Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-10-2024 23:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe
-
Size
50KB
-
MD5
d0055aaf2813796f4836cff3779a8fd7
-
SHA1
f118ac31aa6ebcc137f57579d4cca3535cef30d8
-
SHA256
7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659
-
SHA512
d3751189d8fb83831aaaa57604480031c540c1de25343d95d93dd58da5d28148f775960c3b0fbab3f62579b28c84127e61b47da97cf453fe0d7442cbaf1586d8
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvXB:0cdpeeBSHHMHLf9RyIKB
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
resource yara_rule behavioral1/memory/1152-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1812-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2704-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2780-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2648-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3068-114-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/844-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/844-123-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/2564-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-143-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1864-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-207-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/3060-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-301-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-416-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1440-422-0x0000000000270000-0x0000000000299000-memory.dmp family_blackmoon behavioral1/memory/1576-430-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/548-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-437-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2008-451-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2940-466-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-516-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1196-531-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1196-530-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2092-544-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1308-556-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2120-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-602-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1860-670-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1340-693-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1792-700-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1996-730-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/572-758-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/572-760-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-831-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2532-840-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/1812-881-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2884-893-0x0000000001B80000-0x0000000001BA9000-memory.dmp family_blackmoon behavioral1/memory/664-933-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 bbtbbh.exe 2536 dddpd.exe 1812 llflrxl.exe 2340 jvjvj.exe 2704 fflrffl.exe 2752 1lfxlfl.exe 2852 vpddp.exe 2780 1pvpv.exe 2712 7hhttn.exe 2648 3jvdj.exe 3068 jpjvj.exe 844 nnhbnb.exe 2564 5ththh.exe 1932 ppvvd.exe 1116 flrxffr.exe 1864 7btbtt.exe 1824 9vdjd.exe 2004 llxfrrx.exe 1780 llfrfxl.exe 2904 3bntbn.exe 2252 pjdjv.exe 1632 3llrflx.exe 1112 llrxllx.exe 3060 bbhbnt.exe 1392 ntbhtb.exe 2436 pvjjj.exe 2464 lxlrflx.exe 2092 3nnthn.exe 1700 3dddp.exe 1620 lxfrrlr.exe 2532 3fffllr.exe 2504 dvjpv.exe 2528 ppdpv.exe 2380 ffrrrxl.exe 1688 nnnnnb.exe 2820 9vdpd.exe 2740 9jpvj.exe 2756 xlflrxr.exe 2832 9vvvd.exe 2928 vvvjd.exe 2796 rxfrlfr.exe 2736 xflxflr.exe 2592 tbhhnt.exe 2664 ppjpp.exe 2768 jjvdj.exe 1860 9ffxflx.exe 556 llflxxl.exe 1816 ttnbbb.exe 2360 9jpdv.exe 1440 5jvdj.exe 1576 lrllfll.exe 548 1btbbb.exe 1044 hthnbb.exe 2008 vdppd.exe 1996 7lflxxf.exe 2940 htbhhn.exe 2280 ttbhtb.exe 2236 ppjpv.exe 2244 fxllllx.exe 1904 frxxflx.exe 2456 ntnthb.exe 2916 jvjpd.exe 1804 pjppv.exe 2460 lrrllxf.