Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe
-
Size
456KB
-
MD5
254f06adf78ae1223269f6dd14b3d2e8
-
SHA1
67ecc863e8c699c82f5223f4dece78cfbb378528
-
SHA256
ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a
-
SHA512
b8fd4fce9cd71a69f0b4908447309108b2c414e401377bce109a3ada4c21dbc6253e45e5f8308b6f0dd5a6d2a3827511d3bf347b1d8efa499b44844753803a09
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRl:q7Tc2NYHUrAwfMp3CDRl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2416-6-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2912-15-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1052-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-102-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/972-524-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-547-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-619-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-634-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-648-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/736-701-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1848-708-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2472-787-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1548-799-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1812-832-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-896-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2912 7nbhnn.exe 1052 rfrlrlx.exe 2992 nhnttt.exe 2120 3jpjd.exe 2752 1rfffff.exe 2624 nnnhtn.exe 2788 5ffrxxr.exe 2960 bthtbt.exe 2772 jvjdp.exe 2568 nhnnnn.exe 2828 jpdvd.exe 596 1frrfxr.exe 1144 nhtntt.exe 1108 vpjjj.exe 2256 7rflfll.exe 2308 nhtbhn.exe 1800 5xllrrr.exe 1300 7hnntb.exe 2292 7vdjj.exe 1788 flrxllr.exe 1948 3pjpv.exe 1936 rfrrffr.exe 2716 7nbhhn.exe 3044 vjpvv.exe 1512 lfflllr.exe 972 nbbntn.exe 1540 llxrxfl.exe 316 hthhtt.exe 1280 vpjdj.exe 2072 fxllrrx.exe 2864 bnbhtn.exe 1508 pjvpv.exe 1596 htnnbb.exe 2924 ddvdp.exe 2912 vjvpv.exe 2052 lfrrxlr.exe 2992 1htthh.exe 3008 vjvpv.exe 2780 dppjp.exe 2868 7fxrffr.exe 2608 btnntb.exe 2680 9vppp.exe 2672 fxlxfff.exe 3020 nhbbhb.exe 2556 tnbhnb.exe 1032 ddvdd.exe 2568 5xlxllr.exe 592 7lffrlr.exe 320 nthnbb.exe 1492 3jddp.exe 2032 3jjpd.exe 1108 rlfxlrx.exe 2312 hbhbbb.exe 1780 7tnntn.exe 1452 dppjp.exe 2280 xlrrxrx.exe 1796 nbttbb.exe 1308 bntbhh.exe 2004 7dppj.exe 1960 1xllrrx.exe 1984 tbhntb.exe 2712 nbhhhh.exe 2368 9pdvv.exe 3044 9xrrlfl.exe -
resource yara_rule behavioral1/memory/2416-6-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2912-15-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-447-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-446-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/2004-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/972-524-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-619-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-634-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-787-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1548-799-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2592-819-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-832-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2912 2416 ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe 28 PID 2416 wrote to memory of 2912 2416 ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe 28 PID 2416 wrote to memory of 2912 2416 ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe 28 PID 2416 wrote to memory of 2912 2416 ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe 28 PID 2912 wrote to