Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe
-
Size
452KB
-
MD5
9fb45cb4881e004f47e19f5dc623b948
-
SHA1
a1b0a3d67c0556f92f61a541fe879030ab06a590
-
SHA256
0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c
-
SHA512
6a672cc56f109a25bb1772aece23ca370bd83fb8c9590f5d427b77235337b166d97cf97dd5b6760de709b3d5166cf76dd254c5486ffcd92714901c27bc3738d8
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeX:q7Tc2NYHUrAwfMp3CDX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1580-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-73-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1072-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-112-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2392-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-141-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/776-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1928-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2580-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-542-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2064-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-608-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2180-633-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1104-679-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2876-883-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-958-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3048 dbdfdxt.exe 2736 ptfpr.exe 2992 fnnhnb.exe 2708 phrlhv.exe 2928 ttnvfn.exe 2664 htlxb.exe 2824 rxfvb.exe 1072 rprlbdj.exe 2688 xplbljv.exe 2988 rfdjn.exe 552 xlbvp.exe 2392 bnjpdxx.exe 2768 tdvtd.exe 1436 vrhtprp.exe 1688 dbjtvhv.exe 776 blhtd.exe 2088 hnxvdhn.exe 2116 bhphdbv.exe 1928 nhfjhdr.exe 2120 djxjfb.exe 2016 xrfjtld.exe 1288 pltpln.exe 2568 bnhvfdl.exe 2156 nthrn.exe 1468 vnndthd.exe 1148 ntrflhl.exe 3024 xdfxdn.exe 1404 npfvt.exe 2368 xhjfd.exe 1676 vfpflxn.exe 1332 txfbp.exe 2000 njlphtd.exe 2508 nvdlj.exe 1916 ffjttbr.exe 1744 xptrvt.exe 2772 jjjlhv.exe 2812 vhfdjr.exe 2980 tbvdjdx.exe 2856 drdvrft.exe 2808 nhtfhpj.exe 2616 lvlbh.exe 2704 vtpbxh.exe 2668 xbnbdd.exe 1364 rbpvtr.exe 1200 xtljl.exe 2932 lrfpv.exe 1296 vjbhf.exe 2580 vdbhjpn.exe 2912 pntrn.exe 1156 vtvth.exe 2960 httjtlt.exe 2408 bbvrdxv.exe 2144 vvvdtb.exe 1968 xnvhtpb.exe 320 djptdt.exe 2460 vplrt.exe 2344 rvtvh.exe 2196 xvnvxx.exe 1384 nrpfbpt.exe 2328 rjtrp.exe 1904 txpblhb.exe 2176 lxjprh.exe 1276 lnnvl.exe 2028 thnjhbb.exe -
resource yara_rule behavioral1/memory/1580-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-770-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-883-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-965-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-1010-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlnvnhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdhfpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blpfbxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlnrppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpppldd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpdvbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dflhbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txbvpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txtjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxthd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjnljnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxjjxbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnvhtpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvhjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbbrvb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pttlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flnnpdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njnrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdbtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnxdjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxhrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrhxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vntnbvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvxlhpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpftbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxhhbxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnbnfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhxlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhffllb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jfrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxjrld.