Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 20:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84be26eeb57dd53776219f43b7378930N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
84be26eeb57dd53776219f43b7378930N.exe
-
Size
84KB
-
MD5
84be26eeb57dd53776219f43b7378930
-
SHA1
e56d1dc33dd5b06dea1c3a8db4b1365e882acf9d
-
SHA256
3643cb9269274ab909405dc59faa53a8a1b7a85b428f43f7e50d9978444db9f1
-
SHA512
29db0eb45a65117bd2b9ac1e243540bc83fc1d0e8b4918b2edcccc8470274464924eb322ddeff2304a392ab34e69757b1588c386656ce08e1b0cfb564870b18c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIEgxdaqXU63hZ7Cpw2OzgdNAx2K:ymb3NkkiQ3mdBjFIEgSqtRZ7N2OMdN0b
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2088-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1220-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/284-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1660-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2192-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2344-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2556 1nbbhh.exe 2228 btnbth.exe 2820 ppvdv.exe 2744 dvjjv.exe 2344 7ffxffl.exe 2656 tnhhnt.exe 2636 hhtbnn.exe 1640 ddjvv.exe 2280 ffxrlrf.exe 2420 lffrxlr.exe 2532 7hhnbt.exe 2968 7hhhtt.exe 2920 jjdjv.exe 2960 pjvvd.exe 3036 lfxlxxf.exe 2212 frxxffl.exe 1960 btnbtb.exe 2460 btbbnh.exe 2908 pjjjv.exe 2172 jdvdj.exe 2192 dvjdj.exe 1660 fxllrlr.exe 284 lfrlffr.exe 1496 3bnttb.exe 2428 tntbht.exe 1896 9jppd.exe 2384 pjjjp.exe 1020 frxllfl.exe 1220 xxlrflr.exe 2700 bthtnt.exe 2088 bbhbhn.exe 2812 nhtthb.exe 2828 jvjpv.exe 2836 pjvdj.exe 2664 7frllrr.exe 2632 xlrrfrx.exe 652 xfflrxx.exe 2636 tnbntt.exe 1640 nbtttt.exe 2280 pjpdj.exe 1212 vjppd.exe 3012 lflfrrr.exe 3004 9fllxxf.exe 2300 xlxrxxf.exe 2996 3btnhh.exe 3028 hbhnth.exe 2084 5dpvd.exe 1952 5pvdj.exe 2724 1jvvd.exe 1228 flrfxll.exe 2460 3lrxfxf.exe 2440 7rllxfr.exe 2156 3tntbb.exe 2172 tnbhtn.exe 2168 3ppjp.exe 1244 vjvdp.exe 1092 pdjjd.exe 2308 9flfxff.exe 1692 htbhhh.exe 2276 vpjpv.exe 1896 jdjpj.exe 2056 7vpjv.exe 1480 1rfrrxl.exe 2324 flrxrxf.exe -
resource yara_rule behavioral1/memory/1640-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2088-312-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1220-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/284-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2192-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1960-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2280-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2344-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2556 1108 84be26eeb57dd53776219f43b7378930N.exe 30 PID 1108 wrote to memory of 2556 1108 84be26eeb57dd53776219f43b7378930N.exe 30 PID 1108 wrote to memory of 2556 1108 84be26eeb57dd53776219f43b7378930N.exe 30 PID 1108 wrote to memory of 2556 1108 84be26eeb57dd53776219f43b7378930N.exe 30 PID 2556 wrote to memory of 2228 2556 1nbbhh.exe 31 PID 2556 wrote to memory of 2228 2556 1nbbhh.exe 31 PID 2556 wrote to memory of 2228 2556 1nbbhh.exe 31 PID 2556 wrote to memory of 2228 2556 1nbbhh.exe 31 PID 2228 wrote to memory of 2820 2228 btnbth.exe 32 PID 2228 wrote to memory of 2820 2228 btnbth.exe 32 PID 2228 wrote to memory of 2820 2228 btnbth.exe 32 PID 2228 wrote to memory of 2820 2228 btnbth.exe 32 PID 2820 wrote to memory of 2744 2820 ppvdv.exe 33 PID 2820 wrote to memory of 2744 2820 ppvdv.exe 33 PID 2820 wrote to memory of 2744 