Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 00:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe
-
Size
453KB
-
MD5
4f357b27ab9739ac20f13a0830d31c52
-
SHA1
5f6d2b8a05f929bb2efff8b5fde77407ebc2ad95
-
SHA256
4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549
-
SHA512
4ccce45b677dd8eddaec2e6fac11b9d7bac08936d903c6cc690fd3034ce6263b75f7843e52492d0c9de98b89c7720bb2ce5554d9b36519882d904bc4c74a1dfe
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/628-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-78-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2140-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-99-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-336-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2972-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1360-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-500-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-513-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/812-526-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-675-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-839-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-855-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1624-916-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2300-957-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2648 ppvvd.exe 2704 xrfxxxf.exe 2708 7ttnht.exe 2120 5ppjp.exe 2584 hbbnbh.exe 2668 dvpvd.exe 2632 rlflrxr.exe 2140 3ttbhn.exe 1640 lxrxrrf.exe 2908 hnntbb.exe 3048 9jjpd.exe 3060 7frrrlx.exe 2616 btbhtt.exe 1976 pjppd.exe 1244 ffrxffr.exe 1996 1bttbh.exe 2172 vvvvd.exe 2188 7thhht.exe 2972 ppjvj.exe 1948 rxllrlr.exe 796 5htbhn.exe 1876 dpjjp.exe 1904 vvvvj.exe 1896 llxfllx.exe 1924 djpjv.exe 2144 rfxfxxf.exe 572 httbtt.exe 1692 lrlfrxl.exe 1840 xrxxflx.exe 2992 vvvdd.exe 1528 vvjpj.exe 2664 5hbhnn.exe 2704 jvjjp.exe 2288 xrlrflx.exe 2716 ttnbhh.exe 2816 nhbntb.exe 2596 pddvd.exe 2692 llxfrxl.exe 2552 nbtbnn.exe 2204 5nbbbh.exe 904 pppdp.exe 2836 xlrrrxf.exe 2140 thtbnn.exe 2656 9hhnbh.exe 2892 vvpdd.exe 2884 3tnnbh.exe 1584 5pppv.exe 1040 fxfrxxl.exe 2300 bhtbnt.exe 668 vvdjj.exe 2104 5xrlrrr.exe 2796 hbhhhh.exe 1128 bnnhhn.exe 1912 lfxfrxx.exe 2128 hhbhht.exe 1144 jpjjj.exe 2972 rrlxffr.exe 1360 9rlfxrr.exe 1872 nhnntt.exe 1184 3jjdj.exe 2328 xfxrrll.exe 848 tthbtb.exe 1148 djvvd.exe 2640 vjvvj.exe -
resource yara_rule behavioral1/memory/628-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3060-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1360-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-839-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-852-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-916-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2300-957-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 628 wrote to memory of 2648 628 4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe 31 PID 628 wrote to memory of 2648 628 4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe 31 PID 628 wrote to memory of 2648 628 4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe 31 PID 628 wrote to memory of 2648 628 4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe 31 PID 2648 wrote to memory of 2704 2648 ppvvd.exe 32 PID 2648 wrote to memory of 2704 2648 ppvvd.exe 32 PID 2648 wrote to memory of 2704 2648 ppvvd.exe 32 PID 2648 wrote to memory of 2704 2648 ppvvd.exe 32 PID 2704 wrote to