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xlffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1152 wrote to memory of 2160 1152 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 30 PID 1152 wrote to memory of 2160 1152 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 30 PID 1152 wrote to memory of 2160 1152 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 30 PID 1152 wrote to memory of 2160 1152 7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe 30 PID 2160 wrote to memory of 2536 2160 bbtbbh.exe 31 PID 2160 wrote to memory of 2536 2160 bbtbbh.exe 31 PID 2160 wrote to memory of 2536 2160 bbtbbh.exe 31 PID 2160 wrote to memory of 2536 2160 bbtbbh.exe 31 PID 2536 wrote to memory of 1812 2536 dddpd.exe 32 PID 2536 wrote to memory of 1812 2536 dddpd.exe 32 PID 2536 wrote to memory of 1812 2536 dddpd.exe 32 PID 2536 wrote to memory of 1812 2536 dddpd.exe 32 PID 1812 wrote to memory of 2340 1812 llflrxl.exe 33 PID 1812 wrote to memory of 2340 1812 llflrxl.exe 33 PID 1812 wrote to memory of 2340 1812 llflrxl.exe 33 PID 1812 wrote to memory of 2340 1812 llflrxl.exe 33 PID 2340 wrote to memory of 2704 2340 jvjvj.exe 34 PID 2340 wrote to memory of 2704 2340 jvjvj.exe 34 PID 2340 wrote to memory of 2704 2340 jvjvj.exe 34 PID 2340 wrote to memory of 2704 2340 jvjvj.exe 34 PID 2704 wrote to memory of 2752 2704 fflrffl.exe 35 PID 2704 wrote to memory of 2752 2704 fflrffl.exe 35 PID 2704 wrote to memory of 2752 2704 fflrffl.exe 35 PID 2704 wrote to memory of 2752 2704 fflrffl.exe 35 PID 2752 wrote to memory of 2852 2752 1lfxlfl.exe 36 PID 2752 wrote to memory of 2852 2752 1lfxlfl.exe 36 PID 2752 wrote to memory of 2852 2752 1lfxlfl.exe 36 PID 2752 wrote to memory of 2852 2752 1lfxlfl.exe 36 PID 2852 wrote to memory of 2780 2852 vpddp.exe 37 PID 2852 wrote to memory of 2780 2852 vpddp.exe 37 PID 2852 wrote to memory of 2780 2852 vpddp.exe 37 PID 2852 wrote to memory of 2780 2852 vpddp.exe 37 PID 2780 wrote to memory of 2712 2780 1pvpv.exe 38 PID 2780 wrote to memory of 2712 2780 1pvpv.exe 38 PID 2780 wrote to memory of 2712 2780 1pvpv.exe 38 PID 2780 wrote to memory of 2712 2780 1pvpv.exe 38 PID 2712 wrote to memory of 2648 2712 7hhttn.exe 39 PID 2712 wrote to memory of 2648 2712 7hhttn.exe 39 PID 2712 wrote to memory of 2648 2712 7hhttn.exe 39 PID 2712 wrote to memory of 2648 2712 7hhttn.exe 39 PID 2648 wrote to memory of 3068 2648 3jvdj.exe 40 PID 2648 wrote to memory of 3068 2648 3jvdj.exe 40 PID 2648 wrote to memory of 3068 2648 3jvdj.exe 40 PID 2648 wrote to memory of 3068 2648 3jvdj.exe 40 PID 3068 wrote to memory of 844 3068 jpjvj.exe 41 PID 3068 wrote to memory of 844 3068 jpjvj.exe 41 PID 3068 wrote to memory of 844 3068 jpjvj.exe 41 PID 3068 wrote to memory of 844 3068 jpjvj.exe 41 PID 844 wrote to memory of 2564 844 nnhbnb.exe 42 PID 844 wrote to memory of 2564 844 nnhbnb.exe 42 PID 844 wrote to memory of 2564 844 nnhbnb.exe 42 PID 844 wrote to memory of 2564 844 nnhbnb.exe 42 PID 2564 wrote to memory of 1932 2564 5ththh.exe 43 PID 2564 wrote to memory of 1932 2564 5ththh.exe 43 PID 2564 wrote to memory of 1932 2564 5ththh.exe 43 PID 2564 wrote to memory of 1932 2564 5ththh.exe 43 PID 1932 wrote to memory of 1116 1932 ppvvd.exe 44 PID 1932 wrote to memory of 1116 1932 ppvvd.exe 44 PID 1932 wrote to memory of 1116 1932 ppvvd.exe 44 PID 1932 wrote to memory of 1116 1932 ppvvd.exe 44 PID 1116 wrote to memory of 1864 1116 flrxffr.exe 45 PID 1116 wrote to memory of 1864 1116 flrxffr.exe 45 PID 1116 wrote to memory of 1864 1116 flrxffr.exe 45 PID 1116 wrote to memory of 1864 1116 flrxffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe"C:\Users\Admin\AppData\Local\Temp\7135fa2f54b303f68dbda8225e1eda9f68b70a6dcfc765ff46b2a674ace05659.