Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe
-
Size
455KB
-
MD5
9857eaa42568b103d9f86b1554071cf8
-
SHA1
dd899c3b8e798fe17ad1d38cb81bdde486829503
-
SHA256
c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc
-
SHA512
d7ee82c6d64a2f4fb531e87c419f68ae90fc3942ae640b807f30df6677b5ddb96ebf481bde64c863920d408d0bb8ca19a1a8429f555fb0c8283b2a8434b57969
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR4:q7Tc2NYHUrAwfMp3CDR4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2148-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1344-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-149-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-434-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2388-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-564-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1748-766-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1248-1042-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-1145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2464-1158-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2172-806-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-789-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/468-776-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-611-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2552-599-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-576-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1784-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1140-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2148 hhhbtb.exe 2688 dddpd.exe 2568 fxxlxxx.exe 2700 vpddj.exe 2820 rlxrfxl.exe 2724 bnbnbh.exe 2516 7pvvv.exe 2356 xrlffxl.exe 536 5bbbhn.exe 272 pjvdp.exe 884 llxfllr.exe 2892 5llxflf.exe 2968 3dvdj.exe 2004 xlflxxx.exe 1728 7xxfrff.exe 1856 nhhhtt.exe 1780 llllflx.exe 1476 3hhtht.exe 2124 jdvvd.exe 2056 3flfrfr.exe 2104 ntnbtb.exe 2856 vvpvd.exe 2292 rxrxflf.exe 1140 ffxlfxr.exe 2220 dvpdj.exe 920 rrfxlxl.exe 2824 jjjvj.exe 1932 vjdpj.exe 2384 bhhtnn.exe 1888 9vvdv.exe 772 ffffxfr.exe 1344 thbthh.exe 3064 ddpdj.exe 2732 rfxfxlf.exe 2696 7nbthh.exe 2612 7vppp.exe 2648 lffxfxf.exe 2596 lxflrlr.exe 2456 1tntbt.exe 2500 vddjd.exe 2532 lxffllr.exe 2940 7xrrxfl.exe 600 bnbbnh.exe 536 vdddv.exe 1296 dpddp.exe 2016 ffrxlrf.exe 2972 nbnhnn.exe 1568 bthnbb.exe 2976 vpddp.exe 2020 7ppdp.exe 1540 ffxfxfx.exe 1940 btnnbh.exe 1724 1nbhnt.exe 1996 dvvdj.exe 712 dvpvj.exe 380 ffxxxfr.exe 1580 5nbbhn.exe 1960 thhhbh.exe 468 vvjjp.exe 2440 lllrflr.exe 2864 llfflrx.exe 1172 7tntnt.exe 1752 pdvpv.exe 1168 9jvpd.exe -
resource yara_rule behavioral1/memory/2148-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1344-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-1145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/280-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-1057-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1588-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/468-776-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-599-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1140-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-57-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7flffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1344 wrote to memory of 2148 1344 c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe 233 PID 1344 wrote to memory of 2148 1344 c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe 233 PID 1344 wrote to memory of 2148 1344 c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe 