Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 01:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe
-
Size
453KB
-
MD5
ab42f503fd343be47cd70c3b952b2351
-
SHA1
2b5947d6b8b11387999af3457e96e809016fb7fe
-
SHA256
a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4
-
SHA512
943fe657b01f0d40487b02796beb3c09be5db5dcebad992b64ea74b9081cbccf699a610f339e22ada8145880e24c9d7c667344c642d162ba5a3098cff879a869
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/816-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2556-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2584-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-103-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1204-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1296-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-136-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3056-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-295-0x0000000077270000-0x000000007738F000-memory.dmp family_blackmoon behavioral1/memory/1996-296-0x0000000077170000-0x000000007726A000-memory.dmp family_blackmoon behavioral1/memory/3040-322-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-335-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-426-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/2900-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1044-532-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-641-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 3fxfrrx.exe 2668 jdvdj.exe 2792 hbtbnt.exe 2556 nnntnn.exe 2732 9hnhtt.exe 2616 3jpjp.exe 2584 nbtttt.exe 1840 vjppv.exe 2096 tnbhhh.exe 2388 1nhnbb.exe 1812 fxrxxrf.exe 1204 bthhtb.exe 1908 dpjjv.exe 1104 3vdjj.exe 1296 7bnhhb.exe 2748 jvjdd.exe 3056 nbnhhh.exe 2220 pdvvp.exe 1608 rrrxflx.exe 1504 7vjjv.exe 2124 5rfllfl.exe 1224 fxxlrrx.exe 1668 ttbtbb.exe 2076 rlxrxrr.exe 1520 7ttbhh.exe 1328 pjdpv.exe 1604 1bnttt.exe 2172 vjvvp.exe 2208 xlxlrrx.exe 2444 pdvvv.exe 892 fxllrxx.exe 1996 1nbbhb.exe 2800 rxxxlll.exe 2776 xlfffff.exe 3040 rlrllll.exe 2752 htbttn.exe 2792 vjppp.exe 2580 llfffxf.exe 2528 lfrffxx.exe 2660 bbtnth.exe 2612 dvjdj.exe 1672 1lrxfxf.exe 2796 rrxflxf.exe 2636 tnnntn.exe 2360 vjddj.exe 2396 3flffxf.exe 2520 9nthnn.exe 1620 3tnnnn.exe 1820 vpjdv.exe 1508 rfrxxfx.exe 2860 bntnbh.exe 536 3ddpj.exe 2892 1vpdj.exe 2900 rlffrlx.exe 2080 3nnthn.exe 3016 pjppd.exe 1940 jvjdj.exe 1800 frxrrlr.exe 1680 1bhtbt.exe 1736 nhtttt.exe 2504 dvdjp.exe 1300 fxlrrrr.exe 1864 nbtnnh.exe 1060 nbtttt.exe -
resource yara_rule behavioral1/memory/816-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2584-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1296-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-158-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/2220-178-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1608-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-295-0x0000000077270000-0x000000007738F000-memory.dmp upx behavioral1/memory/3040-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1300-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-566-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1780-641-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-741-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1708-1104-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 2768 816 a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe 31 PID 816 wrote to memory of 2768 816 a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe 31 PID 816 wrote to memory of 2768 816 a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe 31 