Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 11:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe
-
Size
456KB
-
MD5
0e54633ab01be2516d87c11197d5f930
-
SHA1
2403878cd8de851a9292042aaf1a651d1bb73246
-
SHA256
5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1
-
SHA512
c10797881ddef16f2738a4561a026d282df16624393d0e35af8e8967389303300c07072084a7982fde333a97cb34cff97766aa5ef22845584024089be5cbccbb
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeL+:q7Tc2NYHUrAwfMp3CDL+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1800-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-78-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2724-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/664-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-135-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1500-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-149-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1648-147-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/480-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-198-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1788-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1380-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-254-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/756-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2188-399-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2188-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/524-409-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1856-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-464-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-559-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2216-597-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-610-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-723-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2100 djjvj.exe 3048 hbbhbb.exe 1536 jjddd.exe 2948 nnhnht.exe 2760 9xxxflr.exe 2868 pjdjd.exe 3000 rrrrlxr.exe 2960 nnntnt.exe 2724 3pjdv.exe 2508 nnbbtb.exe 2324 pjpvd.exe 664 jddpj.exe 1500 fxflrrr.exe 1648 3ddvj.exe 480 5lxxrrl.exe 2364 3xfrxlx.exe 2024 9hnbnb.exe 1960 rxxfrxr.exe 1720 hhbhth.exe 2400 fllfflf.exe 1788 7nhtnt.exe 2076 7rrxffl.exe 1144 nhhtht.exe 1380 5fflxlx.exe 2060 hbtbnb.exe 2236 fxlrrxf.exe 1872 bbtbth.exe 2488 rlxfrrf.exe 756 bhbttb.exe 2216 7lfflrf.exe 1140 hhtbbh.exe 1612 fxrxrrf.exe 2148 nnnhht.exe 2092 jdppv.exe 2484 fllrrlf.exe 2864 3nnhhh.exe 2892 nhtnbb.exe 2716 dpvdj.exe 2916 3lflxxf.exe 2860 1bttnn.exe 1644 hbthhn.exe 2624 5pvvv.exe 2444 llfrlrr.exe 2188 btbnnb.exe 524 nhhtnt.exe 2788 frffflx.exe 264 5nhnnt.exe 316 bnbbhh.exe 2844 pvppd.exe 532 rfrrrrf.exe 2940 lfrrxrf.exe 1856 btnnnn.exe 1956 ppppd.exe 1220 frffrlx.exe 2360 5lrxlrl.exe 2028 1tttbh.exe 1980 dddvp.exe 2404 lfxxlfr.exe 556 bnhnht.exe 1076 nnhhbb.exe 2596 3ppdj.exe 1144 lxxxrxr.exe 1380 rrlllrf.exe 1548 bbntbh.exe -
resource yara_rule behavioral1/memory/1800-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/664-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1380-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/756-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/524-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1856-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-481-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-597-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-610-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-710-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrflffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3thntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfxrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfrffr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2100 