Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe
-
Size
456KB
-
MD5
c5f1481397bf6c741a6891e32882b090
-
SHA1
7007cc132cc2b5deee031e1d64fb54a0179a16b1
-
SHA256
f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263d
-
SHA512
bcfbae83b56bfd2694f7c8a91bff709c24e920359ffeb540671e309aeeb64f3e392e53b9b06a93076dc6076a8fb12c1c57cfdd56439f63de6dc3efd3d7a87eb7
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeLV:q7Tc2NYHUrAwfMp3CDLV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-213-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2792-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-365-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2612-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1372-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/756-405-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/772-436-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/544-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1708-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-658-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-817-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-824-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2904-920-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3056-939-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2884-955-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-1004-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2520 3rrrrrr.exe 1940 thbhnh.exe 2348 1jvpd.exe 2320 vvdvp.exe 2808 rxlxlfl.exe 2084 hnttnn.exe 2804 dvddj.exe 2628 frxflfl.exe 1372 9ddvv.exe 2728 1jvvv.exe 3068 nhtnbb.exe 1740 jjdjv.exe 1956 9fxffxf.exe 1000 lllxxfl.exe 1420 dvjvj.exe 1364 5rfxlfr.exe 1888 7tbtbb.exe 2912 3dpdd.exe 1900 xlffxxf.exe 2400 bththn.exe 2960 ppvdj.exe 2384 fxlxffr.exe 1604 ddvdp.exe 2016 xfrxxxx.exe 1708 tbbbtt.exe 2792 djvvd.exe 1624 llfxxll.exe 556 hbnthn.exe 2468 dvjjp.exe 984 llrxxxl.exe 1032 xrfllrx.exe 2100 9nnntn.exe 1640 5ddjj.exe 2688 hbntbh.exe 2800 jdvjd.exe 2340 vpdjp.exe 2852 fxllxxr.exe 2808 rfflxrx.exe 2964 hbthtt.exe 2888 ttnthn.exe 2760 5jvpj.exe 2612 lfrlxxl.exe 2640 hbhnhn.exe 1372 nnhthh.exe 1976 dpjjj.exe 2656 lffxffl.exe 756 rrllffr.exe 1676 nhhnbh.exe 1144 5htttb.exe 1412 jpjpj.exe 1432 3fxlrlx.exe 772 1lfxlxf.exe 1500 btbhbh.exe 624 vdppv.exe 2864 frxfflr.exe 3052 lllxlrf.exe 1984 btntbh.exe 2088 9nhhhn.exe 2400 vpdpd.exe 2280 7llxflx.exe 2308 ffrxflx.exe 544 1tttht.exe 1844 dvdjp.exe 2020 jdvvd.exe -
resource yara_rule behavioral1/memory/2100-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-658-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-684-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-697-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-710-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-804-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-857-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-882-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-895-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-946-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-955-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-1004-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxxrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2520 2100 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 30 PID 2100 wrote to memory of 2520 2100 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 30 PID 2100 wrote to memory of 2520 2100 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 30 