Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe
-
Size
455KB
-
MD5
688f2d84932e870bb5ede32ff831a7c5
-
SHA1
dd3a0233daa51e1bb90f5695af83856cd6eab503
-
SHA256
38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e
-
SHA512
4100c01a9cb2c4b26efaff6d4dfaba5ec5b85771a44eca4028757b1f124dce72bfc4815841220c2883b3241d9021163eaac7d97739e01fb53c5b3039384db9ef
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRz:q7Tc2NYHUrAwfMp3CDRz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2692-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-22-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/552-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-41-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-99-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2064-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1192-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-259-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2500-264-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2500-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1696-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1848-275-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-279-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1432-283-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2076-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1252-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-372-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-466-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-488-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/1192-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2040-566-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 dpjjv.exe 552 hbnnnb.exe 2572 djpjj.exe 2656 nnbbhn.exe 2588 vpjpd.exe 2596 lfxxffr.exe 2532 fxrrllr.exe 2980 ppddp.exe 2176 rllrffr.exe 2064 vvpvd.exe 1976 xfflxrf.exe 2776 bbnthh.exe 2876 rrflrxx.exe 2956 pdvvd.exe 1584 rrlrffr.exe 1836 djdpp.exe 2512 dpjpd.exe 1608 3btthn.exe 2416 vjddj.exe 1196 ffxxxxr.exe 2300 bthbhh.exe 1296 xrllflx.exe 1192 nhtbnn.exe 1468 5vjdj.exe 1696 3lxflff.exe 2500 tbntbh.exe 1848 vpjvj.exe 1432 tnhhnt.exe 2076 7jvpp.exe 2756 btntbt.exe 2688 vdvpv.exe 2976 ffxlflx.exe 2952 9bnttb.exe 2572 vvddj.exe 2616 7lfllrx.exe 2588 tnbhnt.exe 2604 1pddj.exe 1252 rfxxffl.exe 2904 bnhhnn.exe 2228 7bntbh.exe 2928 3vpvv.exe 2992 1frrrrr.exe 2064 htnhhh.exe 2872 1tnhtt.exe 2940 1pvjp.exe 2864 3frlllr.exe 2936 xrxfrlr.exe 324 3tbtbb.exe 1972 9dpdd.exe 1248 frffffr.exe 1012 xlllfrf.exe 1876 ntbhht.exe 2404 ddvvd.exe 1704 1pjdv.exe 2416 fxxlflx.exe 2068 nbbbtb.exe 624 1bnbtt.exe 932 3jdvv.exe 1296 lfxffxr.exe 1192 hbbhhn.exe 2308 3nhnnt.exe 1464 vpddj.exe 1212 rfrfxfl.exe 1572 tnbbnn.exe -
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-22-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/552-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-41-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-53-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1848-275-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1252-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-372-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-466-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-517-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-553-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2768 2692 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 31 PID 2692 wrote to memory of 2768 2692 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 31 PID 2692 wrote to memory of 2768 2692 