memory of 2708 2704 xrfxxxf.exe 33 PID 2704 wrote to memory of 2708 2704 xrfxxxf.exe 33 PID 2704 wrote to memory of 2708 2704 xrfxxxf.exe 33 PID 2704 wrote to memory of 2708 2704 xrfxxxf.exe 33 PID 2708 wrote to memory of 2120 2708 7ttnht.exe 34 PID 2708 wrote to memory of 2120 2708 7ttnht.exe 34 PID 2708 wrote to memory of 2120 2708 7ttnht.exe 34 PID 2708 wrote to memory of 2120 2708 7ttnht.exe 34 PID 2120 wrote to memory of 2584 2120 5ppjp.exe 35 PID 2120 wrote to memory of 2584 2120 5ppjp.exe 35 PID 2120 wrote to memory of 2584 2120 5ppjp.exe 35 PID 2120 wrote to memory of 2584 2120 5ppjp.exe 35 PID 2584 wrote to memory of 2668 2584 hbbnbh.exe 36 PID 2584 wrote to memory of 2668 2584 hbbnbh.exe 36 PID 2584 wrote to memory of 2668 2584 hbbnbh.exe 36 PID 2584 wrote to memory of 2668 2584 hbbnbh.exe 36 PID 2668 wrote to memory of 2632 2668 dvpvd.exe 37 PID 2668 wrote to memory of 2632 2668 dvpvd.exe 37 PID 2668 wrote to memory of 2632 2668 dvpvd.exe 37 PID 2668 wrote to memory of 2632 2668 dvpvd.exe 37 PID 2632 wrote to memory of 2140 2632 rlflrxr.exe 38 PID 2632 wrote to memory of 2140 2632 rlflrxr.exe 38 PID 2632 wrote to memory of 2140 2632 rlflrxr.exe 38 PID 2632 wrote to memory of 2140 2632 rlflrxr.exe 38 PID 2140 wrote to memory of 1640 2140 3ttbhn.exe 39 PID 2140 wrote to memory of 1640 2140 3ttbhn.exe 39 PID 2140 wrote to memory of 1640 2140 3ttbhn.exe 39 PID 2140 wrote to memory of 1640 2140 3ttbhn.exe 39 PID 1640 wrote to memory of 2908 1640 lxrxrrf.exe 40 PID 1640 wrote to memory of 2908 1640 lxrxrrf.exe 40 PID 1640 wrote to memory of 2908 1640 lxrxrrf.exe 40 PID 1640 wrote to memory of 2908 1640 lxrxrrf.exe 40 PID 2908 wrote to memory of 3048 2908 hnntbb.exe 41 PID 2908 wrote to memory of 3048 2908 hnntbb.exe 41 PID 2908 wrote to memory of 3048 2908 hnntbb.exe 41 PID 2908 wrote to memory of 3048 2908 hnntbb.exe 41 PID 3048 wrote to memory of 3060 3048 9jjpd.exe 42 PID 3048 wrote to memory of 3060 3048 9jjpd.exe 42 PID 3048 wrote to memory of 3060 3048 9jjpd.exe 42 PID 3048 wrote to memory of 3060 3048 9jjpd.exe 42 PID 3060 wrote to memory of 2616 3060 7frrrlx.exe 43 PID 3060 wrote to memory of 2616 3060 7frrrlx.exe 43 PID 3060 wrote to memory of 2616 3060 7frrrlx.exe 43 PID 3060 wrote to memory of 2616 3060 7frrrlx.exe 43 PID 2616 wrote to memory of 1976 2616 btbhtt.exe 44 PID 2616 wrote to memory of 1976 2616 btbhtt.exe 44 PID 2616 wrote to memory of 1976 2616 btbhtt.exe 44 PID 2616 wrote to memory of 1976 2616 btbhtt.exe 44 PID 1976 wrote to memory of 1244 1976 pjppd.exe 45 PID 1976 wrote to memory of 1244 1976 pjppd.exe 45 PID 1976 wrote to memory of 1244 1976 pjppd.exe 45 PID 1976 wrote to memory of 1244 1976 pjppd.exe 45 PID 1244 wrote to memory of 1996 1244 ffrxffr.exe 46 PID 1244 wrote to memory of 1996 1244 ffrxffr.exe 46 PID 1244 wrote to memory of 1996 1244 ffrxffr.exe 46 PID 1244 wrote to memory of 1996 1244 ffrxffr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe"C:\Users\Admin\AppData\Local\Temp\4b18b00528d5dcddf75e7d16106a481e5ae075ea41d7a423870df78b4ea34549.