Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe
-
Size
454KB
-
MD5
1aabde183d6414432cb8c0cb4b271ce0
-
SHA1
7084df84d5faa5194d8edf460dea8f2040deeb37
-
SHA256
e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2
-
SHA512
6ee2c5c40f4f841615a7c14a6b328129cc883b5bb33c54d150666e0798ad7816a33f2bcdb33c579e4f06ff95878121647d69db92fd1f932e32f26788311ce424
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbea:q7Tc2NYHUrAwfMp3CDa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2636-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3052-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/856-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/332-385-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2212-405-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-558-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-622-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2676-623-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-636-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-850-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/3000-858-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1912-877-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2220 vjvdp.exe 2764 1rlrxfr.exe 2820 dvvdv.exe 2704 rrlflrf.exe 2816 hbhhnn.exe 2540 nhttnb.exe 2620 jdvdv.exe 3052 rlllxxf.exe 772 9hbtbh.exe 576 llffxxr.exe 2128 3bbbhn.exe 2228 7lllxfl.exe 1248 nhtbnb.exe 2808 rlxfrrx.exe 2800 htttht.exe 3008 xrrxflf.exe 1788 9hnntt.exe 1792 vpdjp.exe 2332 fxrxflx.exe 2224 pjddp.exe 2232 lrlxrrl.exe 2236 ffrfrrf.exe 1852 lrrfxfl.exe 1120 nhtbhb.exe 1244 vvppj.exe 1600 bbnnbh.exe 1532 ddvdd.exe 1688 rrxxxrf.exe 856 ttnthn.exe 1740 rlffxxl.exe 1712 ntbbnb.exe 704 1vjpv.exe 2468 llxrffr.exe 2280 bbnthh.exe 1548 9vddd.exe 2736 fxllxfl.exe 2764 fxlrffr.exe 2548 tthhnt.exe 2720 dvppv.exe 2816 frllrxr.exe 2572 rxxfxxl.exe 3044 nnbbnt.exe 2600 5jppp.exe 2592 lrxrxxl.exe 332 xlxfrlx.exe 640 btnthh.exe 2992 5vppj.exe 2212 3jvdp.exe 2640 xxrxllx.exe 2228 3btbbb.exe 2880 vpdjv.exe 1032 pjddd.exe 1780 frxxllr.exe 1916 hhbnbb.exe 2372 1dvvv.exe 2108 rlxrxrf.exe 1900 xrffrrf.exe 2004 nhbnbn.exe 2956 jjdjv.exe 2312 xfrxllr.exe 2132 lrlrlrf.exe 316 vvpvd.exe 1784 vpdpv.exe 408 1llfxrr.exe -
resource yara_rule behavioral1/memory/2636-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-405-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1912-877-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2664-947-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxflxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 2220 2636 e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe 30 PID 2636 wrote to memory of 2220 2636 e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe 30 PID 2636 wrote to memory of 2220 2636 e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe 30 PID 2636 wrote to memory of 2220 2636 e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe 30 PID 2220 wrote to memory of 2764 2220 vjvdp.exe 31 PID 2220 wrote to memory of 2764 2220 vjvdp.exe 31 PID 2220 wrote to memory of 2764 2220 vjvdp.exe 31 PID 2220 wrote to memory of 2764 2220 vjvdp.exe 31 PID 2764 wrote to memory of 2820 2764 1rlrxfr.exe 32 PID 2764 wrote to memory of 2820 2764 1rlrxfr.exe 32 PID 2764 wrote to memory of 2820 2764 1rlrxfr.exe 32 PID 2764 wrote to memory of 2820 2764 1rlrxfr.exe 32 PID 2820 wrote to memory of 2704 2820 dvvdv.exe 33 PID 