Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe
-
Size
453KB
-
MD5
98cb0a158548c7cda262ffc37792cd90
-
SHA1
f141c3a389cfe7c6abea200a93c8ea40d61e8d04
-
SHA256
39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360
-
SHA512
eb95fa137179f219a1771eccf61d1a30f87a064757eff8ff0bc519584708894bfb2055ddcec06655a7c9bcf547f9fec58c9a0983c6ab0a80dc071d4ecd6f9624
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeV:q7Tc2NYHUrAwfMp3CDV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2856-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2332-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-196-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2356-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-233-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1688-246-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1688-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-256-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2396-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-291-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1000-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-349-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2556-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1652-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-471-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2360-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-594-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-628-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/940-840-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2068 bbthth.exe 2836 9nhnhh.exe 2536 jvpdd.exe 2780 ffrfxlx.exe 2552 9bntnn.exe 1736 5vjjp.exe 2600 3nhthh.exe 1404 rfxxffl.exe 2460 bntthn.exe 336 xxllxfr.exe 2756 bhhtnt.exe 2304 fxxflxl.exe 1204 9bntht.exe 1556 7xxfllx.exe 2332 btntbh.exe 956 5fxlrfr.exe 2340 3nbhbb.exe 2072 nhbnbh.exe 2324 jdddj.exe 2360 bbbbtb.exe 2356 vdvdv.exe 1436 bhbhhn.exe 680 5nhhtb.exe 1716 frlrxfx.exe 1688 hnbnhn.exe 1700 llffrxr.exe 2384 ntnhtn.exe 760 fxrxlxr.exe 2396 hnnnhh.exe 1000 llrfrxl.exe 2276 nnhnbh.exe 944 5xlrxlx.exe 1520 9tnbnt.exe 2672 jdppv.exe 2784 3lxfllr.exe 2228 tnhnth.exe 2652 9jdpv.exe 2556 jvppv.exe 2568 rflxflx.exe 2864 bhnhhb.exe 1652 dvpvd.exe 3036 flffrrx.exe 1624 5ntnhh.exe 2280 thbbhb.exe 1168 ddpdv.exe 1100 3xlrfrf.exe 2976 tnhthn.exe 2096 5nhnbh.exe 1072 dddpj.exe 2924 lfxfrfr.exe 1204 bthtbb.exe 2112 vvjpd.exe 2196 7jppv.exe 1044 frrxrrf.exe 264 ntnthh.exe 768 jdvvd.exe 2160 xxffrfl.exe 2952 hnhtnn.exe 3060 bbthnb.exe 2360 pjvdj.exe 2156 9frfxfl.exe 656 tnbhtt.exe 2504 nthnbb.exe 3004 3dpvj.exe -
resource yara_rule behavioral1/memory/2068-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-594-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-613-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2228-620-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-698-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-833-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2068 2856 39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe 30 PID 2856 wrote to memory of 2068 2856 39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe 30 PID 2856 wrote to memory of 2068 2856 39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe 30 PID 2856 wrote to memory of 2068 2856 39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe 30 PID 2068 wrote to memory of 2836 2068 bbthth.exe 31 PID 2068 wrote to memory of 2836 2068 bbthth.exe 31 PID 2068 