Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 08:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe
-
Size
455KB
-
MD5
5a74dab6f88cfa0c99e739bc2802e2b4
-
SHA1
a5701cd3b62d2c5a40068e0b574ac65b885869e6
-
SHA256
36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2
-
SHA512
1c8d1f03de8a8c8f8ae0a3fe64317979b6c3c3020cc1920be54d92a3bb3a35a48ac87dc3d76572a71458d9338f07b2a0393535db291ea93cfb609ab3eb507617
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1384-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-111-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2888-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2988-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/928-217-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2032-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-280-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-290-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-376-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/912-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-393-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-396-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1952-440-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1792-475-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1168-504-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1404-519-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-546-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1728-554-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-587-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2556-604-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2764 rffrrfl.exe 2692 3fxfllx.exe 2932 ppjvj.exe 2636 9llxrrf.exe 2592 9jdjp.exe 2612 rlflxfr.exe 2200 vvdpd.exe 1384 xfrxflr.exe 2336 hhhbnt.exe 2728 lrlxxrr.exe 2888 5bhbbh.exe 2444 tbbhbh.exe 484 5dvvd.exe 2332 1bbhnt.exe 2156 pjddv.exe 1504 pjdpj.exe 1568 fffffxl.exe 2364 ttnbbh.exe 2176 dddpd.exe 2940 ttnbnn.exe 1932 ppjdp.exe 2212 rrrxlxr.exe 928 thbttn.exe 2988 hbhhbh.exe 1516 bbtbtb.exe 2432 5tntbh.exe 1912 9djjv.exe 2492 hhbhnt.exe 2032 dvvdp.exe 3004 3thhnt.exe 864 dvjpd.exe 2404 hnnbnh.exe 2760 vdddv.exe 2704 nnhntb.exe 2744 hnnbbn.exe 2792 vvjjv.exe 2344 rffrrxr.exe 2276 hhhtnt.exe 1992 vppvj.exe 2660 jjjpv.exe 2184 fllrfrr.exe 828 tnhhth.exe 912 pppjp.exe 2960 xrflxxl.exe 2728 hhhnbb.exe 2384 djdjd.exe 1216 9llxxfx.exe 632 fffrxlr.exe 2000 bnttht.exe 1372 5ppvd.exe 292 fxrlrxl.exe 1952 1hntht.exe 1504 vjvdp.exe 2112 rllffrf.exe 2356 btnbth.exe 2980 ddpdp.exe 1792 jddpd.exe 1168 llrfxfr.exe 3000 7tnhtb.exe 2064 9vddj.exe 1732 1llxflx.exe 928 bthtnt.exe 1404 jddjv.exe 3064 pvvpd.exe -
resource yara_rule behavioral1/memory/2688-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2932-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1384-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/928-217-0x0000000000430000-0x000000000045A000-memory.dmp upx behavioral1/memory/2032-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-280-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-290-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/912-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-393-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-440-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1792-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-519-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-599-0x00000000002A0000-0x00000000002CA000-memory.dmp upx behavioral1/memory/2668-629-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-708-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rfrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2764 