Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe
-
Size
454KB
-
MD5
bece5f257dd72a6d56c191adcd31dbc1
-
SHA1
5007dc9a2466d6f4670afc56b289b5e447f11aea
-
SHA256
b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef
-
SHA512
07fad550346ce996590b4517770421316d913767bb0989de02f36d193f516c4a444a0316b00ab16200b8b87d19f95d201964f3afe7708ff3f61fca13847605dc
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe0:q7Tc2NYHUrAwfMp3CD0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2860-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/308-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/660-200-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1356-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1524-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-338-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-359-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2052-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-458-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1584-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-514-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-602-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-615-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-643-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1608-852-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1868-1026-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1692-1065-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2844 9lrrffl.exe 2860 hbhhbb.exe 2736 9lflllr.exe 2592 vvppv.exe 3016 rfrrxxl.exe 472 lxrrxxf.exe 864 vdppp.exe 1856 fxrfllx.exe 2180 vjvvj.exe 2064 frfllfl.exe 2908 tthhnh.exe 308 7ddjd.exe 1236 hthhbt.exe 2660 vvdjj.exe 2184 rlfffrx.exe 316 tnbbtb.exe 1668 xrllrll.exe 2280 thbtbt.exe 2284 jdvvp.exe 2468 rlfflrx.exe 660 bthnhh.exe 1280 7dppp.exe 908 ttntbt.exe 2376 nhnnbb.exe 1356 rlrrrrr.exe 1692 hhbbtt.exe 2424 pjvdd.exe 604 xxllxxl.exe 960 7dvvj.exe 2228 frrrllx.exe 1524 dpvdj.exe 2820 9rffflr.exe 1596 btnbhb.exe 2884 djvvd.exe 2612 rlfxrrf.exe 2684 ffxlllr.exe 2636 thnnhh.exe 3012 ddppj.exe 2144 xrllfxl.exe 672 xlxxffl.exe 1096 9nnnnn.exe 864 7jvpv.exe 1796 1lrxxff.exe 2052 tnhnbt.exe 2248 tnnttn.exe 2064 fxllxxf.exe 2964 rrfxffr.exe 2916 7nttbh.exe 1084 5jdjj.exe 2872 jdpvj.exe 2804 rlxflxl.exe 2000 9tbbhh.exe 2396 9jpdv.exe 1704 vjvvp.exe 2060 9xrxllf.exe 872 htbbhh.exe 2312 7djvv.exe 3060 dvjjp.exe 2236 5lrxxxx.exe 1584 9bthhn.exe 2536 ddjpp.exe 2348 3fllrrr.exe 2972 lxrrxrx.exe 1540 bnthtt.exe -
resource yara_rule behavioral1/memory/2940-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/308-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1356-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-338-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-486-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2536-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-514-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-548-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-602-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-615-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-677-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-719-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2528-772-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1280-782-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-799-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-836-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-863-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-927-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1144-988-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-1026-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1692-1065-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 