Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 21:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe
-
Size
453KB
-
MD5
044c7c77986594b84556303b5eac4a55
-
SHA1
0ea1d1376bd1082439497a743678c8384c5182fc
-
SHA256
3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4
-
SHA512
5ef642bf5866f24d5b6330ae4df3548f65177c210d78d186895168c7068cbd96cdd2579ffe96dd3e01468ea261ddd3e5fa42e81aebb6dccde47b9d0aaf430fc7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeB:q7Tc2NYHUrAwfMp3CDB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2312-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/336-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-299-0x0000000077750000-0x000000007786F000-memory.dmp family_blackmoon behavioral1/memory/1244-300-0x0000000077650000-0x000000007774A000-memory.dmp family_blackmoon behavioral1/memory/2644-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-360-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1276-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-428-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-462-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1768-461-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1064-507-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-567-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2624-846-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-999-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/936-1060-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1704 7vvdj.exe 2784 xxlrxfr.exe 2840 frrlrxx.exe 2880 nnbntb.exe 2924 djdjp.exe 3024 lxrxrxf.exe 2860 ddppj.exe 2720 xrrrxxr.exe 1452 lfxxllx.exe 1036 hhntbn.exe 2388 ffrrxlx.exe 2444 bbnhtt.exe 772 5jjvp.exe 1312 llxfxfl.exe 1748 5vpdp.exe 2268 1fflrfr.exe 804 ddvdj.exe 2128 llxrlrl.exe 2204 5hthtb.exe 1720 1rlrflx.exe 808 3nbnbh.exe 336 xfrrxxl.exe 2484 tbnhnt.exe 1696 vvpjp.exe 2352 lrfrlxl.exe 1588 ntbnbh.exe 2068 9rflrfr.exe 1660 btttbt.exe 1788 fflrxlr.exe 568 bthhtb.exe 2152 jjpvj.exe 1400 rrrrxll.exe 1244 xxflrrx.exe 1708 dvdjj.exe 2800 lrrrrrx.exe 2832 3btbtt.exe 2912 ppvpv.exe 2824 xrxrxxx.exe 2880 3rxfrrx.exe 2452 bbhhbh.exe 1808 jjpvv.exe 2744 xrxfrxl.exe 2692 flflllr.exe 1732 ntnhbh.exe 1276 vvvpp.exe 1344 xxffrxl.exe 2176 lxllxxl.exe 2100 bhtttb.exe 1672 vvjvd.exe 2444 7ffflrl.exe 1504 tbttht.exe 1088 9thtnn.exe 2428 pdpvd.exe 2664 lllrrxf.exe 3032 thttht.exe 888 jjvvd.exe 1768 ddppj.exe 2228 fxfxxxx.exe 2164 5tbbhh.exe 1224 ppjpd.exe 2360 rxlrxxl.exe 808 hhnhhb.exe 1628 hbtbhn.exe 1064 1pdjv.exe -
resource yara_rule behavioral1/memory/2312-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-155-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/804-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-428-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/888-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-461-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1064-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-779-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2624-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-859-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-897-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/936-1060-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2040-1071-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-1085-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1704 2312 3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe 30 PID 2312 wrote to memory of 1704 2312 3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe 30 PID 2312 wrote to memory