of 1508 2988 hbhntt.exe 42 PID 1508 wrote to memory of 2836 1508 pdppp.exe 43 PID 1508 wrote to memory of 2836 1508 pdppp.exe 43 PID 1508 wrote to memory of 2836 1508 pdppp.exe 43 PID 1508 wrote to memory of 2836 1508 pdppp.exe 43 PID 2836 wrote to memory of 2436 2836 bbtntb.exe 44 PID 2836 wrote to memory of 2436 2836 bbtntb.exe 44 PID 2836 wrote to memory of 2436 2836 bbtntb.exe 44 PID 2836 wrote to memory of 2436 2836 bbtntb.exe 44 PID 2436 wrote to memory of 2848 2436 bnbnnn.exe 45 PID 2436 wrote to memory of 2848 2436 bnbnnn.exe 45 PID 2436 wrote to memory of 2848 2436 bnbnnn.exe 45 PID 2436 wrote to memory of 2848 2436 bnbnnn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe"C:\Users\Admin\AppData\Local\Temp\7d52ee2dc3a610d6126a4444642d90ca635a9771f40819c3d1a1c4d33ba80046N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\pdjjv.exec:\pdjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\frffllr.exec:\frffllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jvppj.exec:\jvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\lxlflxr.exec:\lxlflxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\tnnntn.exec:\tnnntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\9rffrxf.exec:\9rffrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnbhnn.exec:\tnbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5rfffxx.exec:\5rfffxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\7ntnnh.exec:\7ntnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\7djdd.exec:\7djdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\7xllflr.exec:\7xllflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\hbhntt.exec:\hbhntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\pdppp.exec:\pdppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\bbtntb.exec:\bbtntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\bnbnnn.exec:\bnbnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\fxlxffx.exec:\fxlxffx.exe17⤵
- Executes dropped EXE
PID:2848 -
\??\c:\3httnn.exec:\3httnn.exe18⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ddddp.exec:\ddddp.exe19⤵
- Executes dropped EXE
PID:1488 -
\??\c:\xrffllr.exec:\xrffllr.exe20⤵
- Executes dropped EXE
PID:2480 -
\??\c:\jjddj.exec:\jjddj.exe21⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jvdvp.exec:\jvdvp.exe22⤵
- Executes dropped EXE
PID:3048 -
\??\c:\3htbbb.exec:\3htbbb.exe23⤵
- Executes dropped EXE
PID:2576 -
\??\c:\9jpjj.exec:\9jpjj.exe24⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9bbhhh.exec:\9bbhhh.exe25⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ththnt.exec:\ththnt.exe26⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pdvvp.exec:\pdvvp.exe27⤵
- Executes dropped EXE
PID:1960 -
\??\c:\htbbbb.exec:\htbbbb.exe28⤵
- Executes dropped EXE
PID:564 -
\??\c:\jdjdd.exec:\jdjdd.exe29⤵
- Executes dropped EXE
PID:1940 -
\??\c:\lfrllff.exec:\lfrllff.exe30⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jdvpv.exec:\jdvpv.exe31⤵
- Executes dropped EXE
PID:1860 -
\??\c:\flflrrx.exec:\flflrrx.exe32⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hthttn.exec:\hthttn.exe33⤵
- Executes dropped EXE
PID:2884 -
\??\c:\9pvdv.exec:\9pvdv.exe34⤵
- Executes dropped EXE
PID:2728 -
\??\c:\lffxrlf.exec:\lffxrlf.exe35⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lrxrrrx.exec:\lrxrrrx.exe36⤵
- Executes dropped EXE
PID:2620 -
\??\c:\pdjdv.exec:\pdjdv.exe37⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5dpvd.exec:\5dpvd.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bbtbnh.exec:\bbtbnh.exe40⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jvddd.exec:\jvddd.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\pjdpj.exec:\pjdpj.exe42⤵
- Executes dropped EXE
PID:1948 -
\??\c:\lxxrrfx.exec:\lxxrrfx.exe43⤵
- Executes dropped EXE
PID:1772 -
\??\c:\thtbtt.exec:\thtbtt.exe44⤵
- Executes dropped EXE
PID:1928 -
\??\c:\pdjpj.exec:\pdjpj.exe45⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jpdjd.exec:\jpdjd.exe46⤵
- Executes dropped EXE
PID:2936 -