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\ppvvd.exec:\ppvvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\7ttnht.exec:\7ttnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\5ppjp.exec:\5ppjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\hbbnbh.exec:\hbbnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\dvpvd.exec:\dvpvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rlflrxr.exec:\rlflrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\3ttbhn.exec:\3ttbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\lxrxrrf.exec:\lxrxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\hnntbb.exec:\hnntbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9jjpd.exec:\9jjpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\7frrrlx.exec:\7frrrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\btbhtt.exec:\btbhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\pjppd.exec:\pjppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\ffrxffr.exec:\ffrxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\1bttbh.exec:\1bttbh.exe17⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vvvvd.exec:\vvvvd.exe18⤵
- Executes dropped EXE
PID:2172 -
\??\c:\7thhht.exec:\7thhht.exe19⤵
- Executes dropped EXE
PID:2188 -
\??\c:\ppjvj.exec:\ppjvj.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rxllrlr.exec:\rxllrlr.exe21⤵
- Executes dropped EXE
PID:1948 -
\??\c:\5htbhn.exec:\5htbhn.exe22⤵
- Executes dropped EXE
PID:796 -
\??\c:\dpjjp.exec:\dpjjp.exe23⤵
- Executes dropped EXE
PID:1876 -
\??\c:\vvvvj.exec:\vvvvj.exe24⤵
- Executes dropped EXE
PID:1904 -
\??\c:\llxfllx.exec:\llxfllx.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\djpjv.exec:\djpjv.exe26⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rfxfxxf.exec:\rfxfxxf.exe27⤵
- Executes dropped EXE
PID:2144 -
\??\c:\httbtt.exec:\httbtt.exe28⤵
- Executes dropped EXE
PID:572 -
\??\c:\lrlfrxl.exec:\lrlfrxl.exe29⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrxxflx.exec:\xrxxflx.exe30⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vvvdd.exec:\vvvdd.exe31⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vvjpj.exec:\vvjpj.exe32⤵
- Executes dropped EXE
PID:1528 -
\??\c:\5hbhnn.exec:\5hbhnn.exe33⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jvjjp.exec:\jvjjp.exe34⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xrlrflx.exec:\xrlrflx.exe35⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ttnbhh.exec:\ttnbhh.exe36⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nhbntb.exec:\nhbntb.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pddvd.exec:\pddvd.exe38⤵
- Executes dropped EXE
PID:2596 -
\??\c:\llxfrxl.exec:\llxfrxl.exe39⤵
- Executes dropped EXE
PID:2692 -
\??\c:\nbtbnn.exec:\nbtbnn.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\5nbbbh.exec:\5nbbbh.exe41⤵
- Executes dropped EXE
PID:2204 -
\??\c:\pppdp.exec:\pppdp.exe42⤵
- Executes dropped EXE
PID:904 -
\??\c:\xlrrrxf.exec:\xlrrrxf.exe43⤵
- Executes dropped EXE
PID:2836 -
\??\c:\thtbnn.exec:\thtbnn.exe44⤵
- Executes dropped EXE
PID:2140 -
\??\c:\9hhnbh.exec:\9hhnbh.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvpdd.exec:\vvpdd.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3tnnbh.exec:\3tnnbh.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5pppv.exec:\5pppv.exe48⤵
- Executes dropped EXE
PID:1584 -
\??\c:\fxfrxxl.exec:\fxfrxxl.exe49⤵
- Executes dropped EXE
PID:1040 -
\??\c:\bhtbnt.exec:\bhtbnt.exe50⤵
- Executes dropped EXE
PID:2300 -
\??\c:\vvdjj.exec:\vvdjj.exe51⤵
- Executes dropped EXE
PID:668 -
\??\c:\5xrlrrr.exec:\5xrlrrr.exe52⤵
- Executes dropped EXE
PID:2104 -
\??\c:\hbhhhh.exec:\hbhhhh.exe53⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bnnhhn.exec:\bnnhhn.exe54⤵
- Executes dropped EXE
PID:1128 -