2688 36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe 30 PID 2688 wrote to memory of 2764 2688 36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe 30 PID 2688 wrote to memory of 2764 2688 36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe 30 PID 2688 wrote to memory of 2764 2688 36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe 30 PID 2764 wrote to memory of 2692 2764 rffrrfl.exe 31 PID 2764 wrote to memory of 2692 2764 rffrrfl.exe 31 PID 2764 wrote to memory of 2692 2764 rffrrfl.exe 31 PID 2764 wrote to memory of 2692 2764 rffrrfl.exe 31 PID 2692 wrote to memory of 2932 2692 3fxfllx.exe 32 PID 2692 wrote to memory of 2932 2692 3fxfllx.exe 32 PID 2692 wrote to memory of 2932 2692 3fxfllx.exe 32 PID 2692 wrote to memory of 2932 2692 3fxfllx.exe 32 PID 2932 wrote to memory of 2636 2932 ppjvj.exe 33 PID 2932 wrote to memory of 2636 2932 ppjvj.exe 33 PID 2932 wrote to memory of 2636 2932 ppjvj.exe 33 PID 2932 wrote to memory of 2636 2932 ppjvj.exe 33 PID 2636 wrote to memory of 2592 2636 9llxrrf.exe 34 PID 2636 wrote to memory of 2592 2636 9llxrrf.exe 34 PID 2636 wrote to memory of 2592 2636 9llxrrf.exe 34 PID 2636 wrote to memory of 2592 2636 9llxrrf.exe 34 PID 2592 wrote to memory of 2612 2592 9jdjp.exe 35 PID 2592 wrote to memory of 2612 2592 9jdjp.exe 35 PID 2592 wrote to memory of 2612 2592 9jdjp.exe 35 PID 2592 wrote to memory of 2612 2592 9jdjp.exe 35 PID 2612 wrote to memory of 2200 2612 rlflxfr.exe 36 PID 2612 wrote to memory of 2200 2612 rlflxfr.exe 36 PID 2612 wrote to memory of 2200 2612 rlflxfr.exe 36 PID 2612 wrote to memory of 2200 2612 rlflxfr.exe 36 PID 2200 wrote to memory of 1384 2200 vvdpd.exe 37 PID 2200 wrote to memory of 1384 2200 vvdpd.exe 37 PID 2200 wrote to memory of 1384 2200 vvdpd.exe 37 PID 2200 wrote to memory of 1384 2200 vvdpd.exe 37 PID 1384 wrote to memory of 2336 1384 xfrxflr.exe 38 PID 1384 wrote to memory of 2336 1384 xfrxflr.exe 38 PID 1384 wrote to memory of 2336 1384 xfrxflr.exe 38 PID 1384 wrote to memory of 2336 1384 xfrxflr.exe 38 PID 2336 wrote to memory of 2728 2336 hhhbnt.exe 39 PID 2336 wrote to memory of 2728 2336 hhhbnt.exe 39 PID 2336 wrote to memory of 2728 2336 hhhbnt.exe 39 PID 2336 wrote to memory of 2728 2336 hhhbnt.exe 39 PID 2728 wrote to memory of 2888 2728 lrlxxrr.exe 40 PID 2728 wrote to memory of 2888 2728 lrlxxrr.exe 40 PID 2728 wrote to memory of 2888 2728 lrlxxrr.exe 40 PID 2728 wrote to memory of 2888 2728 lrlxxrr.exe 40 PID 2888 wrote to memory of 2444 2888 5bhbbh.exe 41 PID 2888 wrote to memory of 2444 2888 5bhbbh.exe 41 PID 2888 wrote to memory of 2444 2888 5bhbbh.exe 41 PID 2888 wrote to memory of 2444 2888 5bhbbh.exe 41 PID 2444 wrote to memory of 484 2444 tbbhbh.exe 42 PID 2444 wrote to memory of 484 2444 tbbhbh.exe 42 PID 2444 wrote to memory of 484 2444 tbbhbh.exe 42 PID 2444 wrote to memory of 484 2444 tbbhbh.exe 42 PID 484 wrote to memory of 2332 484 5dvvd.exe 43 PID 484 wrote to memory of 2332 484 5dvvd.exe 43 PID 484 wrote to memory of 2332 484 5dvvd.exe 43 PID 484 wrote to memory of 2332 484 5dvvd.exe 43 PID 2332 wrote to memory of 2156 2332 1bbhnt.exe 44 PID 2332 wrote to memory of 2156 2332 1bbhnt.exe 44 PID 2332 wrote to memory of 2156 2332 1bbhnt.exe 44 PID 2332 wrote to memory of 2156 2332 1bbhnt.exe 44 PID 2156 wrote to memory of 1504 2156 pjddv.exe 45 PID 2156 wrote to memory of 1504 2156 pjddv.exe 45 PID 2156 wrote to memory of 1504 2156 pjddv.exe 45 PID 2156 wrote to memory of 1504 2156 