Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 13:58
Static task
static1
Behavioral task
behavioral1
Sample
54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe
Resource
win7-20240903-en
General
-
Target
54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe
-
Size
93KB
-
MD5
c7a144a473cf69e5981399ffbec26cb0
-
SHA1
6c1f27e22f1f22683e0d1aa78b6f96e517d6813a
-
SHA256
54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079
-
SHA512
ac2a31e0fa4145390e8a25c3fddea55cea92962bd3b57b0a7803d4469621ac7cc677d8bca45a6858c46df821f789f64db16afb6ff6671520b8b3a74b5148119c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIQIDyviFxx2hCtgIMLP9rBZaRBQ:ymb3NkkiQ3mdBjFIVLd2hWZGreRCYBVa
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/1716-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2628-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/592-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3024-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1736-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1828-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/852-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1876-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2452-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/892-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2188 vvjdp.exe 2656 9lflrxf.exe 2628 7tnbnn.exe 2804 vvdjd.exe 2800 bnhhtn.exe 2532 hhbtnn.exe 2180 9vjpv.exe 592 3lrlllr.exe 1108 7httnn.exe 844 dvjdj.exe 2888 rllxxfl.exe 3024 3fflflx.exe 2752 btbbhn.exe 2340 dvdpj.exe 2744 rflrxfr.exe 1736 9lxrfll.exe 1828 thnnnn.exe 852 dpddp.exe 2316 lffrlfr.exe 2088 3xfxllr.exe 2164 tnhhnb.exe 2932 pjvdp.exe 1876 lxflflr.exe 2360 rlxfllr.exe 812 bbthht.exe 916 dvdjv.exe 1320 lxfffrx.exe 2452 lffxflx.exe 2344 5tttbb.exe 892 1jvvv.exe 2692 vpdjp.exe 2712 rxlfrrf.exe 1612 bhnttn.exe 2624 hbtnbb.exe 2816 jvvdj.exe 2232 7jdjv.exe 2896 xlrlllf.exe 2612 bbtnnn.exe 2800 bbthhn.exe 2496 dpddj.exe 2464 9vdpd.exe 1788 fxfxfff.exe 824 nhhtbb.exe 1484 bttttn.exe 868 dddjj.exe 2848 3frxfxf.exe 2972 9lflrrx.exe 3008 hbbtnt.exe 2768 bbhthb.exe 1752 7vpvd.exe 1248 rlxllfr.exe 1748 rlrxlrf.exe 2744 3hntbb.exe 2600 pdvjv.exe 1988 xfffrrx.exe 1980 lxllxxx.exe 2484 nhbhbh.exe 2104 jdpvv.exe 2204 jdddp.exe 2120 lxflxrl.exe 1760 htbnbb.exe 292 bthnhn.exe 2356 7vvdd.exe 1652 fxxfrlr.exe -
resource yara_rule behavioral1/memory/1716-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2628-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/844-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3024-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1736-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1828-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/852-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2360-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/892-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2188 1716 54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe 28 PID 1716 wrote to memory of 2188 1716 54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe 28 PID 1716 wrote to memory of 2188 1716 54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe 28 PID 1716 wrote to memory of 2188 1716 54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe 28 PID 2188 wrote to memory of 2656 2188 vvjdp.exe 29 PID 2188 wrote to memory of 2656 2188 vvjdp.exe 29 PID 2188 wrote to memory of 2656 2188 vvjdp.exe 29 PID 2188 wrote to memory of 