Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe
-
Size
453KB
-
MD5
826da557ee188a7d9dd44b7cef36d42f
-
SHA1
210866eac5ebf2569c6e403484f990f8b17ef7aa
-
SHA256
2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2
-
SHA512
236dd1be386fb737724d4f7fda08866c2138a014a8978ce7b972659bea581f9057978158ae452d653171c658975da080b719e2044edfbe7e130fa6552d6c8285
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2692-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1632-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2540-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-144-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1964-136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2188-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-269-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1524-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-462-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/844-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-517-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/2808-539-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-603-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-635-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-729-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1852-734-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2356-524-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/844-483-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2096-370-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2016-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-231-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-844-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1844-886-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 pjvdj.exe 2364 dpdvp.exe 2736 7xflxrf.exe 1632 nhbtbb.exe 2540 9vvvd.exe 1724 hbnnnn.exe 1612 btbhtt.exe 1700 vjdjv.exe 2584 3rxlllf.exe 1964 tnhhth.exe 2888 vvjjp.exe 2924 frrxxxf.exe 2896 tnbhth.exe 2916 9pjdj.exe 2944 rfrrrxf.exe 544 ffrrxfl.exe 2188 tntttt.exe 2232 xlrxffx.exe 2216 nbtntt.exe 1320 5nbthh.exe 1144 5lrxxxf.exe 988 fxlrfll.exe 2516 tnhtbb.exe 1916 vjjpp.exe 2624 1rfxfxl.exe 2496 nbhbhh.exe 1572 1dvjv.exe 880 llllxff.exe 2164 pjvdp.exe 1524 9xrflrf.exe 2552 fxrflrf.exe 552 7tnbht.exe 2708 vdpdd.exe 2952 rfrrxfl.exe 2576 9ththn.exe 2596 5dpvj.exe 1724 fxlrxxf.exe 2016 fxlfrrf.exe 1404 ththtb.exe 1664 jvjjj.exe 2096 ddpdj.exe 1356 rlflrxr.exe 528 hhtbnt.exe 472 hhtthh.exe 2924 ppddv.exe 2984 xrflrrf.exe 2988 llflrxr.exe 2864 ttbtbb.exe 1784 jdvdj.exe 2036 vppvd.exe 3036 7frrrrx.exe 1216 nhtbbh.exe 2420 hhbhbh.exe 2220 dvjpv.exe 2480 rlxlxfx.exe 2028 lfrlrxl.exe 1324 tnthnt.exe 844 dpddp.exe 2132 dvjjd.exe 1688 3lfflxf.exe 1788 fxlrrrf.exe 2624 nnhhtn.exe 1000 jjjdj.exe 2356 dvpvj.exe -
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1632-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2624-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-539-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-603-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-319-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2496-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-860-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-887-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-939-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2768 2692 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 31 PID 2692 wrote to memory of 2768 2692 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 31 PID 2692 wrote to memory of 2768 