Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 19:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe
-
Size
70KB
-
MD5
9f396473219c27d0707da9b33f7f042f
-
SHA1
bfbf0477561f22032289aa342fc96812f7479064
-
SHA256
227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814
-
SHA512
e4789626adcd99857c95dd40706b571dbf91f85dca91502dd3025d633be29ac8ca7e692496358a48899470fabb66e7046b9bc536b4c8e47a1758fd75410be9a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBr9:ymb3NkkiQ3mdBjFIqsr9
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/1972-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1704-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1624-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1888-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2164-278-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1884-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2524 lfflxfl.exe 2020 tnnhtb.exe 2888 jpjjj.exe 2224 rfxflrx.exe 2724 btbhtb.exe 2692 pjvpv.exe 2604 llffrfl.exe 2616 thtbtb.exe 2644 jdpvd.exe 2156 1lfxllx.exe 2824 fxlrxxl.exe 1704 hbhhnn.exe 1848 1vpjj.exe 980 rrrxxlx.exe 1088 frfffxf.exe 1624 tnnntt.exe 2916 5bhtnt.exe 2836 vpdpv.exe 2664 lfrxllr.exe 3068 1hbntn.exe 352 nhtthn.exe 1664 jdvjj.exe 1656 rlxrxxf.exe 1888 1rlxflx.exe 768 hbhhbb.exe 2268 dvddp.exe 2164 pjjvd.exe 1740 3xlrrrx.exe 2076 nhtthn.exe 1884 vvdpd.exe 2328 pvjpp.exe 2352 7lfrrxr.exe 2020 ttnbnt.exe 1252 nhbnht.exe 2964 pjpjj.exe 2772 vjvpd.exe 2792 rlxxflx.exe 2892 rrlxlxl.exe 2700 7hbtbb.exe 2880 nthttb.exe 1960 jjjpv.exe 1808 vvvvd.exe 2240 xxlxrfl.exe 2644 btbhhh.exe 3064 vpjvj.exe 2636 5dpvd.exe 2848 lfrflrf.exe 780 frfrrrf.exe 1004 btbttb.exe 2184 ppjjp.exe 1088 dvddv.exe 2940 xlxflff.exe 2844 rlrrffl.exe 2752 hbtbht.exe 2140 5hhnth.exe 2664 ppddd.exe 1484 vvppd.exe 544 lfrxffr.exe 2500 3rxxrxf.exe 968 hhbbnn.exe 2900 nbnthh.exe 1380 1djpv.exe 2068 jjdjp.exe 3004 lfrxlrr.exe -
resource yara_rule behavioral1/memory/1972-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1972-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2224-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1704-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1624-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1888-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-278-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1884-305-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2524 1972 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 30 PID 1972 wrote to memory of 2524 1972 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 30 PID 1972 wrote to memory of 2524 1972 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 30 PID 1972 wrote to memory of 2524 1972 227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe 30 PID 2524 wrote to memory of 2020 2524 lfflxfl.exe 31 PID 2524 wrote to memory of 2020 2524 lfflxfl.exe 31 PID 2524 wrote to memory of 2020 2524 lfflxfl.exe 31 PID 2524 wrote to memory of 2020 2524 lfflxfl.exe 31 PID 2020 wrote to memory of 2888 2020 tnnhtb.exe 32 PID 2020 wrote to memory of 2888 2020 tnnhtb.exe 32 PID 2020 wrote to memory of 2888 2020 tnnhtb.exe 32 PID 2020 wrote to memory of 2888 2020 tnnhtb.exe 32 PID 2888 wrote to memory of 2224 2888 jpjjj.exe 33 PID 2888 wrote to memory of 2224 2888 jpjjj.exe 33 PID 2888 wrote to memory of 