Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 06:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe
-
Size
455KB
-
MD5
135825501d24231331fb54c7fd0aa1f0
-
SHA1
e95223f2e712f862d8dae7ef804eb5662321ef11
-
SHA256
17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2
-
SHA512
042f024a64e7c091b687de4c2ee576b75ab2cdc156e4cc576640ac701cbe88a1b3ff7496d6ec687b8397e80c155a990fe52de4359f455846a0037cbb5b6bb384
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRD:q7Tc2NYHUrAwfMp3CDRD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2632-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-46-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-160-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3064-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-215-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1776-225-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/108-234-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1240-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1016-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-289-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-335-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2572-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-395-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-402-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-411-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2864-427-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-518-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-718-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1680-809-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2632 vvjpv.exe 2720 xrlrffx.exe 2712 bbttbh.exe 2848 jjjjp.exe 2568 1lrrlll.exe 2564 9btnbb.exe 2980 1rxllrx.exe 2336 thttbh.exe 2408 ddvdd.exe 2200 xxrrrxf.exe 2824 jvppj.exe 380 vpjjd.exe 1684 9xrrflr.exe 2832 9tntbh.exe 2964 djdvp.exe 1052 rllrxfr.exe 1032 bttbnn.exe 1484 djddj.exe 3064 flfrflx.exe 2908 hbtbnh.exe 408 dvpvp.exe 2304 xrxfffl.exe 1776 hnhthn.exe 108 pjdpd.exe 1240 rrlxlxr.exe 2044 vpdvj.exe 2156 nnhhnn.exe 2448 pjvjj.exe 1016 btnnbb.exe 1652 7ppvj.exe 1600 rfllxfl.exe 2728 tnhbnt.exe 2736 pvdpd.exe 2796 llxfrrf.exe 2544 nbnntt.exe 2848 3pddd.exe 2556 rrllflr.exe 2644 ttnhbh.exe 2572 tthnbh.exe 1352 jdpvv.exe 2992 rfxxffr.exe 3004 nbnntt.exe 2168 jpjvj.exe 596 jdvdv.exe 2164 lflxrfx.exe 2816 nbttbh.exe 380 bbbtnt.exe 332 ddvdp.exe 1660 rlffrrx.exe 2864 1tbhth.exe 2452 thtthn.exe 1824 pddjp.exe 1920 1xrrrxl.exe 2220 3bthtb.exe 1484 ppjjv.exe 2208 ffrxlrl.exe 2916 fxfflfl.exe 2236 nhtbhh.exe 2340 pdpvj.exe 2080 rrlxflr.exe 2492 lfrxflr.exe 268 3thbhh.exe 2352 9jppj.exe 1548 xlflxfx.exe -
resource yara_rule behavioral1/memory/2632-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/108-234-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1240-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1016-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-395-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-402-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-427-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1824-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-518-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1368-577-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1484-729-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-742-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1760-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1596-834-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1600 wrote to memory of 2632 1600 17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe 30 PID 1600 wrote to memory of 2632 1600 17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe 30 PID 1600 wrote to memory of 2632 1600 17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe 30 PID 1600 wrote to memory of 2632 1600 17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe 30 PID 2632 wrote to memory of 2720 2632 vvjpv.exe 31 PID 2632 wrote to memory of 2720 2632 vvjpv.exe 31 PID 2632 wrote to memory of 2720 2632 vvjpv.exe 31 PID 2632 wrote to memory of 2720 2632 vvjpv.exe 31 PID 2720 wrote to memory of 2712 2720 xrlrffx.exe 32 PID 2720 wrote to memory of 2712 2720 xrlrffx.exe 32 PID 2720 wrote to memory of 2712 2720 xrlrffx.exe 32 PID 2720 wrote to memory of 2712 2720 xrlrffx.exe 32 PID 2712 wrote to memory of 2848 2712 bbttbh.exe 33 PID 2712 wrote to memory of 2848 2712 bbttbh.exe 33 PID 2712 wrote to memory of 2848 2712 bbttbh.exe 33 PID 2712 wrote to memory of 2848 2712 bbttbh.exe 33 PID 2848 wrote to memory of 2568 2848 jjjjp.exe 34 PID 2848 wrote to memory of 2568 2848 jjjjp.exe 34 PID 2848 wrote to memory of 2568 2848 jjjjp.exe 34 PID 2848 wrote to memory of 2568 2848 jjjjp.exe 34 PID 2568 wrote to memory of 2564 2568 1lrrlll.exe 35 PID 2568 wrote to memory of 2564 2568 1lrrlll.exe 35 PID 2568 wrote to memory of 2564 2568 1lrrlll.exe 35 PID 2568 wrote to memory of 2564 2568 1lrrlll.exe 35 PID 2564 wrote to memory of 2980 2564 9btnbb.exe 36 PID 2564 wrote to memory of 2980 2564 9btnbb.exe 36 PID 2564 wrote to memory of 2980 2564 9btnbb.exe 36 PID 2564 wrote to memory of 2980 2564 9btnbb.exe 36 PID 2980 wrote to memory of 2336 2980 1rxllrx.exe 37 PID 2980 wrote to memory of 2336 2980 1rxllrx.exe 37 PID 2980 wrote to memory of 2336 2980 1rxllrx.exe 37 PID 2980 wrote to memory of 2336 2980 1rxllrx.exe 37 PID 2336 wrote to memory of 2408 2336 thttbh.exe 38 PID 2336 wrote to memory of 2408 2336 thttbh.exe 38 PID 2336 wrote to memory of 2408 2336 thttbh.exe 38 PID 2336 wrote to memory of 2408 2336 thttbh.exe 38 PID 2408 wrote to memory of 2200 2408 ddvdd.exe 39 PID 2408 wrote to memory of 2200 2408 ddvdd.exe 39 PID 2408 wrote to memory of 2200 2408 ddvdd.exe 39 PID 2408 wrote to memory of 2200 2408 ddvdd.exe 39 PID 2200 wrote to memory of 2824 2200 xxrrrxf.exe 40 PID 2200 wrote to memory of 2824 2200 xxrrrxf.exe 40 PID 2200 wrote to memory of 2824 2200 xxrrrxf.exe 40 PID 2200 wrote to memory of 2824 2200 xxrrrxf.exe 40 PID 2824 wrote to memory of 380 2824 jvppj.exe 41 PID 2824 wrote to memory of 380 2824 jvppj.exe 41 PID 2824 wrote to memory of 380 2824 jvppj.exe 41 PID 2824 wrote to memory of 380 2824 jvppj.exe 41 PID 380 wrote to memory of 1684 380 vpjjd.exe 42 PID 380 wrote to memory of 1684 380 vpjjd.exe 42 PID 380 wrote to memory of 1684 380 vpjjd.exe 42 PID 380 wrote to memory of 1684 380 vpjjd.exe 42 PID 1684 wrote to memory of 2832 1684 9xrrflr.exe 43 PID 1684 wrote to memory of 2832 1684 9xrrflr.exe 43 PID 1684 wrote to memory of 2832 1684 9xrrflr.exe 43 PID 1684 wrote to memory of 2832 1684 9xrrflr.exe 43 PID 2832 wrote to memory of 2964 2832 9tntbh.exe 44 PID 2832 wrote to memory of 2964 2832 9tntbh.exe 44 PID 2832 wrote to memory of 2964 2832 9tntbh.exe 44 PID 2832 wrote to memory of 2964 2832 9tntbh.exe 44 PID 2964 wrote to memory of 1052 2964 djdvp.exe 45 PID 2964 wrote to memory of 1052 2964 djdvp.exe 45 PID 2964 wrote to memory of 1052 2964 djdvp.exe 45 PID 2964 wrote to memory of 1052 2964 djdvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe"C:\Users\Admin\AppData\Local\Temp\17257cfce619e31df82e960c2d5b9558f77139be81514a6fe29380fc903ad3a2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\vvjpv.exec:\vvjpv.