2692 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 31 PID 2692 wrote to memory of 2768 2692 2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe 31 PID 2768 wrote to memory of 2364 2768 pjvdj.exe 32 PID 2768 wrote to memory of 2364 2768 pjvdj.exe 32 PID 2768 wrote to memory of 2364 2768 pjvdj.exe 32 PID 2768 wrote to memory of 2364 2768 pjvdj.exe 32 PID 2364 wrote to memory of 2736 2364 dpdvp.exe 33 PID 2364 wrote to memory of 2736 2364 dpdvp.exe 33 PID 2364 wrote to memory of 2736 2364 dpdvp.exe 33 PID 2364 wrote to memory of 2736 2364 dpdvp.exe 33 PID 2736 wrote to memory of 1632 2736 7xflxrf.exe 34 PID 2736 wrote to memory of 1632 2736 7xflxrf.exe 34 PID 2736 wrote to memory of 1632 2736 7xflxrf.exe 34 PID 2736 wrote to memory of 1632 2736 7xflxrf.exe 34 PID 1632 wrote to memory of 2540 1632 nhbtbb.exe 35 PID 1632 wrote to memory of 2540 1632 nhbtbb.exe 35 PID 1632 wrote to memory of 2540 1632 nhbtbb.exe 35 PID 1632 wrote to memory of 2540 1632 nhbtbb.exe 35 PID 2540 wrote to memory of 1724 2540 9vvvd.exe 67 PID 2540 wrote to memory of 1724 2540 9vvvd.exe 67 PID 2540 wrote to memory of 1724 2540 9vvvd.exe 67 PID 2540 wrote to memory of 1724 2540 9vvvd.exe 67 PID 1724 wrote to memory of 1612 1724 hbnnnn.exe 37 PID 1724 wrote to memory of 1612 1724 hbnnnn.exe 37 PID 1724 wrote to memory of 1612 1724 hbnnnn.exe 37 PID 1724 wrote to memory of 1612 1724 hbnnnn.exe 37 PID 1612 wrote to memory of 1700 1612 btbhtt.exe 38 PID 1612 wrote to memory of 1700 1612 btbhtt.exe 38 PID 1612 wrote to memory of 1700 1612 btbhtt.exe 38 PID 1612 wrote to memory of 1700 1612 btbhtt.exe 38 PID 1700 wrote to memory of 2584 1700 vjdjv.exe 39 PID 1700 wrote to memory of 2584 1700 vjdjv.exe 39 PID 1700 wrote to memory of 2584 1700 vjdjv.exe 39 PID 1700 wrote to memory of 2584 1700 vjdjv.exe 39 PID 2584 wrote to memory of 1964 2584 3rxlllf.exe 40 PID 2584 wrote to memory of 1964 2584 3rxlllf.exe 40 PID 2584 wrote to memory of 1964 2584 3rxlllf.exe 40 PID 2584 wrote to memory of 1964 2584 3rxlllf.exe 40 PID 1964 wrote to memory of 2888 1964 tnhhth.exe 41 PID 1964 wrote to memory of 2888 1964 tnhhth.exe 41 PID 1964 wrote to memory of 2888 1964 tnhhth.exe 41 PID 1964 wrote to memory of 2888 1964 tnhhth.exe 41 PID 2888 wrote to memory of 2924 2888 vvjjp.exe 42 PID 2888 wrote to memory of 2924 2888 vvjjp.exe 42 PID 2888 wrote to memory of 2924 2888 vvjjp.exe 42 PID 2888 wrote to memory of 2924 2888 vvjjp.exe 42 PID 2924 wrote to memory of 2896 2924 frrxxxf.exe 43 PID 2924 wrote to memory of 2896 2924 frrxxxf.exe 43 PID 2924 wrote to memory of 2896 2924 frrxxxf.exe 43 PID 2924 wrote to memory of 2896 2924 frrxxxf.exe 43 PID 2896 wrote to memory of 2916 2896 tnbhth.exe 44 PID 2896 wrote to memory of 2916 2896 tnbhth.exe 44 PID 2896 wrote to memory of 2916 2896 tnbhth.exe 44 PID 2896 wrote to memory of 2916 2896 tnbhth.exe 44 PID 2916 wrote to memory of 2944 2916 9pjdj.exe 45 PID 2916 wrote to memory of 2944 2916 9pjdj.exe 45 PID 2916 wrote to memory of 2944 2916 9pjdj.exe 45 PID 2916 wrote to memory of 2944 2916 9pjdj.exe 45 PID 2944 wrote to memory of 544 2944 rfrrrxf.exe 46 PID 2944 wrote to memory of 544 2944 rfrrrxf.exe 46 PID 2944 wrote to memory of 544 2944 rfrrrxf.exe 46 PID 2944 wrote to memory of 544 2944 rfrrrxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe"C:\Users\Admin\AppData\Local\Temp\2138cb5347bb09a628385296eb214592c6aa07b17ed19d75cce6e3f9cf4318d2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\pjvdj.exec:\pjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\dpdvp.exec:\dpdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\7xflxrf.exec:\7xflxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nhbtbb.exec:\nhbtbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\9vvvd.exec:\9vvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hbnnnn.exec:\hbnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\btbhtt.exec:\btbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\vjdjv.exec:\vjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\3rxlllf.exec:\3rxlllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tnhhth.exec:\tnhhth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\vvjjp.exec:\vvjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\frrxxxf.exec:\frrxxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\tnbhth.exec:\tnbhth.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\9pjdj.exec:\9pjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\rfrrrxf.exec:\rfrrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\ffrrxfl.exec:\ffrrxfl.exe17⤵
- Executes dropped EXE
PID:544 -
\??\c:\tntttt.exec:\tntttt.exe18⤵
- Executes dropped EXE
PID:2188 -
\??\c:\xlrxffx.exec:\xlrxffx.exe19⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nbtntt.exec:\nbtntt.exe20⤵
- Executes dropped EXE
PID:2216 -
\??\c:\5nbthh.exec:\5nbthh.exe21⤵
- Executes dropped EXE
PID:1320 -
\??\c:\5lrxxxf.exec:\5lrxxxf.exe22⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fxlrfll.exec:\fxlrfll.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\tnhtbb.exec:\tnhtbb.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vjjpp.exec:\vjjpp.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\1rfxfxl.exec:\1rfxfxl.exe26⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbhbhh.exec:\nbhbhh.exe27⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1dvjv.exec:\1dvjv.exe28⤵
- Executes dropped EXE
PID:1572 -
\??\c:\llllxff.exec:\llllxff.exe29⤵
- Executes dropped EXE
PID:880 -
\??\c:\pjvdp.exec:\pjvdp.exe30⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9xrflrf.exec:\9xrflrf.exe31⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxrflrf.exec:\fxrflrf.exe32⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7tnbht.exec:\7tnbht.exe33⤵
- Executes dropped EXE
PID:552 -
\??\c:\vdpdd.exec:\vdpdd.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe35⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9ththn.exec:\9ththn.exe36⤵
- Executes dropped EXE
PID:2576 -
\??\c:\5dpvj.exec:\5dpvj.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe38⤵
- Executes dropped EXE
PID:1724 -
\??\c:\fxlfrrf.exec:\fxlfrrf.exe39⤵
- Executes dropped EXE
PID:2016 -
\??\c:\ththtb.exec:\ththtb.exe40⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jvjjj.exec:\jvjjj.exe41⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ddpdj.exec:\ddpdj.exe42⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rlflrxr.exec:\rlflrxr.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1356 -
\??\c:\hhtbnt.exec:\hhtbnt.exe44⤵
- Executes dropped EXE
PID:528 -
\??\c:\hhtthh.exec:\hhtthh.exe45⤵
- Executes dropped EXE
PID:472 -
\??\c:\ppddv.exec:\ppddv.exe46⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xrflrrf.exec:\xrflrrf.exe47⤵
- Executes dropped EXE
PID:2984 -
\??\c:\llflrxr.exec:\llflrxr.exe48⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ttbtbb.exec:\ttbtbb.exe49⤵
- Executes dropped EXE
PID:2864 -
\??\c:\jdvdj.exec:\jdvdj.exe50⤵
- Executes dropped EXE
PID:1784 -
\??\c:\vppvd.exec:\vppvd.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\7frrrrx.exec:\7frrrrx.exe52⤵
- Executes dropped EXE
PID:3036 -