2820 ppvdv.exe 33 PID 2820 wrote to memory of 2744 2820 ppvdv.exe 33 PID 2744 wrote to memory of 2344 2744 dvjjv.exe 34 PID 2744 wrote to memory of 2344 2744 dvjjv.exe 34 PID 2744 wrote to memory of 2344 2744 dvjjv.exe 34 PID 2744 wrote to memory of 2344 2744 dvjjv.exe 34 PID 2344 wrote to memory of 2656 2344 7ffxffl.exe 35 PID 2344 wrote to memory of 2656 2344 7ffxffl.exe 35 PID 2344 wrote to memory of 2656 2344 7ffxffl.exe 35 PID 2344 wrote to memory of 2656 2344 7ffxffl.exe 35 PID 2656 wrote to memory of 2636 2656 tnhhnt.exe 36 PID 2656 wrote to memory of 2636 2656 tnhhnt.exe 36 PID 2656 wrote to memory of 2636 2656 tnhhnt.exe 36 PID 2656 wrote to memory of 2636 2656 tnhhnt.exe 36 PID 2636 wrote to memory of 1640 2636 hhtbnn.exe 37 PID 2636 wrote to memory of 1640 2636 hhtbnn.exe 37 PID 2636 wrote to memory of 1640 2636 hhtbnn.exe 37 PID 2636 wrote to memory of 1640 2636 hhtbnn.exe 37 PID 1640 wrote to memory of 2280 1640 ddjvv.exe 38 PID 1640 wrote to memory of 2280 1640 ddjvv.exe 38 PID 1640 wrote to memory of 2280 1640 ddjvv.exe 38 PID 1640 wrote to memory of 2280 1640 ddjvv.exe 38 PID 2280 wrote to memory of 2420 2280 ffxrlrf.exe 39 PID 2280 wrote to memory of 2420 2280 ffxrlrf.exe 39 PID 2280 wrote to memory of 2420 2280 ffxrlrf.exe 39 PID 2280 wrote to memory of 2420 2280 ffxrlrf.exe 39 PID 2420 wrote to memory of 2532 2420 lffrxlr.exe 40 PID 2420 wrote to memory of 2532 2420 lffrxlr.exe 40 PID 2420 wrote to memory of 2532 2420 lffrxlr.exe 40 PID 2420 wrote to memory of 2532 2420 lffrxlr.exe 40 PID 2532 wrote to memory of 2968 2532 7hhnbt.exe 309 PID 2532 wrote to memory of 2968 2532 7hhnbt.exe 309 PID 2532 wrote to memory of 2968 2532 7hhnbt.exe 309 PID 2532 wrote to memory of 2968 2532 7hhnbt.exe 309 PID 2968 wrote to memory of 2920 2968 7hhhtt.exe 42 PID 2968 wrote to memory of 2920 2968 7hhhtt.exe 42 PID 2968 wrote to memory of 2920 2968 7hhhtt.exe 42 PID 2968 wrote to memory of 2920 2968 7hhhtt.exe 42 PID 2920 wrote to memory of 2960 2920 jjdjv.exe 43 PID 2920 wrote to memory of 2960 2920 jjdjv.exe 43 PID 2920 wrote to memory of 2960 2920 jjdjv.exe 43 PID 2920 wrote to memory of 2960 2920 jjdjv.exe 43 PID 2960 wrote to memory of 3036 2960 pjvvd.exe 44 PID 2960 wrote to memory of 3036 2960 pjvvd.exe 44 PID 2960 wrote to memory of 3036 2960 pjvvd.exe 44 PID 2960 wrote to memory of 3036 2960 pjvvd.exe 44 PID 3036 wrote to memory of 2212 3036 lfxlxxf.exe 45 PID 3036 wrote to memory of 2212 3036 lfxlxxf.exe 45 PID 3036 wrote to memory of 2212 3036 lfxlxxf.exe 45 PID 3036 wrote to memory of 2212 3036 lfxlxxf.exe 45
Processes
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2ec1⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\84be26eeb57dd53776219f43b7378930N.exe"C:\Users\Admin\AppData\Local\Temp\84be26eeb57dd53776219f43b7378930N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\1nbbhh.exec:\1nbbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\btnbth.exec:\btnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ppvdv.exec:\ppvdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvjjv.exec:\dvjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\7ffxffl.exec:\7ffxffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\tnhhnt.exec:\tnhhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\hhtbnn.exec:\hhtbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\ddjvv.exec:\ddjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\ffxrlrf.exec:\ffxrlrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\lffrxlr.exec:\lffrxlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\7hhnbt.exec:\7hhnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\7hhhtt.exec:\7hhhtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jjdjv.exec:\jjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lfxlxxf.exec:\lfxlxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\frxxffl.exec:\frxxffl.exe17⤵