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\bbtbbh.exec:\bbtbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\dddpd.exec:\dddpd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\llflrxl.exec:\llflrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\jvjvj.exec:\jvjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\fflrffl.exec:\fflrffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1lfxlfl.exec:\1lfxlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\vpddp.exec:\vpddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1pvpv.exec:\1pvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\7hhttn.exec:\7hhttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\3jvdj.exec:\3jvdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\jpjvj.exec:\jpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nnhbnb.exec:\nnhbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\5ththh.exec:\5ththh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ppvvd.exec:\ppvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\flrxffr.exec:\flrxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\7btbtt.exec:\7btbtt.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9vdjd.exec:\9vdjd.exe18⤵
- Executes dropped EXE
PID:1824 -
\??\c:\llxfrrx.exec:\llxfrrx.exe19⤵
- Executes dropped EXE
PID:2004 -
\??\c:\llfrfxl.exec:\llfrfxl.exe20⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3bntbn.exec:\3bntbn.exe21⤵
- Executes dropped EXE
PID:2904 -
\??\c:\pjdjv.exec:\pjdjv.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3llrflx.exec:\3llrflx.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\llrxllx.exec:\llrxllx.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\bbhbnt.exec:\bbhbnt.exe25⤵
- Executes dropped EXE
PID:3060 -
\??\c:\ntbhtb.exec:\ntbhtb.exe26⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pvjjj.exec:\pvjjj.exe27⤵
- Executes dropped EXE
PID:2436 -
\??\c:\lxlrflx.exec:\lxlrflx.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3nnthn.exec:\3nnthn.exe29⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3dddp.exec:\3dddp.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\lxfrrlr.exec:\lxfrrlr.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1620 -
\??\c:\3fffllr.exec:\3fffllr.exe32⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvjpv.exec:\dvjpv.exe33⤵
- Executes dropped EXE
PID:2504 -
\??\c:\ppdpv.exec:\ppdpv.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\ffrrrxl.exec:\ffrrrxl.exe35⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nnnnnb.exec:\nnnnnb.exe36⤵
- Executes dropped EXE
PID:1688 -
\??\c:\9vdpd.exec:\9vdpd.exe37⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9jpvj.exec:\9jpvj.exe38⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xlflrxr.exec:\xlflrxr.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\9vvvd.exec:\9vvvd.exe40⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vvvjd.exec:\vvvjd.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\rxfrlfr.exec:\rxfrlfr.exe42⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xflxflr.exec:\xflxflr.exe43⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tbhhnt.exec:\tbhhnt.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ppjpp.exec:\ppjpp.exe45⤵
- Executes dropped EXE
PID:2664 -
\??\c:\jjvdj.exec:\jjvdj.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9ffxflx.exec:\9ffxflx.exe47⤵
- Executes dropped EXE
PID:1860 -
\??\c:\llflxxl.exec:\llflxxl.exe48⤵
- Executes dropped EXE
PID:556 -
