Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe
-
Size
453KB
-
MD5
5b81c9a6fb6f82cce582d45bf90bc230
-
SHA1
27ea1de46b6b7eb2d15514bff7b4adbbc15e60f9
-
SHA256
bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bd
-
SHA512
03cf85704463faad269a012d4782164017924a1452aad98f731c07eefb29bb57707ed33addddb20b73c6c9aa1b42df9c4692d46200a4797460b31e51e09afdff
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-77-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-97-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/992-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-155-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2760-140-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1264-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/300-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1036-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1876-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/796-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-275-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1608-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-311-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2640-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-354-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3068-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1684-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-526-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1160-559-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-594-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2648-634-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2180-674-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 pjvdd.exe 2604 1rfffff.exe 2816 3dddd.exe 2616 rlxffxf.exe 2680 bnbbhb.exe 2556 dvjdd.exe 2552 7ffxrll.exe 2792 hthbbb.exe 2412 jjppp.exe 992 xrxfrlr.exe 300 tbhhnb.exe 2856 jjdjv.exe 3012 rlxxfxf.exe 2760 nntttt.exe 1740 bntnbb.exe 1100 3vdjj.exe 1264 7ntnnh.exe 2724 3vddd.exe 2020 xxfllfl.exe 1772 nbtthb.exe 2392 dvjdj.exe 1036 rxlflff.exe 2936 1htttn.exe 1876 9jvvd.exe 288 xlxfrxl.exe 2004 hntnnh.exe 620 rxxrlfl.exe 2444 bthnbh.exe 796 vpddj.exe 1164 5rlrxfl.exe 1512 ttttbh.exe 1672 rrrrlff.exe 1608 tbtntb.exe 2648 7thnth.exe 2640 lfllxfr.exe 2816 xxrflrl.exe 2376 bhtthh.exe 3068 vvpdj.exe 2504 hbnbnn.exe 2992 nhbtbb.exe 2552 5rrrlrl.exe 1684 rxfffxf.exe 576 hthbhh.exe 580 1dvvj.exe 1648 rrflfrf.exe 1156 lffrrll.exe 824 hthnnb.exe 2856 5pdvd.exe 2768 rrlrllr.exe 1792 rfrlfxx.exe 1868 1nbhbb.exe 2744 vjpvv.exe 1556 jvppj.exe 2748 9rxxfxf.exe 1748 thttbt.exe 2740 bbhtbb.exe 1984 3ppdv.exe 2484 5lrlfxr.exe 2104 9thhbb.exe 1980 nbtntn.exe 2692 djpjp.exe 692 frrllxx.exe 292 lfrxxxx.exe 2252 hthntt.exe -
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-77-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-97-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1264-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/300-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1036-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1876-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/796-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1684-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-418-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1160-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-559-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-635-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxfllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2184 1672 bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe 28 PID 1672 wrote