\??\c:\nhtbbh.exec:\nhtbbh.exe53⤵
- Executes dropped EXE
PID:1216 -
\??\c:\hhbhbh.exec:\hhbhbh.exe54⤵
- Executes dropped EXE
PID:2420 -
\??\c:\dvjpv.exec:\dvjpv.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rlxlxfx.exec:\rlxlxfx.exe56⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lfrlrxl.exec:\lfrlrxl.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\tnthnt.exec:\tnthnt.exe58⤵
- Executes dropped EXE
PID:1324 -
\??\c:\dpddp.exec:\dpddp.exe59⤵
- Executes dropped EXE
PID:844 -
\??\c:\dvjjd.exec:\dvjjd.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3lfflxf.exec:\3lfflxf.exe61⤵
- Executes dropped EXE
PID:1688 -
\??\c:\fxlrrrf.exec:\fxlrrrf.exe62⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nnhhtn.exec:\nnhhtn.exe63⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jjjdj.exec:\jjjdj.exe64⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dvpvj.exec:\dvpvj.exe65⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rrxfxfl.exec:\rrxfxfl.exe66⤵PID:1188
-
\??\c:\1nnnnh.exec:\1nnnnh.exe67⤵PID:2808
-
\??\c:\hhhhnt.exec:\hhhhnt.exe68⤵PID:328
-
\??\c:\jjdjv.exec:\jjdjv.exe69⤵PID:1436
-
\??\c:\xrffflx.exec:\xrffflx.exe70⤵PID:2976
-
\??\c:\fxlxfxf.exec:\fxlxfxf.exe71⤵PID:2736
-
\??\c:\tnhthn.exec:\tnhthn.exe72⤵PID:2600
-
\??\c:\ddvvp.exec:\ddvvp.exe73⤵PID:2564
-
\??\c:\vvjjv.exec:\vvjjv.exe74⤵PID:348
-
\??\c:\xlxxllr.exec:\xlxxllr.exe75⤵PID:2576
-
\??\c:\xrxlxfr.exec:\xrxlxfr.exe76⤵PID:2920
-
\??\c:\nnthnb.exec:\nnthnb.exe77⤵PID:2604
-
\??\c:\vjppp.exec:\vjppp.exe78⤵PID:1252
-
\??\c:\1jvvd.exec:\1jvvd.exe79⤵PID:2228
-
\??\c:\fffrrff.exec:\fffrrff.exe80⤵PID:2772
-
\??\c:\lxllxfx.exec:\lxllxfx.exe81⤵PID:2024
-
\??\c:\thbhnt.exec:\thbhnt.exe82⤵PID:2280
-
\??\c:\vpjdj.exec:\vpjdj.exe83⤵PID:848
-
\??\c:\ddppd.exec:\ddppd.exe84⤵PID:2776
-
\??\c:\fxrfflr.exec:\fxrfflr.exe85⤵PID:2992
-
\??\c:\lfxlxfr.exec:\lfxlxfr.exe86⤵PID:1444
-
\??\c:\3thhnn.exec:\3thhnn.exe87⤵PID:2984
-
\??\c:\vdppv.exec:\vdppv.exe88⤵PID:2988
-
\??\c:\vpdjj.exec:\vpdjj.exe89⤵PID:2208
-
\??\c:\rlflllx.exec:\rlflllx.exe90⤵PID:308
-
\??\c:\fxlrxfr.exec:\fxlrxfr.exe91⤵PID:2196
-
\??\c:\9hnntt.exec:\9hnntt.exe92⤵PID:1896
-
\??\c:\bbtbhn.exec:\bbtbhn.exe93⤵PID:2232
-
\??\c:\djdvp.exec:\djdvp.exe94⤵PID:1540
-
\??\c:\jvjjp.exec:\jvjjp.exe95⤵PID:2020
-
\??\c:\rlxflfr.exec:\rlxflfr.exe96⤵PID:2336
-
\??\c:\llxxflr.exec:\llxxflr.exe97⤵PID:1544
-
\??\c:\hbhhnt.exec:\hbhhnt.exe98⤵PID:1852
-
\??\c:\dpjjv.exec:\dpjjv.exe99⤵PID:956
-
\??\c:\jdvjv.exec:\jdvjv.exe100⤵PID:2404
-
\??\c:\rffflrf.exec:\rffflrf.exe101⤵PID:2260
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe102⤵PID:2848
-
\??\c:\nbnnbh.exec:\nbnnbh.exe103⤵PID:2964
-
\??\c:\htbtbt.exec:\htbtbt.exe104⤵PID:2128
-
\??\c:\ddvvj.exec:\ddvvj.exe105⤵PID:2072
-
\??\c:\3jdjv.exec:\3jdjv.exe106⤵PID:3040
-
\??\c:\3frrxxf.exec:\3frrxxf.exe107⤵PID:1188
-
\??\c:\hbhtbh.exec:\hbhtbh.exe108⤵PID:1792
-
\??\c:\btnhnt.exec:\btnhnt.exe109⤵PID:328
-
\??\c:\jdppd.exec:\jdppd.exe110⤵PID:2788
-
\??\c:\lrxrfxf.exec:\lrxrfxf.exe111⤵PID:2580
-
\??\c:\bhtbnt.exec:\bhtbnt.exe112⤵PID:2780
-
\??\c:\hbttbh.exec:\hbttbh.exe113⤵PID:1856
-
\??\c:\pppvv.exec:\pppvv.exe114⤵PID:2272
-
\??\c:\htnthb.exec:\htnthb.exe115⤵PID:2388
-
\??\c:\jdpdj.exec:\jdpdj.exe116⤵PID:2532
-
\??\c:\7dvdj.exec:\7dvdj.exe117⤵PID:560
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe118⤵PID:1408
-
\??\c:\9hhhbh.exec:\9hhhbh.exe119⤵PID:2148
-
\??\c:\pjppd.exec:\pjppd.exe120⤵PID:648
-
\??\c:\btbbhn.exec:\btbbhn.exe121⤵PID:3024
-
\??\c:\bnbhhb.exec:\bnbhhb.exe122⤵PID:1844
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-