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\xrlrffx.exec:\xrlrffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\bbttbh.exec:\bbttbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jjjjp.exec:\jjjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\1lrrlll.exec:\1lrrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\9btnbb.exec:\9btnbb.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1rxllrx.exec:\1rxllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\thttbh.exec:\thttbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\ddvdd.exec:\ddvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xxrrrxf.exec:\xxrrrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\jvppj.exec:\jvppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vpjjd.exec:\vpjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\9xrrflr.exec:\9xrrflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\9tntbh.exec:\9tntbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\djdvp.exec:\djdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\rllrxfr.exec:\rllrxfr.exe17⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bttbnn.exec:\bttbnn.exe18⤵
- Executes dropped EXE
PID:1032 -
\??\c:\djddj.exec:\djddj.exe19⤵
- Executes dropped EXE
PID:1484 -
\??\c:\flfrflx.exec:\flfrflx.exe20⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbtbnh.exec:\hbtbnh.exe21⤵
- Executes dropped EXE
PID:2908 -
\??\c:\dvpvp.exec:\dvpvp.exe22⤵
- Executes dropped EXE
PID:408 -
\??\c:\xrxfffl.exec:\xrxfffl.exe23⤵
- Executes dropped EXE
PID:2304 -
\??\c:\hnhthn.exec:\hnhthn.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pjdpd.exec:\pjdpd.exe25⤵
- Executes dropped EXE
PID:108 -
\??\c:\rrlxlxr.exec:\rrlxlxr.exe26⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vpdvj.exec:\vpdvj.exe27⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nnhhnn.exec:\nnhhnn.exe28⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pjvjj.exec:\pjvjj.exe29⤵
- Executes dropped EXE
PID:2448 -
\??\c:\btnnbb.exec:\btnnbb.exe30⤵
- Executes dropped EXE
PID:1016 -
\??\c:\7ppvj.exec:\7ppvj.exe31⤵
- Executes dropped EXE
PID:1652 -
\??\c:\rfllxfl.exec:\rfllxfl.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tnhbnt.exec:\tnhbnt.exe33⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pvdpd.exec:\pvdpd.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\llxfrrf.exec:\llxfrrf.exe35⤵
- Executes dropped EXE
PID:2796 -
\??\c:\nbnntt.exec:\nbnntt.exe36⤵
- Executes dropped EXE
PID:2544 -
\??\c:\3pddd.exec:\3pddd.exe37⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrllflr.exec:\rrllflr.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ttnhbh.exec:\ttnhbh.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tthnbh.exec:\tthnbh.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\jdpvv.exec:\jdpvv.exe41⤵
- Executes dropped EXE
PID:1352 -
\??\c:\rfxxffr.exec:\rfxxffr.exe42⤵
- Executes dropped EXE
PID:2992 -
\??\c:\nbnntt.exec:\nbnntt.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\jpjvj.exec:\jpjvj.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jdvdv.exec:\jdvdv.exe45⤵
- Executes dropped EXE
PID:596 -
\??\c:\lflxrfx.exec:\lflxrfx.exe46⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nbttbh.exec:\nbttbh.exe47⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bbbtnt.exec:\bbbtnt.exe48⤵
- Executes dropped EXE
PID:380 -
\??\c:\ddvdp.exec:\ddvdp.exe49⤵
- Executes dropped EXE
PID:332 -
\??\c:\rlffrrx.exec:\rlffrrx.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1tbhth.exec:\1tbhth.exe51⤵
- Executes dropped EXE
PID:2864 -