1800 5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe 30 PID 1800 wrote to memory of 2100 1800 5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe 30 PID 1800 wrote to memory of 2100 1800 5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe 30 PID 1800 wrote to memory of 2100 1800 5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe 30 PID 2100 wrote to memory of 3048 2100 djjvj.exe 31 PID 2100 wrote to memory of 3048 2100 djjvj.exe 31 PID 2100 wrote to memory of 3048 2100 djjvj.exe 31 PID 2100 wrote to memory of 3048 2100 djjvj.exe 31 PID 3048 wrote to memory of 1536 3048 hbbhbb.exe 32 PID 3048 wrote to memory of 1536 3048 hbbhbb.exe 32 PID 3048 wrote to memory of 1536 3048 hbbhbb.exe 32 PID 3048 wrote to memory of 1536 3048 hbbhbb.exe 32 PID 1536 wrote to memory of 2948 1536 jjddd.exe 33 PID 1536 wrote to memory of 2948 1536 jjddd.exe 33 PID 1536 wrote to memory of 2948 1536 jjddd.exe 33 PID 1536 wrote to memory of 2948 1536 jjddd.exe 33 PID 2948 wrote to memory of 2760 2948 nnhnht.exe 34 PID 2948 wrote to memory of 2760 2948 nnhnht.exe 34 PID 2948 wrote to memory of 2760 2948 nnhnht.exe 34 PID 2948 wrote to memory of 2760 2948 nnhnht.exe 34 PID 2760 wrote to memory of 2868 2760 9xxxflr.exe 35 PID 2760 wrote to memory of 2868 2760 9xxxflr.exe 35 PID 2760 wrote to memory of 2868 2760 9xxxflr.exe 35 PID 2760 wrote to memory of 2868 2760 9xxxflr.exe 35 PID 2868 wrote to memory of 3000 2868 pjdjd.exe 36 PID 2868 wrote to memory of 3000 2868 pjdjd.exe 36 PID 2868 wrote to memory of 3000 2868 pjdjd.exe 36 PID 2868 wrote to memory of 3000 2868 pjdjd.exe 36 PID 3000 wrote to memory of 2960 3000 rrrrlxr.exe 37 PID 3000 wrote to memory of 2960 3000 rrrrlxr.exe 37 PID 3000 wrote to memory of 2960 3000 rrrrlxr.exe 37 PID 3000 wrote to memory of 2960 3000 rrrrlxr.exe 37 PID 2960 wrote to memory of 2724 2960 nnntnt.exe 38 PID 2960 wrote to memory of 2724 2960 nnntnt.exe 38 PID 2960 wrote to memory of 2724 2960 nnntnt.exe 38 PID 2960 wrote to memory of 2724 2960 nnntnt.exe 38 PID 2724 wrote to memory of 2508 2724 3pjdv.exe 39 PID 2724 wrote to memory of 2508 2724 3pjdv.exe 39 PID 2724 wrote to memory of 2508 2724 3pjdv.exe 39 PID 2724 wrote to memory of 2508 2724 3pjdv.exe 39 PID 2508 wrote to memory of 2324 2508 nnbbtb.exe 40 PID 2508 wrote to memory of 2324 2508 nnbbtb.exe 40 PID 2508 wrote to memory of 2324 2508 nnbbtb.exe 40 PID 2508 wrote to memory of 2324 2508 nnbbtb.exe 40 PID 2324 wrote to memory of 664 2324 pjpvd.exe 41 PID 2324 wrote to memory of 664 2324 pjpvd.exe 41 PID 2324 wrote to memory of 664 2324 pjpvd.exe 41 PID 2324 wrote to memory of 664 2324 pjpvd.exe 41 PID 664 wrote to memory of 1500 664 jddpj.exe 42 PID 664 wrote to memory of 1500 664 jddpj.exe 42 PID 664 wrote to memory of 1500 664 jddpj.exe 42 PID 664 wrote to memory of 1500 664 jddpj.exe 42 PID 1500 wrote to memory of 1648 1500 fxflrrr.exe 43 PID 1500 wrote to memory of 1648 1500 fxflrrr.exe 43 PID 1500 wrote to memory of 1648 1500 fxflrrr.exe 43 PID 1500 wrote to memory of 1648 1500 fxflrrr.exe 43 PID 1648 wrote to memory of 480 1648 3ddvj.exe 44 PID 1648 wrote to memory of 480 1648 3ddvj.exe 44 PID 1648 wrote to memory of 480 1648 3ddvj.exe 44 PID 1648 wrote to memory of 480 1648 3ddvj.exe 44 PID 480 wrote to memory of 2364 480 5lxxrrl.exe 45 PID 480 wrote to memory of 2364 480 5lxxrrl.exe 45 PID 480 wrote to memory of 2364 480 5lxxrrl.exe 45 PID 480 wrote to memory of 2364 480 5lxxrrl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe"C:\Users\Admin\AppData\Local\Temp\5e005dd17f19e509ff4971a970206460fb54236c54d81fbeecddf84e7fa5d8b1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\djjvj.exec:\djjvj.