Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe
-
Size
454KB
-
MD5
15dbe86a258c297303d5459479b13c81
-
SHA1
0fbc5060f7f3cf3ab026f71ddf72a58b8cdb79c8
-
SHA256
7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694
-
SHA512
e78d1e330ccf941c9a91fef0801447fa754cca5416774ab6e04bb3e3a3758fee7fcdc08e6b2127b80ac28d3e154ed6a3138d1bde1f46019e85b696a7c34f4d54
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2116-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1084-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1836-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/520-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/560-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-373-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2272-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/680-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-541-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1680-547-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2628-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2880-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-671-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2908-692-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon behavioral1/memory/432-705-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1028-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 760 xfvdb.exe 2184 ldjblbv.exe 2912 hrllhb.exe 2144 xpfrr.exe 3064 xnddf.exe 2480 pjfdjpd.exe 2512 jbptjf.exe 2856 rdhnt.exe 2788 bfjhpb.exe 1084 lpbnj.exe 916 bpvrfdv.exe 3028 bnnbl.exe 2340 xxjffb.exe 1836 frvprrl.exe 2120 fbbnbf.exe 2600 rjpnrbv.exe 2352 xxhtpn.exe 2292 rpbfn.exe 520 rdnbrfh.exe 2176 vlvhh.exe 2284 npjhfx.exe 560 lrdlv.exe 2000 tlxjv.exe 1680 xvprbx.exe 1600 fvxjtnl.exe 2532 ttdtnvd.exe 1308 jnvdhnn.exe 632 nfhhrdr.exe 576 lflbp.exe 1748 xfjhn.exe 1824 tnxjxp.exe 1256 vfvpfp.exe 2164 bvldj.exe 1620 fbffxx.exe 1236 vvthbx.exe 2040 vnfphv.exe 2256 phrff.exe 2952 ntxbrd.exe 2496 ptdft.exe 3032 nfdjjbt.exe 2836 xhdfjh.exe 2820 ndhvxnf.exe 2272 fxjdn.exe 2856 xxbdh.exe 1692 bvrbbpv.exe 2360 vxhvj.exe 1492 vrrvn.exe 2316 nnllbt.exe 2276 nnptb.exe 1500 ntnjdf.exe 1832 phxljbt.exe 1836 hhfdd.exe 1408 tdxlvp.exe 1632 nnhnnf.exe 764 hfhnlnp.exe 1956 rnvrrv.exe 2240 jxxtd.exe 2456 btvfdd.exe 1960 frlxvxr.exe 2412 tjrbj.exe 972 jndjhbt.exe 680 drhpftv.exe 2148 tfpbbnv.exe 1364 frbjd.exe -
resource yara_rule behavioral1/memory/2116-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1084-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1836-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/520-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/560-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1500-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-493-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1680-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-685-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/432-705-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-733-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdtnvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnjdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hplhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vlphlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frhvlpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvthv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxtlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llnhfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njfvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fftlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjfdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxnxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxtd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnrdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjtjh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxnpvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvhpxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bvhxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plhlrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbpfhbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btdrtxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language