233 PID 1344 wrote to memory of 2148 1344 c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe 233 PID 2148 wrote to memory of 2688 2148 hhhbtb.exe 149 PID 2148 wrote to memory of 2688 2148 hhhbtb.exe 149 PID 2148 wrote to memory of 2688 2148 hhhbtb.exe 149 PID 2148 wrote to memory of 2688 2148 hhhbtb.exe 149 PID 2688 wrote to memory of 2568 2688 dddpd.exe 191 PID 2688 wrote to memory of 2568 2688 dddpd.exe 191 PID 2688 wrote to memory of 2568 2688 dddpd.exe 191 PID 2688 wrote to memory of 2568 2688 dddpd.exe 191 PID 2568 wrote to memory of 2700 2568 fxxlxxx.exe 31 PID 2568 wrote to memory of 2700 2568 fxxlxxx.exe 31 PID 2568 wrote to memory of 2700 2568 fxxlxxx.exe 31 PID 2568 wrote to memory of 2700 2568 fxxlxxx.exe 31 PID 2700 wrote to memory of 2820 2700 vpddj.exe 32 PID 2700 wrote to memory of 2820 2700 vpddj.exe 32 PID 2700 wrote to memory of 2820 2700 vpddj.exe 32 PID 2700 wrote to memory of 2820 2700 vpddj.exe 32 PID 2820 wrote to memory of 2724 2820 rlxrfxl.exe 33 PID 2820 wrote to memory of 2724 2820 rlxrfxl.exe 33 PID 2820 wrote to memory of 2724 2820 rlxrfxl.exe 33 PID 2820 wrote to memory of 2724 2820 rlxrfxl.exe 33 PID 2724 wrote to memory of 2516 2724 bnbnbh.exe 34 PID 2724 wrote to memory of 2516 2724 bnbnbh.exe 34 PID 2724 wrote to memory of 2516 2724 bnbnbh.exe 34 PID 2724 wrote to memory of 2516 2724 bnbnbh.exe 34 PID 2516 wrote to memory of 2356 2516 7pvvv.exe 35 PID 2516 wrote to memory of 2356 2516 7pvvv.exe 35 PID 2516 wrote to memory of 2356 2516 7pvvv.exe 35 PID 2516 wrote to memory of 2356 2516 7pvvv.exe 35 PID 2356 wrote to memory of 536 2356 xrlffxl.exe 36 PID 2356 wrote to memory of 536 2356 xrlffxl.exe 36 PID 2356 wrote to memory of 536 2356 xrlffxl.exe 36 PID 2356 wrote to memory of 536 2356 xrlffxl.exe 36 PID 536 wrote to memory of 272 536 5bbbhn.exe 37 PID 536 wrote to memory of 272 536 5bbbhn.exe 37 PID 536 wrote to memory of 272 536 5bbbhn.exe 37 PID 536 wrote to memory of 272 536 5bbbhn.exe 37 PID 272 wrote to memory of 884 272 pjvdp.exe 38 PID 272 wrote to memory of 884 272 pjvdp.exe 38 PID 272 wrote to memory of 884 272 pjvdp.exe 38 PID 272 wrote to memory of 884 272 pjvdp.exe 38 PID 884 wrote to memory of 2892 884 llxfllr.exe 39 PID 884 wrote to memory of 2892 884 llxfllr.exe 39 PID 884 wrote to memory of 2892 884 llxfllr.exe 39 PID 884 wrote to memory of 2892 884 llxfllr.exe 39 PID 2892 wrote to memory of 2968 2892 5llxflf.exe 40 PID 2892 wrote to memory of 2968 2892 5llxflf.exe 40 PID 2892 wrote to memory of 2968 2892 5llxflf.exe 40 PID 2892 wrote to memory of 2968 2892 5llxflf.exe 40 PID 2968 wrote to memory of 2004 2968 3dvdj.exe 41 PID 2968 wrote to memory of 2004 2968 3dvdj.exe 41 PID 2968 wrote to memory of 2004 2968 3dvdj.exe 41 PID 2968 wrote to memory of 2004 2968 3dvdj.exe 41 PID 2004 wrote to memory of 1728 2004 xlflxxx.exe 42 PID 2004 wrote to memory of 1728 2004 xlflxxx.exe 42 PID 2004 wrote to memory of 1728 2004 xlflxxx.exe 42 PID 2004 wrote to memory of 1728 2004 xlflxxx.exe 42 PID 1728 wrote to memory of 1856 1728 7xxfrff.exe 43 PID 1728 wrote to memory of 1856 1728 7xxfrff.exe 43 PID 1728 wrote to memory of 1856 1728 7xxfrff.exe 43 PID 1728 wrote to memory of 1856 1728 7xxfrff.