2224 2888 jpjjj.exe 33 PID 2888 wrote to memory of 2224 2888 jpjjj.exe 33 PID 2224 wrote to memory of 2724 2224 rfxflrx.exe 34 PID 2224 wrote to memory of 2724 2224 rfxflrx.exe 34 PID 2224 wrote to memory of 2724 2224 rfxflrx.exe 34 PID 2224 wrote to memory of 2724 2224 rfxflrx.exe 34 PID 2724 wrote to memory of 2692 2724 btbhtb.exe 35 PID 2724 wrote to memory of 2692 2724 btbhtb.exe 35 PID 2724 wrote to memory of 2692 2724 btbhtb.exe 35 PID 2724 wrote to memory of 2692 2724 btbhtb.exe 35 PID 2692 wrote to memory of 2604 2692 pjvpv.exe 36 PID 2692 wrote to memory of 2604 2692 pjvpv.exe 36 PID 2692 wrote to memory of 2604 2692 pjvpv.exe 36 PID 2692 wrote to memory of 2604 2692 pjvpv.exe 36 PID 2604 wrote to memory of 2616 2604 llffrfl.exe 37 PID 2604 wrote to memory of 2616 2604 llffrfl.exe 37 PID 2604 wrote to memory of 2616 2604 llffrfl.exe 37 PID 2604 wrote to memory of 2616 2604 llffrfl.exe 37 PID 2616 wrote to memory of 2644 2616 thtbtb.exe 38 PID 2616 wrote to memory of 2644 2616 thtbtb.exe 38 PID 2616 wrote to memory of 2644 2616 thtbtb.exe 38 PID 2616 wrote to memory of 2644 2616 thtbtb.exe 38 PID 2644 wrote to memory of 2156 2644 jdpvd.exe 39 PID 2644 wrote to memory of 2156 2644 jdpvd.exe 39 PID 2644 wrote to memory of 2156 2644 jdpvd.exe 39 PID 2644 wrote to memory of 2156 2644 jdpvd.exe 39 PID 2156 wrote to memory of 2824 2156 1lfxllx.exe 40 PID 2156 wrote to memory of 2824 2156 1lfxllx.exe 40 PID 2156 wrote to memory of 2824 2156 1lfxllx.exe 40 PID 2156 wrote to memory of 2824 2156 1lfxllx.exe 40 PID 2824 wrote to memory of 1704 2824 fxlrxxl.exe 41 PID 2824 wrote to memory of 1704 2824 fxlrxxl.exe 41 PID 2824 wrote to memory of 1704 2824 fxlrxxl.exe 41 PID 2824 wrote to memory of 1704 2824 fxlrxxl.exe 41 PID 1704 wrote to memory of 1848 1704 hbhhnn.exe 42 PID 1704 wrote to memory of 1848 1704 hbhhnn.exe 42 PID 1704 wrote to memory of 1848 1704 hbhhnn.exe 42 PID 1704 wrote to memory of 1848 1704 hbhhnn.exe 42 PID 1848 wrote to memory of 980 1848 1vpjj.exe 43 PID 1848 wrote to memory of 980 1848 1vpjj.exe 43 PID 1848 wrote to memory of 980 1848 1vpjj.exe 43 PID 1848 wrote to memory of 980 1848 1vpjj.exe 43 PID 980 wrote to memory of 1088 980 rrrxxlx.exe 44 PID 980 wrote to memory of 1088 980 rrrxxlx.exe 44 PID 980 wrote to memory of 1088 980 rrrxxlx.exe 44 PID 980 wrote to memory of 1088 980 rrrxxlx.exe 44 PID 1088 wrote to memory of 1624 1088 frfffxf.exe 45 PID 1088 wrote to memory of 1624 1088 frfffxf.exe 45 PID 1088 wrote to memory of 1624 1088 frfffxf.exe 45 PID 1088 wrote to memory of 1624 1088 frfffxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe"C:\Users\Admin\AppData\Local\Temp\227ea0cb39c0026144cc0b82ddc9b9b754c339d11f4a8dbb0b85c6aa06673814.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\lfflxfl.exec:\lfflxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\tnnhtb.exec:\tnnhtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\jpjjj.exec:\jpjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\rfxflrx.exec:\rfxflrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\btbhtb.exec:\btbhtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\pjvpv.exec:\pjvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\llffrfl.exec:\llffrfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\thtbtb.exec:\thtbtb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