Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe
Resource
win7-20240729-en
7 signatures
120 seconds
General
-
Target
0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe
-
Size
455KB
-
MD5
7679a5cf47913efaa5eab51923ff3e76
-
SHA1
c267ba816f445206e5b25ddbc46cf0c6b8634831
-
SHA256
0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b
-
SHA512
ce02e25c3aa6c2371e0a0dd424699ade0d677ed2792b1f8cdd22bd194684b55632715a375646d2b26e12a7e471b6f0a9664a21926aec21a24ec2571e453e7ee1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeu:q7Tc2NYHUrAwfMp3CDu
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2336-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2944-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-114-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-141-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2912-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1000-169-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1432-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-249-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2392-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/892-287-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2852-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-425-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2184-426-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-494-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-509-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-523-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2020-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-538-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2772-624-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2872-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-868-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2880 3dpjp.exe 2260 3rfxlxx.exe 2932 hbhhbb.exe 2944 nbhhnt.exe 2592 3llrffr.exe 2876 1jvdj.exe 2660 fxffflr.exe 2368 ppjdj.exe 2352 ttbthh.exe 2928 pdjdj.exe 2108 rlrxfff.exe 1640 pjpdd.exe 1604 bhnttt.exe 2912 ttbhnt.exe 3004 frlffrl.exe 840 vdpdd.exe 1000 1nnthn.exe 2144 bhnnbb.exe 352 fflllll.exe 2616 ttbtbb.exe 2604 xxlrffr.exe 2492 ttbhhh.exe 1432 vdvvj.exe 2124 nhttbb.exe 2620 lfflflr.exe 1292 3tnhnh.exe 2392 jppjp.exe 1368 xlxrxxl.exe 1628 3bttbh.exe 892 1vpvd.exe 1704 rrxxxrx.exe 1588 djddd.exe 2804 flrrxxx.exe 2072 bhnhnt.exe 2852 1vppd.exe 2932 1xxxffr.exe 2776 bbhhnn.exe 3012 dpdvj.exe 2948 vpvvd.exe 2656 xxxxflr.exe 2724 tbnntt.exe 1688 vpvvv.exe 1324 pvvjd.exe 2132 rlrlxxf.exe 1776 nhtthh.exe 2040 nnttbb.exe 2024 jvddd.exe 2756 7rxxxfl.exe 1476 ttnnnn.exe 2900 5dddp.exe 2184 3frlllr.exe 3004 lrllxxf.exe 2060 vpjvd.exe 2728 dvddd.exe 1108 rlflxfl.exe 2144 nnbhnt.exe 2112 jjjjp.exe 2284 vpvdj.exe 2292 rxllrfx.exe 2272 nhtbnt.exe 2244 djddd.exe 2356 xxrlllx.exe 940 nnbhth.exe 2620 hntbbt.exe -
resource yara_rule behavioral1/memory/2336-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2944-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1000-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-509-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-551-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2872-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-718-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1928-743-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/336-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-868-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-881-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2880 2336 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 29 PID 