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfhvlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trhdnbv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnxjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbrnjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lttdpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htlxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxnftn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhdbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jflxhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrdpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxxprr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrxflv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 3048 1580 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 30 PID 1580 wrote to memory of 3048 1580 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 30 PID 1580 wrote to memory of 3048 1580 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 30 PID 1580 wrote to memory of 3048 1580 0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe 30 PID 3048 wrote to memory of 2736 3048 dbdfdxt.exe 31 PID 3048 wrote to memory of 2736 3048 dbdfdxt.exe 31 PID 3048 wrote to memory of 2736 3048 dbdfdxt.exe 31 PID 3048 wrote to memory of 2736 3048 dbdfdxt.exe 31 PID 2736 wrote to memory of 2992 2736 ptfpr.exe 32 PID 2736 wrote to memory of 2992 2736 ptfpr.exe 32 PID 2736 wrote to memory of 2992 2736 ptfpr.exe 32 PID 2736 wrote to memory of 2992 2736 ptfpr.exe 32 PID 2992 wrote to memory of 2708 2992 fnnhnb.exe 33 PID 2992 wrote to memory of 2708 2992 fnnhnb.exe 33 PID 2992 wrote to memory of 2708 2992 fnnhnb.exe 33 PID 2992 wrote to memory of 2708 2992 fnnhnb.exe 33 PID 2708 wrote to memory of 2928 2708 phrlhv.exe 34 PID 2708 wrote to memory of 2928 2708 phrlhv.exe 34 PID 2708 wrote to memory of 2928 2708 phrlhv.exe 34 PID 2708 wrote to memory of 2928 2708 phrlhv.exe 34 PID 2928 wrote to memory of 2664 2928 ttnvfn.exe 35 PID 2928 wrote to memory of 2664 2928 ttnvfn.exe 35 PID 2928 wrote to memory of 2664 2928 ttnvfn.exe 35 PID 2928 wrote to memory of 2664 2928 ttnvfn.exe 35 PID 2664 wrote to memory of 2824 2664 htlxb.exe 36 PID 2664 wrote to memory of 2824 2664 htlxb.exe 36 PID 2664 wrote to memory of 2824 2664 htlxb.exe 36 PID 2664 wrote to memory of 2824 2664 htlxb.exe 36 PID 2824 wrote to memory of 1072 2824 rxfvb.exe 37 PID 2824 wrote to memory of 1072 2824 rxfvb.exe 37 PID 2824 wrote to memory of 1072 2824 rxfvb.exe 37 PID 2824 wrote to memory of 1072 2824 rxfvb.exe 37 PID 1072 wrote to memory of 2688 1072 rprlbdj.exe 38 PID 1072 wrote to memory of 2688 1072 rprlbdj.exe 38 PID 1072 wrote to memory of 2688 1072 rprlbdj.exe 38 PID 1072 wrote to memory of 2688 1072 rprlbdj.exe 38 PID 2688 wrote to memory of 2988 2688 xplbljv.exe 39 PID 2688 wrote to memory of 2988 2688 xplbljv.exe 39 PID 2688 wrote to memory of 2988 2688 xplbljv.exe 39 PID 2688 wrote to memory of 2988 2688 xplbljv.exe 39 PID 2988 wrote to memory of 552 2988 rfdjn.exe 40 PID 2988 wrote to memory of 552 2988 rfdjn.exe 40 PID 2988 wrote to memory of 552 2988 rfdjn.exe 40 PID 2988 wrote to memory of 552 2988 rfdjn.exe 40 PID 552 wrote to memory of 2392 552 xlbvp.exe 41 PID 552 wrote to memory of 2392 552 xlbvp.exe 41 PID 552 wrote to memory of 2392 552 xlbvp.exe 41 PID 552 wrote to memory of 2392 552 xlbvp.exe 41 PID 2392 wrote to memory of 2768 2392 bnjpdxx.exe 42 PID 2392 wrote to memory of 2768 2392 bnjpdxx.exe 42 PID 2392 wrote to memory of 2768 2392 bnjpdxx.exe 42 PID 2392 wrote to memory of 2768 2392 bnjpdxx.exe 42 PID 2768 wrote to memory of 1436 2768 tdvtd.exe 43 PID 