2656 2188 vvjdp.exe 29 PID 2656 wrote to memory of 2628 2656 9lflrxf.exe 30 PID 2656 wrote to memory of 2628 2656 9lflrxf.exe 30 PID 2656 wrote to memory of 2628 2656 9lflrxf.exe 30 PID 2656 wrote to memory of 2628 2656 9lflrxf.exe 30 PID 2628 wrote to memory of 2804 2628 7tnbnn.exe 31 PID 2628 wrote to memory of 2804 2628 7tnbnn.exe 31 PID 2628 wrote to memory of 2804 2628 7tnbnn.exe 31 PID 2628 wrote to memory of 2804 2628 7tnbnn.exe 31 PID 2804 wrote to memory of 2800 2804 vvdjd.exe 32 PID 2804 wrote to memory of 2800 2804 vvdjd.exe 32 PID 2804 wrote to memory of 2800 2804 vvdjd.exe 32 PID 2804 wrote to memory of 2800 2804 vvdjd.exe 32 PID 2800 wrote to memory of 2532 2800 bnhhtn.exe 33 PID 2800 wrote to memory of 2532 2800 bnhhtn.exe 33 PID 2800 wrote to memory of 2532 2800 bnhhtn.exe 33 PID 2800 wrote to memory of 2532 2800 bnhhtn.exe 33 PID 2532 wrote to memory of 2180 2532 hhbtnn.exe 34 PID 2532 wrote to memory of 2180 2532 hhbtnn.exe 34 PID 2532 wrote to memory of 2180 2532 hhbtnn.exe 34 PID 2532 wrote to memory of 2180 2532 hhbtnn.exe 34 PID 2180 wrote to memory of 592 2180 9vjpv.exe 35 PID 2180 wrote to memory of 592 2180 9vjpv.exe 35 PID 2180 wrote to memory of 592 2180 9vjpv.exe 35 PID 2180 wrote to memory of 592 2180 9vjpv.exe 35 PID 592 wrote to memory of 1108 592 3lrlllr.exe 36 PID 592 wrote to memory of 1108 592 3lrlllr.exe 36 PID 592 wrote to memory of 1108 592 3lrlllr.exe 36 PID 592 wrote to memory of 1108 592 3lrlllr.exe 36 PID 1108 wrote to memory of 844 1108 7httnn.exe 37 PID 1108 wrote to memory of 844 1108 7httnn.exe 37 PID 1108 wrote to memory of 844 1108 7httnn.exe 37 PID 1108 wrote to memory of 844 1108 7httnn.exe 37 PID 844 wrote to memory of 2888 844 dvjdj.exe 38 PID 844 wrote to memory of 2888 844 dvjdj.exe 38 PID 844 wrote to memory of 2888 844 dvjdj.exe 38 PID 844 wrote to memory of 2888 844 dvjdj.exe 38 PID 2888 wrote to memory of 3024 2888 rllxxfl.exe 39 PID 2888 wrote to memory of 3024 2888 rllxxfl.exe 39 PID 2888 wrote to memory of 3024 2888 rllxxfl.exe 39 PID 2888 wrote to memory of 3024 2888 rllxxfl.exe 39 PID 3024 wrote to memory of 2752 3024 3fflflx.exe 40 PID 3024 wrote to memory of 2752 3024 3fflflx.exe 40 PID 3024 wrote to memory of 2752 3024 3fflflx.exe 40 PID 3024 wrote to memory of 2752 3024 3fflflx.exe 40 PID 2752 wrote to memory of 2340 2752 btbbhn.exe 41 PID 2752 wrote to memory of 2340 2752 btbbhn.exe 41 PID 2752 wrote to memory of 2340 2752 btbbhn.exe 41 PID 2752 wrote to memory of 2340 2752 btbbhn.exe 41 PID 2340 wrote to memory of 2744 2340 dvdpj.exe 42 PID 2340 wrote to memory of 2744 2340 dvdpj.exe 42 PID 2340 wrote to memory of 2744 2340 dvdpj.exe 42 PID 2340 wrote to memory of 2744 2340 dvdpj.exe 42 PID 2744 wrote to memory of 1736 2744 rflrxfr.exe 43 PID 2744 wrote to memory of 1736 2744 rflrxfr.exe 43 PID 2744 wrote to memory of 1736 2744 rflrxfr.exe 43 PID 2744 wrote to memory of 1736 2744 rflrxfr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe"C:\Users\Admin\AppData\Local\Temp\54884db18fc2626d3651f24d882548c568426dbab9fe91ffba5d9ca69c5a9079N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\vvjdp.exec:\vvjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\9lflrxf.exec:\9lflrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\7tnbnn.exec:\7tnbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\vvdjd.exec:\vvdjd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\bnhhtn.exec:\bnhhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