Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
20-01-2025 09:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe
-
Size
455KB
-
MD5
3f7232c7d9aeda461fae0b5599e4e73d
-
SHA1
21465f687d7f39feb1a006d4455c1dd4f99ec4ba
-
SHA256
b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c
-
SHA512
58813418671e582dcb657b754f9a85f531fe94a4be8b995cbc4945f7e2fd73e354eac6bab504d5d11cb85e12b04aac359c11d52c0d6c2cee1181a07e50050ec6
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 43 IoCs
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-34-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2164-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-51-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-78-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2200-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2208-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/620-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-187-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2292-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-192-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2508-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-279-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1896-284-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-295-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2776-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-380-0x00000000001C0000-0x00000000001EA000-memory.dmp family_blackmoon behavioral1/memory/1172-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-394-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-538-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2160-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-602-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3052-642-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-667-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1868-763-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-881-0x0000000001C80000-0x0000000001CAA000-memory.dmp family_blackmoon behavioral1/memory/2060-909-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2804 nhnnbb.exe 2400 vjdjv.exe 2752 xrffxxl.exe 2164 vvddp.exe 2572 5bhhnn.exe 2652 vjddp.exe 2388 7nhntn.exe 2200 dvjpp.exe 1532 5ttbhh.exe 2368 xfllxxf.exe 2208 hbnhhn.exe 620 ppvdj.exe 2112 hhbbnt.exe 2064 djdvd.exe 1636 nthhtt.exe 1888 9fxfrrx.exe 484 7vjjp.exe 696 7fllfff.exe 2316 7nbhnt.exe 2292 vvjvv.exe 1808 fllxrxl.exe 108 7vjpv.exe 2084 tnhbhb.exe 1500 ddvvj.exe 1684 xrfrxxl.exe 2500 1vjjp.exe 2508 9frffll.exe 3040 hhnbbb.exe 1616 lflrllr.exe 1812 lrllxxl.exe 1896 5ppvd.exe 2776 xxfxxrx.exe 2692 hnnnnn.exe 1524 lfrrffl.exe 2400 5hbhnt.exe 2740 jdpjj.exe 2880 dpjpd.exe 2164 xrflrxf.exe 3016 5tbhnn.exe 2652 vvjvj.exe 1700 1pjdd.exe 1464 3rrflrr.exe 1908 hnbhnt.exe 1532 ppdvj.exe 1172 vvjjj.exe 2408 rxllxfr.exe 2560 bhtbnt.exe 2460 ppvvj.exe 348 xrxfffl.exe 1688 ffrlxfr.exe 2280 nbnttt.exe 1636 5dpjp.exe 1768 9xrrxxl.exe 576 xrflxfr.exe 1708 nthtbn.exe 536 jjvjp.exe 2316 flxfrxx.exe 2484 lxrfrfr.exe 296 hbnhtb.exe 1012 pvdjv.exe 1804 xlxlrrf.exe 1504 9btbbb.exe 1660 3hbhnt.exe 1500 pjvjv.exe -
resource yara_rule behavioral1/memory/2772-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-34-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-59-0x0000000000250000-0x000000000027A000-memory.dmp upx behavioral1/memory/2388-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/620-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-128-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-284-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1172-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-589-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-688-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-725-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/108-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-763-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-888-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2804 