2820 wrote to memory of 2704 2820 dvvdv.exe 33 PID 2820 wrote to memory of 2704 2820 dvvdv.exe 33 PID 2820 wrote to memory of 2704 2820 dvvdv.exe 33 PID 2704 wrote to memory of 2816 2704 rrlflrf.exe 34 PID 2704 wrote to memory of 2816 2704 rrlflrf.exe 34 PID 2704 wrote to memory of 2816 2704 rrlflrf.exe 34 PID 2704 wrote to memory of 2816 2704 rrlflrf.exe 34 PID 2816 wrote to memory of 2540 2816 hbhhnn.exe 35 PID 2816 wrote to memory of 2540 2816 hbhhnn.exe 35 PID 2816 wrote to memory of 2540 2816 hbhhnn.exe 35 PID 2816 wrote to memory of 2540 2816 hbhhnn.exe 35 PID 2540 wrote to memory of 2620 2540 nhttnb.exe 36 PID 2540 wrote to memory of 2620 2540 nhttnb.exe 36 PID 2540 wrote to memory of 2620 2540 nhttnb.exe 36 PID 2540 wrote to memory of 2620 2540 nhttnb.exe 36 PID 2620 wrote to memory of 3052 2620 jdvdv.exe 37 PID 2620 wrote to memory of 3052 2620 jdvdv.exe 37 PID 2620 wrote to memory of 3052 2620 jdvdv.exe 37 PID 2620 wrote to memory of 3052 2620 jdvdv.exe 37 PID 3052 wrote to memory of 772 3052 rlllxxf.exe 38 PID 3052 wrote to memory of 772 3052 rlllxxf.exe 38 PID 3052 wrote to memory of 772 3052 rlllxxf.exe 38 PID 3052 wrote to memory of 772 3052 rlllxxf.exe 38 PID 772 wrote to memory of 576 772 9hbtbh.exe 39 PID 772 wrote to memory of 576 772 9hbtbh.exe 39 PID 772 wrote to memory of 576 772 9hbtbh.exe 39 PID 772 wrote to memory of 576 772 9hbtbh.exe 39 PID 576 wrote to memory of 2128 576 llffxxr.exe 40 PID 576 wrote to memory of 2128 576 llffxxr.exe 40 PID 576 wrote to memory of 2128 576 llffxxr.exe 40 PID 576 wrote to memory of 2128 576 llffxxr.exe 40 PID 2128 wrote to memory of 2228 2128 3bbbhn.exe 41 PID 2128 wrote to memory of 2228 2128 3bbbhn.exe 41 PID 2128 wrote to memory of 2228 2128 3bbbhn.exe 41 PID 2128 wrote to memory of 2228 2128 3bbbhn.exe 41 PID 2228 wrote to memory of 1248 2228 7lllxfl.exe 42 PID 2228 wrote to memory of 1248 2228 7lllxfl.exe 42 PID 2228 wrote to memory of 1248 2228 7lllxfl.exe 42 PID 2228 wrote to memory of 1248 2228 7lllxfl.exe 42 PID 1248 wrote to memory of 2808 1248 nhtbnb.exe 43 PID 1248 wrote to memory of 2808 1248 nhtbnb.exe 43 PID 1248 wrote to memory of 2808 1248 nhtbnb.exe 43 PID 1248 wrote to memory of 2808 1248 nhtbnb.exe 43 PID 2808 wrote to memory of 2800 2808 rlxfrrx.exe 44 PID 2808 wrote to memory of 2800 2808 rlxfrrx.exe 44 PID 2808 wrote to memory of 2800 2808 rlxfrrx.exe 44 PID 2808 wrote to memory of 2800 2808 rlxfrrx.exe 44 PID 2800 wrote to memory of 3008 2800 htttht.exe 45 PID 2800 wrote to memory of 3008 2800 htttht.exe 45 PID 2800 wrote to memory of 3008 2800 htttht.exe 45 PID 2800 wrote to memory of 3008 2800 htttht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe"C:\Users\Admin\AppData\Local\Temp\e5b4502eb3ef3424e3e205fdc20ad42933b104a53073da1767981c84d11ad5a2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vjvdp.exec:\vjvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\1rlrxfr.exec:\1rlrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\dvvdv.exec:\dvvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\rrlflrf.exec:\rrlflrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\hbhhnn.exec:\hbhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\nhttnb.exec:\nhttnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\jdvdv.exec:\jdvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\rlllxxf.exec:\rlllxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