Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-11-2024 08:19
Static task
static1
Behavioral task
behavioral1
Sample
6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe
Resource
win7-20240903-en
General
-
Target
6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe
-
Size
89KB
-
MD5
ac6330b3a0beca73c6750a91cc010ac5
-
SHA1
42f9bc84b2780b172119527b58d359f2df3eb60f
-
SHA256
6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c
-
SHA512
4184929f5e7dfcbecc99d1baf61a56b9a176d0b8d306703bc66986e8c8c22ceb79783a0d4c3b8f26e489a4071d23a0128d688fee3198256dcf71855909a08caa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSLCBCO+HlMO7s0yL+xwl:ymb3NkkiQ3mdBjFIwLMoHW8yL+xc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral1/memory/1292-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2260-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2832-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/900-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1644-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 nbbtbt.exe 2920 rlxfxrf.exe 2260 hnnbbh.exe 2832 jdjpj.exe 2860 rlrrxlr.exe 2788 fxrrrrr.exe 2016 dpdpd.exe 2648 rlxlfrf.exe 2040 hbtbtt.exe 1524 pdvvj.exe 1044 rxlrfrl.exe 2940 btnhhh.exe 2896 dvvdp.exe 2120 lxrxlrx.exe 3000 xlrxffr.exe 1580 bthnbh.exe 1764 jvjjv.exe 2352 rrlrlfr.exe 2104 ntbbhn.exe 2132 5dvjd.exe 760 rllrfrf.exe 2284 5bnhth.exe 1856 jdpdp.exe 900 rxlrffx.exe 1644 btthhn.exe 2204 pppvj.exe 2216 3frrxfr.exe 1892 7djdv.exe 2520 thhthn.exe 2428 1jpjd.exe 1584 5dppv.exe 2712 lllfrxf.exe 2288 hnhhnt.exe 2768 pvpvj.exe 2260 lxrffll.exe 2776 bntbnn.exe 1172 bttbbn.exe 2636 9jjpd.exe 2744 lfflxxx.exe 2656 xxxlrfx.exe 1888 nbhbbn.exe 2244 vdppd.exe 2748 xfrlllr.exe 2040 xlrrfxf.exe 1040 hnhntn.exe 2972 3pvjj.exe 2688 dppjj.exe 1544 rlxlxrr.exe 1504 nhhnbn.exe 1272 1pvvj.exe 1900 flllxxx.exe 1860 xfxrxrr.exe 3036 btnttt.exe 2164 pdvpv.exe 2352 xrlrflx.exe 2496 7flxrxx.exe 1000 bbttht.exe 1628 pddpd.exe 2160 fxrrrrx.exe 276 5hthnb.exe 2484 jdpjj.exe 1868 pdpvv.exe 1528 xfxrfrx.exe 1184 hththb.exe -
resource yara_rule behavioral1/memory/1292-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2260-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2832-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2648-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/900-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1644-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2204-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-310-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2060 1292 6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe 30 PID 1292 wrote to memory of 2060 1292 6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe 30 PID 1292 wrote to memory of 2060 1292 6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe 30 PID 1292 wrote to memory of 2060 1292 6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe 30 PID 2060 wrote to memory of 2920 2060 nbbtbt.exe 31 PID 2060 wrote to memory of 2920 2060 nbbtbt.exe 31 PID 2060 wrote to memory of 2920 2060 nbbtbt.exe 31 PID 2060 wrote to memory of 2920 2060 nbbtbt.exe 31 PID 2920 wrote to memory of 2260 2920 rlxfxrf.exe 32 PID 2920 wrote to memory of 2260 2920 rlxfxrf.exe 32 PID 2920 wrote to memory of 2260 2920 rlxfxrf.exe 32 PID 2920 wrote to memory of 2260 2920 rlxfxrf.exe 32 PID 2260 wrote to memory of 2832 2260 hnnbbh.exe 33 PID 2260 wrote to memory of 2832 2260 hnnbbh.exe 33 PID 2260 wrote to memory of 2832 2260 hnnbbh.exe 33 PID 2260 wrote to memory of 2832 2260 hnnbbh.exe 33 PID 2832 wrote to memory of 2860 2832 jdjpj.exe 34 PID 2832 wrote to memory of 2860 2832 jdjpj.exe 34 PID 2832 wrote to memory of 2860 2832 jdjpj.exe 34 PID 2832 wrote to memory of 2860 2832 jdjpj.exe 34 PID 2860 wrote to memory of 2788 2860 rlrrxlr.exe 35 PID 2860 wrote to memory of 2788 2860 rlrrxlr.exe 35 PID 2860 wrote to memory of 2788 2860 rlrrxlr.exe 35 PID 2860 wrote to memory of 2788 2860 rlrrxlr.exe 35 PID 2788 wrote to memory of 2016 2788 fxrrrrr.exe 36 PID 2788 wrote to memory of 2016 2788 fxrrrrr.exe 36 PID 2788 wrote to memory of 2016 2788 fxrrrrr.exe 36 PID 2788 wrote to memory of 2016 2788 fxrrrrr.exe 36 PID 2016 wrote to memory of 2648 2016 dpdpd.exe 37 PID 2016 wrote to memory of 2648 2016 dpdpd.exe 37 PID 2016 wrote to memory of 2648 2016 dpdpd.exe 37 PID 2016 wrote to memory of 2648 2016 dpdpd.exe 37 PID 2648 wrote to memory of 2040 2648 rlxlfrf.exe 38 PID 2648 wrote to memory of 2040 2648 rlxlfrf.exe 38 PID 2648 wrote to memory of 2040 2648 rlxlfrf.exe 38 PID 2648 wrote to memory of 2040 2648 rlxlfrf.exe 38 PID 2040 wrote to memory of 1524 2040 hbtbtt.exe 39 PID 2040 wrote to memory of 1524 2040 hbtbtt.exe 39 PID 2040 wrote to memory of 1524 2040 hbtbtt.exe 39 PID 2040 wrote to memory of 1524 2040 hbtbtt.exe 39 PID 1524 wrote to memory of 1044 1524 pdvvj.exe 