Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 21:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe
-
Size
457KB
-
MD5
66900a973f941e9a8af51fe715e4a112
-
SHA1
3903ee28689e8fad2d6bbc1a7b9363992929fafa
-
SHA256
5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f
-
SHA512
a7b11736757d757570efe5cf50bdbe96ff13e314bf6e5203dcf6b9c300b3daf75916c85b8e3f9d5ea8e51a8f71f62da8ec05637056abb8a241b6288e586e7b95
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeSc:q7Tc2NYHUrAwfMp3CDF
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 46 IoCs
resource yara_rule behavioral1/memory/2460-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/692-133-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-399-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2240-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-472-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-540-0x0000000001C50000-0x0000000001C7A000-memory.dmp family_blackmoon behavioral1/memory/2992-695-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2824-807-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-1357-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3024-1307-0x0000000000270000-0x000000000029A000-memory.dmp family_blackmoon behavioral1/memory/2220-1253-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2016-1244-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/3028-1182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-715-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2216-578-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2804-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1132-444-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2956-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-270-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/556-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-111-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1560-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1560-100-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-62-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2212-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1288 htnbhn.exe 2736 1hbhnn.exe 2648 9fxrxxf.exe 2804 tnhnnn.exe 2544 nhtbhh.exe 2212 1jppv.exe 2740 5bhttb.exe 2548 jvjdp.exe 3016 rfrxllx.exe 1560 hbnhnn.exe 1644 ddpdj.exe 2840 bthhnt.exe 692 pjjdp.exe 2084 5rlxxrf.exe 2292 bthtnn.exe 2852 jdpdj.exe 556 3xllffl.exe 2872 7lxrllx.exe 2100 3nbhht.exe 2180 pvpvd.exe 2396 fxrxffr.exe 3000 thbbnt.exe 328 pdpjj.exe 2388 xrxrflr.exe 740 bbbhbb.exe 1740 pdvjp.exe 2432 lfrrffr.exe 1160 1pvvd.exe 2956 fxfxffr.exe 2624 ntbbhb.exe 1588 pjvdd.exe 2636 3rxlllf.exe 2808 5hbhtt.exe 2676 9pdpj.exe 3048 3rrxxxf.exe 1988 thnnbn.exe 2656 dvjjp.exe 2580 7fllfxx.exe 2548 llffxrf.exe 904 nbnntn.exe 2232 pjvjv.exe 1724 xrlrxxf.exe 1684 tnbtbb.exe 1396 hbhhnt.exe 1780 djpvd.exe 2536 9lxrxff.exe 1812 tthtbh.exe 1228 9dpdj.exe 2988 xlrrxxx.exe 2632 frlrxfr.exe 2364 hbnbtt.exe 2060 3bttbt.exe 1132 vpjjv.exe 1216 1xflrrr.exe 2240 hbttbb.exe 2864 bthnbt.exe 1624 pdjdj.exe 2388 lflrxxf.exe 2016 lfxfrfr.exe 1972 bbnthh.exe 1996 7bnbtt.exe 2260 vpdjd.exe 2112 5lxllll.exe 1928 lxllrrf.exe -