2336 wrote to memory of 2880 2336 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 29 PID 2336 wrote to memory of 2880 2336 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 29 PID 2336 wrote to memory of 2880 2336 0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe 29 PID 2880 wrote to memory of 2260 2880 3dpjp.exe 30 PID 2880 wrote to memory of 2260 2880 3dpjp.exe 30 PID 2880 wrote to memory of 2260 2880 3dpjp.exe 30 PID 2880 wrote to memory of 2260 2880 3dpjp.exe 30 PID 2260 wrote to memory of 2932 2260 3rfxlxx.exe 31 PID 2260 wrote to memory of 2932 2260 3rfxlxx.exe 31 PID 2260 wrote to memory of 2932 2260 3rfxlxx.exe 31 PID 2260 wrote to memory of 2932 2260 3rfxlxx.exe 31 PID 2932 wrote to memory of 2944 2932 hbhhbb.exe 32 PID 2932 wrote to memory of 2944 2932 hbhhbb.exe 32 PID 2932 wrote to memory of 2944 2932 hbhhbb.exe 32 PID 2932 wrote to memory of 2944 2932 hbhhbb.exe 32 PID 2944 wrote to memory of 2592 2944 nbhhnt.exe 33 PID 2944 wrote to memory of 2592 2944 nbhhnt.exe 33 PID 2944 wrote to memory of 2592 2944 nbhhnt.exe 33 PID 2944 wrote to memory of 2592 2944 nbhhnt.exe 33 PID 2592 wrote to memory of 2876 2592 3llrffr.exe 34 PID 2592 wrote to memory of 2876 2592 3llrffr.exe 34 PID 2592 wrote to memory of 2876 2592 3llrffr.exe 34 PID 2592 wrote to memory of 2876 2592 3llrffr.exe 34 PID 2876 wrote to memory of 2660 2876 1jvdj.exe 35 PID 2876 wrote to memory of 2660 2876 1jvdj.exe 35 PID 2876 wrote to memory of 2660 2876 1jvdj.exe 35 PID 2876 wrote to memory of 2660 2876 1jvdj.exe 35 PID 2660 wrote to memory of 2368 2660 fxffflr.exe 36 PID 2660 wrote to memory of 2368 2660 fxffflr.exe 36 PID 2660 wrote to memory of 2368 2660 fxffflr.exe 36 PID 2660 wrote to memory of 2368 2660 fxffflr.exe 36 PID 2368 wrote to memory of 2352 2368 ppjdj.exe 37 PID 2368 wrote to memory of 2352 2368 ppjdj.exe 37 PID 2368 wrote to memory of 2352 2368 ppjdj.exe 37 PID 2368 wrote to memory of 2352 2368 ppjdj.exe 37 PID 2352 wrote to memory of 2928 2352 ttbthh.exe 38 PID 2352 wrote to memory of 2928 2352 ttbthh.exe 38 PID 2352 wrote to memory of 2928 2352 ttbthh.exe 38 PID 2352 wrote to memory of 2928 2352 ttbthh.exe 38 PID 2928 wrote to memory of 2108 2928 pdjdj.exe 39 PID 2928 wrote to memory of 2108 2928 pdjdj.exe 39 PID 2928 wrote to memory of 2108 2928 pdjdj.exe 39 PID 2928 wrote to memory of 2108 2928 pdjdj.exe 39 PID 2108 wrote to memory of 1640 2108 rlrxfff.exe 40 PID 2108 wrote to memory of 1640 2108 rlrxfff.exe 40 PID 2108 wrote to memory of 1640 2108 rlrxfff.exe 40 PID 2108 wrote to memory of 1640 2108 rlrxfff.exe 40 PID 1640 wrote to memory of 1604 1640 pjpdd.exe 41 PID 1640 wrote to memory of 1604 1640 pjpdd.exe 41 PID 1640 wrote to memory of 1604 1640 pjpdd.exe 41 PID 1640 wrote to memory of 1604 1640 pjpdd.exe 41 PID 1604 wrote to memory of 2912 1604 bhnttt.exe 42 PID 1604 wrote to memory of 2912 1604 bhnttt.exe 42 PID 1604 wrote to memory of 2912 1604 bhnttt.exe 42 PID 1604 wrote to memory of 2912 1604 bhnttt.exe 42 PID 2912 wrote to memory of 3004 2912 ttbhnt.exe 43 PID 2912 wrote to memory of 3004 2912 ttbhnt.exe 43 PID 2912 wrote to memory of 3004 2912 ttbhnt.exe 43 PID 2912 wrote to memory of 3004 2912 ttbhnt.exe 43 PID 3004 wrote to memory of 840 3004 frlffrl.exe 44 PID 3004 wrote to memory of 840 3004 frlffrl.exe 44 PID 3004 wrote to memory of 840 3004 frlffrl.exe 44 PID 3004 wrote to memory of 840 3004 frlffrl.