\hhbtnn.exec:\hhbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\9vjpv.exec:\9vjpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\3lrlllr.exec:\3lrlllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\7httnn.exec:\7httnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\dvjdj.exec:\dvjdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\rllxxfl.exec:\rllxxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\3fflflx.exec:\3fflflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\btbbhn.exec:\btbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\dvdpj.exec:\dvdpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\rflrxfr.exec:\rflrxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\9lxrfll.exec:\9lxrfll.exe17⤵
- Executes dropped EXE
PID:1736 -
\??\c:\thnnnn.exec:\thnnnn.exe18⤵
- Executes dropped EXE
PID:1828 -
\??\c:\dpddp.exec:\dpddp.exe19⤵
- Executes dropped EXE
PID:852 -
\??\c:\lffrlfr.exec:\lffrlfr.exe20⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3xfxllr.exec:\3xfxllr.exe21⤵
- Executes dropped EXE
PID:2088 -
\??\c:\tnhhnb.exec:\tnhhnb.exe22⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pjvdp.exec:\pjvdp.exe23⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lxflflr.exec:\lxflflr.exe24⤵
- Executes dropped EXE
PID:1876 -
\??\c:\rlxfllr.exec:\rlxfllr.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\bbthht.exec:\bbthht.exe26⤵
- Executes dropped EXE
PID:812 -
\??\c:\dvdjv.exec:\dvdjv.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\lxfffrx.exec:\lxfffrx.exe28⤵
- Executes dropped EXE
PID:1320 -
\??\c:\lffxflx.exec:\lffxflx.exe29⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5tttbb.exec:\5tttbb.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1jvvv.exec:\1jvvv.exe31⤵
- Executes dropped EXE
PID:892 -
\??\c:\vpdjp.exec:\vpdjp.exe32⤵
- Executes dropped EXE
PID:2692 -
\??\c:\rxlfrrf.exec:\rxlfrrf.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bhnttn.exec:\bhnttn.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\hbtnbb.exec:\hbtnbb.exe35⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jvvdj.exec:\jvvdj.exe36⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7jdjv.exec:\7jdjv.exe37⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xlrlllf.exec:\xlrlllf.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbtnnn.exec:\bbtnnn.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\bbthhn.exec:\bbthhn.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\dpddj.exec:\dpddj.exe41⤵
- Executes dropped EXE
PID:2496 -
\??\c:\9vdpd.exec:\9vdpd.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\fxfxfff.exec:\fxfxfff.exe43⤵
- Executes dropped EXE
PID:1788 -
\??\c:\nhhtbb.exec:\nhhtbb.exe44⤵
- Executes dropped EXE
PID:824 -
\??\c:\bttttn.exec:\bttttn.exe45⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dddjj.exec:\dddjj.exe46⤵
- Executes dropped EXE
PID:868 -
\??\c:\3frxfxf.exec:\3frxfxf.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9lflrrx.exec:\9lflrrx.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\hbbtnt.exec:\hbbtnt.exe49⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bbhthb.exec:\bbhthb.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7vpvd.exec:\7vpvd.exe51⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rlxllfr.exec:\rlxllfr.exe52⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\3hntbb.exec:\3hntbb.exe54⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pdvjv.exec:\pdvjv.exe55⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xfffrrx.exec:\xfffrrx.exe56⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lxllxxx.exec:\lxllxxx.exe57⤵