2768 wrote to memory of 1436 2768 tdvtd.exe 43 PID 2768 wrote to memory of 1436 2768 tdvtd.exe 43 PID 2768 wrote to memory of 1436 2768 tdvtd.exe 43 PID 1436 wrote to memory of 1688 1436 vrhtprp.exe 44 PID 1436 wrote to memory of 1688 1436 vrhtprp.exe 44 PID 1436 wrote to memory of 1688 1436 vrhtprp.exe 44 PID 1436 wrote to memory of 1688 1436 vrhtprp.exe 44 PID 1688 wrote to memory of 776 1688 dbjtvhv.exe 45 PID 1688 wrote to memory of 776 1688 dbjtvhv.exe 45 PID 1688 wrote to memory of 776 1688 dbjtvhv.exe 45 PID 1688 wrote to memory of 776 1688 dbjtvhv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe"C:\Users\Admin\AppData\Local\Temp\0d28a30a78bbddfa24f3702c66b7f0dd2ad4807922159df24b24be7a4fd8102c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\dbdfdxt.exec:\dbdfdxt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\ptfpr.exec:\ptfpr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\fnnhnb.exec:\fnnhnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\phrlhv.exec:\phrlhv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ttnvfn.exec:\ttnvfn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\htlxb.exec:\htlxb.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\rxfvb.exec:\rxfvb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rprlbdj.exec:\rprlbdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\xplbljv.exec:\xplbljv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rfdjn.exec:\rfdjn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\xlbvp.exec:\xlbvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\bnjpdxx.exec:\bnjpdxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\tdvtd.exec:\tdvtd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vrhtprp.exec:\vrhtprp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\dbjtvhv.exec:\dbjtvhv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\blhtd.exec:\blhtd.exe17⤵
- Executes dropped EXE
PID:776 -
\??\c:\hnxvdhn.exec:\hnxvdhn.exe18⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bhphdbv.exec:\bhphdbv.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nhfjhdr.exec:\nhfjhdr.exe20⤵
- Executes dropped EXE
PID:1928 -
\??\c:\djxjfb.exec:\djxjfb.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\xrfjtld.exec:\xrfjtld.exe22⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pltpln.exec:\pltpln.exe23⤵
- Executes dropped EXE
PID:1288 -
\??\c:\bnhvfdl.exec:\bnhvfdl.exe24⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nthrn.exec:\nthrn.exe25⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vnndthd.exec:\vnndthd.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\ntrflhl.exec:\ntrflhl.exe27⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xdfxdn.exec:\xdfxdn.exe28⤵
- Executes dropped EXE
PID:3024 -
\??\c:\npfvt.exec:\npfvt.exe29⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xhjfd.exec:\xhjfd.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vfpflxn.exec:\vfpflxn.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\txfbp.exec:\txfbp.exe32⤵
- Executes dropped EXE
PID:1332 -
\??\c:\njlphtd.exec:\njlphtd.exe33⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nvdlj.exec:\nvdlj.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ffjttbr.exec:\ffjttbr.exe35⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xptrvt.exec:\xptrvt.exe36⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jjjlhv.exec:\jjjlhv.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\vhfdjr.exec:\vhfdjr.exe38⤵
- Executes dropped EXE
PID:2812 -
\??\c:\tbvdjdx.exec:\tbvdjdx.exe39⤵
- Executes dropped EXE
PID:2980 -
\??\c:\drdvrft.exec:\drdvrft.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\nhtfhpj.exec:\nhtfhpj.exe41⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lvlbh.exec:\lvlbh.exe42⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vtpbxh.exec:\vtpbxh.exe43⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xbnbdd.exec:\xbnbdd.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rbpvtr.exec:\rbpvtr.exe45⤵
- Executes dropped EXE
PID:1364 -
\??\c:\xtljl.exec:\xtljl.exe46⤵
- Executes dropped EXE