\??\c:\rflfxrx.exec:\rflfxrx.exe47⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bntthb.exec:\bntthb.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pdjjp.exec:\pdjjp.exe49⤵
- Executes dropped EXE
PID:2956 -
\??\c:\pdjjp.exec:\pdjjp.exe50⤵
- Executes dropped EXE
PID:1508 -
\??\c:\frrllff.exec:\frrllff.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\thtnbt.exec:\thtnbt.exe52⤵
- Executes dropped EXE
PID:2488 -
\??\c:\thtntt.exec:\thtntt.exe53⤵
- Executes dropped EXE
PID:492 -
\??\c:\jdppp.exec:\jdppp.exe54⤵
- Executes dropped EXE
PID:1904 -
\??\c:\xflfxrl.exec:\xflfxrl.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\hbhtnb.exec:\hbhtnb.exe56⤵
- Executes dropped EXE
PID:1008 -
\??\c:\bhhbtn.exec:\bhhbtn.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dvjjv.exec:\dvjjv.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\7lfffxx.exec:\7lfffxx.exe59⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bnbntt.exec:\bnbntt.exe60⤵
- Executes dropped EXE
PID:832 -
\??\c:\1hnhtt.exec:\1hnhtt.exe61⤵
- Executes dropped EXE
PID:852 -
\??\c:\7vddv.exec:\7vddv.exe62⤵
- Executes dropped EXE
PID:1952 -
\??\c:\3fxxfrr.exec:\3fxxfrr.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hbhnhn.exec:\hbhnhn.exe64⤵
- Executes dropped EXE
PID:956 -
\??\c:\tnbbbt.exec:\tnbbbt.exe65⤵
- Executes dropped EXE
PID:840 -
\??\c:\jvvvv.exec:\jvvvv.exe66⤵PID:1768
-
\??\c:\jvjpv.exec:\jvjpv.exe67⤵PID:476
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe68⤵PID:2388
-
\??\c:\thbhbt.exec:\thbhbt.exe69⤵PID:564
-
\??\c:\pvjjj.exec:\pvjjj.exe70⤵PID:1968
-
\??\c:\pdddd.exec:\pdddd.exe71⤵PID:1012
-
\??\c:\frxrlff.exec:\frxrlff.exe72⤵PID:1632
-
\??\c:\bnnhbt.exec:\bnnhbt.exe73⤵
- System Location Discovery: System Language Discovery
PID:2740 -
\??\c:\nhnntt.exec:\nhnntt.exe74⤵PID:2744
-
\??\c:\jvdvv.exec:\jvdvv.exe75⤵PID:3040
-
\??\c:\rxxxxrl.exec:\rxxxxrl.exe76⤵PID:2732
-
\??\c:\1xlrlff.exec:\1xlrlff.exe77⤵PID:2788
-
\??\c:\5hbnnh.exec:\5hbnnh.exe78⤵PID:2620
-
\??\c:\nhnthh.exec:\nhnthh.exe79⤵PID:2652
-
\??\c:\dpppj.exec:\dpppj.exe80⤵PID:2772
-
\??\c:\frfrrll.exec:\frfrrll.exe81⤵PID:2608
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe82⤵PID:2664
-
\??\c:\3tntnh.exec:\3tntnh.exe83⤵PID:580
-
\??\c:\3vjpp.exec:\3vjpp.exe84⤵PID:2688
-
\??\c:\7vjdj.exec:\7vjdj.exe85⤵PID:2076
-
\??\c:\lrxrrll.exec:\lrxrrll.exe86⤵PID:2060
-
\??\c:\httntn.exec:\httntn.exe87⤵PID:2964
-
\??\c:\hthnnn.exec:\hthnnn.exe88⤵PID:2168
-
\??\c:\vdjvp.exec:\vdjvp.exe89⤵PID:2212
-
\??\c:\jvvvd.exec:\jvvvd.exe90⤵PID:2864
-
\??\c:\rfxlrll.exec:\rfxlrll.exe91⤵PID:1440
-
\??\c:\ntbtnh.exec:\ntbtnh.exe92⤵PID:2876
-
\??\c:\dpvdp.exec:\dpvdp.exe93⤵PID:1316
-
\??\c:\dvddd.exec:\dvddd.exe94⤵PID:2436
-
\??\c:\5rxlrlr.exec:\5rxlrlr.exe95⤵PID:2668
-
\??\c:\nbhbhh.exec:\nbhbhh.exe96⤵PID:940
-
\??\c:\nhttbb.exec:\nhttbb.exe97⤵PID:980
-
\??\c:\1vjjj.exec:\1vjjj.exe98⤵PID:2420
-
\??\c:\rlxfxxf.exec:\rlxfxxf.exe99⤵PID:808
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe100⤵PID:2176
-
\??\c:\nhtbbt.exec:\nhtbbt.exe101⤵PID:2780
-
\??\c:\vpddj.exec:\vpddj.exe102⤵PID:1248
-
\??\c:\dpjdd.exec:\dpjdd.exe103⤵PID:1956
-
\??\c:\rlrflrx.exec:\rlrflrx.exe104⤵PID:2364
-
\??\c:\5rrxxxl.exec:\5rrxxxl.exe105⤵PID:1336
-
\??\c:\1hnthb.exec:\1hnthb.exe106⤵PID:2468
-
\??\c:\pjvdp.exec:\pjvdp.exe107⤵PID:2188
-
\??\c:\vvjjv.exec:\vvjjv.exe108⤵PID:640
-
\??\c:\9rlxrrx.exec:\9rlxrrx.exe109⤵PID:2492
-
\??\c:\hthbbt.exec:\hthbbt.exe110⤵PID:1000
-
\??\c:\dvdvd.exec:\dvdvd.exe111⤵PID:2112
-
\??\c:\7vdvv.exec:\7vdvv.exe112⤵PID:2432
-
\??\c:\rxllxxl.exec:\rxllxxl.exe113⤵PID:2428
-
\??\c:\tbnthh.exec:\tbnthh.exe114⤵PID:1580
-
\??\c:\nbhhnn.exec:\nbhhnn.exe115⤵PID:1680
-
\??\c:\jvdpv.exec:\jvdpv.exe116⤵PID:2820
-
\??\c:\rfxflfl.exec:\rfxflfl.exe117⤵PID:2892
-
\??\c:\rlfxflf.exec:\rlfxflf.exe118⤵PID:2728
-
\??\c:\5nttbh.exec:\5nttbh.exe119⤵PID:2716
-
\??\c:\dvjdj.exec:\dvjdj.exe120⤵PID:2980
-
\??\c:\jdpjv.exec:\jdpjv.exe121⤵PID:2940
-
\??\c:\xlfrlfl.exec:\xlfrlfl.exe122⤵PID:2772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-