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 31 PID 2692 wrote to memory of 2768 2692 38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe 31 PID 2768 wrote to memory of 552 2768 dpjjv.exe 32 PID 2768 wrote to memory of 552 2768 dpjjv.exe 32 PID 2768 wrote to memory of 552 2768 dpjjv.exe 32 PID 2768 wrote to memory of 552 2768 dpjjv.exe 32 PID 552 wrote to memory of 2572 552 hbnnnb.exe 33 PID 552 wrote to memory of 2572 552 hbnnnb.exe 33 PID 552 wrote to memory of 2572 552 hbnnnb.exe 33 PID 552 wrote to memory of 2572 552 hbnnnb.exe 33 PID 2572 wrote to memory of 2656 2572 djpjj.exe 34 PID 2572 wrote to memory of 2656 2572 djpjj.exe 34 PID 2572 wrote to memory of 2656 2572 djpjj.exe 34 PID 2572 wrote to memory of 2656 2572 djpjj.exe 34 PID 2656 wrote to memory of 2588 2656 nnbbhn.exe 35 PID 2656 wrote to memory of 2588 2656 nnbbhn.exe 35 PID 2656 wrote to memory of 2588 2656 nnbbhn.exe 35 PID 2656 wrote to memory of 2588 2656 nnbbhn.exe 35 PID 2588 wrote to memory of 2596 2588 vpjpd.exe 36 PID 2588 wrote to memory of 2596 2588 vpjpd.exe 36 PID 2588 wrote to memory of 2596 2588 vpjpd.exe 36 PID 2588 wrote to memory of 2596 2588 vpjpd.exe 36 PID 2596 wrote to memory of 2532 2596 lfxxffr.exe 37 PID 2596 wrote to memory of 2532 2596 lfxxffr.exe 37 PID 2596 wrote to memory of 2532 2596 lfxxffr.exe 37 PID 2596 wrote to memory of 2532 2596 lfxxffr.exe 37 PID 2532 wrote to memory of 2980 2532 fxrrllr.exe 38 PID 2532 wrote to memory of 2980 2532 fxrrllr.exe 38 PID 2532 wrote to memory of 2980 2532 fxrrllr.exe 38 PID 2532 wrote to memory of 2980 2532 fxrrllr.exe 38 PID 2980 wrote to memory of 2176 2980 ppddp.exe 39 PID 2980 wrote to memory of 2176 2980 ppddp.exe 39 PID 2980 wrote to memory of 2176 2980 ppddp.exe 39 PID 2980 wrote to memory of 2176 2980 ppddp.exe 39 PID 2176 wrote to memory of 2064 2176 rllrffr.exe 40 PID 2176 wrote to memory of 2064 2176 rllrffr.exe 40 PID 2176 wrote to memory of 2064 2176 rllrffr.exe 40 PID 2176 wrote to memory of 2064 2176 rllrffr.exe 40 PID 2064 wrote to memory of 1976 2064 vvpvd.exe 41 PID 2064 wrote to memory of 1976 2064 vvpvd.exe 41 PID 2064 wrote to memory of 1976 2064 vvpvd.exe 41 PID 2064 wrote to memory of 1976 2064 vvpvd.exe 41 PID 1976 wrote to memory of 2776 1976 xfflxrf.exe 42 PID 1976 wrote to memory of 2776 1976 xfflxrf.exe 42 PID 1976 wrote to memory of 2776 1976 xfflxrf.exe 42 PID 1976 wrote to memory of 2776 1976 xfflxrf.exe 42 PID 2776 wrote to memory of 2876 2776 bbnthh.exe 43 PID 2776 wrote to memory of 2876 2776 bbnthh.exe 43 PID 2776 wrote to memory of 2876 2776 bbnthh.exe 43 PID 2776 wrote to memory of 2876 2776 bbnthh.exe 43 PID 2876 wrote to memory of 2956 2876 rrflrxx.exe 44 PID 2876 wrote to memory of 2956 2876 rrflrxx.exe 44 PID 2876 wrote to memory of 2956 2876 rrflrxx.exe 44 PID 2876 wrote to memory of 2956 2876 rrflrxx.exe 44 PID 2956 wrote to memory of 1584 2956 pdvvd.exe 45 PID 2956 wrote to memory of 1584 2956 pdvvd.exe 45 PID 2956 wrote to memory of 1584 2956 pdvvd.exe 45 PID 2956 wrote to memory of 1584 2956 pdvvd.exe 45 PID 1584 wrote to memory of 1836 1584 rrlrffr.exe 46 PID 1584 wrote to memory of 1836 1584 rrlrffr.exe 46 PID 1584 wrote to memory of 1836 1584 rrlrffr.exe 46 PID 1584 wrote to memory of 1836 1584 