Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe
-
Size
69KB
-
MD5
b1feb290557e45a4d35598c75282706a
-
SHA1
1734e81a47e0c29d45b591421551625c0c46e3c4
-
SHA256
a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81
-
SHA512
73b9b15319d762ac3a0237cb4b561d9a256da751e695c2e6bdbc694650a3878f03eabec164aeb5b2d04a7407e33fd7b3a49829ad67d52927ece25b7d6606cc26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcPD:ymb3NkkiQ3mdBjFIsIVcL
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2556-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2968-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2724-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1516-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1072-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1700-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2592-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1068-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2108 5dppj.exe 2584 1bnhnh.exe 2968 rlxfffr.exe 2756 xrfflll.exe 2996 tbbtnh.exe 2848 pdppv.exe 2960 vpvdj.exe 2724 frxxxfr.exe 2732 5hhbhb.exe 1516 pjvjp.exe 1084 5vpjp.exe 2892 xlrxxxx.exe 1204 fxrlllr.exe 1072 1hthtb.exe 1700 7vvpd.exe 2136 vvjjp.exe 1620 xrxrxrx.exe 2336 bbnnhh.exe 1632 nhnttb.exe 1848 jdvpj.exe 2592 7xrfrrf.exe 1116 lxrrrxx.exe 3004 hbnbht.exe 1068 3nnhnh.exe 1612 vjdjp.exe 2396 5pdvd.exe 1696 fxfxfxx.exe 2988 fffflrx.exe 1712 9nhnbb.exe 1556 pppvv.exe 1720 pjdvv.exe 2264 lxlffrr.exe 1680 7xrxlfl.exe 2584 7nhhnt.exe 1960 9nbhhh.exe 2852 jdvdd.exe 2736 9fxrrlx.exe 2616 xrxfllx.exe 2944 hbnttb.exe 2864 7dvvd.exe 2620 dvddj.exe 2664 xrfllrr.exe 2304 xlfffrx.exe 2732 5bttbn.exe 2948 hhbbht.exe 1084 9jdpv.exe 2432 vdvdd.exe 984 rlxfxlr.exe 2912 3lflrrr.exe 1952 nnbbbh.exe 1628 tnbnhn.exe 2024 dddpv.exe 2648 rlxxxxf.exe 3060 7rfrxfl.exe 2336 llxxllr.exe 2128 5hbbbh.exe 780 nbhhnh.exe 1776 ppjjj.exe 2236 vpvjp.exe 692 1xrlxxf.exe 848 3xllllr.exe 2792 hhbnhn.exe 1532 3nbttb.exe 1672 djpvj.exe -
resource yara_rule behavioral1/memory/2556-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2968-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2724-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1516-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1204-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1072-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1700-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2592-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1068-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bttbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbhh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2108 2556 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 30 PID 2556 wrote to memory of 2108 2556 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 30 PID 2556 wrote to memory of 2108 2556 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 30 PID 2556 wrote to memory of 2108 2556 a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe 30 PID 2108 wrote to memory of 2584 2108 5dppj.exe 31 PID 2108 wrote to memory of 2584 2108 5dppj.exe 31 PID 2108 wrote to memory of 2584 2108 5dppj.exe 31 PID 2108 wrote to memory of 2584 2108 5dppj.exe 31 PID 2584 wrote to memory of 2968 2584 1bnhnh.exe 32 PID 2584 wrote to memory of 2968 2584 1bnhnh.exe 32 PID 2584 wrote to memory of 2968 2584 1bnhnh.exe 32 PID 2584 wrote to