PID 816 wrote to memory of 2768 816 a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe 31 PID 2768 wrote to memory of 2668 2768 3fxfrrx.exe 32 PID 2768 wrote to memory of 2668 2768 3fxfrrx.exe 32 PID 2768 wrote to memory of 2668 2768 3fxfrrx.exe 32 PID 2768 wrote to memory of 2668 2768 3fxfrrx.exe 32 PID 2668 wrote to memory of 2792 2668 jdvdj.exe 33 PID 2668 wrote to memory of 2792 2668 jdvdj.exe 33 PID 2668 wrote to memory of 2792 2668 jdvdj.exe 33 PID 2668 wrote to memory of 2792 2668 jdvdj.exe 33 PID 2792 wrote to memory of 2556 2792 hbtbnt.exe 34 PID 2792 wrote to memory of 2556 2792 hbtbnt.exe 34 PID 2792 wrote to memory of 2556 2792 hbtbnt.exe 34 PID 2792 wrote to memory of 2556 2792 hbtbnt.exe 34 PID 2556 wrote to memory of 2732 2556 nnntnn.exe 35 PID 2556 wrote to memory of 2732 2556 nnntnn.exe 35 PID 2556 wrote to memory of 2732 2556 nnntnn.exe 35 PID 2556 wrote to memory of 2732 2556 nnntnn.exe 35 PID 2732 wrote to memory of 2616 2732 9hnhtt.exe 36 PID 2732 wrote to memory of 2616 2732 9hnhtt.exe 36 PID 2732 wrote to memory of 2616 2732 9hnhtt.exe 36 PID 2732 wrote to memory of 2616 2732 9hnhtt.exe 36 PID 2616 wrote to memory of 2584 2616 3jpjp.exe 37 PID 2616 wrote to memory of 2584 2616 3jpjp.exe 37 PID 2616 wrote to memory of 2584 2616 3jpjp.exe 37 PID 2616 wrote to memory of 2584 2616 3jpjp.exe 37 PID 2584 wrote to memory of 1840 2584 nbtttt.exe 38 PID 2584 wrote to memory of 1840 2584 nbtttt.exe 38 PID 2584 wrote to memory of 1840 2584 nbtttt.exe 38 PID 2584 wrote to memory of 1840 2584 nbtttt.exe 38 PID 1840 wrote to memory of 2096 1840 vjppv.exe 39 PID 1840 wrote to memory of 2096 1840 vjppv.exe 39 PID 1840 wrote to memory of 2096 1840 vjppv.exe 39 PID 1840 wrote to memory of 2096 1840 vjppv.exe 39 PID 2096 wrote to memory of 2388 2096 tnbhhh.exe 40 PID 2096 wrote to memory of 2388 2096 tnbhhh.exe 40 PID 2096 wrote to memory of 2388 2096 tnbhhh.exe 40 PID 2096 wrote to memory of 2388 2096 tnbhhh.exe 40 PID 2388 wrote to memory of 1812 2388 1nhnbb.exe 41 PID 2388 wrote to memory of 1812 2388 1nhnbb.exe 41 PID 2388 wrote to memory of 1812 2388 1nhnbb.exe 41 PID 2388 wrote to memory of 1812 2388 1nhnbb.exe 41 PID 1812 wrote to memory of 1204 1812 fxrxxrf.exe 42 PID 1812 wrote to memory of 1204 1812 fxrxxrf.exe 42 PID 1812 wrote to memory of 1204 1812 fxrxxrf.exe 42 PID 1812 wrote to memory of 1204 1812 fxrxxrf.exe 42 PID 1204 wrote to memory of 1908 1204 bthhtb.exe 43 PID 1204 wrote to memory of 1908 1204 bthhtb.exe 43 PID 1204 wrote to memory of 1908 1204 bthhtb.exe 43 PID 1204 wrote to memory of 1908 1204 bthhtb.exe 43 PID 1908 wrote to memory of 1104 1908 dpjjv.exe 44 PID 1908 wrote to memory of 1104 1908 dpjjv.exe 44 PID 1908 wrote to memory of 1104 1908 dpjjv.exe 44 PID 1908 wrote to memory of 1104 1908 dpjjv.exe 44 PID 1104 wrote to memory of 1296 1104 3vdjj.exe 45 PID 1104 wrote to memory of 1296 1104 3vdjj.exe 45 PID 1104 wrote to memory of 1296 1104 3vdjj.exe 45 PID 1104 wrote to memory of 1296 1104 3vdjj.exe 45 PID 1296 wrote to memory of 2748 1296 7bnhhb.exe 46 PID 1296 wrote to memory of 2748 1296 7bnhhb.exe 46 PID 1296 wrote to memory of 2748 1296 7bnhhb.exe 46 PID 1296 wrote to memory of 2748 1296 7bnhhb.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe"C:\Users\Admin\AppData\Local\Temp\a00edb43de9758f31243681cf771230ae72f04d66cf4aa58200aa276797b91f4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\3fxfrrx.exec:\3fxfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jdvdj.exec:\jdvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hbtbnt.exec:\hbtbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\nnntnn.exec:\nnntnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\9hnhtt.exec:\9hnhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3jpjp.exec:\3jpjp.