pjddv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe"C:\Users\Admin\AppData\Local\Temp\36624dbffc154942c4f1c06c003b9f99acc4e1d40973f67e9d0a51237d9264a2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\rffrrfl.exec:\rffrrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3fxfllx.exec:\3fxfllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ppjvj.exec:\ppjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\9llxrrf.exec:\9llxrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\9jdjp.exec:\9jdjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\rlflxfr.exec:\rlflxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vvdpd.exec:\vvdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xfrxflr.exec:\xfrxflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\hhhbnt.exec:\hhhbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\lrlxxrr.exec:\lrlxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5bhbbh.exec:\5bhbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\tbbhbh.exec:\tbbhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\5dvvd.exec:\5dvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\1bbhnt.exec:\1bbhnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pjddv.exec:\pjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\pjdpj.exec:\pjdpj.exe17⤵
- Executes dropped EXE
PID:1504 -
\??\c:\fffffxl.exec:\fffffxl.exe18⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ttnbbh.exec:\ttnbbh.exe19⤵
- Executes dropped EXE
PID:2364 -
\??\c:\dddpd.exec:\dddpd.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ttnbnn.exec:\ttnbnn.exe21⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ppjdp.exec:\ppjdp.exe22⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rrrxlxr.exec:\rrrxlxr.exe23⤵
- Executes dropped EXE
PID:2212 -
\??\c:\thbttn.exec:\thbttn.exe24⤵
- Executes dropped EXE
PID:928 -
\??\c:\hbhhbh.exec:\hbhhbh.exe25⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bbtbtb.exec:\bbtbtb.exe26⤵
- Executes dropped EXE
PID:1516 -
\??\c:\5tntbh.exec:\5tntbh.exe27⤵
- Executes dropped EXE
PID:2432 -
\??\c:\9djjv.exec:\9djjv.exe28⤵
- Executes dropped EXE
PID:1912 -
\??\c:\hhbhnt.exec:\hhbhnt.exe29⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dvvdp.exec:\dvvdp.exe30⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3thhnt.exec:\3thhnt.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dvjpd.exec:\dvjpd.exe32⤵
- Executes dropped EXE
PID:864 -
\??\c:\hnnbnh.exec:\hnnbnh.exe33⤵
- Executes dropped EXE
PID:2404 -
\??\c:\vdddv.exec:\vdddv.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\nnhntb.exec:\nnhntb.exe35⤵
- Executes dropped EXE
PID:2704 -
\??\c:\hnnbbn.exec:\hnnbbn.exe36⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvjjv.exec:\vvjjv.exe37⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rffrrxr.exec:\rffrrxr.exe38⤵
- Executes dropped EXE
PID:2344 -
\??\c:\hhhtnt.exec:\hhhtnt.exe39⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vppvj.exec:\vppvj.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jjjpv.exec:\jjjpv.exe41⤵
- Executes dropped EXE
PID:2660 -
\??\c:\fllrfrr.exec:\fllrfrr.exe42⤵
- Executes dropped EXE
PID:2184 -
\??\c:\tnhhth.exec:\tnhhth.exe43⤵
- Executes dropped EXE
PID:828 -
\??\c:\pppjp.exec:\pppjp.exe44⤵
- Executes dropped EXE
PID:912 -
\??\c:\xrflxxl.exec:\xrflxxl.exe45⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hhhnbb.exec:\hhhnbb.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\djdjd.exec:\djdjd.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9llxxfx.exec:\9llxxfx.exe48⤵
- Executes dropped EXE
PID:1216 -
\??\c:\fffrxlr.exec:\fffrxlr.exe49⤵
- Executes dropped EXE
PID:632 -
\??\c:\bnttht.exec:\bnttht.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\5ppvd.exec:\5ppvd.exe51⤵
- Executes dropped EXE
PID:1372 -
\??\c:\fxrlrxl.exec:\fxrlrxl.exe52⤵
- Executes dropped EXE
PID:292 -