PID:1200 -
\??\c:\lrfpv.exec:\lrfpv.exe47⤵
- Executes dropped EXE
PID:2932 -
\??\c:\vjbhf.exec:\vjbhf.exe48⤵
- Executes dropped EXE
PID:1296 -
\??\c:\vdbhjpn.exec:\vdbhjpn.exe49⤵
- Executes dropped EXE
PID:2580 -
\??\c:\pntrn.exec:\pntrn.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vtvth.exec:\vtvth.exe51⤵
- Executes dropped EXE
PID:1156 -
\??\c:\httjtlt.exec:\httjtlt.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bbvrdxv.exec:\bbvrdxv.exe53⤵
- Executes dropped EXE
PID:2408 -
\??\c:\vvvdtb.exec:\vvvdtb.exe54⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xnvhtpb.exec:\xnvhtpb.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1968 -
\??\c:\djptdt.exec:\djptdt.exe56⤵
- Executes dropped EXE
PID:320 -
\??\c:\vplrt.exec:\vplrt.exe57⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rvtvh.exec:\rvtvh.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xvnvxx.exec:\xvnvxx.exe59⤵
- Executes dropped EXE
PID:2196 -
\??\c:\nrpfbpt.exec:\nrpfbpt.exe60⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rjtrp.exec:\rjtrp.exe61⤵
- Executes dropped EXE
PID:2328 -
\??\c:\txpblhb.exec:\txpblhb.exe62⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lxjprh.exec:\lxjprh.exe63⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lnnvl.exec:\lnnvl.exe64⤵
- Executes dropped EXE
PID:1276 -
\??\c:\thnjhbb.exec:\thnjhbb.exe65⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dhrbpl.exec:\dhrbpl.exe66⤵PID:780
-
\??\c:\njlrjvj.exec:\njlrjvj.exe67⤵PID:2436
-
\??\c:\lfdjt.exec:\lfdjt.exe68⤵PID:1716
-
\??\c:\xxxjrld.exec:\xxxjrld.exe69⤵
- System Location Discovery: System Language Discovery
PID:1720 -
\??\c:\rhlbhr.exec:\rhlbhr.exe70⤵PID:364
-
\??\c:\dxblnr.exec:\dxblnr.exe71⤵PID:2064
-
\??\c:\xbdhj.exec:\xbdhj.exe72⤵PID:1404
-
\??\c:\pxbflbp.exec:\pxbflbp.exe73⤵PID:3000
-
\??\c:\vbxbjh.exec:\vbxbjh.exe74⤵PID:1556
-
\??\c:\vbndhvf.exec:\vbndhvf.exe75⤵PID:2012
-
\??\c:\xbdjx.exec:\xbdjx.exe76⤵PID:884
-
\??\c:\xlvlhn.exec:\xlvlhn.exe77⤵PID:2536
-
\??\c:\nprdptf.exec:\nprdptf.exe78⤵PID:2508
-
\??\c:\trnhhv.exec:\trnhhv.exe79⤵PID:2444
-
\??\c:\hhxbllh.exec:\hhxbllh.exe80⤵PID:2300
-
\??\c:\pnfblxh.exec:\pnfblxh.exe81⤵PID:2796
-
\??\c:\rprdfpd.exec:\rprdfpd.exe82⤵PID:2164
-
\??\c:\dhxrvb.exec:\dhxrvb.exe83⤵PID:2180
-
\??\c:\phrbn.exec:\phrbn.exe84⤵PID:2920
-
\??\c:\pjndrb.exec:\pjndrb.exe85⤵PID:844
-
\??\c:\nrjbff.exec:\nrjbff.exe86⤵PID:2756
-
\??\c:\rxthd.exec:\rxthd.exe87⤵
- System Location Discovery: System Language Discovery
PID:1104 -
\??\c:\rhvbhx.exec:\rhvbhx.exe88⤵PID:2576
-
\??\c:\jvxpph.exec:\jvxpph.exe89⤵PID:1840
-
\??\c:\hjbvn.exec:\hjbvn.exe90⤵PID:2908
-
\??\c:\tbddrr.exec:\tbddrr.exe91⤵PID:2496
-
\??\c:\jhjbvj.exec:\jhjbvj.exe92⤵PID:2892
-
\??\c:\xjlfnbt.exec:\xjlfnbt.exe93⤵PID:2936
-
\??\c:\jhtppr.exec:\jhtppr.exe94⤵PID:2844
-
\??\c:\flhvh.exec:\flhvh.exe95⤵PID:2132
-
\??\c:\pjtvjt.exec:\pjtvjt.exe96⤵PID:1784
-
\??\c:\vnxft.exec:\vnxft.exe97⤵PID:2632
-
\??\c:\jdtjr.exec:\jdtjr.exe98⤵PID:2304
-
\??\c:\ldddf.exec:\ldddf.exe99⤵PID:2340
-
\??\c:\vvbnjrn.exec:\vvbnjrn.exe100⤵PID:2212
-
\??\c:\jvbhj.exec:\jvbhj.exe101⤵PID:2428
-
\??\c:\nlxlpbp.exec:\nlxlpbp.exe102⤵PID:1184
-
\??\c:\fpnjxln.exec:\fpnjxln.exe103⤵PID:2088
-
\??\c:\xnpjbtv.exec:\xnpjbtv.exe104⤵PID:2356
-
\??\c:\vvvflxj.exec:\vvvflxj.exe105⤵PID:1808
-
\??\c:\lhvhj.exec:\lhvhj.exe106⤵PID:1368
-
\??\c:\fdjrf.exec:\fdjrf.exe107⤵PID:2020
-
\??\c:\vrvnrf.exec:\vrvnrf.exe108⤵PID:616
-
\??\c:\ttpxhjh.exec:\ttpxhjh.exe109⤵PID:1852
-
\??\c:\pfldbj.exec:\pfldbj.exe110⤵PID:2028
-
\??\c:\vtdbjdp.exec:\vtdbjdp.exe111⤵PID:1080
-
\??\c:\bjrpf.exec:\bjrpf.exe112⤵PID:2436
-
\??\c:\vjhpptn.exec:\vjhpptn.exe113⤵PID:1228
-
\??\c:\drfbf.exec:\drfbf.exe114⤵PID:1720
-
\??\c:\fttbh.exec:\fttbh.exe115⤵PID:1616
-
\??\c:\rvbpv.exec:\rvbpv.exe116⤵PID:2984
-
\??\c:\dhnrj.exec:\dhnrj.exe117⤵PID:2484
-
\??\c:\dbxlf.exec:\dbxlf.exe118⤵PID:2456
-
\??\c:\txbxvd.exec:\txbxvd.exe119⤵PID:1664
-
\??\c:\txftr.exec:\txftr.exe120⤵PID:2964
-
\??\c:\bbnhbjl.exec:\bbnhbjl.exe121⤵PID:1692
-
\??\c:\fnfxj.exec:\fnfxj.exe122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-