- Executes dropped EXE
PID:1980 -
\??\c:\nhbhbh.exec:\nhbhbh.exe58⤵
- Executes dropped EXE
PID:2484 -
\??\c:\jdpvv.exec:\jdpvv.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\jdddp.exec:\jdddp.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\lxflxrl.exec:\lxflxrl.exe61⤵
- Executes dropped EXE
PID:2120 -
\??\c:\htbnbb.exec:\htbnbb.exe62⤵
- Executes dropped EXE
PID:1760 -
\??\c:\bthnhn.exec:\bthnhn.exe63⤵
- Executes dropped EXE
PID:292 -
\??\c:\7vvdd.exec:\7vvdd.exe64⤵
- Executes dropped EXE
PID:2356 -
\??\c:\fxxfrlr.exec:\fxxfrlr.exe65⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9lxflff.exec:\9lxflff.exe66⤵PID:1292
-
\??\c:\7hhbhh.exec:\7hhbhh.exe67⤵PID:1052
-
\??\c:\tnntbt.exec:\tnntbt.exe68⤵PID:3044
-
\??\c:\pvvdp.exec:\pvvdp.exe69⤵PID:1320
-
\??\c:\pjpjj.exec:\pjpjj.exe70⤵PID:2320
-
\??\c:\lxflxrl.exec:\lxflxrl.exe71⤵PID:896
-
\??\c:\3rffllf.exec:\3rffllf.exe72⤵PID:3056
-
\??\c:\7bnnbh.exec:\7bnnbh.exe73⤵PID:2184
-
\??\c:\bnbnhn.exec:\bnbnhn.exe74⤵PID:1660
-
\??\c:\dpvdj.exec:\dpvdj.exe75⤵PID:2716
-
\??\c:\vvjvd.exec:\vvjvd.exe76⤵PID:2376
-
\??\c:\lfrlxll.exec:\lfrlxll.exe77⤵PID:2508
-
\??\c:\bthhtb.exec:\bthhtb.exe78⤵PID:2816
-
\??\c:\htbbhb.exec:\htbbhb.exe79⤵PID:2536
-
\??\c:\vdpvd.exec:\vdpvd.exe80⤵
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\jdjjp.exec:\jdjjp.exe81⤵PID:2556
-
\??\c:\1xrxxrl.exec:\1xrxxrl.exe82⤵PID:1684
-
\??\c:\hhhbth.exec:\hhhbth.exe83⤵PID:2496
-
\??\c:\hhbbnh.exec:\hhbbnh.exe84⤵PID:2464
-
\??\c:\dvvvp.exec:\dvvvp.exe85⤵PID:2412
-
\??\c:\vvvpp.exec:\vvvpp.exe86⤵PID:1496
-
\??\c:\5rffrlx.exec:\5rffrlx.exe87⤵PID:1488
-
\??\c:\nhbbnn.exec:\nhbbnn.exe88⤵
- System Location Discovery: System Language Discovery
PID:2864 -
\??\c:\thnnnt.exec:\thnnnt.exe89⤵PID:2856
-
\??\c:\jpvvp.exec:\jpvvp.exe90⤵PID:2756
-
\??\c:\dvdjv.exec:\dvdjv.exe91⤵PID:3028
-
\??\c:\1frlflr.exec:\1frlflr.exe92⤵PID:2768
-
\??\c:\1htbhn.exec:\1htbhn.exe93⤵PID:2328
-
\??\c:\tnbhnn.exec:\tnbhnn.exe94⤵PID:1700
-
\??\c:\7jjdp.exec:\7jjdp.exe95⤵PID:2740
-
\??\c:\5pppv.exec:\5pppv.exe96⤵PID:2744
-
\??\c:\xlxxfll.exec:\xlxxfll.exe97⤵PID:2264
-
\??\c:\bnhtht.exec:\bnhtht.exe98⤵PID:2020
-
\??\c:\3tnthh.exec:\3tnthh.exe99⤵PID:2000
-
\??\c:\jdvvd.exec:\jdvvd.exe100⤵PID:2484
-
\??\c:\rlllllr.exec:\rlllllr.exe101⤵PID:2068
-
\??\c:\xlxfrfl.exec:\xlxfrfl.exe102⤵PID:2196
-
\??\c:\nnhhhn.exec:\nnhhhn.exe103⤵PID:2936
-
\??\c:\ddvvd.exec:\ddvvd.exe104⤵PID:1144
-
\??\c:\djjvp.exec:\djjvp.exe105⤵PID:2076
-
\??\c:\rllrxxr.exec:\rllrxxr.exe106⤵PID:2356
-
\??\c:\7rllllx.exec:\7rllllx.exe107⤵PID:2384
-
\??\c:\thnbnh.exec:\thnbnh.exe108⤵PID:812
-
\??\c:\tnnntt.exec:\tnnntt.exe109⤵PID:2448
-
\??\c:\9thbnt.exec:\9thbnt.exe110⤵PID:3044
-
\??\c:\dpppp.exec:\dpppp.exe111⤵PID:2976
-
\??\c:\jdpvp.exec:\jdpvp.exe112⤵PID:1768
-
\??\c:\5lxxfxf.exec:\5lxxfxf.exe113⤵PID:1972
-
\??\c:\xrrxfxf.exec:\xrrxfxf.exe114⤵PID:2324
-
\??\c:\tntbhb.exec:\tntbhb.exe115⤵PID:2184
-
\??\c:\hbbhnb.exec:\hbbhnb.exe116⤵PID:1344
-
\??\c:\dvvdd.exec:\dvvdd.exe117⤵PID:2712
-
\??\c:\pppvp.exec:\pppvp.exe118⤵PID:2072
-
\??\c:\rllfrll.exec:\rllfrll.exe119⤵PID:2528
-
\??\c:\5xlrxrf.exec:\5xlrxrf.exe120⤵PID:2788
-
\??\c:\7bttbb.exec:\7bttbb.exe121⤵PID:2232
-
\??\c:\nnntth.exec:\nnntth.exe122⤵PID:2548
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-