Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe
-
Size
454KB
-
MD5
f1426cf9be092473495d8cc67f88a96d
-
SHA1
010a9792407b5d3aedfae8b1b369532746abe0b4
-
SHA256
60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583
-
SHA512
443c001f7a7366a48d8dc0cb77128e56cd5b8dd3b849c872cb5737c319e29e2948dd707818c75d85f21ac7d69703ce69dbf70b47ab6b455d8ee81d4fa0af93bc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/2824-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1904-271-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1432-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/628-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-432-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-482-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2288-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-521-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-576-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/932-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-809-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1904-829-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-832-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/880-843-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1232-934-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2744-1076-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2672 nbntbh.exe 2564 vvjpd.exe 2840 fxrxflr.exe 2528 frflrxf.exe 2504 9hnnnt.exe 2996 vppvd.exe 1860 xrlxffr.exe 628 ttnnbb.exe 2980 jdvdp.exe 2388 5xrxxrr.exe 1704 rrlrxrl.exe 2320 3bnhnn.exe 1564 dpppp.exe 1196 5xlffll.exe 2032 1ntthh.exe 2752 vvpdj.exe 1708 fxfflfl.exe 2132 bthntb.exe 2508 vvjjv.exe 1352 5rxxflf.exe 1864 ttbhhn.exe 2116 vvvdp.exe 1512 9lxxxrr.exe 1560 7hbbhn.exe 1660 pjppv.exe 1652 1rxxxxx.exe 892 hhbbbb.exe 2344 5pdvj.exe 2092 nhbtbb.exe 1884 dvddp.exe 1904 xlxrxxx.exe 1432 pjvpv.exe 2680 tnbbhb.exe 1520 3dvdv.exe 2124 pjjpv.exe 2552 tnhbbt.exe 2560 7djjd.exe 2828 xrrrlff.exe 2696 thtnnh.exe 264 pjvpp.exe 576 7rrllfl.exe 1408 thnttt.exe 628 9pvdd.exe 2968 7xrfffl.exe 772 hbntbh.exe 2588 3vjpj.exe 1836 dpjdj.exe 1496 7llffff.exe 1108 nbhtbt.exe 2372 vvpvj.exe 2768 1vddj.exe 2800 frfrlfl.exe 2596 7thnnn.exe 1928 ddpjj.exe 2132 fxlffff.exe 2924 frxrlfx.exe 1256 bbnntt.exe 1864 7jvjd.exe 868 pddvv.exe 2760 7xffxrr.exe 760 nhbttn.exe 656 dpdvd.exe 2288 1vjjj.exe 1636 lxfrxxx.exe -
resource yara_rule behavioral1/memory/2824-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/892-236-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1884-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-432-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2924-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-521-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-583-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-801-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1904-829-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-1076-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2712-1087-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2672 2824 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 30 PID 2824 wrote to memory of 2672 2824 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 30 PID 2824 wrote to memory of 2672 2824 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 30 PID 2824 wrote to memory of 2672 2824 60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe 30 PID 2672 wrote to memory of 2564 2672 nbntbh.exe 31 PID 