\??\c:\thtthn.exec:\thtthn.exe52⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pddjp.exec:\pddjp.exe53⤵
- Executes dropped EXE
PID:1824 -
\??\c:\1xrrrxl.exec:\1xrrrxl.exe54⤵
- Executes dropped EXE
PID:1920 -
\??\c:\3bthtb.exec:\3bthtb.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ppjjv.exec:\ppjjv.exe56⤵
- Executes dropped EXE
PID:1484 -
\??\c:\ffrxlrl.exec:\ffrxlrl.exe57⤵
- Executes dropped EXE
PID:2208 -
\??\c:\fxfflfl.exec:\fxfflfl.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nhtbhh.exec:\nhtbhh.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\pdpvj.exec:\pdpvj.exe60⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rrlxflr.exec:\rrlxflr.exe61⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lfrxflr.exec:\lfrxflr.exe62⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3thbhh.exec:\3thbhh.exe63⤵
- Executes dropped EXE
PID:268 -
\??\c:\9jppj.exec:\9jppj.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xlflxfx.exec:\xlflxfx.exe65⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bbthnb.exec:\bbthnb.exe66⤵PID:2140
-
\??\c:\pvpvd.exec:\pvpvd.exe67⤵PID:2044
-
\??\c:\5rlffxx.exec:\5rlffxx.exe68⤵PID:2156
-
\??\c:\lfxflrx.exec:\lfxflrx.exe69⤵PID:1960
-
\??\c:\tntntt.exec:\tntntt.exe70⤵PID:276
-
\??\c:\vddpd.exec:\vddpd.exe71⤵PID:1368
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵PID:1584
-
\??\c:\lfflxxf.exec:\lfflxxf.exe73⤵PID:2884
-
\??\c:\9hnhhb.exec:\9hnhhb.exe74⤵PID:2260
-
\??\c:\dvppv.exec:\dvppv.exe75⤵PID:2764
-
\??\c:\dddvd.exec:\dddvd.exe76⤵PID:2720
-
\??\c:\fxffrxl.exec:\fxffrxl.exe77⤵PID:2660
-
\??\c:\btntbh.exec:\btntbh.exe78⤵PID:2772
-
\??\c:\3vvpp.exec:\3vvpp.exe79⤵PID:2688
-
\??\c:\pdvpv.exec:\pdvpv.exe80⤵PID:2536
-
\??\c:\xrllrrf.exec:\xrllrrf.exe81⤵PID:2696
-
\??\c:\9tbtth.exec:\9tbtth.exe82⤵PID:2564
-
\??\c:\thbhnt.exec:\thbhnt.exe83⤵PID:2976
-
\??\c:\vjjjj.exec:\vjjjj.exe84⤵PID:2992
-
\??\c:\1xllrll.exec:\1xllrll.exe85⤵PID:3004
-
\??\c:\rxllrrf.exec:\rxllrrf.exe86⤵PID:2168
-
\??\c:\nhttbb.exec:\nhttbb.exe87⤵PID:596
-
\??\c:\jvvpj.exec:\jvvpj.exe88⤵PID:2152
-
\??\c:\jjvpv.exec:\jjvpv.exe89⤵PID:1740
-
\??\c:\lxllxxf.exec:\lxllxxf.exe90⤵PID:2264
-
\??\c:\nbhnth.exec:\nbhnth.exe91⤵PID:2960
-
\??\c:\bttthh.exec:\bttthh.exe92⤵PID:2508
-
\??\c:\3pddj.exec:\3pddj.exe93⤵PID:2964
-
\??\c:\fxrrrlx.exec:\fxrrrlx.exe94⤵PID:2940
-
\??\c:\tthnbt.exec:\tthnbt.exe95⤵PID:696
-
\??\c:\bnnntn.exec:\bnnntn.exe96⤵PID:1636
-
\??\c:\vpvvj.exec:\vpvvj.exe97⤵PID:1036
-
\??\c:\lfflxrx.exec:\lfflxrx.exe98⤵PID:1484
-
\??\c:\bnbhnt.exec:\bnbhnt.exe99⤵PID:2208
-
\??\c:\9nttnh.exec:\9nttnh.exe100⤵PID:2916
-
\??\c:\jdvdp.exec:\jdvdp.exe101⤵PID:2236
-
\??\c:\rlrxrrf.exec:\rlrxrrf.exe102⤵PID:1200
-
\??\c:\xlffllx.exec:\xlffllx.exe103⤵PID:2080
-
\??\c:\tthtbb.exec:\tthtbb.exe104⤵PID:1760
-
\??\c:\7pjpv.exec:\7pjpv.exe105⤵PID:108
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe106⤵PID:2440
-
\??\c:\xrllllx.exec:\xrllllx.exe107⤵PID:2120
-
\??\c:\tthbht.exec:\tthbht.exe108⤵PID:2140
-
\??\c:\vpvpd.exec:\vpvpd.exe109⤵PID:1680
-
\??\c:\xrflrxx.exec:\xrflrxx.exe110⤵PID:2156
-
\??\c:\rrlxxlx.exec:\rrlxxlx.exe111⤵PID:1960
-
\??\c:\nnhttb.exec:\nnhttb.exe112⤵PID:1804
-
\??\c:\jvppv.exec:\jvppv.exe113⤵PID:1596
-
\??\c:\jdvdj.exec:\jdvdj.exe114⤵PID:1600
-
\??\c:\3fxlrff.exec:\3fxlrff.exe115⤵PID:2884
-
\??\c:\1nnhhh.exec:\1nnhhh.exe116⤵PID:2792
-
\??\c:\hththn.exec:\hththn.exe117⤵PID:2840
-
\??\c:\pjvdp.exec:\pjvdp.exe118⤵PID:2700
-
\??\c:\ffrflrr.exec:\ffrflrr.exe119⤵PID:2660
-
\??\c:\9frlfff.exec:\9frlfff.exe120⤵PID:2568
-
\??\c:\htbbth.exec:\htbbth.exe121⤵PID:2596
-
\??\c:\pdppv.exec:\pdppv.exe122⤵PID:3048
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-