2772 b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe 30 PID 2772 wrote to memory of 2804 2772 b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe 30 PID 2772 wrote to memory of 2804 2772 b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe 30 PID 2772 wrote to memory of 2804 2772 b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe 30 PID 2804 wrote to memory of 2400 2804 nhnnbb.exe 31 PID 2804 wrote to memory of 2400 2804 nhnnbb.exe 31 PID 2804 wrote to memory of 2400 2804 nhnnbb.exe 31 PID 2804 wrote to memory of 2400 2804 nhnnbb.exe 31 PID 2400 wrote to memory of 2752 2400 vjdjv.exe 32 PID 2400 wrote to memory of 2752 2400 vjdjv.exe 32 PID 2400 wrote to memory of 2752 2400 vjdjv.exe 32 PID 2400 wrote to memory of 2752 2400 vjdjv.exe 32 PID 2752 wrote to memory of 2164 2752 xrffxxl.exe 33 PID 2752 wrote to memory of 2164 2752 xrffxxl.exe 33 PID 2752 wrote to memory of 2164 2752 xrffxxl.exe 33 PID 2752 wrote to memory of 2164 2752 xrffxxl.exe 33 PID 2164 wrote to memory of 2572 2164 vvddp.exe 34 PID 2164 wrote to memory of 2572 2164 vvddp.exe 34 PID 2164 wrote to memory of 2572 2164 vvddp.exe 34 PID 2164 wrote to memory of 2572 2164 vvddp.exe 34 PID 2572 wrote to memory of 2652 2572 5bhhnn.exe 35 PID 2572 wrote to memory of 2652 2572 5bhhnn.exe 35 PID 2572 wrote to memory of 2652 2572 5bhhnn.exe 35 PID 2572 wrote to memory of 2652 2572 5bhhnn.exe 35 PID 2652 wrote to memory of 2388 2652 vjddp.exe 36 PID 2652 wrote to memory of 2388 2652 vjddp.exe 36 PID 2652 wrote to memory of 2388 2652 vjddp.exe 36 PID 2652 wrote to memory of 2388 2652 vjddp.exe 36 PID 2388 wrote to memory of 2200 2388 7nhntn.exe 37 PID 2388 wrote to memory of 2200 2388 7nhntn.exe 37 PID 2388 wrote to memory of 2200 2388 7nhntn.exe 37 PID 2388 wrote to memory of 2200 2388 7nhntn.exe 37 PID 2200 wrote to memory of 1532 2200 dvjpp.exe 38 PID 2200 wrote to memory of 1532 2200 dvjpp.exe 38 PID 2200 wrote to memory of 1532 2200 dvjpp.exe 38 PID 2200 wrote to memory of 1532 2200 dvjpp.exe 38 PID 1532 wrote to memory of 2368 1532 5ttbhh.exe 39 PID 1532 wrote to memory of 2368 1532 5ttbhh.exe 39 PID 1532 wrote to memory of 2368 1532 5ttbhh.exe 39 PID 1532 wrote to memory of 2368 1532 5ttbhh.exe 39 PID 2368 wrote to memory of 2208 2368 xfllxxf.exe 40 PID 2368 wrote to memory of 2208 2368 xfllxxf.exe 40 PID 2368 wrote to memory of 2208 2368 xfllxxf.exe 40 PID 2368 wrote to memory of 2208 2368 xfllxxf.exe 40 PID 2208 wrote to memory of 620 2208 hbnhhn.exe 41 PID 2208 wrote to memory of 620 2208 hbnhhn.exe 41 PID 2208 wrote to memory of 620 2208 hbnhhn.exe 41 PID 2208 wrote to memory of 620 2208 hbnhhn.exe 41 PID 620 wrote to memory of 2112 620 ppvdj.exe 42 PID 620 wrote to memory of 2112 620 ppvdj.exe 42 PID 620 wrote to memory of 2112 620 ppvdj.exe 42 PID 620 wrote to memory of 2112 620 ppvdj.exe 42 PID 2112 wrote to memory of 2064 2112 hhbbnt.exe 43 PID 2112 wrote to memory of 2064 2112 hhbbnt.exe 43 PID 2112 wrote to memory of 2064 2112 hhbbnt.exe 43 PID 2112 wrote to memory of 2064 2112 hhbbnt.exe 43 PID 2064 wrote to memory of 1636 2064 djdvd.exe 44 PID 2064 wrote to memory of 1636 2064 djdvd.exe 44 PID 2064 wrote to memory of 1636 2064 djdvd.exe 44 PID 2064 wrote to memory of 1636 2064 djdvd.exe 44 PID 1636 wrote to memory of 1888 1636 nthhtt.exe 45 PID 1636 wrote to memory of 1888 1636 nthhtt.exe 45 PID 1636 wrote to memory of 1888 1636 nthhtt.exe 45 PID 1636 wrote to memory