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hbbhbb.exec:\hbbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\jjddd.exec:\jjddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\nnhnht.exec:\nnhnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\9xxxflr.exec:\9xxxflr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pjdjd.exec:\pjdjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rrrrlxr.exec:\rrrrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nnntnt.exec:\nnntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\3pjdv.exec:\3pjdv.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nnbbtb.exec:\nnbbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pjpvd.exec:\pjpvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jddpj.exec:\jddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\fxflrrr.exec:\fxflrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1500 -
\??\c:\3ddvj.exec:\3ddvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\5lxxrrl.exec:\5lxxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\3xfrxlx.exec:\3xfrxlx.exe17⤵
- Executes dropped EXE
PID:2364 -
\??\c:\9hnbnb.exec:\9hnbnb.exe18⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rxxfrxr.exec:\rxxfrxr.exe19⤵
- Executes dropped EXE
PID:1960 -
\??\c:\hhbhth.exec:\hhbhth.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fllfflf.exec:\fllfflf.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7nhtnt.exec:\7nhtnt.exe22⤵
- Executes dropped EXE
PID:1788 -
\??\c:\7rrxffl.exec:\7rrxffl.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nhhtht.exec:\nhhtht.exe24⤵
- Executes dropped EXE
PID:1144 -
\??\c:\5fflxlx.exec:\5fflxlx.exe25⤵
- Executes dropped EXE
PID:1380 -
\??\c:\hbtbnb.exec:\hbtbnb.exe26⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxlrrxf.exec:\fxlrrxf.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2236 -
\??\c:\bbtbth.exec:\bbtbth.exe28⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe29⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bhbttb.exec:\bhbttb.exe30⤵
- Executes dropped EXE
PID:756 -
\??\c:\7lfflrf.exec:\7lfflrf.exe31⤵
- Executes dropped EXE
PID:2216 -
\??\c:\hhtbbh.exec:\hhtbbh.exe32⤵
- Executes dropped EXE
PID:1140 -
\??\c:\fxrxrrf.exec:\fxrxrrf.exe33⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nnnhht.exec:\nnnhht.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\jdppv.exec:\jdppv.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\fllrrlf.exec:\fllrrlf.exe36⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3nnhhh.exec:\3nnhhh.exe37⤵
- Executes dropped EXE
PID:2864 -
\??\c:\nhtnbb.exec:\nhtnbb.exe38⤵
- Executes dropped EXE
PID:2892 -
\??\c:\dpvdj.exec:\dpvdj.exe39⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3lflxxf.exec:\3lflxxf.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1bttnn.exec:\1bttnn.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hbthhn.exec:\hbthhn.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5pvvv.exec:\5pvvv.exe43⤵
- Executes dropped EXE
PID:2624 -
\??\c:\llfrlrr.exec:\llfrlrr.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\btbnnb.exec:\btbnnb.exe45⤵
- Executes dropped EXE
PID:2188 -
\??\c:\nhhtnt.exec:\nhhtnt.exe46⤵
- Executes dropped EXE
PID:524 -
\??\c:\frffflx.exec:\frffflx.exe47⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5nhnnt.exec:\5nhnnt.exe48⤵
- Executes dropped EXE
PID:264 -
\??\c:\bnbbhh.exec:\bnbbhh.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\pvppd.exec:\pvppd.exe50⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rfrrrrf.exec:\rfrrrrf.exe51⤵
- Executes dropped EXE
PID:532 -
\??\c:\lfrrxrf.exec:\lfrrxrf.exe52⤵