PID 2100 wrote to memory of 2520 2100 f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe 30 PID 2520 wrote to memory of 1940 2520 3rrrrrr.exe 31 PID 2520 wrote to memory of 1940 2520 3rrrrrr.exe 31 PID 2520 wrote to memory of 1940 2520 3rrrrrr.exe 31 PID 2520 wrote to memory of 1940 2520 3rrrrrr.exe 31 PID 1940 wrote to memory of 2348 1940 thbhnh.exe 32 PID 1940 wrote to memory of 2348 1940 thbhnh.exe 32 PID 1940 wrote to memory of 2348 1940 thbhnh.exe 32 PID 1940 wrote to memory of 2348 1940 thbhnh.exe 32 PID 2348 wrote to memory of 2320 2348 1jvpd.exe 33 PID 2348 wrote to memory of 2320 2348 1jvpd.exe 33 PID 2348 wrote to memory of 2320 2348 1jvpd.exe 33 PID 2348 wrote to memory of 2320 2348 1jvpd.exe 33 PID 2320 wrote to memory of 2808 2320 vvdvp.exe 34 PID 2320 wrote to memory of 2808 2320 vvdvp.exe 34 PID 2320 wrote to memory of 2808 2320 vvdvp.exe 34 PID 2320 wrote to memory of 2808 2320 vvdvp.exe 34 PID 2808 wrote to memory of 2084 2808 rxlxlfl.exe 35 PID 2808 wrote to memory of 2084 2808 rxlxlfl.exe 35 PID 2808 wrote to memory of 2084 2808 rxlxlfl.exe 35 PID 2808 wrote to memory of 2084 2808 rxlxlfl.exe 35 PID 2084 wrote to memory of 2804 2084 hnttnn.exe 36 PID 2084 wrote to memory of 2804 2084 hnttnn.exe 36 PID 2084 wrote to memory of 2804 2084 hnttnn.exe 36 PID 2084 wrote to memory of 2804 2084 hnttnn.exe 36 PID 2804 wrote to memory of 2628 2804 dvddj.exe 37 PID 2804 wrote to memory of 2628 2804 dvddj.exe 37 PID 2804 wrote to memory of 2628 2804 dvddj.exe 37 PID 2804 wrote to memory of 2628 2804 dvddj.exe 37 PID 2628 wrote to memory of 1372 2628 frxflfl.exe 38 PID 2628 wrote to memory of 1372 2628 frxflfl.exe 38 PID 2628 wrote to memory of 1372 2628 frxflfl.exe 38 PID 2628 wrote to memory of 1372 2628 frxflfl.exe 38 PID 1372 wrote to memory of 2728 1372 9ddvv.exe 39 PID 1372 wrote to memory of 2728 1372 9ddvv.exe 39 PID 1372 wrote to memory of 2728 1372 9ddvv.exe 39 PID 1372 wrote to memory of 2728 1372 9ddvv.exe 39 PID 2728 wrote to memory of 3068 2728 1jvvv.exe 40 PID 2728 wrote to memory of 3068 2728 1jvvv.exe 40 PID 2728 wrote to memory of 3068 2728 1jvvv.exe 40 PID 2728 wrote to memory of 3068 2728 1jvvv.exe 40 PID 3068 wrote to memory of 1740 3068 nhtnbb.exe 41 PID 3068 wrote to memory of 1740 3068 nhtnbb.exe 41 PID 3068 wrote to memory of 1740 3068 nhtnbb.exe 41 PID 3068 wrote to memory of 1740 3068 nhtnbb.exe 41 PID 1740 wrote to memory of 1956 1740 jjdjv.exe 42 PID 1740 wrote to memory of 1956 1740 jjdjv.exe 42 PID 1740 wrote to memory of 1956 1740 jjdjv.exe 42 PID 1740 wrote to memory of 1956 1740 jjdjv.exe 42 PID 1956 wrote to memory of 1000 1956 9fxffxf.exe 43 PID 1956 wrote to memory of 1000 1956 9fxffxf.exe 43 PID 1956 wrote to memory of 1000 1956 9fxffxf.exe 43 PID 1956 wrote to memory of 1000 1956 9fxffxf.exe 43 PID 1000 wrote to memory of 1420 1000 lllxxfl.exe 44 PID 1000 wrote to memory of 1420 1000 lllxxfl.exe 44 PID 1000 wrote to memory of 1420 1000 lllxxfl.exe 44 PID 1000 wrote to memory of 1420 1000 lllxxfl.exe 44 PID 1420 wrote to memory of 1364 1420 dvjvj.exe 45 PID 1420 wrote to memory of 1364 1420 dvjvj.exe 45 PID 1420 wrote to memory of 1364 1420 dvjvj.exe 45 PID 1420 wrote to memory of 1364 1420 dvjvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe"C:\Users\Admin\AppData\Local\Temp\f04fce9327eb7321c2cfc5dfd601763f0d2a4bc8a64ad783c92326a2995b263dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\3rrrrrr.exec:\3rrrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\thbhnh.exec:\thbhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\1jvpd.exec:\1jvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vvdvp.exec:\vvdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\rxlxlfl.exec:\rxlxlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\hnttnn.exec:\hnttnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\dvddj.exec:\dvddj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\frxflfl.exec:\frxflfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\9ddvv.exec:\9ddvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\1jvvv.exec:\1jvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhtnbb.exec:\nhtnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\jjdjv.exec:\jjdjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\9fxffxf.exec:\9fxffxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\lllxxfl.exec:\lllxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\dvjvj.exec:\dvjvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\5rfxlfr.exec:\5rfxlfr.exe17⤵
- Executes dropped EXE
PID:1364 -
\??\c:\7tbtbb.exec:\7tbtbb.exe18⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3dpdd.exec:\3dpdd.exe19⤵
- Executes dropped EXE
PID:2912 -
\??\c:\xlffxxf.exec:\xlffxxf.exe20⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bththn.exec:\bththn.exe21⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ppvdj.exec:\ppvdj.exe22⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxlxffr.exec:\fxlxffr.exe23⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ddvdp.exec:\ddvdp.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\xfrxxxx.exec:\xfrxxxx.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tbbbtt.exec:\tbbbtt.exe26⤵
- Executes dropped EXE
PID:1708 -
\??\c:\djvvd.exec:\djvvd.exe27⤵
- Executes dropped EXE
PID:2792 -
\??\c:\llfxxll.exec:\llfxxll.exe28⤵
- Executes dropped EXE
PID:1624 -
\??\c:\hbnthn.exec:\hbnthn.exe29⤵
- Executes dropped EXE
PID:556 -
\??\c:\dvjjp.exec:\dvjjp.exe30⤵
- Executes dropped EXE
PID:2468 -
\??\c:\llrxxxl.exec:\llrxxxl.exe31⤵
- Executes dropped EXE
PID:984 -
\??\c:\xrfllrx.exec:\xrfllrx.exe32⤵
- Executes dropped EXE
PID:1032 -
\??\c:\9nnntn.exec:\9nnntn.exe33⤵
- Executes dropped EXE
PID:2100 -
\??\c:\5ddjj.exec:\5ddjj.exe34⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbntbh.exec:\hbntbh.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jdvjd.exec:\jdvjd.exe36⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vpdjp.exec:\vpdjp.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxllxxr.exec:\fxllxxr.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rfflxrx.exec:\rfflxrx.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\hbthtt.exec:\hbthtt.exe40⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ttnthn.exec:\ttnthn.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5jvpj.exec:\5jvpj.exe42⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\hbhnhn.exec:\hbhnhn.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\nnhthh.exec:\nnhthh.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\dpjjj.exec:\dpjjj.exe46⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lffxffl.exec:\lffxffl.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rrllffr.exec:\rrllffr.exe48⤵
- Executes dropped EXE
PID:756 -
\??\c:\nhhnbh.exec:\nhhnbh.exe49⤵
- Executes dropped EXE
PID:1676 -
\??\c:\5htttb.exec:\5htttb.exe50⤵
- Executes dropped EXE
PID:1144 -
\??\c:\jpjpj.exec:\jpjpj.exe51⤵
- Executes dropped EXE
PID:1412 -
\??\c:\3fxlrlx.exec:\3fxlrlx.exe52⤵
- Executes dropped EXE
PID:1432 -