jdpvd.exec:\jdpvd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\1lfxllx.exec:\1lfxllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\fxlrxxl.exec:\fxlrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\hbhhnn.exec:\hbhhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\1vpjj.exec:\1vpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\rrrxxlx.exec:\rrrxxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\frfffxf.exec:\frfffxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\tnnntt.exec:\tnnntt.exe17⤵
- Executes dropped EXE
PID:1624 -
\??\c:\5bhtnt.exec:\5bhtnt.exe18⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vpdpv.exec:\vpdpv.exe19⤵
- Executes dropped EXE
PID:2836 -
\??\c:\lfrxllr.exec:\lfrxllr.exe20⤵
- Executes dropped EXE
PID:2664 -
\??\c:\1hbntn.exec:\1hbntn.exe21⤵
- Executes dropped EXE
PID:3068 -
\??\c:\nhtthn.exec:\nhtthn.exe22⤵
- Executes dropped EXE
PID:352 -
\??\c:\jdvjj.exec:\jdvjj.exe23⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe24⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1rlxflx.exec:\1rlxflx.exe25⤵
- Executes dropped EXE
PID:1888 -
\??\c:\hbhhbb.exec:\hbhhbb.exe26⤵
- Executes dropped EXE
PID:768 -
\??\c:\dvddp.exec:\dvddp.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pjjvd.exec:\pjjvd.exe28⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3xlrrrx.exec:\3xlrrrx.exe29⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhtthn.exec:\nhtthn.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vvdpd.exec:\vvdpd.exe31⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pvjpp.exec:\pvjpp.exe32⤵
- Executes dropped EXE
PID:2328 -
\??\c:\7lfrrxr.exec:\7lfrrxr.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ttnbnt.exec:\ttnbnt.exe34⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nhbnht.exec:\nhbnht.exe35⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pjpjj.exec:\pjpjj.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vjvpd.exec:\vjvpd.exe37⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxxflx.exec:\rlxxflx.exe38⤵
- Executes dropped EXE
PID:2792 -
\??\c:\rrlxlxl.exec:\rrlxlxl.exe39⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7hbtbb.exec:\7hbtbb.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nthttb.exec:\nthttb.exe41⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjjpv.exec:\jjjpv.exe42⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vvvvd.exec:\vvvvd.exe43⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xxlxrfl.exec:\xxlxrfl.exe44⤵
- Executes dropped EXE
PID:2240 -
\??\c:\btbhhh.exec:\btbhhh.exe45⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpjvj.exec:\vpjvj.exe46⤵
- Executes dropped EXE
PID:3064 -
\??\c:\5dpvd.exec:\5dpvd.exe47⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lfrflrf.exec:\lfrflrf.exe48⤵
- Executes dropped EXE
PID:2848 -
\??\c:\frfrrrf.exec:\frfrrrf.exe49⤵
- Executes dropped EXE
PID:780 -
\??\c:\btbttb.exec:\btbttb.exe50⤵
- Executes dropped EXE
PID:1004 -
\??\c:\ppjjp.exec:\ppjjp.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvddv.exec:\dvddv.exe52⤵
- Executes dropped EXE
PID:1088 -
\??\c:\xlxflff.exec:\xlxflff.exe53⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rlrrffl.exec:\rlrrffl.exe54⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbtbht.exec:\hbtbht.exe55⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5hhnth.exec:\5hhnth.exe56⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ppddd.exec:\ppddd.exe57⤵