resource yara_rule behavioral1/memory/2460-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-399-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2240-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-807-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-1358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-1285-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2540-740-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-270-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/556-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-28-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2460 wrote to memory of 1288 2460 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 31 PID 2460 wrote to memory of 1288 2460 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 31 PID 2460 wrote to memory of 1288 2460 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 31 PID 2460 wrote to memory of 1288 2460 5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe 31 PID 1288 wrote to memory of 2736 1288 htnbhn.exe 32 PID 1288 wrote to memory of 2736 1288 htnbhn.exe 32 PID 1288 wrote to memory of 2736 1288 htnbhn.exe 32 PID 1288 wrote to memory of 2736 1288 htnbhn.exe 32 PID 2736 wrote to memory of 2648 2736 1hbhnn.exe 33 PID 2736 wrote to memory of 2648 2736 1hbhnn.exe 33 PID 2736 wrote to memory of 2648 2736 1hbhnn.exe 33 PID 2736 wrote to memory of 2648 2736 1hbhnn.exe 33 PID 2648 wrote to memory of 2804 2648 9fxrxxf.exe 100 PID 2648 wrote to memory of 2804 2648 9fxrxxf.exe 100 PID 2648 wrote to memory of 2804 2648 9fxrxxf.exe 100 PID 2648 wrote to memory of 2804 2648 9fxrxxf.exe 100 PID 2804 wrote to memory of 2544 2804 tnhnnn.exe 35 PID 2804 wrote to memory of 2544 2804 tnhnnn.exe 35 PID 2804 wrote to memory of 2544 2804 tnhnnn.exe 35 PID 2804 wrote to memory of 2544 2804 tnhnnn.exe 35 PID 2544 wrote to memory of 2212 2544 nhtbhh.exe 36 PID 2544 wrote to memory of 2212 2544 nhtbhh.exe 36 PID 2544 wrote to memory of 2212 2544 nhtbhh.exe 36 PID 2544 wrote to memory of 2212 2544 nhtbhh.exe 36 PID 2212 wrote to memory of 2740 2212 1jppv.exe 37 PID 2212 wrote to memory of 2740 2212 1jppv.exe 37 PID 2212 wrote to memory of 2740 2212 1jppv.exe 37 PID 2212 wrote to memory of 2740 2212 1jppv.exe 37 PID 2740 wrote to memory of 2548 2740 5bhttb.exe 38 PID 2740 wrote to memory of 2548 2740 5bhttb.exe 38 PID 2740 wrote to memory of 2548 2740 5bhttb.exe 38 PID 2740 wrote to memory of 2548 2740 5bhttb.exe 38 PID 2548 wrote to memory of 3016 2548 jvjdp.exe 39 PID 2548 wrote to memory of 3016 2548 jvjdp.exe 39 PID 2548 wrote to memory of 3016 2548 jvjdp.exe 39 PID 2548 wrote to memory of 3016 2548 jvjdp.exe 39 PID 3016 wrote to memory of 1560 3016 rfrxllx.exe 40 PID 3016 wrote to memory of 1560 3016 rfrxllx.exe 40 PID 3016 wrote to memory of 1560 3016 rfrxllx.exe 40 PID 3016 wrote to memory of 1560 3016 rfrxllx.exe 40 PID 1560 wrote to memory of 1644 1560 hbnhnn.exe 41 PID 1560 wrote to memory of 1644 1560 hbnhnn.exe 41 PID 1560 wrote to memory of 1644 1560 hbnhnn.exe 41 PID 1560 wrote to memory of 1644 1560 hbnhnn.exe 41 PID 1644 wrote to memory of 2840 1644 ddpdj.exe 42 PID 1644 wrote to memory of 2840 1644 ddpdj.exe 42 PID 1644 wrote to memory of 2840 1644 ddpdj.exe 42 PID 1644 wrote to memory of 2840 1644 ddpdj.exe 42 PID 2840 wrote to memory of 692 2840 bthhnt.exe 43 PID 2840 wrote to memory of 692 2840 bthhnt.exe 43 PID 2840 wrote to memory of 692 2840 bthhnt.exe 43 PID 2840 wrote to memory of 692 2840 bthhnt.exe 43 PID 692 wrote to memory of 2084 692 pjjdp.exe 44 PID 692 wrote to memory of 2084 692 pjjdp.exe 44 PID 692 wrote to memory of 2084 692 pjjdp.exe 44 PID 692 wrote to memory of 2084 692 pjjdp.exe 44 PID 2084 wrote to memory of 2292 2084 5rlxxrf.exe 45 PID 2084 wrote to memory of 2292 2084 5rlxxrf.exe 45 PID 2084 wrote to memory of 2292 2084 5rlxxrf.exe 45 PID 2084 wrote to memory of 2292 2084 5rlxxrf.exe 45 PID 2292 wrote to memory of 2852 2292 bthtnn.exe 46 PID 2292 wrote to memory of 2852 2292 bthtnn.exe 46 PID 2292 wrote to memory of 2852 2292 bthtnn.exe 46 PID 2292 wrote to memory of 2852 2292 bthtnn.