Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe
-
Size
453KB
-
MD5
115d6b888b5aec6c8e4d86e66f060e3f
-
SHA1
ad79dce13e451cd9804ef47fedf5f538dee48a10
-
SHA256
b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4
-
SHA512
c1b2f2acf7c594e435a5de5b01981a29a9e24b1ed6f9e195259e3adc5cb11925bb1527d9ad5ef44f5a113a01891d2842b3d9d9db30ba6ebb0cb6f6df57b456d2
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2112-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1736-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1476-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/292-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/912-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-355-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/980-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1916-490-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-758-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-863-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1408-948-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1924-985-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/832-1233-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2392 rlffxff.exe 2352 ttnnhh.exe 2936 dvvpj.exe 2360 pjdjj.exe 2916 llfrffr.exe 2928 3dppv.exe 2736 lxxlxfr.exe 2792 hbntbt.exe 2676 dddpv.exe 1736 djdpd.exe 2268 lllrxxr.exe 672 btttbb.exe 1476 vvvpj.exe 1876 xxrflrx.exe 2444 rfffxxf.exe 980 btbnnb.exe 292 3vdvj.exe 2020 1rlrxxl.exe 2832 hhbhtt.exe 2824 3vjjv.exe 2220 bttbnn.exe 2100 lrlrffr.exe 3028 5nnntb.exe 900 dvjjp.exe 2248 vpjpv.exe 912 lfrxlrf.exe 2284 hbtthb.exe 2068 9btbnt.exe 1212 5btbhn.exe 1644 9vppp.exe 308 rlxfllx.exe 2340 httthb.exe 592 rrrfllf.exe 2352 hhtbnn.exe 2344 djddj.exe 2868 fxlllrr.exe 1716 7fllllx.exe 2916 nnntnt.exe 2712 dvpvd.exe 2908 rlrffxx.exe 2532 rlflxrf.exe 2756 5hbhtt.exe 2512 ddvdp.exe 2632 ppjvj.exe 2336 rfrrllx.exe 2472 btnntb.exe 1960 5nttbh.exe 2236 1vjpv.exe 2432 rllffxf.exe 1408 hnttbb.exe 2856 1htbtb.exe 1584 dddjp.exe 2820 xxrrllx.exe 2028 bbtbnn.exe 980 ttnthn.exe 352 pjjjv.exe 2440 9lffllx.exe 2968 rlrrlrr.exe 2148 9httbh.exe 1648 dvpvd.exe 2220 dvpvj.exe 2964 llffrxl.exe 1916 hbnthh.exe 1692 vjppp.exe -
resource yara_rule behavioral1/memory/2112-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1476-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/292-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-177-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2220-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-279-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2352-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/980-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-651-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-758-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2392 2112 b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe 30 PID 2112 wrote to memory of 2392 2112 b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe 30 PID 2112 wrote to memory of 2392 2112 b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe 30 PID 2112 wrote to memory of 2392 2112 b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe 30 PID 2392 wrote to memory of 2352 2392 rlffxff.exe 31 PID 2392 wrote to memory of 2352 2392 rlffxff.exe 31 PID 2392 wrote to memory of 2352 2392 rlffxff.exe 31 PID 2392 wrote to memory of 2352 2392 rlffxff.exe 31 PID 2352 wrote to memory of 2936 