\9hbtbh.exec:\9hbtbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\llffxxr.exec:\llffxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\3bbbhn.exec:\3bbbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\7lllxfl.exec:\7lllxfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\nhtbnb.exec:\nhtbnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\rlxfrrx.exec:\rlxfrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\htttht.exec:\htttht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xrrxflf.exec:\xrrxflf.exe17⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9hnntt.exec:\9hnntt.exe18⤵
- Executes dropped EXE
PID:1788 -
\??\c:\vpdjp.exec:\vpdjp.exe19⤵
- Executes dropped EXE
PID:1792 -
\??\c:\fxrxflx.exec:\fxrxflx.exe20⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pjddp.exec:\pjddp.exe21⤵
- Executes dropped EXE
PID:2224 -
\??\c:\lrlxrrl.exec:\lrlxrrl.exe22⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ffrfrrf.exec:\ffrfrrf.exe23⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lrrfxfl.exec:\lrrfxfl.exe24⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nhtbhb.exec:\nhtbhb.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\vvppj.exec:\vvppj.exe26⤵
- Executes dropped EXE
PID:1244 -
\??\c:\bbnnbh.exec:\bbnnbh.exe27⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ddvdd.exec:\ddvdd.exe28⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrxxxrf.exec:\rrxxxrf.exe29⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ttnthn.exec:\ttnthn.exe30⤵
- Executes dropped EXE
PID:856 -
\??\c:\rlffxxl.exec:\rlffxxl.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ntbbnb.exec:\ntbbnb.exe32⤵
- Executes dropped EXE
PID:1712 -
\??\c:\1vjpv.exec:\1vjpv.exe33⤵
- Executes dropped EXE
PID:704 -
\??\c:\llxrffr.exec:\llxrffr.exe34⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bbnthh.exec:\bbnthh.exe35⤵
- Executes dropped EXE
PID:2280 -
\??\c:\9vddd.exec:\9vddd.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\fxllxfl.exec:\fxllxfl.exe37⤵
- Executes dropped EXE
PID:2736 -
\??\c:\fxlrffr.exec:\fxlrffr.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tthhnt.exec:\tthhnt.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\dvppv.exec:\dvppv.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\frllrxr.exec:\frllrxr.exe41⤵
- Executes dropped EXE
PID:2816 -
\??\c:\rxxfxxl.exec:\rxxfxxl.exe42⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nnbbnt.exec:\nnbbnt.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\5jppp.exec:\5jppp.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\lrxrxxl.exec:\lrxrxxl.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xlxfrlx.exec:\xlxfrlx.exe46⤵
- Executes dropped EXE
PID:332 -
\??\c:\btnthh.exec:\btnthh.exe47⤵
- Executes dropped EXE
PID:640 -
\??\c:\5vppj.exec:\5vppj.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\3jvdp.exec:\3jvdp.exe49⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xxrxllx.exec:\xxrxllx.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\3btbbb.exec:\3btbbb.exe51⤵
- Executes dropped EXE
PID:2228 -
\??\c:\vpdjv.exec:\vpdjv.exe52⤵
- Executes dropped EXE
PID:2880 -
\??\c:\pjddd.exec:\pjddd.exe53⤵
- Executes dropped EXE
PID:1032 -
\??\c:\frxxllr.exec:\frxxllr.exe54⤵
- Executes dropped EXE
PID:1780 -
\??\c:\hhbnbb.exec:\hhbnbb.exe55⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1dvvv.exec:\1dvvv.exe56⤵