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe"C:\Users\Admin\AppData\Local\Temp\5698484ea82c3111193fad5882f57b08ef7de12a7d6e42c1506f46a7ea2c6b4f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\htnbhn.exec:\htnbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\1hbhnn.exec:\1hbhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\9fxrxxf.exec:\9fxrxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\tnhnnn.exec:\tnhnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\nhtbhh.exec:\nhtbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\1jppv.exec:\1jppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\5bhttb.exec:\5bhttb.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\jvjdp.exec:\jvjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rfrxllx.exec:\rfrxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hbnhnn.exec:\hbnhnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\ddpdj.exec:\ddpdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\bthhnt.exec:\bthhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\pjjdp.exec:\pjjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\5rlxxrf.exec:\5rlxxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\bthtnn.exec:\bthtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\jdpdj.exec:\jdpdj.exe17⤵
- Executes dropped EXE
PID:2852 -
\??\c:\3xllffl.exec:\3xllffl.exe18⤵
- Executes dropped EXE
PID:556 -
\??\c:\7lxrllx.exec:\7lxrllx.exe19⤵
- Executes dropped EXE
PID:2872 -
\??\c:\3nbhht.exec:\3nbhht.exe20⤵
- Executes dropped EXE
PID:2100 -
\??\c:\pvpvd.exec:\pvpvd.exe21⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxrxffr.exec:\fxrxffr.exe22⤵
- Executes dropped EXE
PID:2396 -
\??\c:\thbbnt.exec:\thbbnt.exe23⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pdpjj.exec:\pdpjj.exe24⤵
- Executes dropped EXE
PID:328 -
\??\c:\xrxrflr.exec:\xrxrflr.exe25⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bbbhbb.exec:\bbbhbb.exe26⤵
- Executes dropped EXE
PID:740 -
\??\c:\pdvjp.exec:\pdvjp.exe27⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lfrrffr.exec:\lfrrffr.exe28⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1pvvd.exec:\1pvvd.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\fxfxffr.exec:\fxfxffr.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ntbbhb.exec:\ntbbhb.exe31⤵
- Executes dropped EXE
PID:2624 -
\??\c:\pjvdd.exec:\pjvdd.exe32⤵
- Executes dropped EXE
PID:1588 -
\??\c:\3rxlllf.exec:\3rxlllf.exe33⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5hbhtt.exec:\5hbhtt.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\9pdpj.exec:\9pdpj.exe35⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3rrxxxf.exec:\3rrxxxf.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\thnnbn.exec:\thnnbn.exe37⤵
- Executes dropped EXE
PID:1988 -
\??\c:\dvjjp.exec:\dvjjp.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\7fllfxx.exec:\7fllfxx.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\llffxrf.exec:\llffxrf.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\nbnntn.exec:\nbnntn.exe41⤵
- Executes dropped EXE
PID:904 -
\??\c:\pjvjv.exec:\pjvjv.exe42⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe43⤵
- Executes dropped EXE
PID:1724 -
\??\c:\tnbtbb.exec:\tnbtbb.exe44⤵
- Executes dropped EXE
PID:1684 -
\??\c:\hbhhnt.exec:\hbhhnt.exe45⤵
- Executes dropped EXE
PID:1396 -
\??\c:\djpvd.exec:\djpvd.exe46⤵
- Executes dropped EXE
PID:1780 -
\??\c:\9lxrxff.exec:\9lxrxff.exe47⤵
- Executes dropped EXE
PID:2536 -
\??\c:\tthtbh.exec:\tthtbh.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\9dpdj.exec:\9dpdj.exe49⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe50⤵
- Executes dropped EXE
PID:2988 -