memory of 1052 2912 7nbhnn.exe 29 PID 2912 wrote to memory of 1052 2912 7nbhnn.exe 29 PID 2912 wrote to memory of 1052 2912 7nbhnn.exe 29 PID 2912 wrote to memory of 1052 2912 7nbhnn.exe 29 PID 1052 wrote to memory of 2992 1052 rfrlrlx.exe 30 PID 1052 wrote to memory of 2992 1052 rfrlrlx.exe 30 PID 1052 wrote to memory of 2992 1052 rfrlrlx.exe 30 PID 1052 wrote to memory of 2992 1052 rfrlrlx.exe 30 PID 2992 wrote to memory of 2120 2992 nhnttt.exe 31 PID 2992 wrote to memory of 2120 2992 nhnttt.exe 31 PID 2992 wrote to memory of 2120 2992 nhnttt.exe 31 PID 2992 wrote to memory of 2120 2992 nhnttt.exe 31 PID 2120 wrote to memory of 2752 2120 3jpjd.exe 32 PID 2120 wrote to memory of 2752 2120 3jpjd.exe 32 PID 2120 wrote to memory of 2752 2120 3jpjd.exe 32 PID 2120 wrote to memory of 2752 2120 3jpjd.exe 32 PID 2752 wrote to memory of 2624 2752 1rfffff.exe 33 PID 2752 wrote to memory of 2624 2752 1rfffff.exe 33 PID 2752 wrote to memory of 2624 2752 1rfffff.exe 33 PID 2752 wrote to memory of 2624 2752 1rfffff.exe 33 PID 2624 wrote to memory of 2788 2624 nnnhtn.exe 34 PID 2624 wrote to memory of 2788 2624 nnnhtn.exe 34 PID 2624 wrote to memory of 2788 2624 nnnhtn.exe 34 PID 2624 wrote to memory of 2788 2624 nnnhtn.exe 34 PID 2788 wrote to memory of 2960 2788 5ffrxxr.exe 35 PID 2788 wrote to memory of 2960 2788 5ffrxxr.exe 35 PID 2788 wrote to memory of 2960 2788 5ffrxxr.exe 35 PID 2788 wrote to memory of 2960 2788 5ffrxxr.exe 35 PID 2960 wrote to memory of 2772 2960 bthtbt.exe 36 PID 2960 wrote to memory of 2772 2960 bthtbt.exe 36 PID 2960 wrote to memory of 2772 2960 bthtbt.exe 36 PID 2960 wrote to memory of 2772 2960 bthtbt.exe 36 PID 2772 wrote to memory of 2568 2772 jvjdp.exe 37 PID 2772 wrote to memory of 2568 2772 jvjdp.exe 37 PID 2772 wrote to memory of 2568 2772 jvjdp.exe 37 PID 2772 wrote to memory of 2568 2772 jvjdp.exe 37 PID 2568 wrote to memory of 2828 2568 nhnnnn.exe 38 PID 2568 wrote to memory of 2828 2568 nhnnnn.exe 38 PID 2568 wrote to memory of 2828 2568 nhnnnn.exe 38 PID 2568 wrote to memory of 2828 2568 nhnnnn.exe 38 PID 2828 wrote to memory of 596 2828 jpdvd.exe 39 PID 2828 wrote to memory of 596 2828 jpdvd.exe 39 PID 2828 wrote to memory of 596 2828 jpdvd.exe 39 PID 2828 wrote to memory of 596 2828 jpdvd.exe 39 PID 596 wrote to memory of 1144 596 1frrfxr.exe 40 PID 596 wrote to memory of 1144 596 1frrfxr.exe 40 PID 596 wrote to memory of 1144 596 1frrfxr.exe 40 PID 596 wrote to memory of 1144 596 1frrfxr.exe 40 PID 1144 wrote to memory of 1108 1144 nhtntt.exe 41 PID 1144 wrote to memory of 1108 1144 nhtntt.exe 41 PID 1144 wrote to memory of 1108 1144 nhtntt.exe 41 PID 1144 wrote to memory of 1108 1144 nhtntt.exe 41 PID 1108 wrote to memory of 2256 1108 vpjjj.exe 42 PID 1108 wrote to memory of 2256 1108 vpjjj.exe 42 PID 1108 wrote to memory of 2256 1108 vpjjj.exe 42 PID 1108 wrote to memory of 2256 1108 vpjjj.exe 42 PID 2256 wrote to memory of 2308 2256 7rflfll.exe 43 PID 2256 wrote to memory of 2308 2256 7rflfll.exe 43 PID 2256 wrote to memory of 2308 2256 7rflfll.exe 43 PID 2256 wrote to memory of 2308 2256 7rflfll.