- Executes dropped EXE
PID:2212 -
\??\c:\btnbtb.exec:\btnbtb.exe18⤵
- Executes dropped EXE
PID:1960 -
\??\c:\btbbnh.exec:\btbbnh.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\pjjjv.exec:\pjjjv.exe20⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jdvdj.exec:\jdvdj.exe21⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvjdj.exec:\dvjdj.exe22⤵
- Executes dropped EXE
PID:2192 -
\??\c:\fxllrlr.exec:\fxllrlr.exe23⤵
- Executes dropped EXE
PID:1660 -
\??\c:\lfrlffr.exec:\lfrlffr.exe24⤵
- Executes dropped EXE
PID:284 -
\??\c:\3bnttb.exec:\3bnttb.exe25⤵
- Executes dropped EXE
PID:1496 -
\??\c:\tntbht.exec:\tntbht.exe26⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9jppd.exec:\9jppd.exe27⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pjjjp.exec:\pjjjp.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\frxllfl.exec:\frxllfl.exe29⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xxlrflr.exec:\xxlrflr.exe30⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bthtnt.exec:\bthtnt.exe31⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbhbhn.exec:\bbhbhn.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nhtthb.exec:\nhtthb.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jvjpv.exec:\jvjpv.exe34⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pjvdj.exec:\pjvdj.exe35⤵
- Executes dropped EXE
PID:2836 -
\??\c:\7frllrr.exec:\7frllrr.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xlrrfrx.exec:\xlrrfrx.exe37⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xfflrxx.exec:\xfflrxx.exe38⤵
- Executes dropped EXE
PID:652 -
\??\c:\tnbntt.exec:\tnbntt.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\nbtttt.exec:\nbtttt.exe40⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pjpdj.exec:\pjpdj.exe41⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vjppd.exec:\vjppd.exe42⤵
- Executes dropped EXE
PID:1212 -
\??\c:\lflfrrr.exec:\lflfrrr.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9fllxxf.exec:\9fllxxf.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xlxrxxf.exec:\xlxrxxf.exe45⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3btnhh.exec:\3btnhh.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hbhnth.exec:\hbhnth.exe47⤵
- Executes dropped EXE
PID:3028 -
\??\c:\5dpvd.exec:\5dpvd.exe48⤵
- Executes dropped EXE
PID:2084 -
\??\c:\5pvdj.exec:\5pvdj.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1jvvd.exec:\1jvvd.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\flrfxll.exec:\flrfxll.exe51⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3lrxfxf.exec:\3lrxfxf.exe52⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7rllxfr.exec:\7rllxfr.exe53⤵
- Executes dropped EXE
PID:2440 -
\??\c:\3tntbb.exec:\3tntbb.exe54⤵
- Executes dropped EXE
PID:2156 -
\??\c:\tnbhtn.exec:\tnbhtn.exe55⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3ppjp.exec:\3ppjp.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vjvdp.exec:\vjvdp.exe57⤵
- Executes dropped EXE
PID:1244 -