memory of 2968 2584 1bnhnh.exe 32 PID 2968 wrote to memory of 2756 2968 rlxfffr.exe 33 PID 2968 wrote to memory of 2756 2968 rlxfffr.exe 33 PID 2968 wrote to memory of 2756 2968 rlxfffr.exe 33 PID 2968 wrote to memory of 2756 2968 rlxfffr.exe 33 PID 2756 wrote to memory of 2996 2756 xrfflll.exe 34 PID 2756 wrote to memory of 2996 2756 xrfflll.exe 34 PID 2756 wrote to memory of 2996 2756 xrfflll.exe 34 PID 2756 wrote to memory of 2996 2756 xrfflll.exe 34 PID 2996 wrote to memory of 2848 2996 tbbtnh.exe 35 PID 2996 wrote to memory of 2848 2996 tbbtnh.exe 35 PID 2996 wrote to memory of 2848 2996 tbbtnh.exe 35 PID 2996 wrote to memory of 2848 2996 tbbtnh.exe 35 PID 2848 wrote to memory of 2960 2848 pdppv.exe 36 PID 2848 wrote to memory of 2960 2848 pdppv.exe 36 PID 2848 wrote to memory of 2960 2848 pdppv.exe 36 PID 2848 wrote to memory of 2960 2848 pdppv.exe 36 PID 2960 wrote to memory of 2724 2960 vpvdj.exe 37 PID 2960 wrote to memory of 2724 2960 vpvdj.exe 37 PID 2960 wrote to memory of 2724 2960 vpvdj.exe 37 PID 2960 wrote to memory of 2724 2960 vpvdj.exe 37 PID 2724 wrote to memory of 2732 2724 frxxxfr.exe 38 PID 2724 wrote to memory of 2732 2724 frxxxfr.exe 38 PID 2724 wrote to memory of 2732 2724 frxxxfr.exe 38 PID 2724 wrote to memory of 2732 2724 frxxxfr.exe 38 PID 2732 wrote to memory of 1516 2732 5hhbhb.exe 39 PID 2732 wrote to memory of 1516 2732 5hhbhb.exe 39 PID 2732 wrote to memory of 1516 2732 5hhbhb.exe 39 PID 2732 wrote to memory of 1516 2732 5hhbhb.exe 39 PID 1516 wrote to memory of 1084 1516 pjvjp.exe 40 PID 1516 wrote to memory of 1084 1516 pjvjp.exe 40 PID 1516 wrote to memory of 1084 1516 pjvjp.exe 40 PID 1516 wrote to memory of 1084 1516 pjvjp.exe 40 PID 1084 wrote to memory of 2892 1084 5vpjp.exe 41 PID 1084 wrote to memory of 2892 1084 5vpjp.exe 41 PID 1084 wrote to memory of 2892 1084 5vpjp.exe 41 PID 1084 wrote to memory of 2892 1084 5vpjp.exe 41 PID 2892 wrote to memory of 1204 2892 xlrxxxx.exe 42 PID 2892 wrote to memory of 1204 2892 xlrxxxx.exe 42 PID 2892 wrote to memory of 1204 2892 xlrxxxx.exe 42 PID 2892 wrote to memory of 1204 2892 xlrxxxx.exe 42 PID 1204 wrote to memory of 1072 1204 fxrlllr.exe 43 PID 1204 wrote to memory of 1072 1204 fxrlllr.exe 43 PID 1204 wrote to memory of 1072 1204 fxrlllr.exe 43 PID 1204 wrote to memory of 1072 1204 fxrlllr.exe 43 PID 1072 wrote to memory of 1700 1072 1hthtb.exe 44 PID 1072 wrote to memory of 1700 1072 1hthtb.exe 44 PID 1072 wrote to memory of 1700 1072 1hthtb.exe 44 PID 1072 wrote to memory of 1700 1072 1hthtb.exe 44 PID 1700 wrote to memory of 2136 1700 7vvpd.exe 45 PID 1700 wrote to memory of 2136 1700 7vvpd.exe 45 PID 1700 wrote to memory of 2136 1700 7vvpd.exe 45 PID 1700 wrote to memory of 2136 1700 7vvpd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe"C:\Users\Admin\AppData\Local\Temp\a7861517756489f45119cd9f4969ba3bb5b2e28dfbbc81e0d16d7dfed1e7ef81.