2844 2940 b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe 30 PID 2940 wrote to memory of 2844 2940 b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe 30 PID 2940 wrote to memory of 2844 2940 b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe 30 PID 2940 wrote to memory of 2844 2940 b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe 30 PID 2844 wrote to memory of 2860 2844 9lrrffl.exe 31 PID 2844 wrote to memory of 2860 2844 9lrrffl.exe 31 PID 2844 wrote to memory of 2860 2844 9lrrffl.exe 31 PID 2844 wrote to memory of 2860 2844 9lrrffl.exe 31 PID 2860 wrote to memory of 2736 2860 hbhhbb.exe 32 PID 2860 wrote to memory of 2736 2860 hbhhbb.exe 32 PID 2860 wrote to memory of 2736 2860 hbhhbb.exe 32 PID 2860 wrote to memory of 2736 2860 hbhhbb.exe 32 PID 2736 wrote to memory of 2592 2736 9lflllr.exe 33 PID 2736 wrote to memory of 2592 2736 9lflllr.exe 33 PID 2736 wrote to memory of 2592 2736 9lflllr.exe 33 PID 2736 wrote to memory of 2592 2736 9lflllr.exe 33 PID 2592 wrote to memory of 3016 2592 vvppv.exe 34 PID 2592 wrote to memory of 3016 2592 vvppv.exe 34 PID 2592 wrote to memory of 3016 2592 vvppv.exe 34 PID 2592 wrote to memory of 3016 2592 vvppv.exe 34 PID 3016 wrote to memory of 472 3016 rfrrxxl.exe 35 PID 3016 wrote to memory of 472 3016 rfrrxxl.exe 35 PID 3016 wrote to memory of 472 3016 rfrrxxl.exe 35 PID 3016 wrote to memory of 472 3016 rfrrxxl.exe 35 PID 472 wrote to memory of 864 472 lxrrxxf.exe 36 PID 472 wrote to memory of 864 472 lxrrxxf.exe 36 PID 472 wrote to memory of 864 472 lxrrxxf.exe 36 PID 472 wrote to memory of 864 472 lxrrxxf.exe 36 PID 864 wrote to memory of 1856 864 vdppp.exe 37 PID 864 wrote to memory of 1856 864 vdppp.exe 37 PID 864 wrote to memory of 1856 864 vdppp.exe 37 PID 864 wrote to memory of 1856 864 vdppp.exe 37 PID 1856 wrote to memory of 2180 1856 fxrfllx.exe 38 PID 1856 wrote to memory of 2180 1856 fxrfllx.exe 38 PID 1856 wrote to memory of 2180 1856 fxrfllx.exe 38 PID 1856 wrote to memory of 2180 1856 fxrfllx.exe 38 PID 2180 wrote to memory of 2064 2180 vjvvj.exe 39 PID 2180 wrote to memory of 2064 2180 vjvvj.exe 39 PID 2180 wrote to memory of 2064 2180 vjvvj.exe 39 PID 2180 wrote to memory of 2064 2180 vjvvj.exe 39 PID 2064 wrote to memory of 2908 2064 frfllfl.exe 40 PID 2064 wrote to memory of 2908 2064 frfllfl.exe 40 PID 2064 wrote to memory of 2908 2064 frfllfl.exe 40 PID 2064 wrote to memory of 2908 2064 frfllfl.exe 40 PID 2908 wrote to memory of 308 2908 tthhnh.exe 41 PID 2908 wrote to memory of 308 2908 tthhnh.exe 41 PID 2908 wrote to memory of 308 2908 tthhnh.exe 41 PID 2908 wrote to memory of 308 2908 tthhnh.exe 41 PID 308 wrote to memory of 1236 308 7ddjd.exe 42 PID 308 wrote to memory of 1236 308 7ddjd.exe 42 PID 308 wrote to memory of 1236 308 7ddjd.exe 42 PID 308 wrote to memory of 1236 308 7ddjd.exe 42 PID 1236 wrote to memory of 2660 1236 hthhbt.exe 43 PID 1236 wrote to memory of 2660 1236 hthhbt.exe 43 PID 1236 wrote to memory of 2660 1236 hthhbt.exe 43 PID 1236 wrote to memory of 2660 1236 hthhbt.exe 43 PID 2660 wrote to memory of 2184 2660 vvdjj.exe 44 PID 2660 wrote to memory of 2184 2660 vvdjj.exe 44 PID 2660 wrote to memory of 2184 2660 vvdjj.exe 44 PID 2660 wrote to memory of 2184 2660 vvdjj.exe 44 PID 2184 wrote to memory of 316 2184 rlfffrx.exe 45 PID 2184 wrote to memory of 316 2184 rlfffrx.exe 45 PID 2184 wrote to memory of 316 2184 rlfffrx.exe 45 PID 2184 wrote to memory of 316 2184 rlfffrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe"C:\Users\Admin\AppData\Local\Temp\b64fa5c2fbf36228215fffa523db269d972919ccaf4817f3449836df367e7aef.