wrote to memory of 2836 2068 bbthth.exe 31 PID 2068 wrote to memory of 2836 2068 bbthth.exe 31 PID 2836 wrote to memory of 2536 2836 9nhnhh.exe 32 PID 2836 wrote to memory of 2536 2836 9nhnhh.exe 32 PID 2836 wrote to memory of 2536 2836 9nhnhh.exe 32 PID 2836 wrote to memory of 2536 2836 9nhnhh.exe 32 PID 2536 wrote to memory of 2780 2536 jvpdd.exe 33 PID 2536 wrote to memory of 2780 2536 jvpdd.exe 33 PID 2536 wrote to memory of 2780 2536 jvpdd.exe 33 PID 2536 wrote to memory of 2780 2536 jvpdd.exe 33 PID 2780 wrote to memory of 2552 2780 ffrfxlx.exe 34 PID 2780 wrote to memory of 2552 2780 ffrfxlx.exe 34 PID 2780 wrote to memory of 2552 2780 ffrfxlx.exe 34 PID 2780 wrote to memory of 2552 2780 ffrfxlx.exe 34 PID 2552 wrote to memory of 1736 2552 9bntnn.exe 35 PID 2552 wrote to memory of 1736 2552 9bntnn.exe 35 PID 2552 wrote to memory of 1736 2552 9bntnn.exe 35 PID 2552 wrote to memory of 1736 2552 9bntnn.exe 35 PID 1736 wrote to memory of 2600 1736 5vjjp.exe 36 PID 1736 wrote to memory of 2600 1736 5vjjp.exe 36 PID 1736 wrote to memory of 2600 1736 5vjjp.exe 36 PID 1736 wrote to memory of 2600 1736 5vjjp.exe 36 PID 2600 wrote to memory of 1404 2600 3nhthh.exe 37 PID 2600 wrote to memory of 1404 2600 3nhthh.exe 37 PID 2600 wrote to memory of 1404 2600 3nhthh.exe 37 PID 2600 wrote to memory of 1404 2600 3nhthh.exe 37 PID 1404 wrote to memory of 2460 1404 rfxxffl.exe 38 PID 1404 wrote to memory of 2460 1404 rfxxffl.exe 38 PID 1404 wrote to memory of 2460 1404 rfxxffl.exe 38 PID 1404 wrote to memory of 2460 1404 rfxxffl.exe 38 PID 2460 wrote to memory of 336 2460 bntthn.exe 39 PID 2460 wrote to memory of 336 2460 bntthn.exe 39 PID 2460 wrote to memory of 336 2460 bntthn.exe 39 PID 2460 wrote to memory of 336 2460 bntthn.exe 39 PID 336 wrote to memory of 2756 336 xxllxfr.exe 40 PID 336 wrote to memory of 2756 336 xxllxfr.exe 40 PID 336 wrote to memory of 2756 336 xxllxfr.exe 40 PID 336 wrote to memory of 2756 336 xxllxfr.exe 40 PID 2756 wrote to memory of 2304 2756 bhhtnt.exe 41 PID 2756 wrote to memory of 2304 2756 bhhtnt.exe 41 PID 2756 wrote to memory of 2304 2756 bhhtnt.exe 41 PID 2756 wrote to memory of 2304 2756 bhhtnt.exe 41 PID 2304 wrote to memory of 1204 2304 fxxflxl.exe 42 PID 2304 wrote to memory of 1204 2304 fxxflxl.exe 42 PID 2304 wrote to memory of 1204 2304 fxxflxl.exe 42 PID 2304 wrote to memory of 1204 2304 fxxflxl.exe 42 PID 1204 wrote to memory of 1556 1204 9bntht.exe 43 PID 1204 wrote to memory of 1556 1204 9bntht.exe 43 PID 1204 wrote to memory of 1556 1204 9bntht.exe 43 PID 1204 wrote to memory of 1556 1204 9bntht.exe 43 PID 1556 wrote to memory of 2332 1556 7xxfllx.exe 44 PID 1556 wrote to memory of 2332 1556 7xxfllx.exe 44 PID 1556 wrote to memory of 2332 1556 7xxfllx.exe 44 PID 1556 wrote to memory of 2332 1556 7xxfllx.exe 44 PID 2332 wrote to memory of 956 2332 btntbh.exe 45 PID 2332 wrote to memory of 956 2332 btntbh.exe 45 PID 2332 wrote to memory of 956 2332 btntbh.exe 45 PID 2332 wrote to memory of 956 2332 