\??\c:\1lfxlxf.exec:\1lfxlxf.exe53⤵
- Executes dropped EXE
PID:772 -
\??\c:\btbhbh.exec:\btbhbh.exe54⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vdppv.exec:\vdppv.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\frxfflr.exec:\frxfflr.exe56⤵
- Executes dropped EXE
PID:2864 -
\??\c:\lllxlrf.exec:\lllxlrf.exe57⤵
- Executes dropped EXE
PID:3052 -
\??\c:\btntbh.exec:\btntbh.exe58⤵
- Executes dropped EXE
PID:1984 -
\??\c:\9nhhhn.exec:\9nhhhn.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\vpdpd.exec:\vpdpd.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\7llxflx.exec:\7llxflx.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ffrxflx.exec:\ffrxflx.exe62⤵
- Executes dropped EXE
PID:2308 -
\??\c:\1tttht.exec:\1tttht.exe63⤵
- Executes dropped EXE
PID:544 -
\??\c:\dvdjp.exec:\dvdjp.exe64⤵
- Executes dropped EXE
PID:1844 -
\??\c:\jdvvd.exec:\jdvvd.exe65⤵
- Executes dropped EXE
PID:2020 -
\??\c:\xffrxfl.exec:\xffrxfl.exe66⤵PID:688
-
\??\c:\fxxfrxr.exec:\fxxfrxr.exe67⤵PID:1708
-
\??\c:\9tttnt.exec:\9tttnt.exe68⤵PID:2056
-
\??\c:\3jdvj.exec:\3jdvj.exe69⤵PID:1904
-
\??\c:\jdvvv.exec:\jdvvv.exe70⤵PID:2432
-
\??\c:\lfrxlfl.exec:\lfrxlfl.exe71⤵PID:2236
-
\??\c:\ffrxllx.exec:\ffrxllx.exe72⤵PID:2192
-
\??\c:\1thbnt.exec:\1thbnt.exe73⤵PID:3024
-
\??\c:\ddpdj.exec:\ddpdj.exe74⤵PID:2064
-
\??\c:\jvppv.exec:\jvppv.exe75⤵PID:2540
-
\??\c:\rrfxllf.exec:\rrfxllf.exe76⤵PID:3016
-
\??\c:\htnnhh.exec:\htnnhh.exe77⤵PID:1536
-
\??\c:\nhbhnn.exec:\nhbhnn.exe78⤵PID:2408
-
\??\c:\ddvdj.exec:\ddvdj.exe79⤵PID:2156
-
\??\c:\lfflrfl.exec:\lfflrfl.exe80⤵PID:2824
-
\??\c:\rxflflx.exec:\rxflflx.exe81⤵PID:1912
-
\??\c:\ttnttb.exec:\ttnttb.exe82⤵PID:2860
-
\??\c:\pdppv.exec:\pdppv.exe83⤵PID:2768
-
\??\c:\3dpvd.exec:\3dpvd.exe84⤵PID:2812
-
\??\c:\fxlflxl.exec:\fxlflxl.exe85⤵PID:2780
-
\??\c:\xfflxfr.exec:\xfflxfr.exe86⤵PID:2760
-
\??\c:\ttbtnt.exec:\ttbtnt.exe87⤵PID:2944
-
\??\c:\jdvdj.exec:\jdvdj.exe88⤵PID:2488
-
\??\c:\1jppp.exec:\1jppp.exe89⤵PID:3060
-
\??\c:\xrxlfxl.exec:\xrxlfxl.exe90⤵PID:2884
-
\??\c:\9nhntb.exec:\9nhntb.exe91⤵PID:2344
-
\??\c:\tntbhn.exec:\tntbhn.exe92⤵PID:1740
-
\??\c:\jjvvd.exec:\jjvvd.exe93⤵PID:2648
-
\??\c:\vjvvj.exec:\vjvvj.exe94⤵PID:1584
-
\??\c:\llrrlrx.exec:\llrrlrx.exe95⤵PID:1908
-
\??\c:\tnbntb.exec:\tnbntb.exe96⤵PID:1568
-
\??\c:\nbnntb.exec:\nbnntb.exe97⤵PID:772
-
\??\c:\jdjvj.exec:\jdjvj.exe98⤵PID:1500
-
\??\c:\fxxxllr.exec:\fxxxllr.exe99⤵PID:108
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe100⤵PID:2796
-
\??\c:\1hbhnt.exec:\1hbhnt.exe101⤵PID:2392
-
\??\c:\1dvdj.exec:\1dvdj.exe102⤵PID:2076
-
\??\c:\pjjdj.exec:\pjjdj.exe103⤵PID:2184
-
\??\c:\7fllrrf.exec:\7fllrrf.exe104⤵PID:1556
-
\??\c:\tntbhn.exec:\tntbhn.exe105⤵PID:2308
-
\??\c:\9pppp.exec:\9pppp.exe106⤵PID:2040
-
\??\c:\3ppvd.exec:\3ppvd.exe107⤵PID:1476
-
\??\c:\lxllrrf.exec:\lxllrrf.exe108⤵PID:2020
-
\??\c:\lflrxfr.exec:\lflrxfr.exe109⤵PID:2328
-
\??\c:\btntnt.exec:\btntnt.exe110⤵PID:2792
-
\??\c:\9pjdj.exec:\9pjdj.exe111⤵PID:1052
-
\??\c:\xlllxxf.exec:\xlllxxf.exe112⤵PID:1216
-
\??\c:\lfxlrxf.exec:\lfxlrxf.exe113⤵PID:1728
-
\??\c:\btnthh.exec:\btnthh.exe114⤵PID:2436
-
\??\c:\tttthh.exec:\tttthh.exe115⤵PID:2060
-
\??\c:\pvvvd.exec:\pvvvd.exe116⤵PID:876
-
\??\c:\1xlrxfl.exec:\1xlrxfl.exe117⤵PID:2532
-
\??\c:\rlflrlx.exec:\rlflrlx.exe118⤵PID:2540
-
\??\c:\ntnhnt.exec:\ntnhnt.exe119⤵PID:1636
-
\??\c:\pjjjd.exec:\pjjjd.exe120⤵PID:1668
-
\??\c:\ddjpv.exec:\ddjpv.exe121⤵PID:1940
-
\??\c:\lfrrxxx.exec:\lfrrxxx.exe122⤵PID:2340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-