- Executes dropped EXE
PID:2940 -
\??\c:\btnnnn.exec:\btnnnn.exe53⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ppppd.exec:\ppppd.exe54⤵
- Executes dropped EXE
PID:1956 -
\??\c:\frffrlx.exec:\frffrlx.exe55⤵
- Executes dropped EXE
PID:1220 -
\??\c:\5lrxlrl.exec:\5lrxlrl.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\1tttbh.exec:\1tttbh.exe57⤵
- Executes dropped EXE
PID:2028 -
\??\c:\dddvp.exec:\dddvp.exe58⤵
- Executes dropped EXE
PID:1980 -
\??\c:\lfxxlfr.exec:\lfxxlfr.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\bnhnht.exec:\bnhnht.exe60⤵
- Executes dropped EXE
PID:556 -
\??\c:\nnhhbb.exec:\nnhhbb.exe61⤵
- Executes dropped EXE
PID:1076 -
\??\c:\3ppdj.exec:\3ppdj.exe62⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lxxxrxr.exec:\lxxxrxr.exe63⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rrlllrf.exec:\rrlllrf.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bbntbh.exec:\bbntbh.exe65⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1jvdp.exec:\1jvdp.exe66⤵PID:2460
-
\??\c:\lffxffl.exec:\lffxffl.exe67⤵PID:2292
-
\??\c:\ffrxrxx.exec:\ffrxrxx.exe68⤵PID:544
-
\??\c:\htnntt.exec:\htnntt.exe69⤵PID:1228
-
\??\c:\djvjd.exec:\djvjd.exe70⤵PID:564
-
\??\c:\1jpdd.exec:\1jpdd.exe71⤵PID:756
-
\??\c:\rlffrrr.exec:\rlffrrr.exe72⤵PID:2216
-
\??\c:\7btbhh.exec:\7btbhh.exe73⤵PID:2124
-
\??\c:\tnnbth.exec:\tnnbth.exe74⤵PID:2100
-
\??\c:\vjdpd.exec:\vjdpd.exe75⤵PID:2380
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe76⤵PID:2704
-
\??\c:\3bnhnn.exec:\3bnhnn.exe77⤵PID:2352
-
\??\c:\hhhbth.exec:\hhhbth.exe78⤵PID:2988
-
\??\c:\dvdvv.exec:\dvdvv.exe79⤵PID:2752
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe80⤵PID:2928
-
\??\c:\9lffrxf.exec:\9lffrxf.exe81⤵PID:2336
-
\??\c:\7bnntt.exec:\7bnntt.exe82⤵PID:2912
-
\??\c:\ddvpv.exec:\ddvpv.exe83⤵PID:2640
-
\??\c:\pjvjp.exec:\pjvjp.exe84⤵PID:2616
-
\??\c:\rlllrxl.exec:\rlllrxl.exe85⤵PID:2432
-
\??\c:\tnhntb.exec:\tnhntb.exe86⤵PID:2252
-
\??\c:\hthnbh.exec:\hthnbh.exe87⤵PID:2444
-
\??\c:\ddvdj.exec:\ddvdj.exe88⤵PID:580
-
\??\c:\xrflxxf.exec:\xrflxxf.exe89⤵PID:492
-
\??\c:\xlxlfrf.exec:\xlxlfrf.exe90⤵PID:664
-
\??\c:\7tnttt.exec:\7tnttt.exe91⤵PID:1104
-
\??\c:\vddpv.exec:\vddpv.exe92⤵PID:2680
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe93⤵PID:2824
-
\??\c:\rrrfrxr.exec:\rrrfrxr.exe94⤵PID:2820
-
\??\c:\tnhhtt.exec:\tnhhtt.exe95⤵PID:2040
-
\??\c:\pvpdp.exec:\pvpdp.exe96⤵PID:1368
-
\??\c:\3xffxxf.exec:\3xffxxf.exe97⤵PID:2476
-
\??\c:\xxxfxfx.exec:\xxxfxfx.exe98⤵PID:2112
-
\??\c:\5hhnbb.exec:\5hhnbb.exe99⤵PID:1640
-
\??\c:\ddpvp.exec:\ddpvp.exe100⤵PID:2116
-
\??\c:\dpddj.exec:\dpddj.exe101⤵PID:2228
-
\??\c:\flfxrfr.exec:\flfxrfr.exe102⤵
- System Location Discovery: System Language Discovery
PID:1316 -
\??\c:\hhhntn.exec:\hhhntn.exe103⤵PID:2448
-
\??\c:\9nntbn.exec:\9nntbn.exe104⤵PID:600
-
\??\c:\5jddd.exec:\5jddd.exe105⤵PID:2076
-
\??\c:\ffxxffr.exec:\ffxxffr.exe106⤵PID:2796
-
\??\c:\bhbbtn.exec:\bhbbtn.exe107⤵PID:896
-
\??\c:\nbnnbb.exec:\nbnnbb.exe108⤵PID:344
-
\??\c:\vvdvv.exec:\vvdvv.exe109⤵PID:2496
-
\??\c:\rlllxfl.exec:\rlllxfl.exe110⤵PID:3008
-
\??\c:\5fllxxf.exec:\5fllxxf.exe111⤵PID:2236
-
\??\c:\ttthtb.exec:\ttthtb.exe112⤵PID:2220
-
\??\c:\5pddj.exec:\5pddj.exe113⤵PID:2588
-
\??\c:\9dvvj.exec:\9dvvj.exe114⤵PID:2144
-
\??\c:\5lxxllr.exec:\5lxxllr.exe115⤵PID:1308
-
\??\c:\1hhhnt.exec:\1hhhnt.exe116⤵PID:1580
-
\??\c:\pvpvp.exec:\pvpvp.exe117⤵PID:2108
-
\??\c:\fxrxllx.exec:\fxrxllx.exe118⤵PID:2080
-
\??\c:\nnbhth.exec:\nnbhth.exe119⤵PID:2944
-
\??\c:\5tnnth.exec:\5tnnth.exe120⤵PID:2528
-
\??\c:\jdvpv.exec:\jdvpv.exe121⤵PID:1536
-
\??\c:\xlfrffr.exec:\xlfrffr.exe122⤵PID:2872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-