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\9lrrffl.exec:\9lrrffl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\hbhhbb.exec:\hbhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\9lflllr.exec:\9lflllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\vvppv.exec:\vvppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rfrrxxl.exec:\rfrrxxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\vdppp.exec:\vdppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\fxrfllx.exec:\fxrfllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\vjvvj.exec:\vjvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\frfllfl.exec:\frfllfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\tthhnh.exec:\tthhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\7ddjd.exec:\7ddjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:308 -
\??\c:\hthhbt.exec:\hthhbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\vvdjj.exec:\vvdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\rlfffrx.exec:\rlfffrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\tnbbtb.exec:\tnbbtb.exe17⤵
- Executes dropped EXE
PID:316 -
\??\c:\xrllrll.exec:\xrllrll.exe18⤵
- Executes dropped EXE
PID:1668 -
\??\c:\thbtbt.exec:\thbtbt.exe19⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdvvp.exec:\jdvvp.exe20⤵
- Executes dropped EXE
PID:2284 -
\??\c:\rlfflrx.exec:\rlfflrx.exe21⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bthnhh.exec:\bthnhh.exe22⤵
- Executes dropped EXE
PID:660 -
\??\c:\7dppp.exec:\7dppp.exe23⤵
- Executes dropped EXE
PID:1280 -
\??\c:\ttntbt.exec:\ttntbt.exe24⤵
- Executes dropped EXE
PID:908 -
\??\c:\nhnnbb.exec:\nhnnbb.exe25⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe26⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hhbbtt.exec:\hhbbtt.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pjvdd.exec:\pjvdd.exe28⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xxllxxl.exec:\xxllxxl.exe29⤵
- Executes dropped EXE
PID:604 -
\??\c:\7dvvj.exec:\7dvvj.exe30⤵
- Executes dropped EXE
PID:960 -
\??\c:\frrrllx.exec:\frrrllx.exe31⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dpvdj.exec:\dpvdj.exe32⤵
- Executes dropped EXE
PID:1524 -
\??\c:\9rffflr.exec:\9rffflr.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\btnbhb.exec:\btnbhb.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\djvvd.exec:\djvvd.exe35⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rlfxrrf.exec:\rlfxrrf.exe36⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ffxlllr.exec:\ffxlllr.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\thnnhh.exec:\thnnhh.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\ddppj.exec:\ddppj.exe39⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xrllfxl.exec:\xrllfxl.exe40⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xlxxffl.exec:\xlxxffl.exe41⤵
- Executes dropped EXE
PID:672 -
\??\c:\9nnnnn.exec:\9nnnnn.exe42⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7jvpv.exec:\7jvpv.exe43⤵
- Executes dropped EXE
PID:864 -
\??\c:\1lrxxff.exec:\1lrxxff.exe44⤵
- Executes dropped EXE
PID:1796 -
\??\c:\tnhnbt.exec:\tnhnbt.exe45⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tnnttn.exec:\tnnttn.exe46⤵
- Executes dropped EXE
PID:2248 -
\??\c:\fxllxxf.exec:\fxllxxf.exe47⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rrfxffr.exec:\rrfxffr.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7nttbh.exec:\7nttbh.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\5jdjj.exec:\5jdjj.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\jdpvj.exec:\jdpvj.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlxflxl.exec:\rlxflxl.exe52⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9tbbhh.exec:\9tbbhh.exe53⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9jpdv.exec:\9jpdv.exe54⤵