2672 wrote to memory of 2564 2672 nbntbh.exe 31 PID 2672 wrote to memory of 2564 2672 nbntbh.exe 31 PID 2672 wrote to memory of 2564 2672 nbntbh.exe 31 PID 2564 wrote to memory of 2840 2564 vvjpd.exe 32 PID 2564 wrote to memory of 2840 2564 vvjpd.exe 32 PID 2564 wrote to memory of 2840 2564 vvjpd.exe 32 PID 2564 wrote to memory of 2840 2564 vvjpd.exe 32 PID 2840 wrote to memory of 2528 2840 fxrxflr.exe 33 PID 2840 wrote to memory of 2528 2840 fxrxflr.exe 33 PID 2840 wrote to memory of 2528 2840 fxrxflr.exe 33 PID 2840 wrote to memory of 2528 2840 fxrxflr.exe 33 PID 2528 wrote to memory of 2504 2528 frflrxf.exe 34 PID 2528 wrote to memory of 2504 2528 frflrxf.exe 34 PID 2528 wrote to memory of 2504 2528 frflrxf.exe 34 PID 2528 wrote to memory of 2504 2528 frflrxf.exe 34 PID 2504 wrote to memory of 2996 2504 9hnnnt.exe 35 PID 2504 wrote to memory of 2996 2504 9hnnnt.exe 35 PID 2504 wrote to memory of 2996 2504 9hnnnt.exe 35 PID 2504 wrote to memory of 2996 2504 9hnnnt.exe 35 PID 2996 wrote to memory of 1860 2996 vppvd.exe 36 PID 2996 wrote to memory of 1860 2996 vppvd.exe 36 PID 2996 wrote to memory of 1860 2996 vppvd.exe 36 PID 2996 wrote to memory of 1860 2996 vppvd.exe 36 PID 1860 wrote to memory of 628 1860 xrlxffr.exe 37 PID 1860 wrote to memory of 628 1860 xrlxffr.exe 37 PID 1860 wrote to memory of 628 1860 xrlxffr.exe 37 PID 1860 wrote to memory of 628 1860 xrlxffr.exe 37 PID 628 wrote to memory of 2980 628 ttnnbb.exe 38 PID 628 wrote to memory of 2980 628 ttnnbb.exe 38 PID 628 wrote to memory of 2980 628 ttnnbb.exe 38 PID 628 wrote to memory of 2980 628 ttnnbb.exe 38 PID 2980 wrote to memory of 2388 2980 jdvdp.exe 39 PID 2980 wrote to memory of 2388 2980 jdvdp.exe 39 PID 2980 wrote to memory of 2388 2980 jdvdp.exe 39 PID 2980 wrote to memory of 2388 2980 jdvdp.exe 39 PID 2388 wrote to memory of 1704 2388 5xrxxrr.exe 40 PID 2388 wrote to memory of 1704 2388 5xrxxrr.exe 40 PID 2388 wrote to memory of 1704 2388 5xrxxrr.exe 40 PID 2388 wrote to memory of 1704 2388 5xrxxrr.exe 40 PID 1704 wrote to memory of 2320 1704 rrlrxrl.exe 41 PID 1704 wrote to memory of 2320 1704 rrlrxrl.exe 41 PID 1704 wrote to memory of 2320 1704 rrlrxrl.exe 41 PID 1704 wrote to memory of 2320 1704 rrlrxrl.exe 41 PID 2320 wrote to memory of 1564 2320 3bnhnn.exe 42 PID 2320 wrote to memory of 1564 2320 3bnhnn.exe 42 PID 2320 wrote to memory of 1564 2320 3bnhnn.exe 42 PID 2320 wrote to memory of 1564 2320 3bnhnn.exe 42 PID 1564 wrote to memory of 1196 1564 dpppp.exe 43 PID 1564 wrote to memory of 1196 1564 dpppp.exe 43 PID 1564 wrote to memory of 1196 1564 dpppp.exe 43 PID 1564 wrote to memory of 1196 1564 dpppp.exe 43 PID 1196 wrote to memory of 2032 1196 5xlffll.exe 44 PID 1196 wrote to memory of 2032 1196 5xlffll.exe 44 PID 1196 wrote to memory of 2032 1196 5xlffll.exe 44 PID 1196 wrote to memory of 2032 1196 5xlffll.exe 44 PID 2032 wrote to memory of 2752 2032 1ntthh.exe 45 PID 2032 wrote to memory of 2752 2032 1ntthh.exe 45 PID 2032 wrote to memory of 2752 2032 1ntthh.exe 45 PID 2032 wrote to memory of 2752 2032 1ntthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe"C:\Users\Admin\AppData\Local\Temp\60fa3765523a8ac6cc067363d249cc07e3123a71ced329a5dfcb2b1c8b6ee583.