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe"C:\Users\Admin\AppData\Local\Temp\0b31919303b782dc458069a8d2d608240acae7f90ee71c7a2fe689e54373197b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\3dpjp.exec:\3dpjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\3rfxlxx.exec:\3rfxlxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\hbhhbb.exec:\hbhhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nbhhnt.exec:\nbhhnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\3llrffr.exec:\3llrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1jvdj.exec:\1jvdj.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fxffflr.exec:\fxffflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\ppjdj.exec:\ppjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ttbthh.exec:\ttbthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\pdjdj.exec:\pdjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\rlrxfff.exec:\rlrxfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\pjpdd.exec:\pjpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\bhnttt.exec:\bhnttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\ttbhnt.exec:\ttbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\frlffrl.exec:\frlffrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\vdpdd.exec:\vdpdd.exe17⤵
- Executes dropped EXE
PID:840 -
\??\c:\1nnthn.exec:\1nnthn.exe18⤵
- Executes dropped EXE
PID:1000 -
\??\c:\bhnnbb.exec:\bhnnbb.exe19⤵
- Executes dropped EXE
PID:2144 -
\??\c:\fflllll.exec:\fflllll.exe20⤵
- Executes dropped EXE
PID:352 -
\??\c:\ttbtbb.exec:\ttbtbb.exe21⤵
- Executes dropped EXE
PID:2616 -
\??\c:\xxlrffr.exec:\xxlrffr.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2604 -
\??\c:\ttbhhh.exec:\ttbhhh.exe23⤵
- Executes dropped EXE
PID:2492 -
\??\c:\vdvvj.exec:\vdvvj.exe24⤵
- Executes dropped EXE
PID:1432 -
\??\c:\nhttbb.exec:\nhttbb.exe25⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lfflflr.exec:\lfflflr.exe26⤵
- Executes dropped EXE
PID:2620 -
\??\c:\3tnhnh.exec:\3tnhnh.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\jppjp.exec:\jppjp.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\xlxrxxl.exec:\xlxrxxl.exe29⤵
- Executes dropped EXE
PID:1368 -
\??\c:\3bttbh.exec:\3bttbh.exe30⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1vpvd.exec:\1vpvd.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\rrxxxrx.exec:\rrxxxrx.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\djddd.exec:\djddd.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\flrrxxx.exec:\flrrxxx.exe34⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bhnhnt.exec:\bhnhnt.exe35⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1vppd.exec:\1vppd.exe36⤵
- Executes dropped EXE
PID:2852 -
\??\c:\1xxxffr.exec:\1xxxffr.exe37⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bbhhnn.exec:\bbhhnn.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dpdvj.exec:\dpdvj.exe39⤵
- Executes dropped EXE
PID:3012 -
\??\c:\vpvvd.exec:\vpvvd.exe40⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xxxxflr.exec:\xxxxflr.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tbnntt.exec:\tbnntt.exe42⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vpvvv.exec:\vpvvv.exe43⤵
- Executes dropped EXE
PID:1688 -
\??\c:\pvvjd.exec:\pvvjd.exe44⤵
- Executes dropped EXE
PID:1324 -
\??\c:\rlrlxxf.exec:\rlrlxxf.exe45⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nhtthh.exec:\nhtthh.exe46⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nnttbb.exec:\nnttbb.exe47⤵
- Executes dropped EXE
PID:2040 -
\??\c:\jvddd.exec:\jvddd.exe48⤵
- Executes dropped EXE
PID:2024 -
\??\c:\7rxxxfl.exec:\7rxxxfl.exe49⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ttnnnn.exec:\ttnnnn.exe50⤵
- Executes dropped EXE
PID:1476 -
\??\c:\5dddp.exec:\5dddp.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3frlllr.exec:\3frlllr.exe52⤵