- Executes dropped EXE
PID:2396 -
\??\c:\vjvvp.exec:\vjvvp.exe55⤵
- Executes dropped EXE
PID:1704 -
\??\c:\9xrxllf.exec:\9xrxllf.exe56⤵
- Executes dropped EXE
PID:2060 -
\??\c:\htbbhh.exec:\htbbhh.exe57⤵
- Executes dropped EXE
PID:872 -
\??\c:\7djvv.exec:\7djvv.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dvjjp.exec:\dvjjp.exe59⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5lrxxxx.exec:\5lrxxxx.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\9bthhn.exec:\9bthhn.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ddjpp.exec:\ddjpp.exe62⤵
- Executes dropped EXE
PID:2536 -
\??\c:\3fllrrr.exec:\3fllrrr.exe63⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lxrrxrx.exec:\lxrrxrx.exe64⤵
- Executes dropped EXE
PID:2972 -
\??\c:\bnthtt.exec:\bnthtt.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vjvvp.exec:\vjvvp.exe66⤵PID:624
-
\??\c:\9jdpp.exec:\9jdpp.exe67⤵PID:2420
-
\??\c:\frllxxx.exec:\frllxxx.exe68⤵PID:2516
-
\??\c:\tnhnbb.exec:\tnhnbb.exe69⤵PID:2928
-
\??\c:\pdvpp.exec:\pdvpp.exe70⤵PID:2984
-
\??\c:\1pppp.exec:\1pppp.exe71⤵PID:876
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe72⤵PID:2432
-
\??\c:\5hbbtt.exec:\5hbbtt.exe73⤵PID:2212
-
\??\c:\jdjjv.exec:\jdjjv.exe74⤵PID:2792
-
\??\c:\jvddd.exec:\jvddd.exe75⤵PID:2844
-
\??\c:\xxlfllr.exec:\xxlfllr.exe76⤵PID:1600
-
\??\c:\bbhthb.exec:\bbhthb.exe77⤵PID:2400
-
\??\c:\bnnntn.exec:\bnnntn.exe78⤵PID:2900
-
\??\c:\pjppj.exec:\pjppj.exe79⤵PID:2740
-
\??\c:\9fxlrll.exec:\9fxlrll.exe80⤵PID:2648
-
\??\c:\btnnth.exec:\btnnth.exe81⤵PID:2616
-
\??\c:\3htbbh.exec:\3htbbh.exe82⤵PID:532
-
\??\c:\jdjpp.exec:\jdjpp.exe83⤵PID:1376
-
\??\c:\frfxxrx.exec:\frfxxrx.exe84⤵PID:1184
-
\??\c:\rfllrrr.exec:\rfllrrr.exe85⤵PID:1120
-
\??\c:\3nbnth.exec:\3nbnth.exe86⤵PID:2252
-
\??\c:\7jppd.exec:\7jppd.exe87⤵PID:2180
-
\??\c:\jjvdj.exec:\jjvdj.exe88⤵PID:2896
-
\??\c:\frffrrx.exec:\frffrrx.exe89⤵PID:2560
-
\??\c:\thttbb.exec:\thttbb.exe90⤵PID:2028
-
\??\c:\bthbhn.exec:\bthbhn.exe91⤵PID:1340
-
\??\c:\1pjvv.exec:\1pjvv.exe92⤵PID:1236
-
\??\c:\lfrrxrx.exec:\lfrrxrx.exe93⤵PID:2864
-
\??\c:\nbhbtn.exec:\nbhbtn.exe94⤵PID:2196
-
\??\c:\nhbbtn.exec:\nhbbtn.exe95⤵PID:2804
-
\??\c:\5ddpj.exec:\5ddpj.exe96⤵PID:1220
-
\??\c:\9lxxrrr.exec:\9lxxrrr.exe97⤵PID:1668
-
\??\c:\frxxrll.exec:\frxxrll.exe98⤵PID:1800
-
\??\c:\btnnbt.exec:\btnnbt.exe99⤵PID:2148
-
\??\c:\dvjvv.exec:\dvjvv.exe100⤵PID:3064
-
\??\c:\vjvvv.exec:\vjvvv.exe101⤵PID:1996
-
\??\c:\xlrffrr.exec:\xlrffrr.exe102⤵PID:560
-
\??\c:\btnthh.exec:\btnthh.exe103⤵PID:1472
-
\??\c:\vpdjp.exec:\vpdjp.exe104⤵PID:1280
-
\??\c:\5vdpp.exec:\5vdpp.exe105⤵PID:908
-
\??\c:\flfrffx.exec:\flfrffx.exe106⤵PID:2528
-
\??\c:\3htbnt.exec:\3htbnt.exe107⤵PID:2972
-
\??\c:\7tthhh.exec:\7tthhh.exe108⤵PID:1540
-
\??\c:\dvjdj.exec:\dvjdj.exe109⤵PID:1648
-
\??\c:\lrfffxf.exec:\lrfffxf.exe110⤵PID:3032
-
\??\c:\xlrfrxf.exec:\xlrfrxf.exe111⤵PID:2516
-
\??\c:\bthbbt.exec:\bthbbt.exe112⤵PID:2992
-
\??\c:\vvppv.exec:\vvppv.exe113⤵PID:2984
-
\??\c:\9pvpj.exec:\9pvpj.exe114⤵PID:1784
-
\??\c:\xlrllff.exec:\xlrllff.exe115⤵PID:3052
-
\??\c:\tnbhnh.exec:\tnbhnh.exe116⤵PID:1524
-
\??\c:\9thbbb.exec:\9thbbb.exe117⤵PID:2188
-
\??\c:\vpddp.exec:\vpddp.exe118⤵PID:1608
-
\??\c:\frxxrrx.exec:\frxxrrx.exe119⤵PID:1600
-
\??\c:\nhntbb.exec:\nhntbb.exe120⤵PID:2708
-
\??\c:\5hthbt.exec:\5hthbt.exe121⤵PID:2624
-
\??\c:\5vpjj.exec:\5vpjj.exe122⤵PID:3024
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-