- Executes dropped EXE
PID:2664 -
\??\c:\vvppd.exec:\vvppd.exe58⤵
- Executes dropped EXE
PID:1484 -
\??\c:\lfrxffr.exec:\lfrxffr.exe59⤵
- Executes dropped EXE
PID:544 -
\??\c:\3rxxrxf.exec:\3rxxrxf.exe60⤵
- Executes dropped EXE
PID:2500 -
\??\c:\hhbbnn.exec:\hhbbnn.exe61⤵
- Executes dropped EXE
PID:968 -
\??\c:\nbnthh.exec:\nbnthh.exe62⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1djpv.exec:\1djpv.exe63⤵
- Executes dropped EXE
PID:1380 -
\??\c:\jjdjp.exec:\jjdjp.exe64⤵
- Executes dropped EXE
PID:2068 -
\??\c:\lfrxlrr.exec:\lfrxlrr.exe65⤵
- Executes dropped EXE
PID:3004 -
\??\c:\llfxxxf.exec:\llfxxxf.exe66⤵PID:2268
-
\??\c:\3bnhtb.exec:\3bnhtb.exe67⤵PID:904
-
\??\c:\5hbthh.exec:\5hbthh.exe68⤵PID:2168
-
\??\c:\5vjvv.exec:\5vjvv.exe69⤵PID:2064
-
\??\c:\vpjjj.exec:\vpjjj.exe70⤵PID:2412
-
\??\c:\5fxlxfl.exec:\5fxlxfl.exe71⤵PID:2228
-
\??\c:\lfrffff.exec:\lfrffff.exe72⤵PID:2372
-
\??\c:\5bthnn.exec:\5bthnn.exe73⤵PID:2292
-
\??\c:\bbtbhn.exec:\bbtbhn.exe74⤵PID:2652
-
\??\c:\3djvv.exec:\3djvv.exe75⤵PID:2380
-
\??\c:\jjvpv.exec:\jjvpv.exe76⤵PID:2224
-
\??\c:\frlfllx.exec:\frlfllx.exe77⤵PID:1644
-
\??\c:\fxrxlll.exec:\fxrxlll.exe78⤵PID:2876
-
\??\c:\bbnthh.exec:\bbnthh.exe79⤵PID:2684
-
\??\c:\3vjvv.exec:\3vjvv.exe80⤵PID:2692
-
\??\c:\pjpvd.exec:\pjpvd.exe81⤵PID:2596
-
\??\c:\fxrxrrf.exec:\fxrxrrf.exe82⤵PID:2732
-
\??\c:\llfrxxl.exec:\llfrxxl.exe83⤵PID:3052
-
\??\c:\hbhhnt.exec:\hbhhnt.exe84⤵PID:676
-
\??\c:\vpdvd.exec:\vpdvd.exe85⤵PID:2276
-
\??\c:\dvdjv.exec:\dvdjv.exe86⤵PID:944
-
\??\c:\7rxrflx.exec:\7rxrflx.exe87⤵PID:1760
-
\??\c:\fxrxflx.exec:\fxrxflx.exe88⤵PID:1856
-
\??\c:\btnthn.exec:\btnthn.exe89⤵PID:772
-
\??\c:\hthbhh.exec:\hthbhh.exe90⤵PID:1036
-
\??\c:\jdppp.exec:\jdppp.exe91⤵PID:1152
-
\??\c:\7rxflxf.exec:\7rxflxf.exe92⤵PID:1796
-
\??\c:\9lrrflx.exec:\9lrrflx.exe93⤵PID:372
-
\??\c:\1tbnbb.exec:\1tbnbb.exe94⤵PID:2252
-
\??\c:\5tnhbt.exec:\5tnhbt.exe95⤵PID:2836
-
\??\c:\vpjvd.exec:\vpjvd.exe96⤵PID:2112
-
\??\c:\pvdjd.exec:\pvdjd.exe97⤵PID:2256
-
\??\c:\9lflrrf.exec:\9lflrrf.exe98⤵PID:444
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe99⤵PID:352
-
\??\c:\ttttbb.exec:\ttttbb.exe100⤵PID:1664
-
\??\c:\jdpvj.exec:\jdpvj.exe101⤵PID:612
-
\??\c:\vdppj.exec:\vdppj.exe102⤵PID:1008
-
\??\c:\rrlxllx.exec:\rrlxllx.exe103⤵PID:2092
-
\??\c:\tnbbbh.exec:\tnbbbh.exe104⤵PID:3008
-
\??\c:\btnhnn.exec:\btnhnn.exe105⤵PID:3012
-
\??\c:\vpjpp.exec:\vpjpp.exe106⤵PID:2268
-
\??\c:\3pddj.exec:\3pddj.exe107⤵PID:2428
-
\??\c:\rrxlrxl.exec:\rrxlrxl.exe108⤵PID:2416
-
\??\c:\ffrfrxl.exec:\ffrfrxl.exe109⤵PID:3036
-
\??\c:\hbbhtb.exec:\hbbhtb.exe110⤵PID:1884
-
\??\c:\nbntnn.exec:\nbntnn.exe111⤵PID:2328
-
\??\c:\1dppj.exec:\1dppj.exe112⤵PID:1584
-
\??\c:\7jjpv.exec:\7jjpv.exe113⤵PID:1956
-
\??\c:\3lrflxr.exec:\3lrflxr.exe114⤵
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\bbbthn.exec:\bbbthn.exe115⤵PID:2768
-
\??\c:\5djjv.exec:\5djjv.exe116⤵PID:2696
-
\??\c:\djdjd.exec:\djdjd.exe117⤵PID:2724
-
\??\c:\xxffrrl.exec:\xxffrrl.exe118⤵PID:2972
-
\??\c:\7hntnt.exec:\7hntnt.exe119⤵PID:2592
-
\??\c:\3nbbhh.exec:\3nbbhh.exe120⤵PID:2624
-
\??\c:\3vddv.exec:\3vddv.exe121⤵PID:2588
-
\??\c:\dvddj.exec:\dvddj.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-