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\nbntbh.exec:\nbntbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\vvjpd.exec:\vvjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxrxflr.exec:\fxrxflr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\frflrxf.exec:\frflrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\9hnnnt.exec:\9hnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vppvd.exec:\vppvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\xrlxffr.exec:\xrlxffr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\ttnnbb.exec:\ttnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\jdvdp.exec:\jdvdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\5xrxxrr.exec:\5xrxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rrlrxrl.exec:\rrlrxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\3bnhnn.exec:\3bnhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\dpppp.exec:\dpppp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\5xlffll.exec:\5xlffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\1ntthh.exec:\1ntthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\vvpdj.exec:\vvpdj.exe17⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fxfflfl.exec:\fxfflfl.exe18⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bthntb.exec:\bthntb.exe19⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vvjjv.exec:\vvjjv.exe20⤵
- Executes dropped EXE
PID:2508 -
\??\c:\5rxxflf.exec:\5rxxflf.exe21⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ttbhhn.exec:\ttbhhn.exe22⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vvvdp.exec:\vvvdp.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9lxxxrr.exec:\9lxxxrr.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7hbbhn.exec:\7hbbhn.exe25⤵
- Executes dropped EXE
PID:1560 -
\??\c:\pjppv.exec:\pjppv.exe26⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1rxxxxx.exec:\1rxxxxx.exe27⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hhbbbb.exec:\hhbbbb.exe28⤵
- Executes dropped EXE
PID:892 -
\??\c:\5pdvj.exec:\5pdvj.exe29⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhbtbb.exec:\nhbtbb.exe30⤵
- Executes dropped EXE
PID:2092 -
\??\c:\dvddp.exec:\dvddp.exe31⤵
- Executes dropped EXE
PID:1884 -
\??\c:\xlxrxxx.exec:\xlxrxxx.exe32⤵
- Executes dropped EXE
PID:1904 -
\??\c:\pjvpv.exec:\pjvpv.exe33⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tnbbhb.exec:\tnbbhb.exe34⤵
- Executes dropped EXE
PID:2680 -
\??\c:\3dvdv.exec:\3dvdv.exe35⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pjjpv.exec:\pjjpv.exe36⤵
- Executes dropped EXE
PID:2124 -
\??\c:\tnhbbt.exec:\tnhbbt.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\7djjd.exec:\7djjd.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xrrrlff.exec:\xrrrlff.exe39⤵
- Executes dropped EXE
PID:2828 -
\??\c:\thtnnh.exec:\thtnnh.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjvpp.exec:\pjvpp.exe41⤵
- Executes dropped EXE
PID:264 -
\??\c:\7rrllfl.exec:\7rrllfl.exe42⤵
- Executes dropped EXE
PID:576 -
\??\c:\thnttt.exec:\thnttt.exe43⤵
- Executes dropped EXE
PID:1408 -
\??\c:\9pvdd.exec:\9pvdd.exe44⤵
- Executes dropped EXE
PID:628 -
\??\c:\7xrfffl.exec:\7xrfffl.exe45⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hbntbh.exec:\hbntbh.exe46⤵
- Executes dropped EXE
PID:772 -
\??\c:\3vjpj.exec:\3vjpj.exe47⤵
- Executes dropped EXE
PID:2588 -
\??\c:\dpjdj.exec:\dpjdj.exe48⤵
- Executes dropped EXE
PID:1836 -
\??\c:\7llffff.exec:\7llffff.exe49⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nbhtbt.exec:\nbhtbt.exe50⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vvpvj.exec:\vvpvj.exe51⤵
- Executes dropped EXE
PID:2372 -
\??\c:\1vddj.exec:\1vddj.exe52⤵
- Executes dropped EXE
PID:2768 -