\??\c:\lfxfrxx.exec:\lfxfrxx.exe55⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hhbhht.exec:\hhbhht.exe56⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jpjjj.exec:\jpjjj.exe57⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rrlxffr.exec:\rrlxffr.exe58⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9rlfxrr.exec:\9rlfxrr.exe59⤵
- Executes dropped EXE
PID:1360 -
\??\c:\nhnntt.exec:\nhnntt.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3jjdj.exec:\3jjdj.exe61⤵
- Executes dropped EXE
PID:1184 -
\??\c:\xfxrrll.exec:\xfxrrll.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tthbtb.exec:\tthbtb.exe63⤵
- Executes dropped EXE
PID:848 -
\??\c:\djvvd.exec:\djvvd.exe64⤵
- Executes dropped EXE
PID:1148 -
\??\c:\vjvvj.exec:\vjvvj.exe65⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ffflfrl.exec:\ffflfrl.exe66⤵PID:448
-
\??\c:\btbntn.exec:\btbntn.exe67⤵PID:812
-
\??\c:\jjvvv.exec:\jjvvv.exe68⤵PID:572
-
\??\c:\lxlffxl.exec:\lxlffxl.exe69⤵PID:1224
-
\??\c:\1rxrrxx.exec:\1rxrrxx.exe70⤵PID:3004
-
\??\c:\nbtbbt.exec:\nbtbbt.exe71⤵PID:1304
-
\??\c:\1pjdv.exec:\1pjdv.exe72⤵PID:1628
-
\??\c:\9frffxf.exec:\9frffxf.exe73⤵PID:2648
-
\??\c:\7lrxxxx.exec:\7lrxxxx.exe74⤵PID:584
-
\??\c:\btbntn.exec:\btbntn.exe75⤵PID:2680
-
\??\c:\vdpdj.exec:\vdpdj.exe76⤵PID:2564
-
\??\c:\lrflflr.exec:\lrflflr.exe77⤵PID:2672
-
\??\c:\lxllllr.exec:\lxllllr.exe78⤵PID:2120
-
\??\c:\bhbhtb.exec:\bhbhtb.exe79⤵PID:2184
-
\??\c:\vjvvj.exec:\vjvvj.exe80⤵PID:2560
-
\??\c:\xrffllx.exec:\xrffllx.exe81⤵PID:2668
-
\??\c:\ttnthn.exec:\ttnthn.exe82⤵PID:2572
-
\??\c:\ntnnnn.exec:\ntnnnn.exe83⤵PID:2620
-
\??\c:\dvpvj.exec:\dvpvj.exe84⤵PID:2860
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe85⤵PID:1572
-
\??\c:\bbtbnn.exec:\bbtbnn.exe86⤵PID:3012
-
\??\c:\7jvjj.exec:\7jvjj.exe87⤵PID:2064
-
\??\c:\jdpvj.exec:\jdpvj.exe88⤵PID:3064
-
\??\c:\xflxxrr.exec:\xflxxrr.exe89⤵PID:1956
-
\??\c:\nhtbnh.exec:\nhtbnh.exe90⤵PID:1584
-
\??\c:\9pdvd.exec:\9pdvd.exe91⤵PID:748
-
\??\c:\jjdjp.exec:\jjdjp.exe92⤵PID:2644
-
\??\c:\llffxrx.exec:\llffxrx.exe93⤵PID:1964
-
\??\c:\btbbtt.exec:\btbbtt.exe94⤵PID:1604
-
\??\c:\vdvpp.exec:\vdvpp.exe95⤵PID:2004
-
\??\c:\dvpvv.exec:\dvpvv.exe96⤵PID:1128
-
\??\c:\lfrxffr.exec:\lfrxffr.exe97⤵PID:2968
-
\??\c:\bhnbth.exec:\bhnbth.exe98⤵PID:2276
-
\??\c:\pjddj.exec:\pjddj.exe99⤵PID:1008
-
\??\c:\5vjdd.exec:\5vjdd.exe100⤵PID:1772
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe101⤵PID:2220
-
\??\c:\bnbbhh.exec:\bnbbhh.exe102⤵PID:1540
-
\??\c:\3dvvp.exec:\3dvvp.exe103⤵PID:1512
-
\??\c:\frffllx.exec:\frffllx.exe104⤵PID:2520
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe105⤵PID:1880
-
\??\c:\vvpvd.exec:\vvpvd.exe106⤵PID:784
-
\??\c:\3pjpp.exec:\3pjpp.exe107⤵PID:1004
-
\??\c:\frfllll.exec:\frfllll.exe108⤵PID:2292
-
\??\c:\tntbbh.exec:\tntbbh.exe109⤵PID:572
-
\??\c:\pjdpv.exec:\pjdpv.exe110⤵PID:1224
-
\??\c:\ddjpv.exec:\ddjpv.exe111⤵PID:1256
-
\??\c:\xrffflr.exec:\xrffflr.exe112⤵PID:1424
-
\??\c:\bnntbb.exec:\bnntbb.exe113⤵PID:1728
-
\??\c:\bnbbbt.exec:\bnbbbt.exe114⤵PID:2340
-
\??\c:\vjvvj.exec:\vjvvj.exe115⤵PID:628
-
\??\c:\lxfrxxf.exec:\lxfrxxf.exe116⤵PID:2684
-
\??\c:\tnbbbb.exec:\tnbbbb.exe117⤵PID:2160
-
\??\c:\tnhhnn.exec:\tnhhnn.exe118⤵PID:2280
-
\??\c:\dpjdp.exec:\dpjdp.exe119⤵PID:2920
-
\??\c:\1flffff.exec:\1flffff.exe120⤵PID:2596
-
\??\c:\frlrflf.exec:\frlrflf.exe121⤵PID:2012
-
\??\c:\bbthtt.exec:\bbthtt.exe122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-