- Executes dropped EXE
PID:2184 -
\??\c:\lrllxxf.exec:\lrllxxf.exe53⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vpjvd.exec:\vpjvd.exe54⤵
- Executes dropped EXE
PID:2060 -
\??\c:\dvddd.exec:\dvddd.exe55⤵
- Executes dropped EXE
PID:2728 -
\??\c:\rlflxfl.exec:\rlflxfl.exe56⤵
- Executes dropped EXE
PID:1108 -
\??\c:\nnbhnt.exec:\nnbhnt.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jjjjp.exec:\jjjjp.exe58⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vpvdj.exec:\vpvdj.exe59⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rxllrfx.exec:\rxllrfx.exe60⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhtbnt.exec:\nhtbnt.exe61⤵
- Executes dropped EXE
PID:2272 -
\??\c:\djddd.exec:\djddd.exe62⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxrlllx.exec:\xxrlllx.exe63⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nnbhth.exec:\nnbhth.exe64⤵
- Executes dropped EXE
PID:940 -
\??\c:\hntbbt.exec:\hntbbt.exe65⤵
- Executes dropped EXE
PID:2620 -
\??\c:\vjdvd.exec:\vjdvd.exe66⤵PID:2020
-
\??\c:\1lxlrrr.exec:\1lxlrrr.exe67⤵PID:2420
-
\??\c:\bhttbh.exec:\bhttbh.exe68⤵PID:1920
-
\??\c:\hhbntt.exec:\hhbntt.exe69⤵PID:984
-
\??\c:\jvjjp.exec:\jvjjp.exe70⤵PID:1628
-
\??\c:\lxxlxfx.exec:\lxxlxfx.exe71⤵PID:2568
-
\??\c:\thnhht.exec:\thnhht.exe72⤵PID:2380
-
\??\c:\vjddp.exec:\vjddp.exe73⤵PID:2340
-
\??\c:\rfrxfff.exec:\rfrxfff.exe74⤵PID:2800
-
\??\c:\xfflxfr.exec:\xfflxfr.exe75⤵PID:2864
-
\??\c:\tbhhth.exec:\tbhhth.exe76⤵PID:944
-
\??\c:\7pdjd.exec:\7pdjd.exe77⤵PID:2936
-
\??\c:\fffrxxr.exec:\fffrxxr.exe78⤵PID:3044
-
\??\c:\9ttnhn.exec:\9ttnhn.exe79⤵PID:2684
-
\??\c:\htnthn.exec:\htnthn.exe80⤵PID:1824
-
\??\c:\9dvvd.exec:\9dvvd.exe81⤵PID:2772
-
\??\c:\5xrxlrr.exec:\5xrxlrr.exe82⤵PID:2672
-
\??\c:\5nhbbb.exec:\5nhbbb.exe83⤵PID:2780
-
\??\c:\3jdjd.exec:\3jdjd.exe84⤵PID:2396
-
\??\c:\ppjjp.exec:\ppjjp.exe85⤵PID:828
-
\??\c:\xrxxflr.exec:\xrxxflr.exe86⤵PID:752
-
\??\c:\nbthbn.exec:\nbthbn.exe87⤵
- System Location Discovery: System Language Discovery
PID:2872 -
\??\c:\hbnnnn.exec:\hbnnnn.exe88⤵PID:1776
-
\??\c:\djdjp.exec:\djdjp.exe89⤵PID:2468
-
\??\c:\rrxxffx.exec:\rrxxffx.exe90⤵PID:2512
-
\??\c:\1hnttt.exec:\1hnttt.exe91⤵PID:2888
-
\??\c:\vvpjd.exec:\vvpjd.exe92⤵PID:2912
-
\??\c:\ddjjd.exec:\ddjjd.exe93⤵PID:1288
-
\??\c:\lrxxflr.exec:\lrxxflr.exe94⤵PID:2184
-
\??\c:\hbtbth.exec:\hbtbth.exe95⤵PID:2760
-
\??\c:\nnnbtt.exec:\nnnbtt.exe96⤵PID:2060
-
\??\c:\vdvvd.exec:\vdvvd.exe97⤵PID:2728
-
\??\c:\7rfllxf.exec:\7rfllxf.exe98⤵PID:1108
-
\??\c:\5lxxllr.exec:\5lxxllr.exe99⤵PID:2144
-
\??\c:\hhthth.exec:\hhthth.exe100⤵PID:1928
-
\??\c:\djppv.exec:\djppv.exe101⤵PID:2068
-
\??\c:\3frfflf.exec:\3frfflf.exe102⤵PID:2180
-
\??\c:\rrfffll.exec:\rrfffll.exe103⤵PID:2324
-
\??\c:\bhttbb.exec:\bhttbb.exe104⤵PID:2744
-
\??\c:\3pjdj.exec:\3pjdj.exe105⤵PID:2476
-
\??\c:\vjvvj.exec:\vjvvj.exe106⤵PID:820
-
\??\c:\rflrxlx.exec:\rflrxlx.exe107⤵PID:648
-
\??\c:\1httbb.exec:\1httbb.exe108⤵PID:2620
-
\??\c:\jpddd.exec:\jpddd.exe109⤵PID:2020
-
\??\c:\jpjpp.exec:\jpjpp.exe110⤵PID:2428
-
\??\c:\xflrrxx.exec:\xflrrxx.exe111⤵PID:1720
-
\??\c:\nthbhn.exec:\nthbhn.exe112⤵PID:336
-
\??\c:\hnbtnh.exec:\hnbtnh.exe113⤵PID:2416
-
\??\c:\pvjjd.exec:\pvjjd.exe114⤵PID:1964
-
\??\c:\rrxrrll.exec:\rrxrrll.exe115⤵PID:1576
-
\??\c:\3ffrxlx.exec:\3ffrxlx.exe116⤵PID:2752
-
\??\c:\nntttt.exec:\nntttt.exe117⤵PID:2804
-
\??\c:\vjpjj.exec:\vjpjj.exe118⤵PID:2960
-
\??\c:\flrrxfr.exec:\flrrxfr.exe119⤵PID:2816
-
\??\c:\hntntt.exec:\hntntt.exe120⤵PID:2952
-
\??\c:\pjpjd.exec:\pjpjd.exe121⤵PID:2944
-
\??\c:\7dpvv.exec:\7dpvv.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-