Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 22:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe
-
Size
65KB
-
MD5
7f68282ce25368c0ee4572a49cfa93f0
-
SHA1
7f27b5ee03c9eb6f159efe65d7af6156c3fab21d
-
SHA256
dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6d
-
SHA512
c2e2998ff196224f54107892d1216af109f5ff42b8ae67b9c01fa66c0cdd7235336041ff2a609725aa049df459ad41e013ff3157f01c37322eb038746a73a94a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27elY:ymb3NkkiQ3mdBjFI9Pm
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral1/memory/2368-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2020-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2804-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2656-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2660-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2444-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/964-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2680-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1080-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2272-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1728-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2540-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2692 fxrfrlx.exe 2756 xlrrxxf.exe 2832 jdpvd.exe 2020 1dddv.exe 2804 fxrxrlr.exe 2656 nbtttt.exe 2660 jvjjp.exe 2444 7dpjp.exe 964 xrfrffr.exe 1952 nhnthn.exe 2580 hbtnbb.exe 2680 pjjvp.exe 2044 9pjdj.exe 1752 lfrlrrr.exe 852 rllxfxl.exe 1268 tnbhnt.exe 1156 hbtnbb.exe 1080 9pjvp.exe 2124 vpdjj.exe 2420 9rrlffl.exe 2272 tnbbhh.exe 1904 bbnnbh.exe 648 3pjpv.exe 1816 7ddjj.exe 1684 rlxxlfr.exe 924 tntttb.exe 2560 vdvvv.exe 1464 vjdjd.exe 2348 fxfflfl.exe 1728 5frxxlr.exe 2540 hbnthn.exe 2892 htbtbb.exe 2232 vpdjp.exe 2820 vpddp.exe 2756 rlrrrrr.exe 2972 xlrlrlr.exe 2852 9hhntb.exe 2632 nhnhnt.exe 1068 pdppv.exe 2628 7dpdj.exe 2780 rlxxllr.exe 3060 xrffrxf.exe 1136 hhnntt.exe 2316 bnbhnt.exe 2228 htnhhh.exe 2088 3vppp.exe 2116 jdppj.exe 2000 xrffrxf.exe 2712 lxxflrr.exe 272 tnbbnn.exe 1604 nbbthb.exe 988 vpdjj.exe 1976 pjvdp.exe 1736 vpddj.exe 2160 fxllrrr.exe 1072 llllfrf.exe 2292 tthtnn.exe 2200 hbhbnh.exe 2196 vpdjj.exe 504 1vjvv.exe 236 fxrrxxx.exe 864 xrffrlx.exe 1000 7hbthn.exe 800 btntbb.exe -
resource yara_rule behavioral1/memory/2368-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2020-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2656-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2660-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/964-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2680-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1080-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2272-213-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2348-285-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1728-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2540-303-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2368 wrote to memory of 2692 2368 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 29 PID 2368 wrote to memory of 2692 2368 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 29 PID 2368 wrote to memory of 2692 2368 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 29 PID 2368 wrote to memory of 2692 2368 dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe 29 PID 2692 wrote to memory of 2756 2692 fxrfrlx.exe 30 PID 2692 wrote to