txtdffp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnxtbpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtbrrpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvhxtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frdhrh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flltnbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdjdhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvpdfbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfnlv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xpfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvlvdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnthln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bjtffjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2116 wrote to memory of 760 2116 7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe 30 PID 2116 wrote to memory of 760 2116 7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe 30 PID 2116 wrote to memory of 760 2116 7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe 30 PID 2116 wrote to memory of 760 2116 7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe 30 PID 760 wrote to memory of 2184 760 xfvdb.exe 31 PID 760 wrote to memory of 2184 760 xfvdb.exe 31 PID 760 wrote to memory of 2184 760 xfvdb.exe 31 PID 760 wrote to memory of 2184 760 xfvdb.exe 31 PID 2184 wrote to memory of 2912 2184 ldjblbv.exe 32 PID 2184 wrote to memory of 2912 2184 ldjblbv.exe 32 PID 2184 wrote to memory of 2912 2184 ldjblbv.exe 32 PID 2184 wrote to memory of 2912 2184 ldjblbv.exe 32 PID 2912 wrote to memory of 2144 2912 hrllhb.exe 33 PID 2912 wrote to memory of 2144 2912 hrllhb.exe 33 PID 2912 wrote to memory of 2144 2912 hrllhb.exe 33 PID 2912 wrote to memory of 2144 2912 hrllhb.exe 33 PID 2144 wrote to memory of 3064 2144 xpfrr.exe 34 PID 2144 wrote to memory of 3064 2144 xpfrr.exe 34 PID 2144 wrote to memory of 3064 2144 xpfrr.exe 34 PID 2144 wrote to memory of 3064 2144 xpfrr.exe 34 PID 3064 wrote to memory of 2480 3064 xnddf.exe 35 PID 3064 wrote to memory of 2480 3064 xnddf.exe 35 PID 3064 wrote to memory of 2480 3064 xnddf.exe 35 PID 3064 wrote to memory of 2480 3064 xnddf.exe 35 PID 2480 wrote to memory of 2512 2480 pjfdjpd.exe 36 PID 2480 wrote to memory of 2512 2480 pjfdjpd.exe 36 PID 2480 wrote to memory of 2512 2480 pjfdjpd.exe 36 PID 2480 wrote to memory of 2512 2480 pjfdjpd.exe 36 PID 2512 wrote to memory of 2856 2512 jbptjf.exe 37 PID 2512 wrote to memory of 2856 2512 jbptjf.exe 37 PID 2512 wrote to memory of 2856 2512 jbptjf.exe 37 PID 2512 wrote to memory of 2856 2512 jbptjf.exe 37 PID 2856 wrote to memory of 2788 2856 rdhnt.exe 38 PID 2856 wrote to memory of 2788 2856 rdhnt.exe 38 PID 2856 wrote to memory of 2788 2856 rdhnt.exe 38 PID 2856 wrote to memory of 2788 2856 rdhnt.exe 38 PID 2788 wrote to memory of 1084 2788 bfjhpb.exe 39 PID 2788 wrote to memory of 1084 2788 bfjhpb.exe 39 PID 2788 wrote to memory of 1084 2788 bfjhpb.exe 39 PID 2788 wrote to memory of 1084 2788 bfjhpb.exe 39 PID 1084 wrote to memory of 916 1084 lpbnj.exe 40 PID 1084 wrote to memory of 916 1084 lpbnj.exe 40 PID 1084 wrote to memory of 916 1084 lpbnj.exe 40 PID 1084 wrote to memory of 916 1084 lpbnj.exe 40 PID 916 wrote to memory of 3028 916 bpvrfdv.exe 41 PID 916 wrote to memory of 3028 916 bpvrfdv.exe 41 PID 916 wrote to memory of 3028 916 bpvrfdv.exe 41 PID 916 wrote to memory of 3028 916 bpvrfdv.exe 41 PID 3028 wrote to memory of 2340 3028 bnnbl.exe 42 PID 3028 wrote to memory of 2340 3028 bnnbl.exe 42 PID 3028 wrote to memory of 2340 3028 bnnbl.exe 42 PID 3028 wrote to memory of 2340 3028 bnnbl.exe 42 PID 2340 wrote to memory of 1836 2340 xxjffb.exe 43 PID 2340 wrote to memory of 1836 2340 xxjffb.exe 43 PID 2340 