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5dppj.exec:\5dppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1bnhnh.exec:\1bnhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rlxfffr.exec:\rlxfffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xrfflll.exec:\xrfflll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\tbbtnh.exec:\tbbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\pdppv.exec:\pdppv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vpvdj.exec:\vpvdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\frxxxfr.exec:\frxxxfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\5hhbhb.exec:\5hhbhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\pjvjp.exec:\pjvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\5vpjp.exec:\5vpjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\fxrlllr.exec:\fxrlllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\1hthtb.exec:\1hthtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\7vvpd.exec:\7vvpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\vvjjp.exec:\vvjjp.exe17⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe18⤵
- Executes dropped EXE
PID:1620 -
\??\c:\bbnnhh.exec:\bbnnhh.exe19⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhnttb.exec:\nhnttb.exe20⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdvpj.exec:\jdvpj.exe21⤵
- Executes dropped EXE
PID:1848 -
\??\c:\7xrfrrf.exec:\7xrfrrf.exe22⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lxrrrxx.exec:\lxrrrxx.exe23⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hbnbht.exec:\hbnbht.exe24⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3nnhnh.exec:\3nnhnh.exe25⤵
- Executes dropped EXE
PID:1068 -
\??\c:\vjdjp.exec:\vjdjp.exe26⤵
- Executes dropped EXE
PID:1612 -
\??\c:\5pdvd.exec:\5pdvd.exe27⤵
- Executes dropped EXE
PID:2396 -
\??\c:\fxfxfxx.exec:\fxfxfxx.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fffflrx.exec:\fffflrx.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\9nhnbb.exec:\9nhnbb.exe30⤵
- Executes dropped EXE
PID:1712 -
\??\c:\pppvv.exec:\pppvv.exe31⤵
- Executes dropped EXE
PID:1556 -
\??\c:\pjdvv.exec:\pjdvv.exe32⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lxlffrr.exec:\lxlffrr.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7xrxlfl.exec:\7xrxlfl.exe34⤵
- Executes dropped EXE
PID:1680 -
\??\c:\7nhhnt.exec:\7nhhnt.exe35⤵
- Executes dropped EXE
PID:2584 -
\??\c:\9nbhhh.exec:\9nbhhh.exe36⤵
- Executes dropped EXE
PID:1960 -
\??\c:\jdvdd.exec:\jdvdd.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9fxrrlx.exec:\9fxrrlx.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrxfllx.exec:\xrxfllx.exe39⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbnttb.exec:\hbnttb.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\7dvvd.exec:\7dvvd.exe41⤵
- Executes dropped EXE
PID:2864 -
\??\c:\dvddj.exec:\dvddj.exe42⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrfllrr.exec:\xrfllrr.exe43⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xlfffrx.exec:\xlfffrx.exe44⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5bttbn.exec:\5bttbn.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2732 -
\??\c:\hhbbht.exec:\hhbbht.exe46⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9jdpv.exec:\9jdpv.exe47⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vdvdd.exec:\vdvdd.exe48⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rlxfxlr.exec:\rlxfxlr.exe49⤵
- Executes dropped EXE
PID:984 -
\??\c:\3lflrrr.exec:\3lflrrr.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nnbbbh.exec:\nnbbbh.exe51⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnbnhn.exec:\tnbnhn.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\dddpv.exec:\dddpv.exe53⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe54⤵
- Executes dropped EXE
PID:2648 -