btntbh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe"C:\Users\Admin\AppData\Local\Temp\39fa248de863162216428501232d39b99623a08f6eb16f8fa7909f443f774360N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bbthth.exec:\bbthth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9nhnhh.exec:\9nhnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jvpdd.exec:\jvpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\ffrfxlx.exec:\ffrfxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\9bntnn.exec:\9bntnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\5vjjp.exec:\5vjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\3nhthh.exec:\3nhthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rfxxffl.exec:\rfxxffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\bntthn.exec:\bntthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\xxllxfr.exec:\xxllxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\bhhtnt.exec:\bhhtnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxxflxl.exec:\fxxflxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\9bntht.exec:\9bntht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\7xxfllx.exec:\7xxfllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\btntbh.exec:\btntbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\5fxlrfr.exec:\5fxlrfr.exe17⤵
- Executes dropped EXE
PID:956 -
\??\c:\3nbhbb.exec:\3nbhbb.exe18⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhbnbh.exec:\nhbnbh.exe19⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jdddj.exec:\jdddj.exe20⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bbbbtb.exec:\bbbbtb.exe21⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vdvdv.exec:\vdvdv.exe22⤵
- Executes dropped EXE
PID:2356 -
\??\c:\bhbhhn.exec:\bhbhhn.exe23⤵
- Executes dropped EXE
PID:1436 -
\??\c:\5nhhtb.exec:\5nhhtb.exe24⤵
- Executes dropped EXE
PID:680 -
\??\c:\frlrxfx.exec:\frlrxfx.exe25⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hnbnhn.exec:\hnbnhn.exe26⤵
- Executes dropped EXE
PID:1688 -
\??\c:\llffrxr.exec:\llffrxr.exe27⤵
- Executes dropped EXE
PID:1700 -
\??\c:\ntnhtn.exec:\ntnhtn.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxrxlxr.exec:\fxrxlxr.exe29⤵
- Executes dropped EXE
PID:760 -
\??\c:\hnnnhh.exec:\hnnnhh.exe30⤵
- Executes dropped EXE
PID:2396 -
\??\c:\llrfrxl.exec:\llrfrxl.exe31⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nnhnbh.exec:\nnhnbh.exe32⤵
- Executes dropped EXE
PID:2276 -
\??\c:\5xlrxlx.exec:\5xlrxlx.exe33⤵
- Executes dropped EXE
PID:944 -
\??\c:\9tnbnt.exec:\9tnbnt.exe34⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:2672 -
\??\c:\3lxfllr.exec:\3lxfllr.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\tnhnth.exec:\tnhnth.exe37⤵
- Executes dropped EXE
PID:2228 -
\??\c:\9jdpv.exec:\9jdpv.exe38⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jvppv.exec:\jvppv.exe39⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rflxflx.exec:\rflxflx.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\bhnhhb.exec:\bhnhhb.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dvpvd.exec:\dvpvd.exe42⤵
- Executes dropped EXE
PID:1652 -
\??\c:\flffrrx.exec:\flffrrx.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5ntnhh.exec:\5ntnhh.exe44⤵
- Executes dropped EXE
PID:1624 -
\??\c:\thbbhb.exec:\thbbhb.exe45⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ddpdv.exec:\ddpdv.exe46⤵
- Executes dropped EXE
PID:1168 -
\??\c:\3xlrfrf.exec:\3xlrfrf.exe47⤵
- Executes dropped EXE
PID:1100 -
\??\c:\tnhthn.exec:\tnhthn.exe48⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5nhnbh.exec:\5nhnbh.exe49⤵
- Executes dropped EXE
PID:2096 -
\??\c:\dddpj.exec:\dddpj.exe50⤵
- Executes dropped EXE
PID:1072 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe51⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bthtbb.exec:\bthtbb.exe52⤵
- Executes dropped EXE
PID:1204 -
\??\c:\vvjpd.exec:\vvjpd.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7jppv.exec:\7jppv.exe54⤵
- Executes dropped EXE
PID:2196 -