\??\c:\pdjjd.exec:\pdjjd.exe58⤵
- Executes dropped EXE
PID:1092 -
\??\c:\9flfxff.exec:\9flfxff.exe59⤵
- Executes dropped EXE
PID:2308 -
\??\c:\htbhhh.exec:\htbhhh.exe60⤵
- Executes dropped EXE
PID:1692 -
\??\c:\vpjpv.exec:\vpjpv.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\jdjpj.exec:\jdjpj.exe62⤵
- Executes dropped EXE
PID:1896 -
\??\c:\7vpjv.exec:\7vpjv.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1rfrrxl.exec:\1rfrrxl.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\flrxrxf.exec:\flrxrxf.exe65⤵
- Executes dropped EXE
PID:2324 -
\??\c:\7bhhnt.exec:\7bhhnt.exe66⤵
- System Location Discovery: System Language Discovery
PID:2708 -
\??\c:\bnhnbt.exec:\bnhnbt.exe67⤵PID:1988
-
\??\c:\3pdpj.exec:\3pdpj.exe68⤵PID:2416
-
\??\c:\9dvvd.exec:\9dvvd.exe69⤵PID:2868
-
\??\c:\lflrlxx.exec:\lflrlxx.exe70⤵PID:2780
-
\??\c:\1lffllr.exec:\1lffllr.exe71⤵PID:1788
-
\??\c:\9btntt.exec:\9btntt.exe72⤵PID:1864
-
\??\c:\hbhbnh.exec:\hbhbnh.exe73⤵PID:2672
-
\??\c:\tnhttb.exec:\tnhttb.exe74⤵PID:2392
-
\??\c:\9vpjj.exec:\9vpjj.exe75⤵PID:2760
-
\??\c:\3pjjv.exec:\3pjjv.exe76⤵PID:1504
-
\??\c:\dpddd.exec:\dpddd.exe77⤵PID:2636
-
\??\c:\xlrrlll.exec:\xlrrlll.exe78⤵PID:2448
-
\??\c:\llfrrxr.exec:\llfrrxr.exe79⤵PID:944
-
\??\c:\frflxfx.exec:\frflxfx.exe80⤵PID:3024
-
\??\c:\tnntbh.exec:\tnntbh.exe81⤵PID:2892
-
\??\c:\9thnhh.exec:\9thnhh.exe82⤵PID:2684
-
\??\c:\dpddj.exec:\dpddj.exe83⤵PID:3004
-
\??\c:\ppddv.exec:\ppddv.exe84⤵PID:2300
-
\??\c:\pjvdp.exec:\pjvdp.exe85⤵PID:2996
-
\??\c:\lxxfflr.exec:\lxxfflr.exe86⤵PID:3028
-
\??\c:\fxlxllr.exec:\fxlxllr.exe87⤵PID:2084
-
\??\c:\rlxrffr.exec:\rlxrffr.exe88⤵PID:1100
-
\??\c:\tthnbb.exec:\tthnbb.exe89⤵PID:1960
-
\??\c:\5hthtb.exec:\5hthtb.exe90⤵PID:1940
-
\??\c:\nhtttb.exec:\nhtttb.exe91⤵PID:2404
-
\??\c:\vjpdj.exec:\vjpdj.exe92⤵PID:2092
-
\??\c:\jvdvd.exec:\jvdvd.exe93⤵PID:880
-
\??\c:\1djjp.exec:\1djjp.exe94⤵PID:2152
-
\??\c:\llrflfr.exec:\llrflfr.exe95⤵
- System Location Discovery: System Language Discovery
PID:2272 -
\??\c:\pjjjv.exec:\pjjjv.exe96⤵PID:856
-
\??\c:\vvjvp.exec:\vvjvp.exe97⤵
- System Location Discovery: System Language Discovery
PID:2436 -
\??\c:\rlrxffx.exec:\rlrxffx.exe98⤵PID:2768
-
\??\c:\lfllrrx.exec:\lfllrrx.exe99⤵
- System Location Discovery: System Language Discovery
PID:1048 -
\??\c:\rrlrxxf.exec:\rrlrxxf.exe100⤵PID:1796
-
\??\c:\ntbthb.exec:\ntbthb.exe101⤵
- System Location Discovery: System Language Discovery
PID:2464 -
\??\c:\nbhhnt.exec:\nbhhnt.exe102⤵PID:1224
-
\??\c:\hhnbnt.exec:\hhnbnt.exe103⤵PID:3060
-
\??\c:\dvjjd.exec:\dvjjd.exe104⤵PID:556
-
\??\c:\1vjjp.exec:\1vjjp.exe105⤵PID:824
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe106⤵PID:2844
-
\??\c:\1xllxlr.exec:\1xllxlr.exe107⤵PID:2816
-
\??\c:\7rffxrf.exec:\7rffxrf.exe108⤵PID:2852
-
\??\c:\hhbhtt.exec:\hhbhtt.exe109⤵PID:2128
-
\??\c:\thttbb.exec:\thttbb.exe110⤵PID:1580
-
\??\c:\1bbhbb.exec:\1bbhbb.exe111⤵PID:2344
-
\??\c:\3vdpv.exec:\3vdpv.exe112⤵PID:2656
-
\??\c:\vppvp.exec:\vppvp.exe113⤵PID:532
-
\??\c:\rfxfrrf.exec:\rfxfrrf.exe114⤵PID:2932
-
\??\c:\ffxffrl.exec:\ffxffrl.exe115⤵PID:2208
-
\??\c:\hbhtnn.exec:\hbhtnn.exe116⤵PID:1888
-
\??\c:\bthtnt.exec:\bthtnt.exe117⤵PID:1144
-
\??\c:\nbnnbb.exec:\nbnnbb.exe118⤵PID:2280
-
\??\c:\ddvjj.exec:\ddvjj.exe119⤵PID:1684
-
\??\c:\9dvjv.exec:\9dvjv.exe120⤵PID:1456
-
\??\c:\lflrfrx.exec:\lflrfrx.exe121⤵PID:2764
-
\??\c:\frlrxfr.exec:\frlrxfr.exe122⤵PID:2956
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-