of 1704 2312 3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe 30 PID 2312 wrote to memory of 1704 2312 3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe 30 PID 1704 wrote to memory of 2784 1704 7vvdj.exe 31 PID 1704 wrote to memory of 2784 1704 7vvdj.exe 31 PID 1704 wrote to memory of 2784 1704 7vvdj.exe 31 PID 1704 wrote to memory of 2784 1704 7vvdj.exe 31 PID 2784 wrote to memory of 2840 2784 xxlrxfr.exe 32 PID 2784 wrote to memory of 2840 2784 xxlrxfr.exe 32 PID 2784 wrote to memory of 2840 2784 xxlrxfr.exe 32 PID 2784 wrote to memory of 2840 2784 xxlrxfr.exe 32 PID 2840 wrote to memory of 2880 2840 frrlrxx.exe 33 PID 2840 wrote to memory of 2880 2840 frrlrxx.exe 33 PID 2840 wrote to memory of 2880 2840 frrlrxx.exe 33 PID 2840 wrote to memory of 2880 2840 frrlrxx.exe 33 PID 2880 wrote to memory of 2924 2880 nnbntb.exe 34 PID 2880 wrote to memory of 2924 2880 nnbntb.exe 34 PID 2880 wrote to memory of 2924 2880 nnbntb.exe 34 PID 2880 wrote to memory of 2924 2880 nnbntb.exe 34 PID 2924 wrote to memory of 3024 2924 djdjp.exe 35 PID 2924 wrote to memory of 3024 2924 djdjp.exe 35 PID 2924 wrote to memory of 3024 2924 djdjp.exe 35 PID 2924 wrote to memory of 3024 2924 djdjp.exe 35 PID 3024 wrote to memory of 2860 3024 lxrxrxf.exe 36 PID 3024 wrote to memory of 2860 3024 lxrxrxf.exe 36 PID 3024 wrote to memory of 2860 3024 lxrxrxf.exe 36 PID 3024 wrote to memory of 2860 3024 lxrxrxf.exe 36 PID 2860 wrote to memory of 2720 2860 ddppj.exe 37 PID 2860 wrote to memory of 2720 2860 ddppj.exe 37 PID 2860 wrote to memory of 2720 2860 ddppj.exe 37 PID 2860 wrote to memory of 2720 2860 ddppj.exe 37 PID 2720 wrote to memory of 1452 2720 xrrrxxr.exe 38 PID 2720 wrote to memory of 1452 2720 xrrrxxr.exe 38 PID 2720 wrote to memory of 1452 2720 xrrrxxr.exe 38 PID 2720 wrote to memory of 1452 2720 xrrrxxr.exe 38 PID 1452 wrote to memory of 1036 1452 lfxxllx.exe 39 PID 1452 wrote to memory of 1036 1452 lfxxllx.exe 39 PID 1452 wrote to memory of 1036 1452 lfxxllx.exe 39 PID 1452 wrote to memory of 1036 1452 lfxxllx.exe 39 PID 1036 wrote to memory of 2388 1036 hhntbn.exe 40 PID 1036 wrote to memory of 2388 1036 hhntbn.exe 40 PID 1036 wrote to memory of 2388 1036 hhntbn.exe 40 PID 1036 wrote to memory of 2388 1036 hhntbn.exe 40 PID 2388 wrote to memory of 2444 2388 ffrrxlx.exe 41 PID 2388 wrote to memory of 2444 2388 ffrrxlx.exe 41 PID 2388 wrote to memory of 2444 2388 ffrrxlx.exe 41 PID 2388 wrote to memory of 2444 2388 ffrrxlx.exe 41 PID 2444 wrote to memory of 772 2444 bbnhtt.exe 42 PID 2444 wrote to memory of 772 2444 bbnhtt.exe 42 PID 2444 wrote to memory of 772 2444 bbnhtt.exe 42 PID 2444 wrote to memory of 772 2444 bbnhtt.exe 42 PID 772 wrote to memory of 1312 772 5jjvp.exe 43 PID 772 wrote to memory of 1312 772 5jjvp.exe 43 PID 772 wrote to memory of 1312 772 5jjvp.exe 43 PID 772 wrote to memory of 1312 772 5jjvp.exe 43 PID 1312 wrote to memory of 1748 1312 llxfxfl.exe 44 PID 1312 wrote to memory of 1748 1312 llxfxfl.exe 44 PID 1312 wrote to memory of 1748 1312 llxfxfl.exe 44 PID 1312 wrote to memory of 1748 1312 llxfxfl.exe 44 PID 1748 wrote to memory of 2268 1748 5vpdp.exe 45 PID 1748 wrote to memory of 2268 1748 5vpdp.exe 45 PID 1748 wrote to memory of 2268 1748 5vpdp.exe 45 PID 1748 wrote to memory of 2268 1748 