memory of 2756 2692 fxrfrlx.exe 30 PID 2692 wrote to memory of 2756 2692 fxrfrlx.exe 30 PID 2692 wrote to memory of 2756 2692 fxrfrlx.exe 30 PID 2756 wrote to memory of 2832 2756 xlrrxxf.exe 31 PID 2756 wrote to memory of 2832 2756 xlrrxxf.exe 31 PID 2756 wrote to memory of 2832 2756 xlrrxxf.exe 31 PID 2756 wrote to memory of 2832 2756 xlrrxxf.exe 31 PID 2832 wrote to memory of 2020 2832 jdpvd.exe 32 PID 2832 wrote to memory of 2020 2832 jdpvd.exe 32 PID 2832 wrote to memory of 2020 2832 jdpvd.exe 32 PID 2832 wrote to memory of 2020 2832 jdpvd.exe 32 PID 2020 wrote to memory of 2804 2020 1dddv.exe 33 PID 2020 wrote to memory of 2804 2020 1dddv.exe 33 PID 2020 wrote to memory of 2804 2020 1dddv.exe 33 PID 2020 wrote to memory of 2804 2020 1dddv.exe 33 PID 2804 wrote to memory of 2656 2804 fxrxrlr.exe 34 PID 2804 wrote to memory of 2656 2804 fxrxrlr.exe 34 PID 2804 wrote to memory of 2656 2804 fxrxrlr.exe 34 PID 2804 wrote to memory of 2656 2804 fxrxrlr.exe 34 PID 2656 wrote to memory of 2660 2656 nbtttt.exe 35 PID 2656 wrote to memory of 2660 2656 nbtttt.exe 35 PID 2656 wrote to memory of 2660 2656 nbtttt.exe 35 PID 2656 wrote to memory of 2660 2656 nbtttt.exe 35 PID 2660 wrote to memory of 2444 2660 jvjjp.exe 36 PID 2660 wrote to memory of 2444 2660 jvjjp.exe 36 PID 2660 wrote to memory of 2444 2660 jvjjp.exe 36 PID 2660 wrote to memory of 2444 2660 jvjjp.exe 36 PID 2444 wrote to memory of 964 2444 7dpjp.exe 37 PID 2444 wrote to memory of 964 2444 7dpjp.exe 37 PID 2444 wrote to memory of 964 2444 7dpjp.exe 37 PID 2444 wrote to memory of 964 2444 7dpjp.exe 37 PID 964 wrote to memory of 1952 964 xrfrffr.exe 38 PID 964 wrote to memory of 1952 964 xrfrffr.exe 38 PID 964 wrote to memory of 1952 964 xrfrffr.exe 38 PID 964 wrote to memory of 1952 964 xrfrffr.exe 38 PID 1952 wrote to memory of 2580 1952 nhnthn.exe 39 PID 1952 wrote to memory of 2580 1952 nhnthn.exe 39 PID 1952 wrote to memory of 2580 1952 nhnthn.exe 39 PID 1952 wrote to memory of 2580 1952 nhnthn.exe 39 PID 2580 wrote to memory of 2680 2580 hbtnbb.exe 40 PID 2580 wrote to memory of 2680 2580 hbtnbb.exe 40 PID 2580 wrote to memory of 2680 2580 hbtnbb.exe 40 PID 2580 wrote to memory of 2680 2580 hbtnbb.exe 40 PID 2680 wrote to memory of 2044 2680 pjjvp.exe 41 PID 2680 wrote to memory of 2044 2680 pjjvp.exe 41 PID 2680 wrote to memory of 2044 2680 pjjvp.exe 41 PID 2680 wrote to memory of 2044 2680 pjjvp.exe 41 PID 2044 wrote to memory of 1752 2044 9pjdj.exe 42 PID 2044 wrote to memory of 1752 2044 9pjdj.exe 42 PID 2044 wrote to memory of 1752 2044 9pjdj.exe 42 PID 2044 wrote to memory of 1752 2044 9pjdj.exe 42 PID 1752 wrote to memory of 852 1752 lfrlrrr.exe 43 PID 1752 wrote to memory of 852 1752 lfrlrrr.exe 43 PID 1752 wrote to memory of 852 1752 lfrlrrr.exe 43 PID 1752 wrote to memory of 852 1752 lfrlrrr.exe 43 PID 852 wrote to memory of 1268 852 rllxfxl.exe 44 PID 852 wrote to memory of 1268 852 rllxfxl.exe 44 PID 852 wrote to memory of 1268 852 rllxfxl.exe 44 PID 852 wrote to memory of 1268 852 rllxfxl.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe"C:\Users\Admin\AppData\Local\Temp\dd0038ce3a5311bcb19bb53b66bb1203b968adefe28f21416259da3d27c92a6dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\jdpvd.exec:\jdpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\1dddv.exec:\1dddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\fxrxrlr.exec:\fxrxrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\nbtttt.exec:\nbtttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\jvjjp.exec:\jvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\7dpjp.exec:\7dpjp.