of 1888 1636 nthhtt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe"C:\Users\Admin\AppData\Local\Temp\b00fa19e8ff822092d53f80a732cd56f7f6a11d1cc4e2b38f45de915344bd46c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nhnnbb.exec:\nhnnbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\vjdjv.exec:\vjdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\xrffxxl.exec:\xrffxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vvddp.exec:\vvddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\5bhhnn.exec:\5bhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\vjddp.exec:\vjddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7nhntn.exec:\7nhntn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\dvjpp.exec:\dvjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\5ttbhh.exec:\5ttbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\xfllxxf.exec:\xfllxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hbnhhn.exec:\hbnhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\ppvdj.exec:\ppvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\hhbbnt.exec:\hhbbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\djdvd.exec:\djdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\nthhtt.exec:\nthhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\9fxfrrx.exec:\9fxfrrx.exe17⤵
- Executes dropped EXE
PID:1888 -
\??\c:\7vjjp.exec:\7vjjp.exe18⤵
- Executes dropped EXE
PID:484 -
\??\c:\7fllfff.exec:\7fllfff.exe19⤵
- Executes dropped EXE
PID:696 -
\??\c:\7nbhnt.exec:\7nbhnt.exe20⤵
- Executes dropped EXE
PID:2316 -
\??\c:\vvjvv.exec:\vvjvv.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fllxrxl.exec:\fllxrxl.exe22⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7vjpv.exec:\7vjpv.exe23⤵
- Executes dropped EXE
PID:108 -
\??\c:\tnhbhb.exec:\tnhbhb.exe24⤵
- Executes dropped EXE
PID:2084 -
\??\c:\ddvvj.exec:\ddvvj.exe25⤵
- Executes dropped EXE
PID:1500 -
\??\c:\xrfrxxl.exec:\xrfrxxl.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1vjjp.exec:\1vjjp.exe27⤵
- Executes dropped EXE
PID:2500 -
\??\c:\9frffll.exec:\9frffll.exe28⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hhnbbb.exec:\hhnbbb.exe29⤵
- Executes dropped EXE
PID:3040 -
\??\c:\lflrllr.exec:\lflrllr.exe30⤵
- Executes dropped EXE
PID:1616 -
\??\c:\lrllxxl.exec:\lrllxxl.exe31⤵
- Executes dropped EXE
PID:1812 -
\??\c:\5ppvd.exec:\5ppvd.exe32⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xxfxxrx.exec:\xxfxxrx.exe33⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hnnnnn.exec:\hnnnnn.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lfrrffl.exec:\lfrrffl.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\5hbhnt.exec:\5hbhnt.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jdpjj.exec:\jdpjj.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dpjpd.exec:\dpjpd.exe38⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xrflrxf.exec:\xrflrxf.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5tbhnn.exec:\5tbhnn.exe40⤵
- Executes dropped EXE
PID:3016 -
\??\c:\vvjvj.exec:\vvjvj.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\1pjdd.exec:\1pjdd.exe42⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3rrflrr.exec:\3rrflrr.exe43⤵
- Executes dropped EXE
PID:1464 -
\??\c:\hnbhnt.exec:\hnbhnt.exe44⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ppdvj.exec:\ppdvj.exe45⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvjjj.exec:\vvjjj.exe46⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rxllxfr.exec:\rxllxfr.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bhtbnt.exec:\bhtbnt.exe48⤵
- Executes dropped EXE
PID:2560 -
\??\c:\ppvvj.exec:\ppvvj.exe49⤵
- Executes dropped EXE
PID:2460 -
\??\c:\xrxfffl.exec:\xrxfffl.exe50⤵
- Executes dropped EXE
