Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 15:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe
-
Size
64KB
-
MD5
cde2bd634e51c3c47ed59327f93c2910
-
SHA1
e516d0c5bd87d74e6957268176e8d36f705cfd46
-
SHA256
bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9
-
SHA512
7c92e498f3c2dd22cd1a29c7dd678f86dfaf1b2754488c10e9000754e5b3cfeaa22d96c31789b518b1ceaf1f8c7a8966bf8d26b870370d8ad22642daaf5b7cd9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxi0:ymb3NkkiQ3mdBjF0y7kb9
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/2128-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2396-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1048-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/836-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1588-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2472-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/832-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2992 btnnbh.exe 2396 vpvdj.exe 2432 btnnhh.exe 2828 5nttht.exe 2800 jjvdj.exe 2240 fxlrxfr.exe 2552 3htthh.exe 1048 httbbt.exe 836 7jvdj.exe 2952 frxxfrx.exe 596 9hhnth.exe 1652 jdjjj.exe 2892 9pdjp.exe 1588 xlrrrrr.exe 2932 1fxrxrx.exe 2916 1nhntt.exe 2148 nbntbh.exe 2056 3vjjp.exe 2472 rlfrfrf.exe 832 rrrlxll.exe 2976 hbhhnt.exe 372 djpdv.exe 1648 1jdvj.exe 884 9lxxrrf.exe 1724 hbtbhh.exe 2476 3thnnh.exe 1012 vjjjj.exe 1420 xrlflrx.exe 1536 nhbtbb.exe 2408 hbbbhb.exe 1964 5djpv.exe 2660 7rxrxxx.exe 2824 rfxfrrf.exe 3004 nhbhnn.exe 2712 nhnthn.exe 2728 htnhtb.exe 2784 1dpjv.exe 2724 9pppd.exe 2624 lfrxxxf.exe 2116 rxrlrlx.exe 2132 nhbhnn.exe 2944 hbbthh.exe 2440 pdppp.exe 2928 pvvdv.exe 2864 vpvdp.exe 2808 rrlllxr.exe 2288 htbnnh.exe 1440 tnbhhh.exe 2912 vjjvv.exe 2932 jvjpv.exe 2508 3fxfllf.exe 1376 lfxfllf.exe 1548 3thnnn.exe 620 bntbbb.exe 1416 dvpvj.exe 1188 flrxlfl.exe 1300 1nbthn.exe 2520 ntthhb.exe 1660 pjvvd.exe 1432 dpddj.exe 884 xrfflrr.exe 1724 rlxrlfr.exe 560 1fxlllx.exe 2632 nhbbtb.exe -
resource yara_rule behavioral1/memory/2128-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2396-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2240-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1048-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/836-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1588-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2932-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2056-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2472-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/832-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-295-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tntbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 2992 2128 bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe 31 PID 2128 wrote to memory of 2992 2128 bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe 31 PID 2128 wrote to memory of 2992 2128 bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe 31 PID 2128 wrote to memory of 2992 2128 bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe 31 PID 2992 wrote to memory of 2396 2992 btnnbh.exe 32 PID 2992 wrote to memory of 2396 2992 btnnbh.exe 32 PID 2992 wrote to memory of 2396 2992 btnnbh.exe 32 PID 2992 wrote to memory of 2396 2992 btnnbh.exe 32 PID 2396 wrote to memory of 2432 2396 vpvdj.exe 33 PID 2396 wrote to memory of 2432 2396 vpvdj.exe 