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\xrfrffr.exec:\xrfrffr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\nhnthn.exec:\nhnthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\hbtnbb.exec:\hbtnbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\pjjvp.exec:\pjjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\9pjdj.exec:\9pjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\rllxfxl.exec:\rllxfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\tnbhnt.exec:\tnbhnt.exe17⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hbtnbb.exec:\hbtnbb.exe18⤵
- Executes dropped EXE
PID:1156 -
\??\c:\9pjvp.exec:\9pjvp.exe19⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vpdjj.exec:\vpdjj.exe20⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9rrlffl.exec:\9rrlffl.exe21⤵
- Executes dropped EXE
PID:2420 -
\??\c:\tnbbhh.exec:\tnbbhh.exe22⤵
- Executes dropped EXE
PID:2272 -
\??\c:\bbnnbh.exec:\bbnnbh.exe23⤵
- Executes dropped EXE
PID:1904 -
\??\c:\3pjpv.exec:\3pjpv.exe24⤵
- Executes dropped EXE
PID:648 -
\??\c:\7ddjj.exec:\7ddjj.exe25⤵
- Executes dropped EXE
PID:1816 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe26⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tntttb.exec:\tntttb.exe27⤵
- Executes dropped EXE
PID:924 -
\??\c:\vdvvv.exec:\vdvvv.exe28⤵
- Executes dropped EXE
PID:2560 -
\??\c:\vjdjd.exec:\vjdjd.exe29⤵
- Executes dropped EXE
PID:1464 -
\??\c:\fxfflfl.exec:\fxfflfl.exe30⤵
- Executes dropped EXE
PID:2348 -
\??\c:\5frxxlr.exec:\5frxxlr.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbnthn.exec:\hbnthn.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\htbtbb.exec:\htbtbb.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vpdjp.exec:\vpdjp.exe34⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vpddp.exec:\vpddp.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe37⤵
- Executes dropped EXE
PID:2972 -
\??\c:\9hhntb.exec:\9hhntb.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\nhnhnt.exec:\nhnhnt.exe39⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdppv.exec:\pdppv.exe40⤵
- Executes dropped EXE
PID:1068 -
\??\c:\7dpdj.exec:\7dpdj.exe41⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlxxllr.exec:\rlxxllr.exe42⤵
- Executes dropped EXE
PID:2780 -
\??\c:\xrffrxf.exec:\xrffrxf.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhnntt.exec:\hhnntt.exe44⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bnbhnt.exec:\bnbhnt.exe45⤵
- Executes dropped EXE
PID:2316 -
\??\c:\htnhhh.exec:\htnhhh.exe46⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3vppp.exec:\3vppp.exe47⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jdppj.exec:\jdppj.exe48⤵
- Executes dropped EXE
PID:2116 -
\??\c:\xrffrxf.exec:\xrffrxf.exe49⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lxxflrr.exec:\lxxflrr.exe50⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tnbbnn.exec:\tnbbnn.exe51⤵
- Executes dropped EXE
PID:272 -
\??\c:\nbbthb.exec:\nbbthb.exe52⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vpdjj.exec:\vpdjj.exe53⤵
- Executes dropped EXE
PID:988 -