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nbtttt.exec:\nbtttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\vjppv.exec:\vjppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\tnbhhh.exec:\tnbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\1nhnbb.exec:\1nhnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fxrxxrf.exec:\fxrxxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bthhtb.exec:\bthhtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\dpjjv.exec:\dpjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3vdjj.exec:\3vdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\7bnhhb.exec:\7bnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jvjdd.exec:\jvjdd.exe17⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nbnhhh.exec:\nbnhhh.exe18⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pdvvp.exec:\pdvvp.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrrxflx.exec:\rrrxflx.exe20⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7vjjv.exec:\7vjjv.exe21⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5rfllfl.exec:\5rfllfl.exe22⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxxlrrx.exec:\fxxlrrx.exe23⤵
- Executes dropped EXE
PID:1224 -
\??\c:\ttbtbb.exec:\ttbtbb.exe24⤵
- Executes dropped EXE
PID:1668 -
\??\c:\rlxrxrr.exec:\rlxrxrr.exe25⤵
- Executes dropped EXE
PID:2076 -
\??\c:\7ttbhh.exec:\7ttbhh.exe26⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pjdpv.exec:\pjdpv.exe27⤵
- Executes dropped EXE
PID:1328 -
\??\c:\1bnttt.exec:\1bnttt.exe28⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vjvvp.exec:\vjvvp.exe29⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xlxlrrx.exec:\xlxlrrx.exe30⤵
- Executes dropped EXE
PID:2208 -
\??\c:\pdvvv.exec:\pdvvv.exe31⤵
- Executes dropped EXE
PID:2444 -
\??\c:\fxllrxx.exec:\fxllrxx.exe32⤵
- Executes dropped EXE
PID:892 -
\??\c:\1nbbhb.exec:\1nbbhb.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vdjpp.exec:\vdjpp.exe34⤵PID:1584
-
\??\c:\rxxxlll.exec:\rxxxlll.exe35⤵
- Executes dropped EXE
PID:2800 -
\??\c:\xlfffff.exec:\xlfffff.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rlrllll.exec:\rlrllll.exe37⤵
- Executes dropped EXE
PID:3040 -
\??\c:\htbttn.exec:\htbttn.exe38⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vjppp.exec:\vjppp.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\llfffxf.exec:\llfffxf.exe40⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lfrffxx.exec:\lfrffxx.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bbtnth.exec:\bbtnth.exe42⤵
- Executes dropped EXE
PID:2660 -
\??\c:\dvjdj.exec:\dvjdj.exe43⤵
- Executes dropped EXE
PID:2612 -
\??\c:\1lrxfxf.exec:\1lrxfxf.exe44⤵
- Executes dropped EXE
PID:1672 -
\??\c:\rrxflxf.exec:\rrxflxf.exe45⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tnnntn.exec:\tnnntn.exe46⤵
- Executes dropped EXE
PID:2636 -
\??\c:\vjddj.exec:\vjddj.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\3flffxf.exec:\3flffxf.exe48⤵
- Executes dropped EXE
PID:2396 -
\??\c:\9nthnn.exec:\9nthnn.exe49⤵
- Executes dropped EXE
PID:2520 -
\??\c:\3tnnnn.exec:\3tnnnn.exe50⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vpjdv.exec:\vpjdv.exe51⤵
- Executes dropped EXE
PID:1820 -
\??\c:\rfrxxfx.exec:\rfrxxfx.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\bntnbh.exec:\bntnbh.exe53⤵
- Executes dropped EXE
PID:2860 -
\??\c:\3ddpj.exec:\3ddpj.exe54⤵