5vpdp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe"C:\Users\Admin\AppData\Local\Temp\3e80ebfd02026f952b2c3d640c71567542e5103860e27d81633d5f300f03b2c4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\7vvdj.exec:\7vvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\xxlrxfr.exec:\xxlrxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\frrlrxx.exec:\frrlrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\nnbntb.exec:\nnbntb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\djdjp.exec:\djdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\lxrxrxf.exec:\lxrxrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\ddppj.exec:\ddppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\xrrrxxr.exec:\xrrrxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\lfxxllx.exec:\lfxxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\hhntbn.exec:\hhntbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\ffrrxlx.exec:\ffrrxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\bbnhtt.exec:\bbnhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5jjvp.exec:\5jjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\llxfxfl.exec:\llxfxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\5vpdp.exec:\5vpdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\1fflrfr.exec:\1fflrfr.exe17⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ddvdj.exec:\ddvdj.exe18⤵
- Executes dropped EXE
PID:804 -
\??\c:\llxrlrl.exec:\llxrlrl.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5hthtb.exec:\5hthtb.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1rlrflx.exec:\1rlrflx.exe21⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3nbnbh.exec:\3nbnbh.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\xfrrxxl.exec:\xfrrxxl.exe23⤵
- Executes dropped EXE
PID:336 -
\??\c:\tbnhnt.exec:\tbnhnt.exe24⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vvpjp.exec:\vvpjp.exe25⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lrfrlxl.exec:\lrfrlxl.exe26⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ntbnbh.exec:\ntbnbh.exe27⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9rflrfr.exec:\9rflrfr.exe28⤵
- Executes dropped EXE
PID:2068 -
\??\c:\btttbt.exec:\btttbt.exe29⤵
- Executes dropped EXE
PID:1660 -
\??\c:\fflrxlr.exec:\fflrxlr.exe30⤵
- Executes dropped EXE
PID:1788 -
\??\c:\bthhtb.exec:\bthhtb.exe31⤵
- Executes dropped EXE
PID:568 -
\??\c:\jjpvj.exec:\jjpvj.exe32⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrrrxll.exec:\rrrrxll.exe33⤵
- Executes dropped EXE
PID:1400 -
\??\c:\xxflrrx.exec:\xxflrrx.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244 -
\??\c:\flxxlrx.exec:\flxxlrx.exe35⤵PID:2644
-
\??\c:\dvdjj.exec:\dvdjj.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lrrrrrx.exec:\lrrrrrx.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\3btbtt.exec:\3btbtt.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ppvpv.exec:\ppvpv.exe39⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xrxrxxx.exec:\xrxrxxx.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3rxfrrx.exec:\3rxfrrx.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\bbhhbh.exec:\bbhhbh.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\jjpvv.exec:\jjpvv.exe43⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe44⤵
- Executes dropped EXE
PID:2744 -
\??\c:\flflllr.exec:\flflllr.exe45⤵
- Executes dropped EXE
PID:2692 -
\??\c:\ntnhbh.exec:\ntnhbh.exe46⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vvvpp.exec:\vvvpp.exe47⤵
- Executes dropped EXE
PID:1276 -
\??\c:\xxffrxl.exec:\xxffrxl.exe48⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lxllxxl.exec:\lxllxxl.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bhtttb.exec:\bhtttb.exe50⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vvjvd.exec:\vvjvd.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7ffflrl.exec:\7ffflrl.exe52⤵
- Executes dropped EXE
