Analysis
-
max time kernel
120s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe
-
Size
456KB
-
MD5
67ede20ca1951016d4d3d533898ccecb
-
SHA1
c0dd03efcc764e463019c7ac6365a38bc000e098
-
SHA256
551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779
-
SHA512
3a2b9d95bcd4d2080ce4bc8c357b3db884980dbddee0df17ac66c6f58596cbeeb3af48b91d7b0048ad8bc09c4bb0bcc74ecef556e9e65f2e1b5e7f9243c9cc8c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbelE:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 35 IoCs
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1656-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2288-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-114-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-128-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/932-278-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1512-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/516-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-508-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/808-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1888-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-602-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2524-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 vpxhn.exe 2772 fhvnrp.exe 2556 rffpp.exe 2904 rxnpt.exe 2888 rxnvtd.exe 2224 ftdlh.exe 2856 vdnnfpj.exe 2708 ljbfxtd.exe 2288 rrxlvb.exe 1656 nbvdft.exe 1152 vvdfn.exe 1576 dlbhfh.exe 1732 vdbnbtl.exe 2676 vfbjj.exe 3028 rtjtnvb.exe 856 jrrxv.exe 1920 ltflf.exe 320 fvrxt.exe 2096 hjxffx.exe 1224 tbhjj.exe 2132 jftnn.exe 808 ddnxfpj.exe 1652 fllddtx.exe 2232 lnfpv.exe 2364 tbbdf.exe 1664 hvnrj.exe 308 jrnnx.exe 1084 bjlrxx.exe 932 bpdlx.exe 1512 jpprtbx.exe 984 dtnnbt.exe 1672 txjbrf.exe 2344 rnphnd.exe 1716 vbdtbn.exe 2008 rdpxvbt.exe 2528 dnvrnvb.exe 2820 bdtxffn.exe 2908 rdtrt.exe 2696 hvrdh.exe 2724 dhdrj.exe 2936 hlhbj.exe 2860 thtpnh.exe 2756 nprprvp.exe 2024 djntdfj.exe 2176 fdffr.exe 1656 djxndn.exe 3060 dlnlnt.exe 1424 fbfltfr.exe 516 xxhxb.exe 2108 phrtj.exe 1732 rrnnpvn.exe 3020 vtlnb.exe 3036 thlnlxr.exe 652 ltxfxdd.exe 2568 xrdbb.exe 2660 ljjtn.exe 320 jfnnlr.exe 1720 xhlxl.exe 2252 xtndn.exe 2436 nnfvb.exe 2132 ltbddnt.exe 808 bbxtb.exe 2212 rjvppd.exe 960 lxtdb.exe -
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1656-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-134-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2676-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/856-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1512-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-424-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2108-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/808-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1888-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-628-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-649-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-696-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvxjtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhbbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbxvplx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnljvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrpntj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdlbdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnbll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbftvvt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjvthtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddtdjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxdnpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language blhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxxddph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbjffn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxbnr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvhrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlblvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbdrnrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hrvpdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bpdlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpprtbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrnldjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxfhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nljxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnfdtl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrdnlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrrjndr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfjfjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phrtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnrnlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftflpnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhvtxhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjthljv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hptht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnfrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpnjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrrlp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxptn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prpvx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbhxhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbfpdtp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2008 2412 551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe 29 PID 2412 wrote to memory of 2008 2412 551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe 29 PID 2412 wrote to memory of 2008 2412 551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe 29 PID 2412 wrote to memory of 2008 2412 551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe 29 PID 2008 wrote to memory of 2772 2008 vpxhn.exe 30 PID 2008 wrote to memory of 2772 2008 vpxhn.exe 30 PID 2008 wrote to memory of 2772 2008 vpxhn.exe 30 PID 2008 wrote to memory of 2772 2008 vpxhn.exe 30 PID 2772 wrote to memory of 2556 2772 fhvnrp.exe 31 PID 2772 wrote to memory of 2556 2772 fhvnrp.exe 31 PID 2772 wrote to memory of 2556 2772 fhvnrp.exe 31 PID 2772 wrote to memory of 2556 2772 fhvnrp.exe 31 PID 2556 wrote to memory of 2904 2556 rffpp.exe 32 PID 2556 wrote to memory of 2904 2556 rffpp.exe 32 PID 2556 wrote to memory of 2904 2556 rffpp.exe 32 PID 2556 wrote to memory of 2904 2556 rffpp.exe 32 PID 2904 wrote to memory of 2888 2904 rxnpt.exe 33 PID 2904 wrote to memory of 2888 2904 rxnpt.exe 33 PID 2904 wrote to memory of 2888 2904 rxnpt.exe 33 PID 2904 wrote to memory of 2888 2904 rxnpt.exe 33 PID 2888 wrote to memory of 2224 2888 rxnvtd.exe 34 PID 2888 wrote to memory of 2224 2888 rxnvtd.exe 34 PID 2888 wrote to memory of 2224 2888 rxnvtd.exe 34 PID 2888 wrote to memory of 2224 2888 rxnvtd.exe 34 PID 2224 wrote to memory of 2856 2224 ftdlh.exe 35 PID 2224 wrote to memory of 2856 2224 ftdlh.exe 35 PID 2224 wrote to memory of 2856 2224 ftdlh.exe 35 PID 2224 wrote to memory of 2856 2224 ftdlh.exe 35 PID 2856 wrote to memory of 2708 2856 vdnnfpj.exe 36 PID 2856 wrote to memory of 2708 2856 vdnnfpj.exe 36 PID 2856 wrote to memory of 2708 2856 vdnnfpj.exe 36 PID 2856 wrote to memory of 2708 2856 vdnnfpj.exe 36 PID 2708 wrote to memory of 2288 2708 ljbfxtd.exe 37 PID 2708 wrote to memory of 2288 2708 ljbfxtd.exe 37 PID 2708 wrote to memory of 2288 2708 ljbfxtd.exe 37 PID 2708 wrote to memory of 2288 2708 ljbfxtd.exe 37 PID 2288 wrote to memory of 1656 2288 rrxlvb.exe 38 PID 2288 wrote to memory of 1656 2288 rrxlvb.exe 38 PID 2288 wrote to memory of 1656 2288 rrxlvb.exe 38 PID 2288 wrote to memory of 1656 2288 rrxlvb.exe 38 PID 1656 wrote to memory of 1152 1656 nbvdft.exe 39 PID 1656 wrote to memory of 1152 1656 nbvdft.exe 39 PID 1656 wrote to memory of 1152 1656 nbvdft.exe 39 PID 1656 wrote to memory of 1152 1656 nbvdft.exe 39 PID 1152 wrote to memory of 1576 1152 vvdfn.exe 40 PID 1152 wrote to memory of 1576 1152 vvdfn.exe 40 PID 1152 wrote to memory of 1576 1152 vvdfn.exe 40 PID 1152 wrote to memory of 1576 1152 vvdfn.exe 40 PID 1576 wrote to memory of 1732 1576 dlbhfh.exe 41 PID 1576 wrote to memory of 1732 1576 dlbhfh.exe 41 PID 1576 wrote to memory of 1732 