- Executes dropped EXE
PID:536 -
\??\c:\1vpdj.exec:\1vpdj.exe55⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlffrlx.exec:\rlffrlx.exe56⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3nnthn.exec:\3nnthn.exe57⤵
- Executes dropped EXE
PID:2080 -
\??\c:\pjppd.exec:\pjppd.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\jvjdj.exec:\jvjdj.exe59⤵
- Executes dropped EXE
PID:1940 -
\??\c:\frxrrlr.exec:\frxrrlr.exe60⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1bhtbt.exec:\1bhtbt.exe61⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhtttt.exec:\nhtttt.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\dvdjp.exec:\dvdjp.exe63⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fxlrrrr.exec:\fxlrrrr.exe64⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nbtnnh.exec:\nbtnnh.exe65⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbtttt.exec:\nbtttt.exe66⤵
- Executes dropped EXE
PID:1060 -
\??\c:\dpppp.exec:\dpppp.exe67⤵PID:3012
-
\??\c:\frfxrrr.exec:\frfxrrr.exe68⤵PID:1744
-
\??\c:\5hnhnh.exec:\5hnhnh.exe69⤵PID:1044
-
\??\c:\1tntbn.exec:\1tntbn.exe70⤵PID:320
-
\??\c:\1pvvd.exec:\1pvvd.exe71⤵PID:2508
-
\??\c:\9lxrlfl.exec:\9lxrlfl.exe72⤵PID:684
-
\??\c:\tnbhhh.exec:\tnbhhh.exe73⤵PID:1448
-
\??\c:\vpjdj.exec:\vpjdj.exe74⤵PID:2728
-
\??\c:\dpdvd.exec:\dpdvd.exe75⤵PID:884
-
\??\c:\lxfrrrr.exec:\lxfrrrr.exe76⤵PID:1580
-
\??\c:\nbnhhh.exec:\nbnhhh.exe77⤵PID:2812
-
\??\c:\1dvpj.exec:\1dvpj.exe78⤵PID:2700
-
\??\c:\3jvdd.exec:\3jvdd.exe79⤵PID:2756
-
\??\c:\5frrxff.exec:\5frrxff.exe80⤵PID:2568
-
\??\c:\9nbthh.exec:\9nbthh.exe81⤵PID:2676
-
\??\c:\vjvpv.exec:\vjvpv.exe82⤵PID:2652
-
\??\c:\vpjvj.exec:\vpjvj.exe83⤵PID:2548
-
\??\c:\fxrrrrx.exec:\fxrrrrx.exe84⤵PID:2716
-
\??\c:\tthbhh.exec:\tthbhh.exe85⤵PID:3008
-
\??\c:\vdvdp.exec:\vdvdp.exe86⤵PID:1780
-
\??\c:\3rfllff.exec:\3rfllff.exe87⤵PID:2980
-
\??\c:\nbtnnt.exec:\nbtnnt.exe88⤵PID:1900
-
\??\c:\nbnnbt.exec:\nbnnbt.exe89⤵
- System Location Discovery: System Language Discovery
PID:2164 -
\??\c:\vvpvj.exec:\vvpvj.exe90⤵PID:2128
-
\??\c:\3fxllll.exec:\3fxllll.exe91⤵PID:1200
-
\??\c:\xrlrrrx.exec:\xrlrrrx.exe92⤵PID:2264
-
\??\c:\htnntb.exec:\htnntb.exe93⤵PID:1836
-
\??\c:\3jddd.exec:\3jddd.exe94⤵PID:1248
-
\??\c:\rfllxlf.exec:\rfllxlf.exe95⤵PID:1908
-
\??\c:\fxrllfr.exec:\fxrllfr.exe96⤵PID:980
-
\??\c:\nntnhb.exec:\nntnhb.exe97⤵PID:2884
-
\??\c:\5jvdd.exec:\5jvdd.exe98⤵PID:3028
-
\??\c:\xlxllfl.exec:\xlxllfl.exe99⤵PID:2232
-
\??\c:\ffxlflf.exec:\ffxlflf.exe100⤵PID:2148
-
\??\c:\hbttbb.exec:\hbttbb.exe101⤵PID:604
-
\??\c:\3pdvp.exec:\3pdvp.exe102⤵PID:2916
-
\??\c:\llrxlxr.exec:\llrxlxr.exe103⤵PID:1028
-
\??\c:\ttnbhn.exec:\ttnbhn.exe104⤵PID:988
-
\??\c:\thbnht.exec:\thbnht.exe105⤵PID:1344
-
\??\c:\vvjpv.exec:\vvjpv.exe106⤵PID:2488
-
\??\c:\fxffrrf.exec:\fxffrrf.exe107⤵PID:700
-
\??\c:\nnnhtb.exec:\nnnhtb.exe108⤵PID:1668
-
\??\c:\hhtbtb.exec:\hhtbtb.exe109⤵PID:2912
-
\??\c:\1vdjp.exec:\1vdjp.exe110⤵PID:1560
-
\??\c:\lxfxlfl.exec:\lxfxlfl.exe111⤵PID:1740
-
\??\c:\thnthh.exec:\thnthh.exe112⤵PID:628
-
\??\c:\bbtbnn.exec:\bbtbnn.exe113⤵PID:2392
-
\??\c:\5jjpv.exec:\5jjpv.exe114⤵
- System Location Discovery: System Language Discovery
PID:1640 -
\??\c:\lfrxlll.exec:\lfrxlll.exe115⤵PID:2172
-
\??\c:\bnhtnt.exec:\bnhtnt.exe116⤵PID:1052
-
\??\c:\vjjpd.exec:\vjjpd.exe117⤵PID:1788
-
\??\c:\flflfll.exec:\flflfll.exe118⤵PID:2784
-
\??\c:\bnhntn.exec:\bnhntn.exe119⤵PID:884
-
\??\c:\ddvdj.exec:\ddvdj.exe120⤵PID:1580
-
\??\c:\lfrrxxr.exec:\lfrrxxr.exe121⤵PID:2812
-
\??\c:\5frlrrx.exec:\5frlrrx.exe122⤵PID:2700
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-