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe"C:\Users\Admin\AppData\Local\Temp\ad5236a2a757a0605d5cfa9d615046ff3397ff9a71189ce1d1c1adc4e0db191a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\7nbhnn.exec:\7nbhnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\rfrlrlx.exec:\rfrlrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\nhnttt.exec:\nhnttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\3jpjd.exec:\3jpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\1rfffff.exec:\1rfffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\nnnhtn.exec:\nnnhtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\5ffrxxr.exec:\5ffrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\bthtbt.exec:\bthtbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\jvjdp.exec:\jvjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nhnnnn.exec:\nhnnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\jpdvd.exec:\jpdvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1frrfxr.exec:\1frrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\nhtntt.exec:\nhtntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\vpjjj.exec:\vpjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\7rflfll.exec:\7rflfll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nhtbhn.exec:\nhtbhn.exe17⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5xllrrr.exec:\5xllrrr.exe18⤵
- Executes dropped EXE
PID:1800 -
\??\c:\7hnntb.exec:\7hnntb.exe19⤵
- Executes dropped EXE
PID:1300 -
\??\c:\7vdjj.exec:\7vdjj.exe20⤵
- Executes dropped EXE
PID:2292 -
\??\c:\flrxllr.exec:\flrxllr.exe21⤵
- Executes dropped EXE
PID:1788 -
\??\c:\3pjpv.exec:\3pjpv.exe22⤵
- Executes dropped EXE
PID:1948 -
\??\c:\rfrrffr.exec:\rfrrffr.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7nbhhn.exec:\7nbhhn.exe24⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vjpvv.exec:\vjpvv.exe25⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lfflllr.exec:\lfflllr.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nbbntn.exec:\nbbntn.exe27⤵
- Executes dropped EXE
PID:972 -
\??\c:\llxrxfl.exec:\llxrxfl.exe28⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hthhtt.exec:\hthhtt.exe29⤵
- Executes dropped EXE
PID:316 -
\??\c:\vpjdj.exec:\vpjdj.exe30⤵
- Executes dropped EXE
PID:1280 -
\??\c:\fxllrrx.exec:\fxllrrx.exe31⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bnbhtn.exec:\bnbhtn.exe32⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pjvpv.exec:\pjvpv.exe33⤵
- Executes dropped EXE
PID:1508 -
\??\c:\htnnbb.exec:\htnnbb.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\ddvdp.exec:\ddvdp.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\vjvpv.exec:\vjvpv.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\lfrrxlr.exec:\lfrrxlr.exe37⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1htthh.exec:\1htthh.exe38⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vjvpv.exec:\vjvpv.exe39⤵
- Executes dropped EXE
PID:3008 -
\??\c:\dppjp.exec:\dppjp.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7fxrffr.exec:\7fxrffr.exe41⤵
- Executes dropped EXE
PID:2868 -
\??\c:\btnntb.exec:\btnntb.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\9vppp.exec:\9vppp.exe43⤵
- Executes dropped EXE
PID:2680 -
\??\c:\fxlxfff.exec:\fxlxfff.exe44⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nhbbhb.exec:\nhbbhb.exe45⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnbhnb.exec:\tnbhnb.exe46⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ddvdd.exec:\ddvdd.exe47⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5xlxllr.exec:\5xlxllr.exe48⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7lffrlr.exec:\7lffrlr.exe49⤵
- Executes dropped EXE
PID:592 -
\??\c:\nthnbb.exec:\nthnbb.exe50⤵
- Executes dropped EXE
PID:320 -
\??\c:\3jddp.exec:\3jddp.exe51⤵
- Executes dropped EXE
PID:1492 -