rrlrffr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe"C:\Users\Admin\AppData\Local\Temp\38e6fde750e22af7f43790d0005f30e25d5fe5c63c99289c1e71ce4c30076a4e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\dpjjv.exec:\dpjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hbnnnb.exec:\hbnnnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\djpjj.exec:\djpjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\nnbbhn.exec:\nnbbhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vpjpd.exec:\vpjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lfxxffr.exec:\lfxxffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\fxrrllr.exec:\fxrrllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\ppddp.exec:\ppddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\rllrffr.exec:\rllrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\vvpvd.exec:\vvpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\xfflxrf.exec:\xfflxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\bbnthh.exec:\bbnthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rrflrxx.exec:\rrflrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\pdvvd.exec:\pdvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\rrlrffr.exec:\rrlrffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\djdpp.exec:\djdpp.exe17⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dpjpd.exec:\dpjpd.exe18⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3btthn.exec:\3btthn.exe19⤵
- Executes dropped EXE
PID:1608 -
\??\c:\vjddj.exec:\vjddj.exe20⤵
- Executes dropped EXE
PID:2416 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe21⤵
- Executes dropped EXE
PID:1196 -
\??\c:\bthbhh.exec:\bthbhh.exe22⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xrllflx.exec:\xrllflx.exe23⤵
- Executes dropped EXE
PID:1296 -
\??\c:\nhtbnn.exec:\nhtbnn.exe24⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5vjdj.exec:\5vjdj.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\3lxflff.exec:\3lxflff.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\tbntbh.exec:\tbntbh.exe27⤵
- Executes dropped EXE
PID:2500 -
\??\c:\vpjvj.exec:\vpjvj.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tnhhnt.exec:\tnhhnt.exe29⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7jvpp.exec:\7jvpp.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\btntbt.exec:\btntbt.exe31⤵
- Executes dropped EXE
PID:2756 -
\??\c:\vdvpv.exec:\vdvpv.exe32⤵
- Executes dropped EXE
PID:2688 -
\??\c:\ffxlflx.exec:\ffxlflx.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9bnttb.exec:\9bnttb.exe34⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vvddj.exec:\vvddj.exe35⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7lfllrx.exec:\7lfllrx.exe36⤵
- Executes dropped EXE
PID:2616 -
\??\c:\tnbhnt.exec:\tnbhnt.exe37⤵
- Executes dropped EXE
PID:2588 -
\??\c:\1pddj.exec:\1pddj.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rfxxffl.exec:\rfxxffl.exe39⤵
- Executes dropped EXE
PID:1252 -
\??\c:\bnhhnn.exec:\bnhhnn.exe40⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7bntbh.exec:\7bntbh.exe41⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3vpvv.exec:\3vpvv.exe42⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1frrrrr.exec:\1frrrrr.exe43⤵
- Executes dropped EXE
PID:2992 -
\??\c:\htnhhh.exec:\htnhhh.exe44⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1tnhtt.exec:\1tnhtt.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\1pvjp.exec:\1pvjp.exe46⤵
- Executes dropped EXE
PID:2940 -
\??\c:\3frlllr.exec:\3frlllr.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xrxfrlr.exec:\xrxfrlr.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\3tbtbb.exec:\3tbtbb.exe49⤵
- Executes dropped EXE
PID:324 -
\??\c:\9dpdd.exec:\9dpdd.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\frffffr.exec:\frffffr.exe51⤵
- Executes dropped EXE
PID:1248 -
\??\c:\xlllfrf.exec:\xlllfrf.exe52⤵
- Executes dropped EXE
PID:1012 -
\??\c:\ntbhht.exec:\ntbhht.exe53⤵