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe"C:\Users\Admin\AppData\Local\Temp\c13fc9f11a5f4ddaddd9b326a4f2dbf8f3ee17cd1dbb3aa1feb25158fe6f59cc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\hhhbtb.exec:\hhhbtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dddpd.exec:\dddpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fxxlxxx.exec:\fxxlxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\vpddj.exec:\vpddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rlxrfxl.exec:\rlxrfxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\bnbnbh.exec:\bnbnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\7pvvv.exec:\7pvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\xrlffxl.exec:\xrlffxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\5bbbhn.exec:\5bbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\pjvdp.exec:\pjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\llxfllr.exec:\llxfllr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\5llxflf.exec:\5llxflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\3dvdj.exec:\3dvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xlflxxx.exec:\xlflxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\7xxfrff.exec:\7xxfrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\nhhhtt.exec:\nhhhtt.exe17⤵
- Executes dropped EXE
PID:1856 -
\??\c:\llllflx.exec:\llllflx.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3hhtht.exec:\3hhtht.exe19⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jdvvd.exec:\jdvvd.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3flfrfr.exec:\3flfrfr.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ntnbtb.exec:\ntnbtb.exe22⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vvpvd.exec:\vvpvd.exe23⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rxrxflf.exec:\rxrxflf.exe24⤵
- Executes dropped EXE
PID:2292 -
\??\c:\ffxlfxr.exec:\ffxlfxr.exe25⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dvpdj.exec:\dvpdj.exe26⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrfxlxl.exec:\rrfxlxl.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:920 -
\??\c:\jjjvj.exec:\jjjvj.exe28⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vjdpj.exec:\vjdpj.exe29⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bhhtnn.exec:\bhhtnn.exe30⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9vvdv.exec:\9vvdv.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\ffffxfr.exec:\ffffxfr.exe32⤵
- Executes dropped EXE
PID:772 -
\??\c:\thbthh.exec:\thbthh.exe33⤵
- Executes dropped EXE
PID:1344 -
\??\c:\ddpdj.exec:\ddpdj.exe34⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rfxfxlf.exec:\rfxfxlf.exe35⤵
- Executes dropped EXE
PID:2732 -
\??\c:\7nbthh.exec:\7nbthh.exe36⤵
- Executes dropped EXE
PID:2696 -
\??\c:\7vppp.exec:\7vppp.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lffxfxf.exec:\lffxfxf.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lxflrlr.exec:\lxflrlr.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1tntbt.exec:\1tntbt.exe40⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vddjd.exec:\vddjd.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lxffllr.exec:\lxffllr.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7xrrxfl.exec:\7xrrxfl.exe43⤵
- Executes dropped EXE
PID:2940 -
\??\c:\bnbbnh.exec:\bnbbnh.exe44⤵
- Executes dropped EXE
PID:600 -
\??\c:\vdddv.exec:\vdddv.exe45⤵
- Executes dropped EXE
PID:536 -
\??\c:\dpddp.exec:\dpddp.exe46⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ffrxlrf.exec:\ffrxlrf.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbnhnn.exec:\nbnhnn.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bthnbb.exec:\bthnbb.exe49⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vpddp.exec:\vpddp.exe50⤵
- Executes dropped EXE
PID:2976 -
\??\c:\7ppdp.exec:\7ppdp.exe51⤵
- Executes dropped EXE
PID:2020 -
\??\c:\ffxfxfx.exec:\ffxfxfx.exe52⤵