1576 dlbhfh.exe 41 PID 1576 wrote to memory of 1732 1576 dlbhfh.exe 41 PID 1732 wrote to memory of 2676 1732 vdbnbtl.exe 42 PID 1732 wrote to memory of 2676 1732 vdbnbtl.exe 42 PID 1732 wrote to memory of 2676 1732 vdbnbtl.exe 42 PID 1732 wrote to memory of 2676 1732 vdbnbtl.exe 42 PID 2676 wrote to memory of 3028 2676 vfbjj.exe 43 PID 2676 wrote to memory of 3028 2676 vfbjj.exe 43 PID 2676 wrote to memory of 3028 2676 vfbjj.exe 43 PID 2676 wrote to memory of 3028 2676 vfbjj.exe 43 PID 3028 wrote to memory of 856 3028 rtjtnvb.exe 44 PID 3028 wrote to memory of 856 3028 rtjtnvb.exe 44 PID 3028 wrote to memory of 856 3028 rtjtnvb.exe 44 PID 3028 wrote to memory of 856 3028 rtjtnvb.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe"C:\Users\Admin\AppData\Local\Temp\551ca38b20b40d7c1beb309677f2a466981067d27846c447094edb0fa3f7a779.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\vpxhn.exec:\vpxhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\fhvnrp.exec:\fhvnrp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\rffpp.exec:\rffpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\rxnpt.exec:\rxnpt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rxnvtd.exec:\rxnvtd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\ftdlh.exec:\ftdlh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vdnnfpj.exec:\vdnnfpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\ljbfxtd.exec:\ljbfxtd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\rrxlvb.exec:\rrxlvb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nbvdft.exec:\nbvdft.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vvdfn.exec:\vvdfn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\dlbhfh.exec:\dlbhfh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\vdbnbtl.exec:\vdbnbtl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vfbjj.exec:\vfbjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\rtjtnvb.exec:\rtjtnvb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jrrxv.exec:\jrrxv.exe17⤵
- Executes dropped EXE
PID:856 -
\??\c:\ltflf.exec:\ltflf.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1920 -
\??\c:\fvrxt.exec:\fvrxt.exe19⤵
- Executes dropped EXE
PID:320 -
\??\c:\hjxffx.exec:\hjxffx.exe20⤵
- Executes dropped EXE
PID:2096 -
\??\c:\tbhjj.exec:\tbhjj.exe21⤵
- Executes dropped EXE
PID:1224 -
\??\c:\jftnn.exec:\jftnn.exe22⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ddnxfpj.exec:\ddnxfpj.exe23⤵
- Executes dropped EXE
PID:808 -
\??\c:\fllddtx.exec:\fllddtx.exe24⤵
- Executes dropped EXE
PID:1652 -
\??\c:\lnfpv.exec:\lnfpv.exe25⤵
- Executes dropped EXE
PID:2232 -
\??\c:\tbbdf.exec:\tbbdf.exe26⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hvnrj.exec:\hvnrj.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\jrnnx.exec:\jrnnx.exe28⤵
- Executes dropped EXE
PID:308 -
\??\c:\bjlrxx.exec:\bjlrxx.exe29⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bpdlx.exec:\bpdlx.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:932 -
\??\c:\jpprtbx.exec:\jpprtbx.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1512 -
\??\c:\dtnnbt.exec:\dtnnbt.exe32⤵
- Executes dropped EXE
PID:984 -
\??\c:\txjbrf.exec:\txjbrf.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rnphnd.exec:\rnphnd.exe34⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vbdtbn.exec:\vbdtbn.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\rdpxvbt.exec:\rdpxvbt.exe36⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dnvrnvb.exec:\dnvrnvb.exe37⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bdtxffn.exec:\bdtxffn.exe38⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rdtrt.exec:\rdtrt.exe39⤵
- Executes dropped EXE
PID:2908 -
\??\c:\hvrdh.exec:\hvrdh.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dhdrj.exec:\dhdrj.exe41⤵
- Executes dropped EXE
PID:2724 -
\??\c:\hlhbj.exec:\hlhbj.exe42⤵
- Executes dropped EXE
PID:2936 -
\??\c:\thtpnh.exec:\thtpnh.exe43⤵
- Executes dropped EXE
PID:2860 -
\??\c:\nprprvp.exec:\nprprvp.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\djntdfj.exec:\djntdfj.exe45⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fdffr.exec:\fdffr.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\djxndn.exec:\djxndn.exe47⤵