\??\c:\frfrlfl.exec:\frfrlfl.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7thnnn.exec:\7thnnn.exe54⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2596 -
\??\c:\ddpjj.exec:\ddpjj.exe55⤵
- Executes dropped EXE
PID:1928 -
\??\c:\fxlffff.exec:\fxlffff.exe56⤵
- Executes dropped EXE
PID:2132 -
\??\c:\frxrlfx.exec:\frxrlfx.exe57⤵
- Executes dropped EXE
PID:2924 -
\??\c:\bbnntt.exec:\bbnntt.exe58⤵
- Executes dropped EXE
PID:1256 -
\??\c:\7jvjd.exec:\7jvjd.exe59⤵
- Executes dropped EXE
PID:1864 -
\??\c:\pddvv.exec:\pddvv.exe60⤵
- Executes dropped EXE
PID:868 -
\??\c:\7xffxrr.exec:\7xffxrr.exe61⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nhbttn.exec:\nhbttn.exe62⤵
- Executes dropped EXE
PID:760 -
\??\c:\dpdvd.exec:\dpdvd.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\1vjjj.exec:\1vjjj.exe64⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lxfrxxx.exec:\lxfrxxx.exe65⤵
- Executes dropped EXE
PID:1636 -
\??\c:\thnbbt.exec:\thnbbt.exe66⤵PID:2060
-
\??\c:\dvjvv.exec:\dvjvv.exe67⤵PID:1848
-
\??\c:\vjjjd.exec:\vjjjd.exe68⤵PID:1648
-
\??\c:\frfrlfl.exec:\frfrlfl.exe69⤵PID:904
-
\??\c:\1hbhhn.exec:\1hbhhn.exe70⤵PID:2344
-
\??\c:\jdjjj.exec:\jdjjj.exe71⤵PID:3020
-
\??\c:\5xlrlfl.exec:\5xlrlfl.exe72⤵PID:2900
-
\??\c:\7hbhhb.exec:\7hbhhb.exe73⤵PID:3036
-
\??\c:\hbnnnh.exec:\hbnnnh.exe74⤵PID:2264
-
\??\c:\pppjj.exec:\pppjj.exe75⤵PID:2296
-
\??\c:\xlfxxff.exec:\xlfxxff.exe76⤵PID:2684
-
\??\c:\7ttnhh.exec:\7ttnhh.exe77⤵PID:2672
-
\??\c:\jvpjj.exec:\jvpjj.exe78⤵PID:2852
-
\??\c:\dvvvp.exec:\dvvvp.exe79⤵PID:2548
-
\??\c:\xlfflfl.exec:\xlfflfl.exe80⤵PID:2560
-
\??\c:\tthhnn.exec:\tthhnn.exe81⤵PID:3016
-
\??\c:\9bbbbb.exec:\9bbbbb.exe82⤵PID:2644
-
\??\c:\jjdvd.exec:\jjdvd.exe83⤵PID:2592
-
\??\c:\xlflxfl.exec:\xlflxfl.exe84⤵PID:2616
-
\??\c:\nttthh.exec:\nttthh.exe85⤵PID:2888
-
\??\c:\nbhhtn.exec:\nbhhtn.exe86⤵PID:2180
-
\??\c:\9pjdj.exec:\9pjdj.exe87⤵PID:2380
-
\??\c:\llrllfl.exec:\llrllfl.exe88⤵PID:2400
-
\??\c:\rrlrxrr.exec:\rrlrxrr.exe89⤵PID:1704
-
\??\c:\hthbbt.exec:\hthbbt.exe90⤵PID:568
-
\??\c:\3pdvv.exec:\3pdvv.exe91⤵PID:2292
-
\??\c:\pjvpp.exec:\pjvpp.exe92⤵PID:1420
-
\??\c:\3frxxxx.exec:\3frxxxx.exe93⤵PID:2032
-
\??\c:\hhbbhh.exec:\hhbbhh.exe94⤵PID:620
-
\??\c:\jdvvv.exec:\jdvvv.exe95⤵PID:1732
-
\??\c:\pjdvv.exec:\pjdvv.exe96⤵PID:1728
-
\??\c:\ffxxllr.exec:\ffxxllr.exe97⤵PID:1680
-
\??\c:\frxlfrf.exec:\frxlfrf.exe98⤵PID:2216
-
\??\c:\hbtttt.exec:\hbtttt.exe99⤵PID:2224
-
\??\c:\vjvpd.exec:\vjvpd.exe100⤵PID:1352
-
\??\c:\rlffllr.exec:\rlffllr.exe101⤵PID:2740
-
\??\c:\fxlxlfr.exec:\fxlxlfr.exe102⤵PID:2144
-
\??\c:\nnhhnn.exec:\nnhhnn.exe103⤵PID:1080
-
\??\c:\dvjjp.exec:\dvjjp.exe104⤵PID:2860
-
\??\c:\ffxrxfl.exec:\ffxrxfl.exe105⤵PID:1736
-
\??\c:\lfrlllr.exec:\lfrlllr.exe106⤵PID:2248
-
\??\c:\tnnhhh.exec:\tnnhhh.exe107⤵PID:1644
-
\??\c:\5dppj.exec:\5dppj.exe108⤵PID:932
-
\??\c:\dvpjp.exec:\dvpjp.exe109⤵PID:1696
-
\??\c:\lxfxrfl.exec:\lxfxrfl.exe110⤵PID:664
-
\??\c:\btntbh.exec:\btntbh.exe111⤵PID:1584
-
\??\c:\jdpvv.exec:\jdpvv.exe112⤵PID:2744
-
\??\c:\ppppd.exec:\ppppd.exe113⤵PID:2344
-
\??\c:\xrxxxrf.exec:\xrxxxrf.exe114⤵PID:1412
-
\??\c:\7hhntt.exec:\7hhntt.exe115⤵PID:880
-
\??\c:\jdvvp.exec:\jdvvp.exe116⤵PID:1904
-
\??\c:\dvvdd.exec:\dvvdd.exe117⤵PID:1516
-
\??\c:\fxrxllx.exec:\fxrxllx.exe118⤵PID:2680
-
\??\c:\hbnbhn.exec:\hbnbhn.exe119⤵PID:2780
-
\??\c:\ppjjd.exec:\ppjjd.exe120⤵PID:2524
-
\??\c:\5lrrrlr.exec:\5lrrrlr.exe121⤵PID:2692
-
\??\c:\xlrfxrx.exec:\xlrfxrx.exe122⤵PID:2628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-