- Executes dropped EXE
PID:1540 -
\??\c:\btnnbh.exec:\btnnbh.exe53⤵
- Executes dropped EXE
PID:1940 -
\??\c:\1nbhnt.exec:\1nbhnt.exe54⤵
- Executes dropped EXE
PID:1724 -
\??\c:\dvvdj.exec:\dvvdj.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\dvpvj.exec:\dvpvj.exe56⤵
- Executes dropped EXE
PID:712 -
\??\c:\ffxxxfr.exec:\ffxxxfr.exe57⤵
- Executes dropped EXE
PID:380 -
\??\c:\5nbbhn.exec:\5nbbhn.exe58⤵
- Executes dropped EXE
PID:1580 -
\??\c:\thhhbh.exec:\thhhbh.exe59⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vvjjp.exec:\vvjjp.exe60⤵
- Executes dropped EXE
PID:468 -
\??\c:\lllrflr.exec:\lllrflr.exe61⤵
- Executes dropped EXE
PID:2440 -
\??\c:\llfflrx.exec:\llfflrx.exe62⤵
- Executes dropped EXE
PID:2864 -
\??\c:\7tntnt.exec:\7tntnt.exe63⤵
- Executes dropped EXE
PID:1172 -
\??\c:\pdvpv.exec:\pdvpv.exe64⤵
- Executes dropped EXE
PID:1752 -
\??\c:\9jvpd.exec:\9jvpd.exe65⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rrfrxlr.exec:\rrfrxlr.exe66⤵PID:1852
-
\??\c:\thtttt.exec:\thtttt.exe67⤵PID:2388
-
\??\c:\7pdpj.exec:\7pdpj.exe68⤵PID:1784
-
\??\c:\djppj.exec:\djppj.exe69⤵PID:788
-
\??\c:\rlffxfr.exec:\rlffxfr.exe70⤵PID:2816
-
\??\c:\hnhthh.exec:\hnhthh.exe71⤵PID:2240
-
\??\c:\ttnbnt.exec:\ttnbnt.exe72⤵PID:1488
-
\??\c:\vjjvp.exec:\vjjvp.exe73⤵PID:2260
-
\??\c:\rfllrrx.exec:\rfllrrx.exe74⤵PID:2396
-
\??\c:\hhhnhn.exec:\hhhnhn.exe75⤵PID:1740
-
\??\c:\1bnntt.exec:\1bnntt.exe76⤵PID:2552
-
\??\c:\5pppv.exec:\5pppv.exe77⤵PID:3060
-
\??\c:\xlxfffr.exec:\xlxfffr.exe78⤵PID:2732
-
\??\c:\hhthtt.exec:\hhthtt.exe79⤵PID:2752
-
\??\c:\nbnbhh.exec:\nbnbhh.exe80⤵PID:2912
-
\??\c:\1pjjj.exec:\1pjjj.exe81⤵PID:2664
-
\??\c:\9xrrlxf.exec:\9xrrlxf.exe82⤵PID:2504
-
\??\c:\hbtbhh.exec:\hbtbhh.exe83⤵PID:2484
-
\??\c:\9ttnhh.exec:\9ttnhh.exe84⤵PID:2624
-
\??\c:\pvjvd.exec:\pvjvd.exe85⤵PID:3040
-
\??\c:\pjjjj.exec:\pjjjj.exe86⤵PID:264
-
\??\c:\rrflxxl.exec:\rrflxxl.exe87⤵PID:1900
-
\??\c:\bbthbh.exec:\bbthbh.exe88⤵PID:1572
-
\??\c:\bhnbht.exec:\bhnbht.exe89⤵PID:2804
-
\??\c:\pvjvj.exec:\pvjvj.exe90⤵PID:1868
-
\??\c:\jdppd.exec:\jdppd.exe91⤵PID:2960
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe92⤵PID:2168
-
\??\c:\5bhtnb.exec:\5bhtnb.exe93⤵PID:2712
-
\??\c:\tnnthh.exec:\tnnthh.exe94⤵PID:2976
-
\??\c:\9pjdp.exec:\9pjdp.exe95⤵PID:2020
-
\??\c:\jjjpj.exec:\jjjpj.exe96⤵PID:2744
-
\??\c:\xlrfrxl.exec:\xlrfrxl.exe97⤵PID:2740
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe98⤵PID:1712
-
\??\c:\tthhht.exec:\tthhht.exe99⤵PID:1996
-
\??\c:\ddvjd.exec:\ddvjd.exe100⤵PID:1848
-
\??\c:\jdjjv.exec:\jdjjv.exe101⤵PID:2528
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe102⤵PID:2056
-
\??\c:\bthbbb.exec:\bthbbb.exe103⤵PID:1960
-
\??\c:\7tbhbb.exec:\7tbhbb.exe104⤵PID:468
-
\??\c:\djdpj.exec:\djdpj.exe105⤵PID:1748
-
\??\c:\dddpd.exec:\dddpd.exe106⤵PID:2864
-
\??\c:\rlrlllr.exec:\rlrlllr.exe107⤵PID:1136
-
\??\c:\bntbtn.exec:\bntbtn.exe108⤵PID:1200
-
\??\c:\3nnnnh.exec:\3nnnnh.exe109⤵PID:1936
-
\??\c:\vddpj.exec:\vddpj.exe110⤵PID:1512
-
\??\c:\rllrfxl.exec:\rllrfxl.exe111⤵PID:2172
-
\??\c:\7lfxrxl.exec:\7lfxrxl.exe112⤵PID:1784
-
\??\c:\btnbhn.exec:\btnbhn.exe113⤵PID:2380
-
\??\c:\9vddv.exec:\9vddv.exe114⤵PID:1564
-
\??\c:\pjdjv.exec:\pjdjv.exe115⤵PID:900
-
\??\c:\fxfflfl.exec:\fxfflfl.exe116⤵PID:1920
-
\??\c:\fxffllx.exec:\fxffllx.exe117⤵PID:772
-
\??\c:\nhnnhh.exec:\nhnnhh.exe118⤵PID:1528
-
\??\c:\ttnntb.exec:\ttnntb.exe119⤵PID:3024
-
\??\c:\pjdjj.exec:\pjdjj.exe120⤵PID:2188
-
\??\c:\lxllrfl.exec:\lxllrfl.exe121⤵PID:2608
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-