2352 ttnnhh.exe 32 PID 2352 wrote to memory of 2936 2352 ttnnhh.exe 32 PID 2352 wrote to memory of 2936 2352 ttnnhh.exe 32 PID 2352 wrote to memory of 2936 2352 ttnnhh.exe 32 PID 2936 wrote to memory of 2360 2936 dvvpj.exe 33 PID 2936 wrote to memory of 2360 2936 dvvpj.exe 33 PID 2936 wrote to memory of 2360 2936 dvvpj.exe 33 PID 2936 wrote to memory of 2360 2936 dvvpj.exe 33 PID 2360 wrote to memory of 2916 2360 pjdjj.exe 34 PID 2360 wrote to memory of 2916 2360 pjdjj.exe 34 PID 2360 wrote to memory of 2916 2360 pjdjj.exe 34 PID 2360 wrote to memory of 2916 2360 pjdjj.exe 34 PID 2916 wrote to memory of 2928 2916 llfrffr.exe 35 PID 2916 wrote to memory of 2928 2916 llfrffr.exe 35 PID 2916 wrote to memory of 2928 2916 llfrffr.exe 35 PID 2916 wrote to memory of 2928 2916 llfrffr.exe 35 PID 2928 wrote to memory of 2736 2928 3dppv.exe 36 PID 2928 wrote to memory of 2736 2928 3dppv.exe 36 PID 2928 wrote to memory of 2736 2928 3dppv.exe 36 PID 2928 wrote to memory of 2736 2928 3dppv.exe 36 PID 2736 wrote to memory of 2792 2736 lxxlxfr.exe 37 PID 2736 wrote to memory of 2792 2736 lxxlxfr.exe 37 PID 2736 wrote to memory of 2792 2736 lxxlxfr.exe 37 PID 2736 wrote to memory of 2792 2736 lxxlxfr.exe 37 PID 2792 wrote to memory of 2676 2792 hbntbt.exe 38 PID 2792 wrote to memory of 2676 2792 hbntbt.exe 38 PID 2792 wrote to memory of 2676 2792 hbntbt.exe 38 PID 2792 wrote to memory of 2676 2792 hbntbt.exe 38 PID 2676 wrote to memory of 1736 2676 dddpv.exe 39 PID 2676 wrote to memory of 1736 2676 dddpv.exe 39 PID 2676 wrote to memory of 1736 2676 dddpv.exe 39 PID 2676 wrote to memory of 1736 2676 dddpv.exe 39 PID 1736 wrote to memory of 2268 1736 djdpd.exe 40 PID 1736 wrote to memory of 2268 1736 djdpd.exe 40 PID 1736 wrote to memory of 2268 1736 djdpd.exe 40 PID 1736 wrote to memory of 2268 1736 djdpd.exe 40 PID 2268 wrote to memory of 672 2268 lllrxxr.exe 41 PID 2268 wrote to memory of 672 2268 lllrxxr.exe 41 PID 2268 wrote to memory of 672 2268 lllrxxr.exe 41 PID 2268 wrote to memory of 672 2268 lllrxxr.exe 41 PID 672 wrote to memory of 1476 672 btttbb.exe 42 PID 672 wrote to memory of 1476 672 btttbb.exe 42 PID 672 wrote to memory of 1476 672 btttbb.exe 42 PID 672 wrote to memory of 1476 672 btttbb.exe 42 PID 1476 wrote to memory of 1876 1476 vvvpj.exe 43 PID 1476 wrote to memory of 1876 1476 vvvpj.exe 43 PID 1476 wrote to memory of 1876 1476 vvvpj.exe 43 PID 1476 wrote to memory of 1876 1476 vvvpj.exe 43 PID 1876 wrote to memory of 2444 1876 xxrflrx.exe 44 PID 1876 wrote to memory of 2444 1876 xxrflrx.exe 44 PID 1876 wrote to memory of 2444 1876 xxrflrx.exe 44 PID 1876 wrote to memory of 2444 1876 xxrflrx.exe 44 PID 2444 wrote to memory of 980 2444 rfffxxf.exe 45 PID 2444 wrote to memory of 980 2444 rfffxxf.exe 45 PID 2444 wrote to memory of 980 2444 rfffxxf.exe 45 PID 2444 wrote to memory of 980 2444 rfffxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe"C:\Users\Admin\AppData\Local\Temp\b8058d1dee529ebcb82558093957efe08c0104afeb399c4589f8276b20d4a2d4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\rlffxff.exec:\rlffxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\ttnnhh.exec:\ttnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\dvvpj.exec:\dvvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pjdjj.exec:\pjdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\llfrffr.exec:\llfrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\3dppv.exec:\3dppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\lxxlxfr.exec:\lxxlxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbntbt.exec:\hbntbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dddpv.exec:\dddpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\djdpd.exec:\djdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\lllrxxr.exec:\lllrxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\btttbb.exec:\btttbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\vvvpj.exec:\vvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xxrflrx.exec:\xxrflrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\rfffxxf.exec:\rfffxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\btbnnb.exec:\btbnnb.exe17⤵
- Executes dropped EXE
PID:980 -
\??\c:\3vdvj.exec:\3vdvj.exe18⤵
- Executes dropped EXE
PID:292 -
\??\c:\1rlrxxl.exec:\1rlrxxl.exe19⤵
- Executes dropped EXE
PID:2020 -
\??\c:\hhbhtt.exec:\hhbhtt.exe20⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3vjjv.exec:\3vjjv.exe21⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bttbnn.exec:\bttbnn.exe22⤵
- Executes dropped EXE
PID:2220 -
\??\c:\lrlrffr.exec:\lrlrffr.exe23⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5nnntb.exec:\5nnntb.exe24⤵
- Executes dropped EXE
PID:3028 -
\??\c:\dvjjp.exec:\dvjjp.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\vpjpv.exec:\vpjpv.exe26⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lfrxlrf.exec:\lfrxlrf.exe27⤵
- Executes dropped EXE
PID:912 -
\??\c:\hbtthb.exec:\hbtthb.exe28⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9btbnt.exec:\9btbnt.exe29⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5btbhn.exec:\5btbhn.exe30⤵
- Executes dropped EXE
PID:1212 -
\??\c:\9vppp.exec:\9vppp.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\rlxfllx.exec:\rlxfllx.exe32⤵
- Executes dropped EXE
PID:308 -
\??\c:\httthb.exec:\httthb.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rrrfllf.exec:\rrrfllf.exe34⤵
- Executes dropped EXE
PID:592 -
\??\c:\hhtbnn.exec:\hhtbnn.exe35⤵
- Executes dropped EXE
PID:2352 -
\??\c:\djddj.exec:\djddj.exe36⤵
- Executes dropped EXE
PID:2344 -
\??\c:\fxlllrr.exec:\fxlllrr.exe37⤵
- Executes dropped EXE
PID:2868 -
\??\c:\7fllllx.exec:\7fllllx.exe38⤵
- Executes dropped EXE
PID:1716 -
\??\c:\nnntnt.exec:\nnntnt.exe39⤵
- Executes dropped EXE
PID:2916 -
\??\c:\dvpvd.exec:\dvpvd.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rlrffxx.exec:\rlrffxx.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\rlflxrf.exec:\rlflxrf.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\5hbhtt.exec:\5hbhtt.exe43⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ddvdp.exec:\ddvdp.exe44⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ppjvj.exec:\ppjvj.exe45⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rfrrllx.exec:\rfrrllx.exe46⤵
- Executes dropped EXE
PID:2336 -
\??\c:\btnntb.exec:\btnntb.exe47⤵
- Executes dropped EXE
PID:2472 -
\??\c:\5nttbh.exec:\5nttbh.exe48⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1vjpv.exec:\1vjpv.exe49⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rllffxf.exec:\rllffxf.exe50⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hnttbb.exec:\hnttbb.exe51⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1htbtb.exec:\1htbtb.exe52⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dddjp.exec:\dddjp.exe53⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xxrrllx.exec:\xxrrllx.exe54⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bbtbnn.exec:\bbtbnn.exe55⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ttnthn.exec:\ttnthn.exe56⤵