- Executes dropped EXE
PID:2372 -
\??\c:\rlxrxrf.exec:\rlxrxrf.exe57⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xrffrrf.exec:\xrffrrf.exe58⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nhbnbn.exec:\nhbnbn.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jjdjv.exec:\jjdjv.exe60⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xfrxllr.exec:\xfrxllr.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lrlrlrf.exec:\lrlrlrf.exe62⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvpvd.exec:\vvpvd.exe63⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpdpv.exec:\vpdpv.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\1llfxrr.exec:\1llfxrr.exe65⤵
- Executes dropped EXE
PID:408 -
\??\c:\fxllffr.exec:\fxllffr.exe66⤵PID:1092
-
\??\c:\1tbhnt.exec:\1tbhnt.exe67⤵PID:1040
-
\??\c:\9vdvj.exec:\9vdvj.exe68⤵PID:1268
-
\??\c:\rrrxllf.exec:\rrrxllf.exe69⤵PID:1752
-
\??\c:\xrllxxx.exec:\xrllxxx.exe70⤵PID:1716
-
\??\c:\ttnhnn.exec:\ttnhnn.exe71⤵PID:1304
-
\??\c:\dvjpv.exec:\dvjpv.exe72⤵PID:604
-
\??\c:\5pvvv.exec:\5pvvv.exe73⤵PID:1956
-
\??\c:\xrflffr.exec:\xrflffr.exe74⤵PID:2520
-
\??\c:\hbtbtn.exec:\hbtbtn.exe75⤵PID:2336
-
\??\c:\btthnh.exec:\btthnh.exe76⤵PID:1508
-
\??\c:\dvpvj.exec:\dvpvj.exe77⤵PID:872
-
\??\c:\xrlrlrl.exec:\xrlrlrl.exe78⤵PID:2296
-
\??\c:\xlrrllr.exec:\xlrrllr.exe79⤵PID:2684
-
\??\c:\bthhnn.exec:\bthhnn.exe80⤵PID:1584
-
\??\c:\7vddj.exec:\7vddj.exe81⤵PID:2752
-
\??\c:\rlflrxl.exec:\rlflrxl.exe82⤵PID:2676
-
\??\c:\3ntttt.exec:\3ntttt.exe83⤵PID:2568
-
\??\c:\btnnhn.exec:\btnnhn.exe84⤵
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\3pjdd.exec:\3pjdd.exe85⤵PID:2560
-
\??\c:\ffrxrrf.exec:\ffrxrrf.exe86⤵PID:2540
-
\??\c:\rrllxxl.exec:\rrllxxl.exe87⤵PID:2836
-
\??\c:\bhhhth.exec:\bhhhth.exe88⤵PID:2028
-
\??\c:\dvpvd.exec:\dvpvd.exe89⤵PID:2804
-
\??\c:\pjvjp.exec:\pjvjp.exe90⤵PID:568
-
\??\c:\xlxfllx.exec:\xlxfllx.exe91⤵PID:2092
-
\??\c:\btnnbb.exec:\btnnbb.exe92⤵PID:3060
-
\??\c:\5pjpv.exec:\5pjpv.exe93⤵PID:2436
-
\??\c:\ddvdd.exec:\ddvdd.exe94⤵PID:2856
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe95⤵PID:2612
-
\??\c:\7bnthh.exec:\7bnthh.exe96⤵PID:2864
-
\??\c:\3hbhnn.exec:\3hbhnn.exe97⤵PID:556
-
\??\c:\vpdpj.exec:\vpdpj.exe98⤵PID:3024
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe99⤵PID:2800
-
\??\c:\fxxlxfr.exec:\fxxlxfr.exe100⤵
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\nhhthn.exec:\nhhthn.exe101⤵PID:1760
-
\??\c:\dvppd.exec:\dvppd.exe102⤵PID:1792
-
\??\c:\jdvdp.exec:\jdvdp.exe103⤵PID:2320
-
\??\c:\rfxxrxl.exec:\rfxxrxl.exe104⤵PID:1292
-
\??\c:\9btnbb.exec:\9btnbb.exe105⤵PID:2164
-
\??\c:\ddpjp.exec:\ddpjp.exe106⤵PID:2140
-
\??\c:\jjjdd.exec:\jjjdd.exe107⤵PID:544
-
\??\c:\llxrlrf.exec:\llxrlrf.exe108⤵PID:748
-
\??\c:\rrllxxl.exec:\rrllxxl.exe109⤵PID:1852
-
\??\c:\htbtnh.exec:\htbtnh.exe110⤵PID:2444
-
\??\c:\jdjpv.exec:\jdjpv.exe111⤵PID:1368
-
\??\c:\3rxxfll.exec:\3rxxfll.exe112⤵PID:976
-
\??\c:\llxxlll.exec:\llxxlll.exe113⤵PID:1268
-
\??\c:\hhhnbh.exec:\hhhnbh.exe114⤵PID:2180
-
\??\c:\jjdpj.exec:\jjdpj.exe115⤵PID:2380
-
\??\c:\pjdjv.exec:\pjdjv.exe116⤵PID:888
-
\??\c:\xxrxflr.exec:\xxrxflr.exe117⤵PID:604
-
\??\c:\nnnnhh.exec:\nnnnhh.exe118⤵PID:3000
-
\??\c:\tbnttb.exec:\tbnttb.exe119⤵PID:288
-
\??\c:\jdppd.exec:\jdppd.exe120⤵PID:2336
-
\??\c:\rlflrrx.exec:\rlflrrx.exe121⤵PID:1912
-
\??\c:\rfxrxff.exec:\rfxrxff.exe122⤵PID:2468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-