to memory of 2184 1672 bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe 28 PID 1672 wrote to memory of 2184 1672 bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe 28 PID 1672 wrote to memory of 2184 1672 bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe 28 PID 2184 wrote to memory of 2604 2184 pjvdd.exe 29 PID 2184 wrote to memory of 2604 2184 pjvdd.exe 29 PID 2184 wrote to memory of 2604 2184 pjvdd.exe 29 PID 2184 wrote to memory of 2604 2184 pjvdd.exe 29 PID 2604 wrote to memory of 2816 2604 1rfffff.exe 30 PID 2604 wrote to memory of 2816 2604 1rfffff.exe 30 PID 2604 wrote to memory of 2816 2604 1rfffff.exe 30 PID 2604 wrote to memory of 2816 2604 1rfffff.exe 30 PID 2816 wrote to memory of 2616 2816 3dddd.exe 31 PID 2816 wrote to memory of 2616 2816 3dddd.exe 31 PID 2816 wrote to memory of 2616 2816 3dddd.exe 31 PID 2816 wrote to memory of 2616 2816 3dddd.exe 31 PID 2616 wrote to memory of 2680 2616 rlxffxf.exe 32 PID 2616 wrote to memory of 2680 2616 rlxffxf.exe 32 PID 2616 wrote to memory of 2680 2616 rlxffxf.exe 32 PID 2616 wrote to memory of 2680 2616 rlxffxf.exe 32 PID 2680 wrote to memory of 2556 2680 bnbbhb.exe 33 PID 2680 wrote to memory of 2556 2680 bnbbhb.exe 33 PID 2680 wrote to memory of 2556 2680 bnbbhb.exe 33 PID 2680 wrote to memory of 2556 2680 bnbbhb.exe 33 PID 2556 wrote to memory of 2552 2556 dvjdd.exe 34 PID 2556 wrote to memory of 2552 2556 dvjdd.exe 34 PID 2556 wrote to memory of 2552 2556 dvjdd.exe 34 PID 2556 wrote to memory of 2552 2556 dvjdd.exe 34 PID 2552 wrote to memory of 2792 2552 7ffxrll.exe 35 PID 2552 wrote to memory of 2792 2552 7ffxrll.exe 35 PID 2552 wrote to memory of 2792 2552 7ffxrll.exe 35 PID 2552 wrote to memory of 2792 2552 7ffxrll.exe 35 PID 2792 wrote to memory of 2412 2792 hthbbb.exe 36 PID 2792 wrote to memory of 2412 2792 hthbbb.exe 36 PID 2792 wrote to memory of 2412 2792 hthbbb.exe 36 PID 2792 wrote to memory of 2412 2792 hthbbb.exe 36 PID 2412 wrote to memory of 992 2412 jjppp.exe 37 PID 2412 wrote to memory of 992 2412 jjppp.exe 37 PID 2412 wrote to memory of 992 2412 jjppp.exe 37 PID 2412 wrote to memory of 992 2412 jjppp.exe 37 PID 992 wrote to memory of 300 992 xrxfrlr.exe 38 PID 992 wrote to memory of 300 992 xrxfrlr.exe 38 PID 992 wrote to memory of 300 992 xrxfrlr.exe 38 PID 992 wrote to memory of 300 992 xrxfrlr.exe 38 PID 300 wrote to memory of 2856 300 tbhhnb.exe 39 PID 300 wrote to memory of 2856 300 tbhhnb.exe 39 PID 300 wrote to memory of 2856 300 tbhhnb.exe 39 PID 300 wrote to memory of 2856 300 tbhhnb.exe 39 PID 2856 wrote to memory of 3012 2856 jjdjv.exe 40 PID 2856 wrote to memory of 3012 2856 jjdjv.exe 40 PID 2856 wrote to memory of 3012 2856 jjdjv.exe 40 PID 2856 wrote to memory of 3012 2856 jjdjv.exe 40 PID 3012 wrote to memory of 2760 3012 rlxxfxf.exe 41 PID 3012 wrote to memory of 2760 3012 rlxxfxf.exe 41 PID 3012 wrote to memory of 2760 3012 rlxxfxf.exe 41 PID 3012 wrote to memory of 2760 3012 rlxxfxf.exe 41 PID 2760 wrote to memory of 1740 2760 nntttt.exe 42 PID 2760 wrote to memory of 1740 2760 nntttt.exe 42 PID 2760 wrote to memory of 1740 2760 nntttt.exe 42 PID 2760 wrote to memory of 1740 2760 nntttt.exe 42 PID 1740 wrote to memory of 1100 1740 bntnbb.exe 43 PID 1740 wrote to memory of 1100 1740 bntnbb.exe 43 PID 1740 wrote to memory of 1100 1740 bntnbb.exe 43 PID 1740 wrote to memory of 1100 1740 