\??\c:\pjvdp.exec:\pjvdp.exe54⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vpddj.exec:\vpddj.exe55⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fxllrrr.exec:\fxllrrr.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\llllfrf.exec:\llllfrf.exe57⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tthtnn.exec:\tthtnn.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hbhbnh.exec:\hbhbnh.exe59⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vpdjj.exec:\vpdjj.exe60⤵
- Executes dropped EXE
PID:2196 -
\??\c:\1vjvv.exec:\1vjvv.exe61⤵
- Executes dropped EXE
PID:504 -
\??\c:\fxrrxxx.exec:\fxrrxxx.exe62⤵
- Executes dropped EXE
PID:236 -
\??\c:\xrffrlx.exec:\xrffrlx.exe63⤵
- Executes dropped EXE
PID:864 -
\??\c:\7hbthn.exec:\7hbthn.exe64⤵
- Executes dropped EXE
PID:1000 -
\??\c:\btntbb.exec:\btntbb.exe65⤵
- Executes dropped EXE
PID:800 -
\??\c:\9dpvv.exec:\9dpvv.exe66⤵PID:1240
-
\??\c:\jdpdp.exec:\jdpdp.exe67⤵PID:2212
-
\??\c:\rfllllr.exec:\rfllllr.exe68⤵PID:1284
-
\??\c:\frflrrx.exec:\frflrrx.exe69⤵PID:876
-
\??\c:\7xllrrf.exec:\7xllrrf.exe70⤵PID:1272
-
\??\c:\nhbbhb.exec:\nhbbhb.exe71⤵PID:2548
-
\??\c:\jdpvd.exec:\jdpvd.exe72⤵PID:1920
-
\??\c:\vpdjv.exec:\vpdjv.exe73⤵PID:2056
-
\??\c:\vvjpp.exec:\vvjpp.exe74⤵PID:2720
-
\??\c:\rlllrrf.exec:\rlllrrf.exe75⤵PID:2836
-
\??\c:\lfrxxxx.exec:\lfrxxxx.exe76⤵PID:2764
-
\??\c:\7bnnnt.exec:\7bnnnt.exe77⤵PID:2616
-
\??\c:\jjdpj.exec:\jjdpj.exe78⤵PID:2288
-
\??\c:\fxrrffr.exec:\fxrrffr.exe79⤵PID:2852
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe80⤵PID:2612
-
\??\c:\nbtbbt.exec:\nbtbbt.exe81⤵PID:2684
-
\??\c:\5tntnh.exec:\5tntnh.exe82⤵PID:2060
-
\??\c:\vvjdd.exec:\vvjdd.exe83⤵PID:1712
-
\??\c:\jvpjp.exec:\jvpjp.exe84⤵PID:620
-
\??\c:\rlxfxxl.exec:\rlxfxxl.exe85⤵PID:2708
-
\??\c:\frrrxxx.exec:\frrrxxx.exe86⤵PID:2084
-
\??\c:\btnttt.exec:\btnttt.exe87⤵PID:2796
-
\??\c:\btnhnn.exec:\btnhnn.exe88⤵PID:2580
-
\??\c:\3bnbbh.exec:\3bnbbh.exe89⤵PID:2036
-
\??\c:\dvjpp.exec:\dvjpp.exe90⤵PID:2320
-
\??\c:\vpddv.exec:\vpddv.exe91⤵PID:1576
-
\??\c:\5frrrxf.exec:\5frrrxf.exe92⤵PID:2908
-
\??\c:\xxxxlrx.exec:\xxxxlrx.exe93⤵PID:1584
-
\??\c:\9rxxfxf.exec:\9rxxfxf.exe94⤵PID:1268
-
\??\c:\tnthtn.exec:\tnthtn.exe95⤵PID:2336
-
\??\c:\3vjjd.exec:\3vjjd.exe96⤵
- System Location Discovery: System Language Discovery
PID:1080 -
\??\c:\jdppd.exec:\jdppd.exe97⤵PID:2124
-
\??\c:\3vvpv.exec:\3vvpv.exe98⤵PID:2420
-
\??\c:\frxxffl.exec:\frxxffl.exe99⤵PID:2220
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe100⤵PID:1708
-
\??\c:\9hhttt.exec:\9hhttt.exe101⤵PID:336
-
\??\c:\hbhbbb.exec:\hbhbbb.exe102⤵PID:2516
-
\??\c:\pvvdj.exec:\pvvdj.exe103⤵PID:2964
-
\??\c:\pdvvd.exec:\pdvvd.exe104⤵PID:1928
-
\??\c:\5lffrlr.exec:\5lffrlr.exe105⤵PID:2468
-
\??\c:\rrllrrf.exec:\rrllrrf.exe106⤵PID:700
-
\??\c:\lxfllrl.exec:\lxfllrl.exe107⤵PID:1240
-
\??\c:\btbbbh.exec:\btbbbh.exe108⤵PID:2344
-
\??\c:\bnthnn.exec:\bnthnn.exe109⤵PID:2120
-
\??\c:\ttnnbb.exec:\ttnnbb.exe110⤵PID:1756
-
\??\c:\ppddv.exec:\ppddv.exe111⤵PID:1272
-
\??\c:\vdjdj.exec:\vdjdj.exe112⤵PID:2304
-
\??\c:\xxlxxlr.exec:\xxlxxlr.exe113⤵PID:2956
-
\??\c:\fxrrffr.exec:\fxrrffr.exe114⤵PID:2816
-
\??\c:\rlflffl.exec:\rlflffl.exe115⤵PID:2820
-
\??\c:\3nhbhh.exec:\3nhbhh.exe116⤵PID:2752
-
\??\c:\1bbhnn.exec:\1bbhnn.exe117⤵PID:2848
-
\??\c:\tnbhnb.exec:\tnbhnb.exe118⤵PID:2788
-
\??\c:\dpjpp.exec:\dpjpp.exe119⤵PID:2664
-
\??\c:\3ppvd.exec:\3ppvd.exe120⤵PID:2900
-
\??\c:\fllfxxf.exec:\fllfxxf.exe121⤵PID:2656
-
\??\c:\frrfflf.exec:\frrfflf.exe122⤵PID:2688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-