33 PID 2396 wrote to memory of 2432 2396 vpvdj.exe 33 PID 2396 wrote to memory of 2432 2396 vpvdj.exe 33 PID 2432 wrote to memory of 2828 2432 btnnhh.exe 34 PID 2432 wrote to memory of 2828 2432 btnnhh.exe 34 PID 2432 wrote to memory of 2828 2432 btnnhh.exe 34 PID 2432 wrote to memory of 2828 2432 btnnhh.exe 34 PID 2828 wrote to memory of 2800 2828 5nttht.exe 35 PID 2828 wrote to memory of 2800 2828 5nttht.exe 35 PID 2828 wrote to memory of 2800 2828 5nttht.exe 35 PID 2828 wrote to memory of 2800 2828 5nttht.exe 35 PID 2800 wrote to memory of 2240 2800 jjvdj.exe 36 PID 2800 wrote to memory of 2240 2800 jjvdj.exe 36 PID 2800 wrote to memory of 2240 2800 jjvdj.exe 36 PID 2800 wrote to memory of 2240 2800 jjvdj.exe 36 PID 2240 wrote to memory of 2552 2240 fxlrxfr.exe 37 PID 2240 wrote to memory of 2552 2240 fxlrxfr.exe 37 PID 2240 wrote to memory of 2552 2240 fxlrxfr.exe 37 PID 2240 wrote to memory of 2552 2240 fxlrxfr.exe 37 PID 2552 wrote to memory of 1048 2552 3htthh.exe 38 PID 2552 wrote to memory of 1048 2552 3htthh.exe 38 PID 2552 wrote to memory of 1048 2552 3htthh.exe 38 PID 2552 wrote to memory of 1048 2552 3htthh.exe 38 PID 1048 wrote to memory of 836 1048 httbbt.exe 39 PID 1048 wrote to memory of 836 1048 httbbt.exe 39 PID 1048 wrote to memory of 836 1048 httbbt.exe 39 PID 1048 wrote to memory of 836 1048 httbbt.exe 39 PID 836 wrote to memory of 2952 836 7jvdj.exe 40 PID 836 wrote to memory of 2952 836 7jvdj.exe 40 PID 836 wrote to memory of 2952 836 7jvdj.exe 40 PID 836 wrote to memory of 2952 836 7jvdj.exe 40 PID 2952 wrote to memory of 596 2952 frxxfrx.exe 41 PID 2952 wrote to memory of 596 2952 frxxfrx.exe 41 PID 2952 wrote to memory of 596 2952 frxxfrx.exe 41 PID 2952 wrote to memory of 596 2952 frxxfrx.exe 41 PID 596 wrote to memory of 1652 596 9hhnth.exe 42 PID 596 wrote to memory of 1652 596 9hhnth.exe 42 PID 596 wrote to memory of 1652 596 9hhnth.exe 42 PID 596 wrote to memory of 1652 596 9hhnth.exe 42 PID 1652 wrote to memory of 2892 1652 jdjjj.exe 43 PID 1652 wrote to memory of 2892 1652 jdjjj.exe 43 PID 1652 wrote to memory of 2892 1652 jdjjj.exe 43 PID 1652 wrote to memory of 2892 1652 jdjjj.exe 43 PID 2892 wrote to memory of 1588 2892 9pdjp.exe 44 PID 2892 wrote to memory of 1588 2892 9pdjp.exe 44 PID 2892 wrote to memory of 1588 2892 9pdjp.exe 44 PID 2892 wrote to memory of 1588 2892 9pdjp.exe 44 PID 1588 wrote to memory of 2932 1588 xlrrrrr.exe 45 PID 1588 wrote to memory of 2932 1588 xlrrrrr.exe 45 PID 1588 wrote to memory of 2932 1588 xlrrrrr.exe 45 PID 1588 wrote to memory of 2932 1588 xlrrrrr.exe 45 PID 2932 wrote to memory of 2916 2932 1fxrxrx.exe 46 PID 2932 wrote to memory of 2916 2932 1fxrxrx.exe 46 PID 2932 wrote to memory of 2916 2932 1fxrxrx.exe 46 PID 2932 wrote to memory of 2916 2932 1fxrxrx.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe"C:\Users\Admin\AppData\Local\Temp\bcef4755c32cbe9a8230f635647bd446411bcdaea038bdd73da5f6736ece18e9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\btnnbh.exec:\btnnbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\vpvdj.exec:\vpvdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\btnnhh.exec:\btnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\5nttht.exec:\5nttht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\jjvdj.exec:\jjvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\fxlrxfr.exec:\fxlrxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\3htthh.exec:\3htthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\httbbt.exec:\httbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\7jvdj.exec:\7jvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\frxxfrx.exec:\frxxfrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\9hhnth.exec:\9hhnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\jdjjj.exec:\jdjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\9pdjp.exec:\9pdjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\1fxrxrx.exec:\1fxrxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\1nhntt.exec:\1nhntt.exe17⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nbntbh.exec:\nbntbh.exe18⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3vjjp.exec:\3vjjp.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe20⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rrrlxll.exec:\rrrlxll.exe21⤵
- Executes dropped EXE
PID:832 -
\??\c:\hbhhnt.exec:\hbhhnt.exe22⤵
- Executes dropped EXE
PID:2976 -
\??\c:\djpdv.exec:\djpdv.exe23⤵
- Executes dropped EXE
PID:372 -
\??\c:\1jdvj.exec:\1jdvj.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\9lxxrrf.exec:\9lxxrrf.exe25⤵
- Executes dropped EXE
PID:884 -
\??\c:\hbtbhh.exec:\hbtbhh.exe26⤵
- Executes dropped EXE
PID:1724 -
\??\c:\3thnnh.exec:\3thnnh.exe27⤵
- Executes dropped EXE
PID:2476 -
\??\c:\vjjjj.exec:\vjjjj.exe28⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xrlflrx.exec:\xrlflrx.exe29⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nhbtbb.exec:\nhbtbb.exe30⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbbbhb.exec:\hbbbhb.exe31⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5djpv.exec:\5djpv.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\7rxrxxx.exec:\7rxrxxx.exe33⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rfxfrrf.exec:\rfxfrrf.exe34⤵
- Executes dropped EXE
PID:2824 -
\??\c:\nhbhnn.exec:\nhbhnn.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhnthn.exec:\nhnthn.exe36⤵
- Executes dropped EXE
PID:2712 -
\??\c:\htnhtb.exec:\htnhtb.exe37⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1dpjv.exec:\1dpjv.exe38⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9pppd.exec:\9pppd.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rxrlrlx.exec:\rxrlrlx.exe41⤵
- Executes dropped EXE
PID:2116 -
\??\c:\nhbhnn.exec:\nhbhnn.exe42⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hbbthh.exec:\hbbthh.exe43⤵
- Executes dropped EXE
PID:2944 -
\??\c:\pdppp.exec:\pdppp.exe44⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pvvdv.exec:\pvvdv.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vpvdp.exec:\vpvdp.exe46⤵
- Executes dropped EXE
PID:2864 -
\??\c:\rrlllxr.exec:\rrlllxr.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\htbnnh.exec:\htbnnh.exe48⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tnbhhh.exec:\tnbhhh.exe49⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vjjvv.exec:\vjjvv.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\jvjpv.exec:\jvjpv.exe51⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3fxfllf.exec:\3fxfllf.exe52⤵
- Executes dropped EXE
PID:2508 -
\??\c:\lfxfllf.exec:\lfxfllf.exe53⤵
- Executes dropped EXE
PID:1376 -
\??\c:\3thnnn.exec:\3thnnn.exe54⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bntbbb.exec:\bntbbb.exe55⤵
- Executes dropped EXE