bntnbb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe"C:\Users\Admin\AppData\Local\Temp\bc5b4c86e869f1cb5902ef8b4f1546c92beb517c42864c81fd376dc918bda5bdN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\pjvdd.exec:\pjvdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1rfffff.exec:\1rfffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\3dddd.exec:\3dddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlxffxf.exec:\rlxffxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\bnbbhb.exec:\bnbbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\dvjdd.exec:\dvjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\7ffxrll.exec:\7ffxrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hthbbb.exec:\hthbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\jjppp.exec:\jjppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xrxfrlr.exec:\xrxfrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\tbhhnb.exec:\tbhhnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:300 -
\??\c:\jjdjv.exec:\jjdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\nntttt.exec:\nntttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\bntnbb.exec:\bntnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\3vdjj.exec:\3vdjj.exe17⤵
- Executes dropped EXE
PID:1100 -
\??\c:\7ntnnh.exec:\7ntnnh.exe18⤵
- Executes dropped EXE
PID:1264 -
\??\c:\3vddd.exec:\3vddd.exe19⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xxfllfl.exec:\xxfllfl.exe20⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nbtthb.exec:\nbtthb.exe21⤵
- Executes dropped EXE
PID:1772 -
\??\c:\dvjdj.exec:\dvjdj.exe22⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rxlflff.exec:\rxlflff.exe23⤵
- Executes dropped EXE
PID:1036 -
\??\c:\1htttn.exec:\1htttn.exe24⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9jvvd.exec:\9jvvd.exe25⤵
- Executes dropped EXE
PID:1876 -
\??\c:\xlxfrxl.exec:\xlxfrxl.exe26⤵
- Executes dropped EXE
PID:288 -
\??\c:\hntnnh.exec:\hntnnh.exe27⤵
- Executes dropped EXE
PID:2004 -
\??\c:\rxxrlfl.exec:\rxxrlfl.exe28⤵
- Executes dropped EXE
PID:620 -
\??\c:\bthnbh.exec:\bthnbh.exe29⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vpddj.exec:\vpddj.exe30⤵
- Executes dropped EXE
PID:796 -
\??\c:\5rlrxfl.exec:\5rlrxfl.exe31⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ttttbh.exec:\ttttbh.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rrrrlff.exec:\rrrrlff.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tbtntb.exec:\tbtntb.exe34⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7thnth.exec:\7thnth.exe35⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfllxfr.exec:\lfllxfr.exe36⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xxrflrl.exec:\xxrflrl.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bhtthh.exec:\bhtthh.exe38⤵
- Executes dropped EXE
PID:2376 -
\??\c:\vvpdj.exec:\vvpdj.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hbnbnn.exec:\hbnbnn.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nhbtbb.exec:\nhbtbb.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5rrrlrl.exec:\5rrrlrl.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\rxfffxf.exec:\rxfffxf.exe43⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hthbhh.exec:\hthbhh.exe44⤵
- Executes dropped EXE
PID:576 -
\??\c:\1dvvj.exec:\1dvvj.exe45⤵
- Executes dropped EXE
PID:580 -
\??\c:\rrflfrf.exec:\rrflfrf.exe46⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lffrrll.exec:\lffrrll.exe47⤵
- Executes dropped EXE
PID:1156 -
\??\c:\hthnnb.exec:\hthnnb.exe48⤵
- Executes dropped EXE
PID:824 -
\??\c:\5pdvd.exec:\5pdvd.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856 -
\??\c:\rrlrllr.exec:\rrlrllr.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\rfrlfxx.exec:\rfrlfxx.exe51⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1nbhbb.exec:\1nbhbb.exe52⤵
- Executes dropped EXE