\??\c:\frlrxfr.exec:\frlrxfr.exe51⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hbnbtt.exec:\hbnbtt.exe52⤵
- Executes dropped EXE
PID:2364 -
\??\c:\3bttbt.exec:\3bttbt.exe53⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vpjjv.exec:\vpjjv.exe54⤵
- Executes dropped EXE
PID:1132 -
\??\c:\1xflrrr.exec:\1xflrrr.exe55⤵
- Executes dropped EXE
PID:1216 -
\??\c:\hbttbb.exec:\hbttbb.exe56⤵
- Executes dropped EXE
PID:2240 -
\??\c:\bthnbt.exec:\bthnbt.exe57⤵
- Executes dropped EXE
PID:2864 -
\??\c:\pdjdj.exec:\pdjdj.exe58⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lflrxxf.exec:\lflrxxf.exe59⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe60⤵
- Executes dropped EXE
PID:2016 -
\??\c:\bbnthh.exec:\bbnthh.exe61⤵
- Executes dropped EXE
PID:1972 -
\??\c:\7bnbtt.exec:\7bnbtt.exe62⤵
- Executes dropped EXE
PID:1996 -
\??\c:\vpdjd.exec:\vpdjd.exe63⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5lxllll.exec:\5lxllll.exe64⤵
- Executes dropped EXE
PID:2112 -
\??\c:\lxllrrf.exec:\lxllrrf.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hhtnbb.exec:\hhtnbb.exe66⤵PID:2072
-
\??\c:\hthhtt.exec:\hthhtt.exe67⤵PID:1600
-
\??\c:\3dddj.exec:\3dddj.exe68⤵PID:2264
-
\??\c:\xlrrxxl.exec:\xlrrxxl.exe69⤵PID:2672
-
\??\c:\5xrrxxl.exec:\5xrrxxl.exe70⤵PID:2636
-
\??\c:\tntnbt.exec:\tntnbt.exe71⤵PID:2804
-
\??\c:\bhnbhh.exec:\bhnbhh.exe72⤵PID:3060
-
\??\c:\vpjjv.exec:\vpjjv.exe73⤵PID:2560
-
\??\c:\3rrrffr.exec:\3rrrffr.exe74⤵PID:2584
-
\??\c:\lxllrxf.exec:\lxllrxf.exe75⤵PID:2216
-
\??\c:\7nbthb.exec:\7nbthb.exe76⤵PID:2712
-
\??\c:\bbhthh.exec:\bbhthh.exe77⤵PID:2580
-
\??\c:\dvjjv.exec:\dvjjv.exe78⤵PID:2380
-
\??\c:\jvvvd.exec:\jvvvd.exe79⤵PID:316
-
\??\c:\xrfxrll.exec:\xrfxrll.exe80⤵PID:2004
-
\??\c:\9nhtnt.exec:\9nhtnt.exe81⤵PID:2452
-
\??\c:\bnbtbb.exec:\bnbtbb.exe82⤵PID:2840
-
\??\c:\jdpjp.exec:\jdpjp.exe83⤵PID:3020
-
\??\c:\1rrxxfl.exec:\1rrxxfl.exe84⤵PID:1784
-
\??\c:\7lrlrrr.exec:\7lrlrrr.exe85⤵PID:2348
-
\??\c:\hhthbh.exec:\hhthbh.exe86⤵PID:1048
-
\??\c:\bnnnth.exec:\bnnnth.exe87⤵PID:2292
-
\??\c:\vjdvv.exec:\vjdvv.exe88⤵PID:1760
-
\??\c:\jvdpv.exec:\jvdpv.exe89⤵PID:2844
-
\??\c:\3xlfffl.exec:\3xlfffl.exe90⤵PID:1944
-
\??\c:\rlrrxxl.exec:\rlrrxxl.exe91⤵PID:2872
-
\??\c:\thttbt.exec:\thttbt.exe92⤵PID:2364
-
\??\c:\hbhhhh.exec:\hbhhhh.exe93⤵PID:2168
-
\??\c:\dvddj.exec:\dvddj.exe94⤵PID:2992
-
\??\c:\fxffffl.exec:\fxffffl.exe95⤵PID:2396
-
\??\c:\xrlrxxr.exec:\xrlrxxr.exe96⤵PID:1216
-
\??\c:\nbhbhh.exec:\nbhbhh.exe97⤵PID:1144
-
\??\c:\thtbtn.exec:\thtbtn.exe98⤵PID:2932
-
\??\c:\9dddd.exec:\9dddd.exe99⤵PID:2772
-
\??\c:\jpvdd.exec:\jpvdd.exe100⤵PID:1932
-
\??\c:\rfrlrfl.exec:\rfrlrfl.exe101⤵PID:1740
-
\??\c:\xxlfllx.exec:\xxlfllx.exe102⤵PID:2540
-
\??\c:\bthtnn.exec:\bthtnn.exe103⤵PID:2432
-
\??\c:\vpdjv.exec:\vpdjv.exe104⤵PID:1348
-
\??\c:\pdvdd.exec:\pdvdd.exe105⤵PID:2284
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe106⤵PID:2128
-
\??\c:\fxfllrx.exec:\fxfllrx.exe107⤵PID:1700
-
\??\c:\7thnnn.exec:\7thnnn.exe108⤵PID:1600
-
\??\c:\nnbbhh.exec:\nnbbhh.exe109⤵PID:2700
-
\??\c:\vvpvj.exec:\vvpvj.exe110⤵PID:2672
-
\??\c:\7dddp.exec:\7dddp.exe111⤵PID:2636
-
\??\c:\7rxxffl.exec:\7rxxffl.exe112⤵PID:2824
-
\??\c:\1lxfrrx.exec:\1lxfrrx.exe113⤵PID:2716
-
\??\c:\3httnh.exec:\3httnh.exe114⤵PID:2680
-
\??\c:\7jjjd.exec:\7jjjd.exe115⤵PID:552
-
\??\c:\vvjjd.exec:\vvjjd.exe116⤵PID:2684
-
\??\c:\3xlfrrf.exec:\3xlfrrf.exe117⤵PID:2656
-
\??\c:\7xlxxfr.exec:\7xlxxfr.exe118⤵PID:3004
-
\??\c:\tnhhtt.exec:\tnhhtt.exe119⤵PID:2276
-
\??\c:\hbnnnn.exec:\hbnnnn.exe120⤵PID:596
-
\??\c:\vpvpv.exec:\vpvpv.exe121⤵PID:1336
-
\??\c:\7dvdd.exec:\7dvdd.exe122⤵PID:1724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-