PID:620 -
\??\c:\dvpvj.exec:\dvpvj.exe56⤵
- Executes dropped EXE
PID:1416 -
\??\c:\flrxlfl.exec:\flrxlfl.exe57⤵
- Executes dropped EXE
PID:1188 -
\??\c:\1nbthn.exec:\1nbthn.exe58⤵
- Executes dropped EXE
PID:1300 -
\??\c:\ntthhb.exec:\ntthhb.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\pjvvd.exec:\pjvvd.exe60⤵
- Executes dropped EXE
PID:1660 -
\??\c:\dpddj.exec:\dpddj.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\xrfflrr.exec:\xrfflrr.exe62⤵
- Executes dropped EXE
PID:884 -
\??\c:\rlxrlfr.exec:\rlxrlfr.exe63⤵
- Executes dropped EXE
PID:1724 -
\??\c:\1fxlllx.exec:\1fxlllx.exe64⤵
- Executes dropped EXE
PID:560 -
\??\c:\nhbbtb.exec:\nhbbtb.exe65⤵
- Executes dropped EXE
PID:2632 -
\??\c:\1hhnnt.exec:\1hhnnt.exe66⤵PID:2128
-
\??\c:\jdvdj.exec:\jdvdj.exe67⤵PID:1420
-
\??\c:\jvjdd.exec:\jvjdd.exe68⤵PID:1868
-
\??\c:\xrxfllr.exec:\xrxfllr.exe69⤵PID:2260
-
\??\c:\3nbhtb.exec:\3nbhtb.exe70⤵PID:2140
-
\??\c:\7ttnhh.exec:\7ttnhh.exe71⤵PID:1964
-
\??\c:\1ddpv.exec:\1ddpv.exe72⤵PID:2692
-
\??\c:\ddvjp.exec:\ddvjp.exe73⤵PID:2696
-
\??\c:\xllffxf.exec:\xllffxf.exe74⤵PID:3004
-
\??\c:\rflrxrf.exec:\rflrxrf.exe75⤵PID:2712
-
\??\c:\hhttbb.exec:\hhttbb.exe76⤵PID:2716
-
\??\c:\dpvdj.exec:\dpvdj.exe77⤵PID:2784
-
\??\c:\3dvjp.exec:\3dvjp.exe78⤵PID:2724
-
\??\c:\flrrxff.exec:\flrrxff.exe79⤵
- System Location Discovery: System Language Discovery
PID:2624 -
\??\c:\lfrflrf.exec:\lfrflrf.exe80⤵PID:2116
-
\??\c:\thtbtn.exec:\thtbtn.exe81⤵PID:2132
-
\??\c:\btnhtt.exec:\btnhtt.exe82⤵PID:236
-
\??\c:\jvjjp.exec:\jvjjp.exe83⤵PID:2876
-
\??\c:\dvjvd.exec:\dvjvd.exe84⤵PID:2804
-
\??\c:\lfrxxxf.exec:\lfrxxxf.exe85⤵PID:2084
-
\??\c:\xfxxxff.exec:\xfxxxff.exe86⤵PID:2896
-
\??\c:\btbhhh.exec:\btbhhh.exe87⤵PID:628
-
\??\c:\7btntt.exec:\7btntt.exe88⤵PID:1440
-
\??\c:\dvjjv.exec:\dvjjv.exe89⤵PID:2912
-
\??\c:\jvpvv.exec:\jvpvv.exe90⤵PID:2932
-
\??\c:\xxffrfx.exec:\xxffrfx.exe91⤵PID:2404
-
\??\c:\btbhtt.exec:\btbhtt.exe92⤵PID:1376
-
\??\c:\hbbntb.exec:\hbbntb.exe93⤵PID:1108
-
\??\c:\jvjdd.exec:\jvjdd.exe94⤵PID:648
-
\??\c:\pdjjj.exec:\pdjjj.exe95⤵PID:1416
-
\??\c:\9flfffr.exec:\9flfffr.exe96⤵PID:1188
-
\??\c:\rxrxrfx.exec:\rxrxrfx.exe97⤵PID:1300
-
\??\c:\nbhntt.exec:\nbhntt.exe98⤵PID:2520
-
\??\c:\9bnthn.exec:\9bnthn.exe99⤵PID:1660
-
\??\c:\vjvvj.exec:\vjvvj.exe100⤵PID:1432
-
\??\c:\dpvvj.exec:\dpvvj.exe101⤵PID:1880
-
\??\c:\pdjjj.exec:\pdjjj.exe102⤵PID:1052
-
\??\c:\7xffflr.exec:\7xffflr.exe103⤵PID:560
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe104⤵PID:2632
-
\??\c:\7ntnnh.exec:\7ntnnh.exe105⤵PID:2128
-
\??\c:\jdvdd.exec:\jdvdd.exe106⤵PID:1420
-
\??\c:\djppv.exec:\djppv.exe107⤵PID:2324
-
\??\c:\7lrlrlx.exec:\7lrlrlx.exe108⤵PID:2260
-
\??\c:\frxrrlr.exec:\frxrrlr.exe109⤵PID:2140
-
\??\c:\nbhhbt.exec:\nbhhbt.exe110⤵PID:2744
-
\??\c:\nhtttb.exec:\nhtttb.exe111⤵PID:2692
-
\??\c:\jddvv.exec:\jddvv.exe112⤵PID:2696
-
\??\c:\vdvdd.exec:\vdvdd.exe113⤵PID:2920
-
\??\c:\7rfrxrl.exec:\7rfrxrl.exe114⤵PID:2712
-
\??\c:\5lfxfxf.exec:\5lfxfxf.exe115⤵PID:2568
-
\??\c:\tnbhtn.exec:\tnbhtn.exe116⤵PID:2784
-
\??\c:\thntbt.exec:\thntbt.exe117⤵PID:1636
-
\??\c:\5nhtbh.exec:\5nhtbh.exe118⤵PID:2624
-
\??\c:\3jvvj.exec:\3jvvj.exe119⤵PID:2536
-
\??\c:\dvvvv.exec:\dvvvv.exe120⤵PID:2132
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe121⤵PID:2356
-
\??\c:\1xrfllx.exec:\1xrfllx.exe122⤵PID:2876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-