- Executes dropped EXE
PID:1656 -
\??\c:\dlnlnt.exec:\dlnlnt.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\fbfltfr.exec:\fbfltfr.exe49⤵
- Executes dropped EXE
PID:1424 -
\??\c:\xxhxb.exec:\xxhxb.exe50⤵
- Executes dropped EXE
PID:516 -
\??\c:\phrtj.exec:\phrtj.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2108 -
\??\c:\rrnnpvn.exec:\rrnnpvn.exe52⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vtlnb.exec:\vtlnb.exe53⤵
- Executes dropped EXE
PID:3020 -
\??\c:\thlnlxr.exec:\thlnlxr.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ltxfxdd.exec:\ltxfxdd.exe55⤵
- Executes dropped EXE
PID:652 -
\??\c:\xrdbb.exec:\xrdbb.exe56⤵
- Executes dropped EXE
PID:2568 -
\??\c:\ljjtn.exec:\ljjtn.exe57⤵
- Executes dropped EXE
PID:2660 -
\??\c:\jfnnlr.exec:\jfnnlr.exe58⤵
- Executes dropped EXE
PID:320 -
\??\c:\xhlxl.exec:\xhlxl.exe59⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xtndn.exec:\xtndn.exe60⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nnfvb.exec:\nnfvb.exe61⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ltbddnt.exec:\ltbddnt.exe62⤵
- Executes dropped EXE
PID:2132 -
\??\c:\bbxtb.exec:\bbxtb.exe63⤵
- Executes dropped EXE
PID:808 -
\??\c:\rjvppd.exec:\rjvppd.exe64⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lxtdb.exec:\lxtdb.exe65⤵
- Executes dropped EXE
PID:960 -
\??\c:\blbjp.exec:\blbjp.exe66⤵PID:1888
-
\??\c:\fblbb.exec:\fblbb.exe67⤵PID:276
-
\??\c:\ndjdl.exec:\ndjdl.exe68⤵PID:1664
-
\??\c:\nbndlh.exec:\nbndlh.exe69⤵PID:2932
-
\??\c:\hdxdx.exec:\hdxdx.exe70⤵PID:2564
-
\??\c:\dfbjxj.exec:\dfbjxj.exe71⤵PID:2644
-
\??\c:\dfxdhbl.exec:\dfxdhbl.exe72⤵PID:2632
-
\??\c:\rtvvt.exec:\rtvvt.exe73⤵PID:1512
-
\??\c:\rjfndv.exec:\rjfndv.exe74⤵PID:1904
-
\??\c:\jpnpvbb.exec:\jpnpvbb.exe75⤵PID:1776
-
\??\c:\vjlpnh.exec:\vjlpnh.exe76⤵PID:2532
-
\??\c:\nnljvpv.exec:\nnljvpv.exe77⤵
- System Location Discovery: System Language Discovery
PID:2656 -
\??\c:\jnxjx.exec:\jnxjx.exe78⤵PID:2524
-
\??\c:\xbptrn.exec:\xbptrn.exe79⤵PID:2172
-
\??\c:\hnhtlj.exec:\hnhtlj.exe80⤵PID:2512
-
\??\c:\fpxjp.exec:\fpxjp.exe81⤵PID:2948
-
\??\c:\jpxjb.exec:\jpxjb.exe82⤵PID:2964
-
\??\c:\bbrpjnl.exec:\bbrpjnl.exe83⤵PID:2228
-
\??\c:\jvfvtlp.exec:\jvfvtlp.exe84⤵PID:2036
-
\??\c:\ppfnb.exec:\ppfnb.exe85⤵PID:2864
-
\??\c:\vnrbtvl.exec:\vnrbtvl.exe86⤵PID:2700
-
\??\c:\fjlpfpb.exec:\fjlpfpb.exe87⤵PID:2428
-
\??\c:\drfdfn.exec:\drfdfn.exe88⤵PID:2292
-
\??\c:\tndtjvf.exec:\tndtjvf.exe89⤵PID:1032
-
\??\c:\bjvnnj.exec:\bjvnnj.exe90⤵PID:944
-
\??\c:\rhjnph.exec:\rhjnph.exe91⤵PID:1152
-
\??\c:\tpfdll.exec:\tpfdll.exe92⤵PID:1424
-
\??\c:\fnlnv.exec:\fnlnv.exe93⤵PID:2224
-
\??\c:\rnbnr.exec:\rnbnr.exe94⤵PID:2108
-
\??\c:\nprbpb.exec:\nprbpb.exe95⤵PID:2996
-
\??\c:\jhndrr.exec:\jhndrr.exe96⤵PID:1272
-
\??\c:\fxvvn.exec:\fxvvn.exe97⤵PID:2944
-
\??\c:\dnjlb.exec:\dnjlb.exe98⤵PID:700
-
\??\c:\dvfvh.exec:\dvfvh.exe99⤵PID:1740
-
\??\c:\ttfbvrv.exec:\ttfbvrv.exe100⤵PID:2192
-
\??\c:\jvbxrbb.exec:\jvbxrbb.exe101⤵PID:2248
-
\??\c:\ftvrxjv.exec:\ftvrxjv.exe102⤵PID:2260
-
\??\c:\rvrtr.exec:\rvrtr.exe103⤵PID:2276
-
\??\c:\njvprl.exec:\njvprl.exe104⤵PID:2788
-
\??\c:\dnbnxb.exec:\dnbnxb.exe105⤵PID:2420
-
\??\c:\fltvnrh.exec:\fltvnrh.exe106⤵PID:1828
-
\??\c:\ftbtx.exec:\ftbtx.exe107⤵PID:2392
-
\??\c:\tbvdhrt.exec:\tbvdhrt.exe108⤵PID:1948
-
\??\c:\fjjbtpr.exec:\fjjbtpr.exe109⤵PID:1496
-
\??\c:\vtvxtnh.exec:\vtvxtnh.exe110⤵PID:1460
-
\??\c:\ddhvr.exec:\ddhvr.exe111⤵PID:1696
-
\??\c:\xfldfxp.exec:\xfldfxp.exe112⤵PID:1664
-
\??\c:\jrlxpnp.exec:\jrlxpnp.exe113⤵PID:1160
-
\??\c:\htftfp.exec:\htftfp.exe114⤵PID:2624
-
\??\c:\rjlfjf.exec:\rjlfjf.exe115⤵PID:928
-
\??\c:\rtnvp.exec:\rtnvp.exe116⤵PID:2520
-
\??\c:\pttjx.exec:\pttjx.exe117⤵PID:2612
-
\??\c:\rfrhx.exec:\rfrhx.exe118⤵PID:1904
-
\??\c:\xtnvp.exec:\xtnvp.exe119⤵PID:2368
-
\??\c:\ffxlhd.exec:\ffxlhd.exe120⤵PID:672
-
\??\c:\dtplr.exec:\dtplr.exe121⤵PID:1900
-
\??\c:\trdblrl.exec:\trdblrl.exe122⤵PID:2880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-