\??\c:\ttnbbb.exec:\ttnbbb.exe49⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9jpdv.exec:\9jpdv.exe50⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5jvdj.exec:\5jvdj.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lrllfll.exec:\lrllfll.exe52⤵
- Executes dropped EXE
PID:1576 -
\??\c:\1btbbb.exec:\1btbbb.exe53⤵
- Executes dropped EXE
PID:548 -
\??\c:\hthnbb.exec:\hthnbb.exe54⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vdppd.exec:\vdppd.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\7lflxxf.exec:\7lflxxf.exe56⤵
- Executes dropped EXE
PID:1996 -
\??\c:\htbhhn.exec:\htbhhn.exe57⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ttbhtb.exec:\ttbhtb.exe58⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ppjpv.exec:\ppjpv.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fxllllx.exec:\fxllllx.exe60⤵
- Executes dropped EXE
PID:2244 -
\??\c:\frxxflx.exec:\frxxflx.exe61⤵
- Executes dropped EXE
PID:1904 -
\??\c:\ntnthb.exec:\ntnthb.exe62⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jvjpd.exec:\jvjpd.exe63⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjppv.exec:\pjppv.exe64⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lrrllxf.exec:\lrrllxf.exe65⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nnntth.exec:\nnntth.exe66⤵PID:1392
-
\??\c:\jjdjv.exec:\jjdjv.exe67⤵PID:1196
-
\??\c:\ppddj.exec:\ppddj.exe68⤵PID:1120
-
\??\c:\xxlxffl.exec:\xxlxffl.exe69⤵PID:2092
-
\??\c:\tbhnth.exec:\tbhnth.exe70⤵PID:1232
-
\??\c:\3ttbhn.exec:\3ttbhn.exe71⤵PID:1308
-
\??\c:\7pjpv.exec:\7pjpv.exe72⤵PID:2120
-
\??\c:\7lflxfl.exec:\7lflxfl.exe73⤵PID:2568
-
\??\c:\llfrlrx.exec:\llfrlrx.exe74⤵PID:1560
-
\??\c:\hhtthh.exec:\hhtthh.exe75⤵PID:2396
-
\??\c:\nnttbb.exec:\nnttbb.exe76⤵PID:1800
-
\??\c:\3dvdp.exec:\3dvdp.exe77⤵PID:2380
-
\??\c:\ppddj.exec:\ppddj.exe78⤵PID:2748
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe79⤵PID:2732
-
\??\c:\nnnbtb.exec:\nnnbtb.exe80⤵PID:2476
-
\??\c:\djvvj.exec:\djvvj.exe81⤵PID:2860
-
\??\c:\vvjvp.exec:\vvjvp.exe82⤵PID:2348
-
\??\c:\rxlrxlf.exec:\rxlrxlf.exe83⤵PID:3052
-
\??\c:\xlxlfxx.exec:\xlxlfxx.exe84⤵PID:2764
-
\??\c:\tnbbht.exec:\tnbbht.exe85⤵PID:2612
-
\??\c:\ppjvp.exec:\ppjvp.exe86⤵PID:1092
-
\??\c:\1dvvd.exec:\1dvvd.exe87⤵PID:2656
-
\??\c:\xxfrrxr.exec:\xxfrrxr.exe88⤵PID:3064
-
\??\c:\lrflrrx.exec:\lrflrrx.exe89⤵PID:1860
-
\??\c:\bbnntt.exec:\bbnntt.exe90⤵PID:556
-
\??\c:\vpvvp.exec:\vpvvp.exe91⤵PID:1316
-
\??\c:\ppvdj.exec:\ppvdj.exe92⤵PID:1340
-
\??\c:\7fflllx.exec:\7fflllx.exe93⤵PID:1792
-
\??\c:\bnnbbb.exec:\bnnbbb.exe94⤵PID:1864
-
\??\c:\jjdpp.exec:\jjdpp.exe95⤵PID:2024
-
\??\c:\pjdjv.exec:\pjdjv.exe96⤵PID:1992
-
\??\c:\7llflfr.exec:\7llflfr.exe97⤵PID:2944
-
\??\c:\tnthnt.exec:\tnthnt.exe98⤵PID:1996
-
\??\c:\nnhntt.exec:\nnhntt.exe99⤵PID:2940
-
\??\c:\9vppp.exec:\9vppp.exe100⤵PID:2164
-
\??\c:\7flxrrr.exec:\7flxrrr.exe101⤵PID:2232
-
\??\c:\5xlfxff.exec:\5xlfxff.exe102⤵PID:572
-
\??\c:\nnhbnt.exec:\nnhbnt.exe103⤵PID:1904
-
\??\c:\vdjjj.exec:\vdjjj.exe104⤵PID:2936
-
\??\c:\djddj.exec:\djddj.exe105⤵PID:948
-
\??\c:\xxrxfxr.exec:\xxrxfxr.exe106⤵PID:3048
-
\??\c:\nnbhnn.exec:\nnbhnn.exe107⤵PID:776
-
\??\c:\tnhtbh.exec:\tnhtbh.exe108⤵PID:1784
-
\??\c:\jjdpv.exec:\jjdpv.exe109⤵PID:1196
-
\??\c:\djvdj.exec:\djvdj.exe110⤵PID:2444
-
\??\c:\xllxfll.exec:\xllxfll.exe111⤵PID:1828
-
\??\c:\flfxxxr.exec:\flfxxxr.exe112⤵PID:1700
-
\??\c:\hhbhtb.exec:\hhbhtb.exe113⤵PID:2372
-
\??\c:\jjddj.exec:\jjddj.exe114⤵PID:2400
-
\??\c:\7dvjp.exec:\7dvjp.exe115⤵PID:2532
-
\??\c:\xxxfllx.exec:\xxxfllx.exe116⤵PID:2320
-
\??\c:\btntbh.exec:\btntbh.exe117⤵PID:2144
-
\??\c:\hhbtht.exec:\hhbtht.exe118⤵PID:1812
-
\??\c:\pvvdd.exec:\pvvdd.exe119⤵PID:2812
-
\??\c:\lfllrrx.exec:\lfllrrx.exe120⤵PID:2744
-
\??\c:\9frflll.exec:\9frflll.exe121⤵PID:2976
-
\??\c:\hbhttb.exec:\hbhttb.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-