PID:2444 -
\??\c:\tbttht.exec:\tbttht.exe53⤵
- Executes dropped EXE
PID:1504 -
\??\c:\9thtnn.exec:\9thtnn.exe54⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pdpvd.exec:\pdpvd.exe55⤵
- Executes dropped EXE
PID:2428 -
\??\c:\lllrrxf.exec:\lllrrxf.exe56⤵
- Executes dropped EXE
PID:2664 -
\??\c:\thttht.exec:\thttht.exe57⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjvvd.exec:\jjvvd.exe58⤵
- Executes dropped EXE
PID:888 -
\??\c:\ddppj.exec:\ddppj.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5tbbhh.exec:\5tbbhh.exe61⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ppjpd.exec:\ppjpd.exe62⤵
- Executes dropped EXE
PID:1224 -
\??\c:\rxlrxxl.exec:\rxlrxxl.exe63⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hhnhhb.exec:\hhnhhb.exe64⤵
- Executes dropped EXE
PID:808 -
\??\c:\hbtbhn.exec:\hbtbhn.exe65⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1pdjv.exec:\1pdjv.exe66⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe67⤵PID:2120
-
\??\c:\hhnnnn.exec:\hhnnnn.exe68⤵PID:2172
-
\??\c:\ntnttt.exec:\ntnttt.exe69⤵PID:1760
-
\??\c:\vpdjv.exec:\vpdjv.exe70⤵PID:1588
-
\??\c:\lrflxlx.exec:\lrflxlx.exe71⤵PID:2064
-
\??\c:\ttnnbh.exec:\ttnnbh.exe72⤵PID:1680
-
\??\c:\bbnbhb.exec:\bbnbhb.exe73⤵PID:2640
-
\??\c:\5vpdj.exec:\5vpdj.exe74⤵PID:1216
-
\??\c:\lllxxlf.exec:\lllxxlf.exe75⤵PID:2632
-
\??\c:\9llrflx.exec:\9llrflx.exe76⤵PID:2524
-
\??\c:\bhbbtb.exec:\bhbbtb.exe77⤵PID:2608
-
\??\c:\pdpvp.exec:\pdpvp.exe78⤵PID:1400
-
\??\c:\3pddd.exec:\3pddd.exe79⤵PID:1608
-
\??\c:\ffrxflf.exec:\ffrxflf.exe80⤵PID:1340
-
\??\c:\hnhbnb.exec:\hnhbnb.exe81⤵PID:2464
-
\??\c:\bhtbth.exec:\bhtbth.exe82⤵PID:2188
-
\??\c:\ddvvd.exec:\ddvvd.exe83⤵PID:2816
-
\??\c:\lrlxflr.exec:\lrlxflr.exe84⤵PID:2236
-
\??\c:\9lxxlrr.exec:\9lxxlrr.exe85⤵PID:2928
-
\??\c:\3tntbt.exec:\3tntbt.exe86⤵PID:2792
-
\??\c:\pvddp.exec:\pvddp.exe87⤵PID:3024
-
\??\c:\vvpjd.exec:\vvpjd.exe88⤵PID:2856
-
\??\c:\9frrrrx.exec:\9frrrrx.exe89⤵PID:2768
-
\??\c:\hnhnbt.exec:\hnhnbt.exe90⤵PID:1456
-
\??\c:\tnnhnh.exec:\tnnhnh.exe91⤵PID:1832
-
\??\c:\7pjpv.exec:\7pjpv.exe92⤵PID:1940
-
\??\c:\rrffxxl.exec:\rrffxxl.exe93⤵PID:580
-
\??\c:\hhtthh.exec:\hhtthh.exe94⤵PID:2388
-
\??\c:\1bnthh.exec:\1bnthh.exe95⤵PID:3016
-
\??\c:\jjvdj.exec:\jjvdj.exe96⤵PID:2032
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe97⤵PID:2964
-
\??\c:\nhtnbt.exec:\nhtnbt.exe98⤵PID:572
-
\??\c:\nhhnnn.exec:\nhhnnn.exe99⤵PID:3036
-
\??\c:\jvpjj.exec:\jvpjj.exe100⤵PID:2664
-
\??\c:\ffflrrl.exec:\ffflrrl.exe101⤵PID:1388
-
\??\c:\xlrxxff.exec:\xlrxxff.exe102⤵PID:836
-
\??\c:\tthntb.exec:\tthntb.exe103⤵PID:2004
-
\??\c:\jpdjv.exec:\jpdjv.exe104⤵
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\vdjjp.exec:\vdjjp.exe105⤵PID:1720
-
\??\c:\xfrfxfl.exec:\xfrfxfl.exe106⤵PID:2148
-
\??\c:\1thhbh.exec:\1thhbh.exe107⤵PID:1192
-
\??\c:\jpvvv.exec:\jpvvv.exe108⤵PID:1076
-
\??\c:\pjvvd.exec:\pjvvd.exe109⤵PID:2016
-
\??\c:\xffflrf.exec:\xffflrf.exe110⤵PID:1696
-
\??\c:\rlrrffl.exec:\rlrrffl.exe111⤵PID:552
-
\??\c:\hhbbht.exec:\hhbbht.exe112⤵PID:2272
-
\??\c:\jjppd.exec:\jjppd.exe113⤵PID:1328
-
\??\c:\jjvvd.exec:\jjvvd.exe114⤵PID:1864
-
\??\c:\rrffflx.exec:\rrffflx.exe115⤵PID:1676
-
\??\c:\tntthh.exec:\tntthh.exe116⤵PID:2304
-
\??\c:\bttthh.exec:\bttthh.exe117⤵PID:2624
-
\??\c:\lrlrfrf.exec:\lrlrfrf.exe118⤵PID:2244
-
\??\c:\bthnbb.exec:\bthnbb.exe119⤵
- System Location Discovery: System Language Discovery
PID:1056 -
\??\c:\1dpdj.exec:\1dpdj.exe120⤵PID:1500
-
\??\c:\jjvvd.exec:\jjvvd.exe121⤵PID:2308
-
\??\c:\rrfllrx.exec:\rrfllrx.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-