\??\c:\frrxrrf.exec:\frrxrrf.exe55⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ntnthh.exec:\ntnthh.exe56⤵
- Executes dropped EXE
PID:264 -
\??\c:\jdvvd.exec:\jdvvd.exe57⤵
- Executes dropped EXE
PID:768 -
\??\c:\xxffrfl.exec:\xxffrfl.exe58⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hnhtnn.exec:\hnhtnn.exe59⤵
- Executes dropped EXE
PID:2952 -
\??\c:\bbthnb.exec:\bbthnb.exe60⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjvdj.exec:\pjvdj.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2360 -
\??\c:\9frfxfl.exec:\9frfxfl.exe62⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnbhtt.exec:\tnbhtt.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\nthnbb.exec:\nthnbb.exe64⤵
- Executes dropped EXE
PID:2504 -
\??\c:\3dpvj.exec:\3dpvj.exe65⤵
- Executes dropped EXE
PID:3004 -
\??\c:\7fllflr.exec:\7fllflr.exe66⤵PID:1648
-
\??\c:\nnbhtb.exec:\nnbhtb.exe67⤵PID:1704
-
\??\c:\nbbttt.exec:\nbbttt.exe68⤵
- System Location Discovery: System Language Discovery
PID:840 -
\??\c:\pjvpj.exec:\pjvpj.exe69⤵PID:2496
-
\??\c:\fxxrlxl.exec:\fxxrlxl.exe70⤵PID:2768
-
\??\c:\3btnnb.exec:\3btnnb.exe71⤵PID:756
-
\??\c:\1ttnnn.exec:\1ttnnn.exe72⤵PID:2400
-
\??\c:\ppdjp.exec:\ppdjp.exe73⤵PID:2396
-
\??\c:\xrlrlrl.exec:\xrlrlrl.exe74⤵PID:1588
-
\??\c:\lflrlfr.exec:\lflrlfr.exe75⤵PID:2436
-
\??\c:\nntbnb.exec:\nntbnb.exe76⤵PID:952
-
\??\c:\jpdvp.exec:\jpdvp.exe77⤵PID:2464
-
\??\c:\9vvdj.exec:\9vvdj.exe78⤵PID:2636
-
\??\c:\9rxfrxf.exec:\9rxfrxf.exe79⤵PID:2964
-
\??\c:\nhhtbh.exec:\nhhtbh.exe80⤵PID:2956
-
\??\c:\5dvjp.exec:\5dvjp.exe81⤵PID:2228
-
\??\c:\9lxlffr.exec:\9lxlffr.exe82⤵PID:2868
-
\??\c:\nhnbnt.exec:\nhnbnt.exe83⤵PID:2692
-
\??\c:\nnhnhn.exec:\nnhnhn.exe84⤵PID:2540
-
\??\c:\jdvvd.exec:\jdvvd.exe85⤵PID:2592
-
\??\c:\rrlrlrf.exec:\rrlrlrf.exe86⤵
- System Location Discovery: System Language Discovery
PID:2472 -
\??\c:\thhnnn.exec:\thhnnn.exe87⤵PID:3048
-
\??\c:\vvpdj.exec:\vvpdj.exe88⤵PID:1816
-
\??\c:\5pdjj.exec:\5pdjj.exe89⤵PID:404
-
\??\c:\llffxfx.exec:\llffxfx.exe90⤵PID:1600
-
\??\c:\nhhbtb.exec:\nhhbtb.exe91⤵PID:2740
-
\??\c:\dvpvd.exec:\dvpvd.exe92⤵PID:2972
-
\??\c:\jdvvv.exec:\jdvvv.exe93⤵PID:2940
-
\??\c:\lrrrlrl.exec:\lrrrlrl.exe94⤵PID:2888
-
\??\c:\btnthh.exec:\btnthh.exe95⤵PID:2588
-
\??\c:\bhbhbb.exec:\bhbhbb.exe96⤵PID:2924
-
\??\c:\3jjvv.exec:\3jjvv.exe97⤵PID:1204
-
\??\c:\fxrlflf.exec:\fxrlflf.exe98⤵PID:1412
-
\??\c:\1bthth.exec:\1bthth.exe99⤵PID:2348
-
\??\c:\hbthtb.exec:\hbthtb.exe100⤵PID:2100
-
\??\c:\pvvpv.exec:\pvvpv.exe101⤵PID:604
-
\??\c:\xrlflxl.exec:\xrlflxl.exe102⤵PID:768
-
\??\c:\hbbbtt.exec:\hbbbtt.exe103⤵PID:1772
-
\??\c:\nhhhtb.exec:\nhhhtb.exe104⤵PID:912
-
\??\c:\ddpvp.exec:\ddpvp.exe105⤵PID:1532
-
\??\c:\rrrxllx.exec:\rrrxllx.exe106⤵PID:2364
-
\??\c:\3ttbnt.exec:\3ttbnt.exe107⤵PID:2356
-
\??\c:\bbthbb.exec:\bbthbb.exe108⤵PID:1976
-
\??\c:\vvvdj.exec:\vvvdj.exe109⤵PID:872
-
\??\c:\fxlxrrl.exec:\fxlxrrl.exe110⤵PID:2352
-
\??\c:\ttnbtb.exec:\ttnbtb.exe111⤵PID:1716
-
\??\c:\pdddp.exec:\pdddp.exe112⤵PID:1720
-
\??\c:\lfxfxxr.exec:\lfxfxxr.exe113⤵PID:1728
-
\??\c:\9hbnbh.exec:\9hbnbh.exe114⤵PID:940
-
\??\c:\tttbnn.exec:\tttbnn.exe115⤵PID:996
-
\??\c:\vvvjj.exec:\vvvjj.exe116⤵PID:2284
-
\??\c:\flrfrrf.exec:\flrfrrf.exe117⤵PID:236
-
\??\c:\rrfrflx.exec:\rrfrflx.exe118⤵PID:2396
-
\??\c:\5nthth.exec:\5nthth.exe119⤵PID:2288
-
\??\c:\ppdjj.exec:\ppdjj.exe120⤵PID:1864
-
\??\c:\3lxxxlx.exec:\3lxxxlx.exe121⤵PID:1516
-
\??\c:\lflrlrx.exec:\lflrlrx.exe122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-