wrote to memory of 1836 2340 xxjffb.exe 43 PID 2340 wrote to memory of 1836 2340 xxjffb.exe 43 PID 1836 wrote to memory of 2120 1836 frvprrl.exe 44 PID 1836 wrote to memory of 2120 1836 frvprrl.exe 44 PID 1836 wrote to memory of 2120 1836 frvprrl.exe 44 PID 1836 wrote to memory of 2120 1836 frvprrl.exe 44 PID 2120 wrote to memory of 2600 2120 fbbnbf.exe 45 PID 2120 wrote to memory of 2600 2120 fbbnbf.exe 45 PID 2120 wrote to memory of 2600 2120 fbbnbf.exe 45 PID 2120 wrote to memory of 2600 2120 fbbnbf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe"C:\Users\Admin\AppData\Local\Temp\7b07b624d6fca61adeb6b5327255071bdea63730fef894120ef8ea93de40d694.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\xfvdb.exec:\xfvdb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\ldjblbv.exec:\ldjblbv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\hrllhb.exec:\hrllhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\xpfrr.exec:\xpfrr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\xnddf.exec:\xnddf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\pjfdjpd.exec:\pjfdjpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\jbptjf.exec:\jbptjf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\rdhnt.exec:\rdhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\bfjhpb.exec:\bfjhpb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lpbnj.exec:\lpbnj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\bpvrfdv.exec:\bpvrfdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\bnnbl.exec:\bnnbl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\xxjffb.exec:\xxjffb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\frvprrl.exec:\frvprrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\fbbnbf.exec:\fbbnbf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\rjpnrbv.exec:\rjpnrbv.exe17⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xxhtpn.exec:\xxhtpn.exe18⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rpbfn.exec:\rpbfn.exe19⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rdnbrfh.exec:\rdnbrfh.exe20⤵
- Executes dropped EXE
PID:520 -
\??\c:\vlvhh.exec:\vlvhh.exe21⤵
- Executes dropped EXE
PID:2176 -
\??\c:\npjhfx.exec:\npjhfx.exe22⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lrdlv.exec:\lrdlv.exe23⤵
- Executes dropped EXE
PID:560 -
\??\c:\tlxjv.exec:\tlxjv.exe24⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xvprbx.exec:\xvprbx.exe25⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fvxjtnl.exec:\fvxjtnl.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ttdtnvd.exec:\ttdtnvd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2532 -
\??\c:\jnvdhnn.exec:\jnvdhnn.exe28⤵
- Executes dropped EXE
PID:1308 -
\??\c:\nfhhrdr.exec:\nfhhrdr.exe29⤵
- Executes dropped EXE
PID:632 -
\??\c:\lflbp.exec:\lflbp.exe30⤵
- Executes dropped EXE
PID:576 -
\??\c:\xfjhn.exec:\xfjhn.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tnxjxp.exec:\tnxjxp.exe32⤵
- Executes dropped EXE
PID:1824 -
\??\c:\vfvpfp.exec:\vfvpfp.exe33⤵
- Executes dropped EXE
PID:1256 -
\??\c:\bvldj.exec:\bvldj.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fbffxx.exec:\fbffxx.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vvthbx.exec:\vvthbx.exe36⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vnfphv.exec:\vnfphv.exe37⤵
- Executes dropped EXE
PID:2040 -
\??\c:\phrff.exec:\phrff.exe38⤵
- Executes dropped EXE
PID:2256 -
\??\c:\ntxbrd.exec:\ntxbrd.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\ptdft.exec:\ptdft.exe40⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nfdjjbt.exec:\nfdjjbt.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xhdfjh.exec:\xhdfjh.exe42⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ndhvxnf.exec:\ndhvxnf.exe43⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxjdn.exec:\fxjdn.exe44⤵
- Executes dropped EXE
PID:2272 -