PID:1868 -
\??\c:\vjpvv.exec:\vjpvv.exe53⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jvppj.exec:\jvppj.exe54⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9rxxfxf.exec:\9rxxfxf.exe55⤵
- Executes dropped EXE
PID:2748 -
\??\c:\thttbt.exec:\thttbt.exe56⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbhtbb.exec:\bbhtbb.exe57⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3ppdv.exec:\3ppdv.exe58⤵
- Executes dropped EXE
PID:1984 -
\??\c:\5lrlfxr.exec:\5lrlfxr.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\9thhbb.exec:\9thhbb.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\nbtntn.exec:\nbtntn.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\djpjp.exec:\djpjp.exe62⤵
- Executes dropped EXE
PID:2692 -
\??\c:\frrllxx.exec:\frrllxx.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:692 -
\??\c:\lfrxxxx.exec:\lfrxxxx.exe64⤵
- Executes dropped EXE
PID:292 -
\??\c:\hthntt.exec:\hthntt.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vdpdj.exec:\vdpdj.exe66⤵PID:2356
-
\??\c:\vdjdp.exec:\vdjdp.exe67⤵PID:288
-
\??\c:\lxlfllr.exec:\lxlfllr.exe68⤵PID:336
-
\??\c:\hbhbtn.exec:\hbhbtn.exe69⤵PID:2200
-
\??\c:\tnbtnn.exec:\tnbtnn.exe70⤵PID:1160
-
\??\c:\pdpjj.exec:\pdpjj.exe71⤵PID:2444
-
\??\c:\lrxfxrr.exec:\lrxfxrr.exe72⤵PID:2968
-
\??\c:\1tbtnt.exec:\1tbtnt.exe73⤵PID:1056
-
\??\c:\htnnhn.exec:\htnnhn.exe74⤵PID:1032
-
\??\c:\dvddj.exec:\dvddj.exe75⤵PID:2132
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe76⤵PID:1972
-
\??\c:\tnhhth.exec:\tnhhth.exe77⤵PID:2796
-
\??\c:\nhbtbt.exec:\nhbtbt.exe78⤵PID:2648
-
\??\c:\dvdvd.exec:\dvdvd.exe79⤵PID:2140
-
\??\c:\9lxxxrr.exec:\9lxxxrr.exe80⤵PID:2632
-
\??\c:\xlllfxx.exec:\xlllfxx.exe81⤵PID:2772
-
\??\c:\3nttnn.exec:\3nttnn.exe82⤵PID:2736
-
\??\c:\9pvvp.exec:\9pvvp.exe83⤵PID:2776
-
\??\c:\1dppp.exec:\1dppp.exe84⤵PID:2180
-
\??\c:\flrlllf.exec:\flrlllf.exe85⤵PID:2992
-
\??\c:\tntnhn.exec:\tntnhn.exe86⤵PID:1788
-
\??\c:\hnnnnt.exec:\hnnnnt.exe87⤵PID:2996
-
\??\c:\jvddd.exec:\jvddd.exe88⤵PID:1108
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe89⤵PID:868
-
\??\c:\xlrxxxx.exec:\xlrxxxx.exe90⤵PID:2848
-
\??\c:\3bhhnn.exec:\3bhhnn.exe91⤵PID:844
-
\??\c:\jvddd.exec:\jvddd.exe92⤵PID:3036
-
\??\c:\vjdvp.exec:\vjdvp.exe93⤵PID:2852
-
\??\c:\lxfllfr.exec:\lxfllfr.exe94⤵PID:2760
-
\??\c:\5tbttt.exec:\5tbttt.exe95⤵PID:1752
-
\??\c:\thnnnh.exec:\thnnnh.exe96⤵PID:1252
-
\??\c:\djpjp.exec:\djpjp.exe97⤵PID:1248
-
\??\c:\jpdvp.exec:\jpdvp.exe98⤵PID:1264
-
\??\c:\3xlfffl.exec:\3xlfffl.exe99⤵PID:1720
-
\??\c:\tntbbb.exec:\tntbbb.exe100⤵PID:852
-
\??\c:\1nhttn.exec:\1nhttn.exe101⤵PID:1984
-
\??\c:\vpdjj.exec:\vpdjj.exe102⤵PID:2484
-
\??\c:\7llrxxr.exec:\7llrxxr.exe103⤵PID:2364
-
\??\c:\xlxxxrx.exec:\xlxxxrx.exe104⤵PID:2932
-
\??\c:\5bnbth.exec:\5bnbth.exe105⤵PID:2208
-
\??\c:\vjdjv.exec:\vjdjv.exe106⤵PID:2172
-
\??\c:\7vjvv.exec:\7vjvv.exe107⤵PID:2380
-
\??\c:\fllllfl.exec:\fllllfl.exe108⤵PID:1520
-
\??\c:\7nbhbt.exec:\7nbhbt.exe109⤵PID:2108
-
\??\c:\bnnhnh.exec:\bnnhnh.exe110⤵PID:336
-
\??\c:\jdjjj.exec:\jdjjj.exe111⤵PID:2468
-
\??\c:\frrlfrl.exec:\frrlfrl.exe112⤵PID:2300
-
\??\c:\9frlffl.exec:\9frlffl.exe113⤵PID:2304
-
\??\c:\nbhnnn.exec:\nbhnnn.exe114⤵PID:2980
-
\??\c:\pjjdj.exec:\pjjdj.exe115⤵PID:1072
-
\??\c:\djvjj.exec:\djvjj.exe116⤵PID:2124
-
\??\c:\9flxrrl.exec:\9flxrrl.exe117⤵PID:1512
-
\??\c:\xrxrrlr.exec:\xrxrrlr.exe118⤵PID:1604
-
\??\c:\3bbttn.exec:\3bbttn.exe119⤵PID:2652
-
\??\c:\5dvvp.exec:\5dvvp.exe120⤵PID:2628
-
\??\c:\dvjjj.exec:\dvjjj.exe121⤵PID:2916
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe122⤵PID:2824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-