- Executes dropped EXE
PID:1876 -
\??\c:\ddvvd.exec:\ddvvd.exe54⤵
- Executes dropped EXE
PID:2404 -
\??\c:\1pjdv.exec:\1pjdv.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\fxxlflx.exec:\fxxlflx.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nbbbtb.exec:\nbbbtb.exe57⤵
- Executes dropped EXE
PID:2068 -
\??\c:\1bnbtt.exec:\1bnbtt.exe58⤵
- Executes dropped EXE
PID:624 -
\??\c:\3jdvv.exec:\3jdvv.exe59⤵
- Executes dropped EXE
PID:932 -
\??\c:\lfxffxr.exec:\lfxffxr.exe60⤵
- Executes dropped EXE
PID:1296 -
\??\c:\hbbhhn.exec:\hbbhhn.exe61⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3nhnnt.exec:\3nhnnt.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpddj.exec:\vpddj.exe63⤵
- Executes dropped EXE
PID:1464 -
\??\c:\rfrfxfl.exec:\rfrfxfl.exe64⤵
- Executes dropped EXE
PID:1212 -
\??\c:\tnbbnn.exec:\tnbbnn.exe65⤵
- Executes dropped EXE
PID:1572 -
\??\c:\nbhbhb.exec:\nbhbhb.exe66⤵PID:1000
-
\??\c:\3dvjp.exec:\3dvjp.exe67⤵PID:2128
-
\??\c:\5lxflxx.exec:\5lxflxx.exe68⤵PID:2040
-
\??\c:\bthbbb.exec:\bthbbb.exe69⤵PID:3068
-
\??\c:\nhtbhn.exec:\nhtbhn.exe70⤵PID:2756
-
\??\c:\pdpvv.exec:\pdpvv.exe71⤵PID:2676
-
\??\c:\xrffrrx.exec:\xrffrrx.exe72⤵PID:2660
-
\??\c:\nhnntt.exec:\nhnntt.exe73⤵PID:1632
-
\??\c:\tthtbh.exec:\tthtbh.exe74⤵PID:2952
-
\??\c:\vdjvd.exec:\vdjvd.exe75⤵PID:2680
-
\??\c:\vpddd.exec:\vpddd.exe76⤵PID:2816
-
\??\c:\frfxxfl.exec:\frfxxfl.exe77⤵PID:2712
-
\??\c:\nbnhnh.exec:\nbnhnh.exe78⤵PID:1844
-
\??\c:\thbttt.exec:\thbttt.exe79⤵PID:3008
-
\??\c:\pppdd.exec:\pppdd.exe80⤵PID:2264
-
\??\c:\rrfflrx.exec:\rrfflrx.exe81⤵PID:2640
-
\??\c:\frxffxx.exec:\frxffxx.exe82⤵PID:2724
-
\??\c:\tbtnth.exec:\tbtnth.exe83⤵PID:604
-
\??\c:\ppjvp.exec:\ppjvp.exe84⤵PID:2280
-
\??\c:\3dppv.exec:\3dppv.exe85⤵PID:1976
-
\??\c:\lxflllr.exec:\lxflllr.exe86⤵PID:2884
-
\??\c:\1hbttt.exec:\1hbttt.exe87⤵PID:2868
-
\??\c:\hthhbt.exec:\hthhbt.exe88⤵PID:992
-
\??\c:\7pjdj.exec:\7pjdj.exe89⤵PID:2936
-
\??\c:\3pddp.exec:\3pddp.exe90⤵PID:1540
-
\??\c:\lxrrxrf.exec:\lxrrxrf.exe91⤵PID:2168
-
\??\c:\thnhhh.exec:\thnhhh.exe92⤵PID:1884
-
\??\c:\bnbbhh.exec:\bnbbhh.exe93⤵PID:2360
-
\??\c:\dvddj.exec:\dvddj.exe94⤵PID:1876
-
\??\c:\ffrxfxf.exec:\ffrxfxf.exe95⤵PID:2404
-
\??\c:\xrlflfr.exec:\xrlflfr.exe96⤵PID:1140
-
\??\c:\bthbhb.exec:\bthbhb.exe97⤵PID:1960
-
\??\c:\bnbhhn.exec:\bnbhhn.exe98⤵PID:1188
-
\??\c:\jpvdv.exec:\jpvdv.exe99⤵PID:1508
-
\??\c:\lxfxxff.exec:\lxfxxff.exe100⤵
- System Location Discovery: System Language Discovery
PID:1932 -
\??\c:\9hbttt.exec:\9hbttt.exe101⤵PID:2516
-
\??\c:\tnhttt.exec:\tnhttt.exe102⤵PID:2132
-
\??\c:\5vjdd.exec:\5vjdd.exe103⤵PID:2472
-
\??\c:\lfxfxlr.exec:\lfxfxlr.exe104⤵PID:956
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe105⤵PID:1464
-
\??\c:\httttn.exec:\httttn.exe106⤵PID:1920
-
\??\c:\dpjjj.exec:\dpjjj.exe107⤵PID:1980
-
\??\c:\jvdvv.exec:\jvdvv.exe108⤵PID:880
-
\??\c:\xrflrrf.exec:\xrflrrf.exe109⤵PID:3020
-
\??\c:\lxrrxxf.exec:\lxrrxxf.exe110⤵PID:2752
-
\??\c:\thttbb.exec:\thttbb.exe111⤵PID:2804
-
\??\c:\9dppj.exec:\9dppj.exe112⤵PID:2820
-
\??\c:\pjvdd.exec:\pjvdd.exe113⤵PID:3024
-
\??\c:\lxlffll.exec:\lxlffll.exe114⤵PID:2092
-
\??\c:\bnbbhn.exec:\bnbbhn.exe115⤵PID:2660
-
\??\c:\nhbbbb.exec:\nhbbbb.exe116⤵PID:2812
-
\??\c:\pjvdj.exec:\pjvdj.exe117⤵PID:2156
-
\??\c:\rrffllr.exec:\rrffllr.exe118⤵PID:2560
-
\??\c:\hnbhnh.exec:\hnbhnh.exe119⤵PID:2588
-
\??\c:\7bnnbb.exec:\7bnnbb.exe120⤵
- System Location Discovery: System Language Discovery
PID:2596 -
\??\c:\jjvpv.exec:\jjvpv.exe121⤵PID:2968
-
\??\c:\pjdjp.exec:\pjdjp.exe122⤵PID:1700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-