\??\c:\3jjpd.exec:\3jjpd.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rlfxlrx.exec:\rlfxlrx.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\hbhbbb.exec:\hbhbbb.exe54⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7tnntn.exec:\7tnntn.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\dppjp.exec:\dppjp.exe56⤵
- Executes dropped EXE
PID:1452 -
\??\c:\xlrrxrx.exec:\xlrrxrx.exe57⤵
- Executes dropped EXE
PID:2280 -
\??\c:\nbttbb.exec:\nbttbb.exe58⤵
- Executes dropped EXE
PID:1796 -
\??\c:\bntbhh.exec:\bntbhh.exe59⤵
- Executes dropped EXE
PID:1308 -
\??\c:\7dppj.exec:\7dppj.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\1xllrrx.exec:\1xllrrx.exe61⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tbhntb.exec:\tbhntb.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nbhhhh.exec:\nbhhhh.exe63⤵
- Executes dropped EXE
PID:2712 -
\??\c:\9pdvv.exec:\9pdvv.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\9xrrlfl.exec:\9xrrlfl.exe65⤵
- Executes dropped EXE
PID:3044 -
\??\c:\nthntn.exec:\nthntn.exe66⤵PID:2688
-
\??\c:\tbtbhn.exec:\tbtbhn.exe67⤵PID:2392
-
\??\c:\dvjjp.exec:\dvjjp.exe68⤵PID:972
-
\??\c:\3xfllfl.exec:\3xfllfl.exe69⤵PID:1540
-
\??\c:\9bhbhn.exec:\9bhbhn.exe70⤵PID:1640
-
\??\c:\bbttnn.exec:\bbttnn.exe71⤵PID:1908
-
\??\c:\dvdjp.exec:\dvdjp.exe72⤵PID:1860
-
\??\c:\xrxrffl.exec:\xrxrffl.exe73⤵PID:816
-
\??\c:\5htntt.exec:\5htntt.exe74⤵
- System Location Discovery: System Language Discovery
PID:2092 -
\??\c:\7bnttt.exec:\7bnttt.exe75⤵PID:1600
-
\??\c:\vvpjp.exec:\vvpjp.exe76⤵PID:2920
-
\??\c:\vpppp.exec:\vpppp.exe77⤵PID:2932
-
\??\c:\lrllrrx.exec:\lrllrrx.exe78⤵PID:2984
-
\??\c:\tnbhtb.exec:\tnbhtb.exe79⤵PID:1048
-
\??\c:\pjvdj.exec:\pjvdj.exe80⤵PID:2136
-
\??\c:\frllrxf.exec:\frllrxf.exe81⤵PID:2768
-
\??\c:\rflfrlr.exec:\rflfrlr.exe82⤵PID:2780
-
\??\c:\hnhhtn.exec:\hnhhtn.exe83⤵PID:2868
-
\??\c:\3pjpv.exec:\3pjpv.exe84⤵PID:2520
-
\??\c:\vjddj.exec:\vjddj.exe85⤵PID:2604
-
\??\c:\rrlrxfl.exec:\rrlrxfl.exe86⤵PID:2524
-
\??\c:\fxllrrx.exec:\fxllrrx.exe87⤵PID:2664
-
\??\c:\nhtbbh.exec:\nhtbbh.exe88⤵PID:2956
-
\??\c:\jdvvd.exec:\jdvvd.exe89⤵PID:324
-
\??\c:\9fxrfxf.exec:\9fxrfxf.exe90⤵PID:736
-
\??\c:\llllxfr.exec:\llllxfr.exe91⤵PID:1480
-
\??\c:\9hbbhh.exec:\9hbbhh.exe92⤵PID:1144
-
\??\c:\dvjjd.exec:\dvjjd.exe93⤵PID:2016
-
\??\c:\xxxlrrl.exec:\xxxlrrl.exe94⤵PID:1848
-
\??\c:\rlflfxf.exec:\rlflfxf.exe95⤵PID:1432
-
\??\c:\3ttttt.exec:\3ttttt.exe96⤵PID:1976
-
\??\c:\vjvdd.exec:\vjvdd.exe97⤵PID:1804
-
\??\c:\pvppv.exec:\pvppv.exe98⤵PID:2000
-
\??\c:\lffrlxr.exec:\lffrlxr.exe99⤵PID:2396
-
\??\c:\bnbbhn.exec:\bnbbhn.exe100⤵PID:2024
-
\??\c:\nbhhbb.exec:\nbhhbb.exe101⤵PID:1216
-
\??\c:\5vvdd.exec:\5vvdd.exe102⤵PID:1920
-
\??\c:\xrllxxl.exec:\xrllxxl.exe103⤵PID:1936
-
\??\c:\frfffxf.exec:\frfffxf.exe104⤵PID:2192
-
\??\c:\bnhhnn.exec:\bnhhnn.exe105⤵
- System Location Discovery: System Language Discovery
PID:2696 -
\??\c:\5jpjj.exec:\5jpjj.exe106⤵PID:2472
-
\??\c:\pjpdp.exec:\pjpdp.exe107⤵PID:1636
-
\??\c:\lfxlllr.exec:\lfxlllr.exe108⤵PID:1548
-
\??\c:\thbbhb.exec:\thbbhb.exe109⤵PID:3004
-
\??\c:\vjdjp.exec:\vjdjp.exe110⤵PID:896
-
\??\c:\pjdvv.exec:\pjdvv.exe111⤵PID:316
-
\??\c:\xflfxxf.exec:\xflfxxf.exe112⤵PID:2592
-
\??\c:\7hnntb.exec:\7hnntb.exe113⤵PID:2072
-
\??\c:\nhtnbt.exec:\nhtnbt.exe114⤵PID:1812
-
\??\c:\5pppj.exec:\5pppj.exe115⤵PID:2904
-
\??\c:\vjppv.exec:\vjppv.exe116⤵PID:1940
-
\??\c:\xrllrrf.exec:\xrllrrf.exe117⤵PID:1852
-
\??\c:\9hhhnt.exec:\9hhhnt.exe118⤵PID:2968
-
\??\c:\pjdvp.exec:\pjdvp.exe119⤵PID:2836
-
\??\c:\pjvvd.exec:\pjvvd.exe120⤵PID:2856
-
\??\c:\xxrrffr.exec:\xxrrffr.exe121⤵PID:2636
-
\??\c:\nbtntt.exec:\nbtntt.exe122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-