PID:348 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\nbnttt.exec:\nbnttt.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\5dpjp.exec:\5dpjp.exe53⤵
- Executes dropped EXE
PID:1636 -
\??\c:\9xrrxxl.exec:\9xrrxxl.exe54⤵
- Executes dropped EXE
PID:1768 -
\??\c:\xrflxfr.exec:\xrflxfr.exe55⤵
- Executes dropped EXE
PID:576 -
\??\c:\nthtbn.exec:\nthtbn.exe56⤵
- Executes dropped EXE
PID:1708 -
\??\c:\jjvjp.exec:\jjvjp.exe57⤵
- Executes dropped EXE
PID:536 -
\??\c:\flxfrxx.exec:\flxfrxx.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lxrfrfr.exec:\lxrfrfr.exe59⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbnhtb.exec:\hbnhtb.exe60⤵
- Executes dropped EXE
PID:296 -
\??\c:\pvdjv.exec:\pvdjv.exe61⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xlxlrrf.exec:\xlxlrrf.exe62⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9btbbb.exec:\9btbbb.exe63⤵
- Executes dropped EXE
PID:1504 -
\??\c:\3hbhnt.exec:\3hbhnt.exe64⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pjvjv.exec:\pjvjv.exe65⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe66⤵PID:2440
-
\??\c:\1nnhbn.exec:\1nnhbn.exe67⤵PID:2976
-
\??\c:\jjdpd.exec:\jjdpd.exe68⤵PID:3048
-
\??\c:\ffllrlx.exec:\ffllrlx.exe69⤵PID:1740
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe70⤵PID:3032
-
\??\c:\7ththn.exec:\7ththn.exe71⤵PID:876
-
\??\c:\jdpdj.exec:\jdpdj.exe72⤵PID:2184
-
\??\c:\flrxflx.exec:\flrxflx.exe73⤵PID:2992
-
\??\c:\hbtbnn.exec:\hbtbnn.exe74⤵PID:2800
-
\??\c:\hhbnhn.exec:\hhbnhn.exe75⤵PID:2700
-
\??\c:\jjvdp.exec:\jjvdp.exe76⤵PID:1544
-
\??\c:\9xrfxfr.exec:\9xrfxfr.exe77⤵PID:2160
-
\??\c:\nntntt.exec:\nntntt.exe78⤵PID:3036
-
\??\c:\1pvdp.exec:\1pvdp.exe79⤵PID:2740
-
\??\c:\fllrflx.exec:\fllrflx.exe80⤵PID:2880
-
\??\c:\flxffxf.exec:\flxffxf.exe81⤵PID:2616
-
\??\c:\bhbnhn.exec:\bhbnhn.exe82⤵PID:3052
-
\??\c:\pvddj.exec:\pvddj.exe83⤵PID:1496
-
\??\c:\rrfxrlx.exec:\rrfxrlx.exe84⤵PID:2764
-
\??\c:\llrrrxl.exec:\llrrrxl.exe85⤵PID:1464
-
\??\c:\nthtbh.exec:\nthtbh.exe86⤵PID:2040
-
\??\c:\ddppv.exec:\ddppv.exe87⤵PID:1532
-
\??\c:\1pjjv.exec:\1pjjv.exe88⤵PID:308
-
\??\c:\5frrfff.exec:\5frrfff.exe89⤵PID:2208
-
\??\c:\9httbh.exec:\9httbh.exe90⤵PID:1096
-
\??\c:\5tnthn.exec:\5tnthn.exe91⤵PID:1976
-
\??\c:\jjvjd.exec:\jjvjd.exe92⤵PID:1640
-
\??\c:\lrrxlxx.exec:\lrrxlxx.exe93⤵PID:2136
-
\??\c:\hbhnnn.exec:\hbhnnn.exe94⤵PID:1276
-
\??\c:\5bhhnt.exec:\5bhhnt.exe95⤵PID:1124
-
\??\c:\dpjpd.exec:\dpjpd.exe96⤵PID:1768
-
\??\c:\3lxrxxx.exec:\3lxrxxx.exe97⤵PID:264
-
\??\c:\hhnnnh.exec:\hhnnnh.exe98⤵PID:2392
-
\??\c:\hbbtbh.exec:\hbbtbh.exe99⤵PID:536
-
\??\c:\ppvdp.exec:\ppvdp.exe100⤵PID:1308
-
\??\c:\xlrxfxf.exec:\xlrxfxf.exe101⤵PID:2484
-
\??\c:\xrffllr.exec:\xrffllr.exe102⤵PID:588
-
\??\c:\hhtbnb.exec:\hhtbnb.exe103⤵PID:108
-
\??\c:\ddjdj.exec:\ddjdj.exe104⤵PID:1868
-
\??\c:\3ppvv.exec:\3ppvv.exe105⤵PID:1680
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe106⤵PID:2476
-
\??\c:\5ttttt.exec:\5ttttt.exe107⤵PID:3056
-
\??\c:\7dvvd.exec:\7dvvd.exe108⤵
- System Location Discovery: System Language Discovery
PID:824 -
\??\c:\3xxfrxl.exec:\3xxfrxl.exe109⤵PID:1572
-
\??\c:\9xflflx.exec:\9xflflx.exe110⤵PID:2972
-
\??\c:\nnbbhh.exec:\nnbbhh.exe111⤵PID:1584
-
\??\c:\djvdj.exec:\djvdj.exe112⤵PID:1560
-
\??\c:\pjjvj.exec:\pjjvj.exe113⤵PID:2984
-
\??\c:\xxrxllx.exec:\xxrxllx.exe114⤵PID:2824
-
\??\c:\tnbbhh.exec:\tnbbhh.exe115⤵PID:2780
-
\??\c:\9dppd.exec:\9dppd.exe116⤵PID:2736
-
\??\c:\llflxlx.exec:\llflxlx.exe117⤵PID:2808
-
\??\c:\bhhbhh.exec:\bhhbhh.exe118⤵PID:2900
-
\??\c:\hhtbhn.exec:\hhtbhn.exe119⤵PID:2748
-
\??\c:\jpdpd.exec:\jpdpd.exe120⤵PID:3036
-
\??\c:\7lxfffl.exec:\7lxfffl.exe121⤵PID:1732
-
\??\c:\tthhnb.exec:\tthhnb.exe122⤵PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-