\??\c:\7rfrxfl.exec:\7rfrxfl.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\llxxllr.exec:\llxxllr.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5hbbbh.exec:\5hbbbh.exe57⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nbhhnh.exec:\nbhhnh.exe58⤵
- Executes dropped EXE
PID:780 -
\??\c:\ppjjj.exec:\ppjjj.exe59⤵
- Executes dropped EXE
PID:1776 -
\??\c:\vpvjp.exec:\vpvjp.exe60⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1xrlxxf.exec:\1xrlxxf.exe61⤵
- Executes dropped EXE
PID:692 -
\??\c:\3xllllr.exec:\3xllllr.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:848 -
\??\c:\hhbnhn.exec:\hhbnhn.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\3nbttb.exec:\3nbttb.exe64⤵
- Executes dropped EXE
PID:1532 -
\??\c:\djpvj.exec:\djpvj.exe65⤵
- Executes dropped EXE
PID:1672 -
\??\c:\ddjjp.exec:\ddjjp.exe66⤵PID:1912
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe67⤵PID:2192
-
\??\c:\7xrfflx.exec:\7xrfflx.exe68⤵PID:876
-
\??\c:\7rllrrf.exec:\7rllrrf.exe69⤵PID:2424
-
\??\c:\1bnthh.exec:\1bnthh.exe70⤵PID:2012
-
\??\c:\pdpvv.exec:\pdpvv.exe71⤵PID:1684
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe72⤵PID:2696
-
\??\c:\bttntn.exec:\bttntn.exe73⤵PID:2544
-
\??\c:\bntttt.exec:\bntttt.exe74⤵PID:2704
-
\??\c:\vpddv.exec:\vpddv.exe75⤵PID:2500
-
\??\c:\3vjdj.exec:\3vjdj.exe76⤵PID:2816
-
\??\c:\xrrrfxr.exec:\xrrrfxr.exe77⤵PID:2768
-
\??\c:\rfxxffr.exec:\rfxxffr.exe78⤵PID:2868
-
\??\c:\hbhnnh.exec:\hbhnnh.exe79⤵PID:2880
-
\??\c:\htttnt.exec:\htttnt.exe80⤵PID:2348
-
\??\c:\3pdpv.exec:\3pdpv.exe81⤵PID:2608
-
\??\c:\rxxlxff.exec:\rxxlxff.exe82⤵PID:2612
-
\??\c:\1fxlxxf.exec:\1fxlxxf.exe83⤵PID:2684
-
\??\c:\ttbnnt.exec:\ttbnnt.exe84⤵PID:2328
-
\??\c:\3thbbb.exec:\3thbbb.exe85⤵PID:628
-
\??\c:\ppdvp.exec:\ppdvp.exe86⤵PID:1516
-
\??\c:\jvvdd.exec:\jvvdd.exe87⤵PID:2428
-
\??\c:\7xlllrx.exec:\7xlllrx.exe88⤵PID:1180
-
\??\c:\7nntbt.exec:\7nntbt.exe89⤵PID:704
-
\??\c:\1nbttt.exec:\1nbttt.exe90⤵PID:2700
-
\??\c:\7thhnn.exec:\7thhnn.exe91⤵PID:1592
-
\??\c:\1jvjd.exec:\1jvjd.exe92⤵PID:1652
-
\??\c:\dpjjv.exec:\dpjjv.exe93⤵PID:2136
-
\??\c:\7rflrxf.exec:\7rflrxf.exe94⤵PID:1140
-
\??\c:\rllrxxf.exec:\rllrxxf.exe95⤵PID:2420
-
\??\c:\1nbnbb.exec:\1nbnbb.exe96⤵PID:2292
-
\??\c:\3jpvd.exec:\3jpvd.exe97⤵PID:2208
-
\??\c:\dpdjj.exec:\dpdjj.exe98⤵PID:1848
-
\??\c:\3rrfrrx.exec:\3rrfrrx.exe99⤵PID:780
-
\??\c:\rlrxlrx.exec:\rlrxlrx.exe100⤵PID:3000
-
\??\c:\tthnbb.exec:\tthnbb.exe101⤵PID:1596
-
\??\c:\btbhtb.exec:\btbhtb.exe102⤵PID:1408
-
\??\c:\dvddj.exec:\dvddj.exe103⤵PID:2472
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe104⤵PID:2052
-
\??\c:\lxffllr.exec:\lxffllr.exe105⤵PID:2464
-
\??\c:\9lxrflr.exec:\9lxrflr.exe106⤵PID:2112
-
\??\c:\hthnnh.exec:\hthnnh.exe107⤵PID:880
-
\??\c:\bnhnnn.exec:\bnhnnn.exe108⤵PID:2988
-
\??\c:\dvpvp.exec:\dvpvp.exe109⤵PID:1712
-
\??\c:\dvppd.exec:\dvppd.exe110⤵PID:1588
-
\??\c:\5frxllr.exec:\5frxllr.exe111⤵PID:2692
-
\??\c:\frxlrll.exec:\frxlrll.exe112⤵PID:1988
-
\??\c:\5nbntt.exec:\5nbntt.exe113⤵PID:2220
-
\??\c:\nhtnbt.exec:\nhtnbt.exe114⤵PID:1680
-
\??\c:\pjppp.exec:\pjppp.exe115⤵PID:2824
-
\??\c:\3flxlrx.exec:\3flxlrx.exe116⤵PID:2764
-
\??\c:\rfrxlll.exec:\rfrxlll.exe117⤵PID:2812
-
\??\c:\9tthnt.exec:\9tthnt.exe118⤵PID:2728
-
\??\c:\7hnhbt.exec:\7hnhbt.exe119⤵PID:2980
-
\??\c:\pdjjj.exec:\pdjjj.exe120⤵PID:2944
-
\??\c:\1vjdj.exec:\1vjdj.exe121⤵PID:2780
-
\??\c:\lflrrxf.exec:\lflrrxf.exe122⤵PID:2724
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-