\??\c:\xxbdh.exec:\xxbdh.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bvrbbpv.exec:\bvrbbpv.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vxhvj.exec:\vxhvj.exe47⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vrrvn.exec:\vrrvn.exe48⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nnllbt.exec:\nnllbt.exe49⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nnptb.exec:\nnptb.exe50⤵
- Executes dropped EXE
PID:2276 -
\??\c:\ntnjdf.exec:\ntnjdf.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1500 -
\??\c:\phxljbt.exec:\phxljbt.exe52⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hhfdd.exec:\hhfdd.exe53⤵
- Executes dropped EXE
PID:1836 -
\??\c:\tdxlvp.exec:\tdxlvp.exe54⤵
- Executes dropped EXE
PID:1408 -
\??\c:\nnhnnf.exec:\nnhnnf.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\hfhnlnp.exec:\hfhnlnp.exe56⤵
- Executes dropped EXE
PID:764 -
\??\c:\rnvrrv.exec:\rnvrrv.exe57⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jxxtd.exec:\jxxtd.exe58⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btvfdd.exec:\btvfdd.exe59⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frlxvxr.exec:\frlxvxr.exe60⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tjrbj.exec:\tjrbj.exe61⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jndjhbt.exec:\jndjhbt.exe62⤵
- Executes dropped EXE
PID:972 -
\??\c:\drhpftv.exec:\drhpftv.exe63⤵
- Executes dropped EXE
PID:680 -
\??\c:\tfpbbnv.exec:\tfpbbnv.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\frbjd.exec:\frbjd.exe65⤵
- Executes dropped EXE
PID:1364 -
\??\c:\fvftfv.exec:\fvftfv.exe66⤵PID:1680
-
\??\c:\tjvpp.exec:\tjvpp.exe67⤵PID:2568
-
\??\c:\xfdfl.exec:\xfdfl.exe68⤵PID:1712
-
\??\c:\xhhvf.exec:\xhhvf.exe69⤵PID:2072
-
\??\c:\hnbbxf.exec:\hnbbxf.exe70⤵PID:2628
-
\??\c:\xdjnft.exec:\xdjnft.exe71⤵PID:1668
-
\??\c:\jdpndt.exec:\jdpndt.exe72⤵PID:2172
-
\??\c:\xfvhb.exec:\xfvhb.exe73⤵PID:932
-
\??\c:\vnvff.exec:\vnvff.exe74⤵PID:2320
-
\??\c:\xdltv.exec:\xdltv.exe75⤵PID:2224
-
\??\c:\dllxtvj.exec:\dllxtvj.exe76⤵PID:2012
-
\??\c:\bbfnjjl.exec:\bbfnjjl.exe77⤵PID:2164
-
\??\c:\dpdfh.exec:\dpdfh.exe78⤵PID:2220
-
\??\c:\jtlrjx.exec:\jtlrjx.exe79⤵PID:2036
-
\??\c:\dbrplxp.exec:\dbrplxp.exe80⤵PID:2324
-
\??\c:\ddpvrpl.exec:\ddpvrpl.exe81⤵PID:3048
-
\??\c:\plldlrj.exec:\plldlrj.exe82⤵PID:3064
-
\??\c:\tltnh.exec:\tltnh.exe83⤵PID:2924
-
\??\c:\ddjhhhl.exec:\ddjhhhl.exe84⤵PID:3040
-
\??\c:\hbpdprp.exec:\hbpdprp.exe85⤵PID:2880
-
\??\c:\fbxfjt.exec:\fbxfjt.exe86⤵PID:2572
-
\??\c:\xnhlfv.exec:\xnhlfv.exe87⤵PID:264
-
\??\c:\xlbhpp.exec:\xlbhpp.exe88⤵PID:944
-
\??\c:\vdxjr.exec:\vdxjr.exe89⤵PID:3056
-
\??\c:\jjdbbt.exec:\jjdbbt.exe90⤵PID:2908
-
\??\c:\bbpfp.exec:\bbpfp.exe91⤵PID:1436
-
\??\c:\thrhvdv.exec:\thrhvdv.exe92⤵PID:432
-
\??\c:\rfvfff.exec:\rfvfff.exe93⤵PID:1108
-
\??\c:\jxpfxxn.exec:\jxpfxxn.exe94⤵PID:608
-
\??\c:\jjdrlhr.exec:\jjdrlhr.exe95⤵PID:1148
-
\??\c:\hvfxnt.exec:\hvfxnt.exe96⤵PID:1028
-
\??\c:\drlbxd.exec:\drlbxd.exe97⤵PID:2600
-
\??\c:\lrpttdj.exec:\lrpttdj.exe98⤵PID:2504
-
\??\c:\nbvhtj.exec:\nbvhtj.exe99⤵PID:1532
-
\??\c:\fblvd.exec:\fblvd.exe100⤵PID:2476
-
\??\c:\rvxhxb.exec:\rvxhxb.exe101⤵PID:1964
-
\??\c:\dfdnd.exec:\dfdnd.exe102⤵PID:2436
-
\??\c:\dhntlft.exec:\dhntlft.exe103⤵PID:2176
-
\??\c:\tdvrnb.exec:\tdvrnb.exe104⤵PID:2284
-
\??\c:\ldljl.exec:\ldljl.exe105⤵PID:2672
-
\??\c:\phjlj.exec:\phjlj.exe106⤵PID:960
-
\??\c:\tbdphxl.exec:\tbdphxl.exe107⤵PID:1420
-
\??\c:\jplrttb.exec:\jplrttb.exe108⤵PID:1788
-
\??\c:\bnthx.exec:\bnthx.exe109⤵PID:2520
-
\??\c:\dtrdhv.exec:\dtrdhv.exe110⤵PID:2532
-
\??\c:\vxxtv.exec:\vxxtv.exe111⤵PID:2096
-
\??\c:\pfxdbb.exec:\pfxdbb.exe112⤵PID:1768
-
\??\c:\vhftjpv.exec:\vhftjpv.exe113⤵PID:2808
-
\??\c:\rnbbpp.exec:\rnbbpp.exe114⤵PID:1668
-
\??\c:\bfdnbdv.exec:\bfdnbdv.exe115⤵PID:2108
-
\??\c:\lntvnl.exec:\lntvnl.exe116⤵PID:1824
-
\??\c:\vlrdtb.exec:\vlrdtb.exe117⤵PID:2104
-
\??\c:\prtttvb.exec:\prtttvb.exe118⤵PID:2156
-
\??\c:\bdddr.exec:\bdddr.exe119⤵PID:2916
-
\??\c:\dpxdtv.exec:\dpxdtv.exe120⤵PID:2948
-
\??\c:\nhnvj.exec:\nhnvj.exe121⤵PID:2160
-
\??\c:\bhhnn.exec:\bhhnn.exe122⤵PID:3052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-