\??\c:\1hntht.exec:\1hntht.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vjvdp.exec:\vjvdp.exe54⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rllffrf.exec:\rllffrf.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\btnbth.exec:\btnbth.exe56⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ddpdp.exec:\ddpdp.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jddpd.exec:\jddpd.exe58⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llrfxfr.exec:\llrfxfr.exe59⤵
- Executes dropped EXE
PID:1168 -
\??\c:\7tnhtb.exec:\7tnhtb.exe60⤵
- Executes dropped EXE
PID:3000 -
\??\c:\9vddj.exec:\9vddj.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\1llxflx.exec:\1llxflx.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bthtnt.exec:\bthtnt.exe63⤵
- Executes dropped EXE
PID:928 -
\??\c:\jddjv.exec:\jddjv.exe64⤵
- Executes dropped EXE
PID:1404 -
\??\c:\pvvpd.exec:\pvvpd.exe65⤵
- Executes dropped EXE
PID:3064 -
\??\c:\llrfrfx.exec:\llrfrfx.exe66⤵PID:1708
-
\??\c:\tbthnt.exec:\tbthnt.exe67⤵PID:376
-
\??\c:\djjjv.exec:\djjjv.exe68⤵PID:2476
-
\??\c:\lfxrlxl.exec:\lfxrlxl.exe69⤵PID:1728
-
\??\c:\llfrxrl.exec:\llfrxrl.exe70⤵PID:2060
-
\??\c:\hhnbht.exec:\hhnbht.exe71⤵PID:1684
-
\??\c:\pvvdv.exec:\pvvdv.exe72⤵PID:2232
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe73⤵PID:1880
-
\??\c:\lllfrfx.exec:\lllfrfx.exe74⤵PID:2652
-
\??\c:\3nbbhn.exec:\3nbbhn.exe75⤵PID:2772
-
\??\c:\vvpdv.exec:\vvpdv.exe76⤵PID:2708
-
\??\c:\ffxlrfr.exec:\ffxlrfr.exe77⤵PID:2556
-
\??\c:\fflxfxf.exec:\fflxfxf.exe78⤵PID:2720
-
\??\c:\nhhbth.exec:\nhhbth.exe79⤵PID:2188
-
\??\c:\jjpvj.exec:\jjpvj.exe80⤵PID:2840
-
\??\c:\xxrxflr.exec:\xxrxflr.exe81⤵PID:2668
-
\??\c:\ttbhtb.exec:\ttbhtb.exe82⤵PID:2612
-
\??\c:\7jdvj.exec:\7jdvj.exe83⤵PID:3036
-
\??\c:\pvvdp.exec:\pvvdp.exe84⤵PID:1108
-
\??\c:\7frlrfr.exec:\7frlrfr.exe85⤵PID:2528
-
\??\c:\nbtntt.exec:\nbtntt.exe86⤵PID:2944
-
\??\c:\jddvj.exec:\jddvj.exe87⤵PID:2960
-
\??\c:\3jvdp.exec:\3jvdp.exe88⤵
- System Location Discovery: System Language Discovery
PID:2148 -
\??\c:\xrlrxfl.exec:\xrlrxfl.exe89⤵PID:1324
-
\??\c:\ttntbt.exec:\ttntbt.exe90⤵
- System Location Discovery: System Language Discovery
PID:1444 -
\??\c:\vvvvp.exec:\vvvvp.exe91⤵PID:1976
-
\??\c:\xrlxllx.exec:\xrlxllx.exe92⤵PID:1676
-
\??\c:\nhtbtb.exec:\nhtbtb.exe93⤵PID:1900
-
\??\c:\3vddd.exec:\3vddd.exe94⤵PID:1740
-
\??\c:\xrrrxrf.exec:\xrrrxrf.exe95⤵PID:2360
-
\??\c:\7xlrlll.exec:\7xlrlll.exe96⤵PID:2100
-
\??\c:\hhbhtt.exec:\hhbhtt.exe97⤵PID:1568
-
\??\c:\jjdvj.exec:\jjdvj.exe98⤵PID:2092
-
\??\c:\9jdjv.exec:\9jdjv.exe99⤵PID:2008
-
\??\c:\llfrxxf.exec:\llfrxxf.exe100⤵PID:1936
-
\??\c:\ntnbbh.exec:\ntnbbh.exe101⤵PID:280
-
\??\c:\bbbbhb.exec:\bbbbhb.exe102⤵PID:1084
-
\??\c:\vvppj.exec:\vvppj.exe103⤵PID:1752
-
\??\c:\xxrxrrf.exec:\xxrxrrf.exe104⤵PID:2076
-
\??\c:\rrlxlxl.exec:\rrlxlxl.exe105⤵PID:1804
-
\??\c:\5hbbbh.exec:\5hbbbh.exe106⤵PID:1800
-
\??\c:\vpjpv.exec:\vpjpv.exe107⤵PID:3064
-
\??\c:\7lxlxff.exec:\7lxlxff.exe108⤵PID:1940
-
\??\c:\rfxfxlx.exec:\rfxfxlx.exe109⤵PID:2848
-
\??\c:\7bnttb.exec:\7bnttb.exe110⤵PID:1912
-
\??\c:\hthhth.exec:\hthhth.exe111⤵PID:2488
-
\??\c:\9ppdj.exec:\9ppdj.exe112⤵PID:1736
-
\??\c:\5rllrxf.exec:\5rllrxf.exe113⤵PID:2468
-
\??\c:\bthbnt.exec:\bthbnt.exe114⤵PID:2512
-
\??\c:\jjdpj.exec:\jjdpj.exe115⤵PID:2748
-
\??\c:\vpjpv.exec:\vpjpv.exe116⤵PID:2804
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe117⤵PID:2760
-
\??\c:\nhbhbh.exec:\nhbhbh.exe118⤵
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\3vddp.exec:\3vddp.exe119⤵PID:2932
-
\??\c:\vvppd.exec:\vvppd.exe120⤵PID:1700
-
\??\c:\lllrflx.exec:\lllrflx.exe121⤵PID:2344
-
\??\c:\ntttnb.exec:\ntttnb.exe122⤵PID:2620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-