- Executes dropped EXE
PID:980 -
\??\c:\pjjjv.exec:\pjjjv.exe57⤵
- Executes dropped EXE
PID:352 -
\??\c:\9lffllx.exec:\9lffllx.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9httbh.exec:\9httbh.exe60⤵
- Executes dropped EXE
PID:2148 -
\??\c:\dvpvd.exec:\dvpvd.exe61⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvpvj.exec:\dvpvj.exe62⤵
- Executes dropped EXE
PID:2220 -
\??\c:\llffrxl.exec:\llffrxl.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbnthh.exec:\hbnthh.exe64⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vjppp.exec:\vjppp.exe65⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vjvdd.exec:\vjvdd.exe66⤵PID:840
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe67⤵PID:1788
-
\??\c:\thbntt.exec:\thbntt.exe68⤵PID:1604
-
\??\c:\jdvvd.exec:\jdvvd.exe69⤵PID:2452
-
\??\c:\dvvvj.exec:\dvvvj.exe70⤵PID:344
-
\??\c:\rlffrxl.exec:\rlffrxl.exe71⤵PID:2348
-
\??\c:\tnhtbb.exec:\tnhtbb.exe72⤵PID:3036
-
\??\c:\btntbb.exec:\btntbb.exe73⤵PID:2212
-
\??\c:\vdjjd.exec:\vdjjd.exe74⤵PID:1780
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe75⤵PID:308
-
\??\c:\fxxxffl.exec:\fxxxffl.exe76⤵PID:2340
-
\??\c:\nhtnnn.exec:\nhtnnn.exe77⤵PID:2392
-
\??\c:\vvvpv.exec:\vvvpv.exe78⤵PID:1588
-
\??\c:\jvpjp.exec:\jvpjp.exe79⤵PID:2940
-
\??\c:\9xlrrxf.exec:\9xlrrxf.exe80⤵PID:1576
-
\??\c:\bthntt.exec:\bthntt.exe81⤵PID:3064
-
\??\c:\1nnhnh.exec:\1nnhnh.exe82⤵PID:2724
-
\??\c:\vjvvv.exec:\vjvvv.exe83⤵PID:2628
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe84⤵PID:2876
-
\??\c:\rflllrr.exec:\rflllrr.exe85⤵PID:2892
-
\??\c:\nbhhhh.exec:\nbhhhh.exe86⤵PID:2532
-
\??\c:\vpppd.exec:\vpppd.exe87⤵PID:3000
-
\??\c:\pjvvd.exec:\pjvvd.exe88⤵PID:2512
-
\??\c:\xxrxlrl.exec:\xxrxlrl.exe89⤵PID:2652
-
\??\c:\3tnntt.exec:\3tnntt.exe90⤵PID:2336
-
\??\c:\jdddp.exec:\jdddp.exe91⤵PID:2720
-
\??\c:\jppdd.exec:\jppdd.exe92⤵PID:1532
-
\??\c:\rrrrxfr.exec:\rrrrxfr.exe93⤵PID:2852
-
\??\c:\bttthn.exec:\bttthn.exe94⤵PID:1892
-
\??\c:\tnbhnn.exec:\tnbhnn.exe95⤵PID:1104
-
\??\c:\vppvj.exec:\vppvj.exe96⤵PID:2856
-
\??\c:\1xffxxf.exec:\1xffxxf.exe97⤵PID:1584
-
\??\c:\rrfrfxl.exec:\rrfrfxl.exe98⤵PID:2680
-
\??\c:\btnnbh.exec:\btnnbh.exe99⤵PID:2028
-
\??\c:\vpddv.exec:\vpddv.exe100⤵PID:2020
-
\??\c:\dpdjj.exec:\dpdjj.exe101⤵PID:352
-
\??\c:\1xrlrxl.exec:\1xrlrxl.exe102⤵PID:2440
-
\??\c:\nnnnbh.exec:\nnnnbh.exe103⤵PID:2968
-
\??\c:\ppjpv.exec:\ppjpv.exe104⤵PID:2148
-
\??\c:\xrfflll.exec:\xrfflll.exe105⤵PID:2204
-
\??\c:\7xrlrrf.exec:\7xrlrrf.exe106⤵PID:3016
-
\??\c:\thbbhh.exec:\thbbhh.exe107⤵PID:1208
-
\??\c:\5tntbh.exec:\5tntbh.exe108⤵PID:2480
-
\??\c:\dpjjp.exec:\dpjjp.exe109⤵PID:840
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe110⤵PID:1516
-
\??\c:\rfllxxf.exec:\rfllxxf.exe111⤵PID:1604
-
\??\c:\tnhthh.exec:\tnhthh.exe112⤵PID:2452
-
\??\c:\jddvd.exec:\jddvd.exe113⤵PID:2288
-
\??\c:\pdvpp.exec:\pdvpp.exe114⤵PID:772
-
\??\c:\5lxflxf.exec:\5lxflxf.exe115⤵PID:300
-
\??\c:\bthntt.exec:\bthntt.exe116⤵PID:2212
-
\??\c:\dddvp.exec:\dddvp.exe117⤵PID:2116
-
\??\c:\7dvvd.exec:\7dvvd.exe118⤵PID:308
-
\??\c:\7rxxlrf.exec:\7rxxlrf.exe119⤵PID:592
-
\??\c:\bhbbhh.exec:\bhbbhh.exe120⤵PID:2704
-
\??\c:\bnhhnt.exec:\bnhhnt.exe121⤵PID:1588
-
\??\c:\jpvvj.exec:\jpvvj.exe122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-