40 PID 1524 wrote to memory of 1044 1524 pdvvj.exe 40 PID 1524 wrote to memory of 1044 1524 pdvvj.exe 40 PID 1524 wrote to memory of 1044 1524 pdvvj.exe 40 PID 1044 wrote to memory of 2940 1044 rxlrfrl.exe 41 PID 1044 wrote to memory of 2940 1044 rxlrfrl.exe 41 PID 1044 wrote to memory of 2940 1044 rxlrfrl.exe 41 PID 1044 wrote to memory of 2940 1044 rxlrfrl.exe 41 PID 2940 wrote to memory of 2896 2940 btnhhh.exe 42 PID 2940 wrote to memory of 2896 2940 btnhhh.exe 42 PID 2940 wrote to memory of 2896 2940 btnhhh.exe 42 PID 2940 wrote to memory of 2896 2940 btnhhh.exe 42 PID 2896 wrote to memory of 2120 2896 dvvdp.exe 43 PID 2896 wrote to memory of 2120 2896 dvvdp.exe 43 PID 2896 wrote to memory of 2120 2896 dvvdp.exe 43 PID 2896 wrote to memory of 2120 2896 dvvdp.exe 43 PID 2120 wrote to memory of 3000 2120 lxrxlrx.exe 44 PID 2120 wrote to memory of 3000 2120 lxrxlrx.exe 44 PID 2120 wrote to memory of 3000 2120 lxrxlrx.exe 44 PID 2120 wrote to memory of 3000 2120 lxrxlrx.exe 44 PID 3000 wrote to memory of 1580 3000 xlrxffr.exe 45 PID 3000 wrote to memory of 1580 3000 xlrxffr.exe 45 PID 3000 wrote to memory of 1580 3000 xlrxffr.exe 45 PID 3000 wrote to memory of 1580 3000 xlrxffr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe"C:\Users\Admin\AppData\Local\Temp\6c9f1d4db12ffa97658705b5f2d0627731969f346b9d0646268c5b76c0f0724c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\nbbtbt.exec:\nbbtbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rlxfxrf.exec:\rlxfxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\hnnbbh.exec:\hnnbbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\jdjpj.exec:\jdjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rlrrxlr.exec:\rlrrxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dpdpd.exec:\dpdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rlxlfrf.exec:\rlxlfrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\hbtbtt.exec:\hbtbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\pdvvj.exec:\pdvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\rxlrfrl.exec:\rxlrfrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\btnhhh.exec:\btnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\dvvdp.exec:\dvvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\lxrxlrx.exec:\lxrxlrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\xlrxffr.exec:\xlrxffr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\bthnbh.exec:\bthnbh.exe17⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvjjv.exec:\jvjjv.exe18⤵
- Executes dropped EXE
PID:1764 -
\??\c:\rrlrlfr.exec:\rrlrlfr.exe19⤵
- Executes dropped EXE
PID:2352 -
\??\c:\ntbbhn.exec:\ntbbhn.exe20⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5dvjd.exec:\5dvjd.exe21⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rllrfrf.exec:\rllrfrf.exe22⤵
- Executes dropped EXE
PID:760 -
\??\c:\5bnhth.exec:\5bnhth.exe23⤵
- Executes dropped EXE
PID:2284 -
\??\c:\jdpdp.exec:\jdpdp.exe24⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rxlrffx.exec:\rxlrffx.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\btthhn.exec:\btthhn.exe26⤵
- Executes dropped EXE
PID:1644 -
\??\c:\pppvj.exec:\pppvj.exe27⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3frrxfr.exec:\3frrxfr.exe28⤵
- Executes dropped EXE
PID:2216 -
\??\c:\7djdv.exec:\7djdv.exe29⤵
- Executes dropped EXE
PID:1892 -
\??\c:\thhthn.exec:\thhthn.exe30⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1jpjd.exec:\1jpjd.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\5dppv.exec:\5dppv.exe32⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lllfrxf.exec:\lllfrxf.exe33⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hnhhnt.exec:\hnhhnt.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\pvpvj.exec:\pvpvj.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lxrffll.exec:\lxrffll.exe36⤵
- Executes dropped EXE
PID:2260 -
\??\c:\bntbnn.exec:\bntbnn.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2776 -
\??\c:\bttbbn.exec:\bttbbn.exe38⤵
- Executes dropped EXE
PID:1172 -
\??\c:\9jjpd.exec:\9jjpd.exe39⤵
- Executes dropped EXE
PID:2636 -
\??\c:\lfflxxx.exec:\lfflxxx.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xxxlrfx.exec:\xxxlrfx.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nbhbbn.exec:\nbhbbn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1888 -
\??\c:\vdppd.exec:\vdppd.exe43⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xfrlllr.exec:\xfrlllr.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe45⤵
- Executes dropped EXE
PID:2040 -
\??\c:\hnhntn.exec:\hnhntn.exe46⤵
- Executes dropped EXE
PID:1040 -
\??\c:\3pvjj.exec:\3pvjj.exe47⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dppjj.exec:\dppjj.exe48⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rlxlxrr.exec:\rlxlxrr.exe49⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhhnbn.exec:\nhhnbn.exe50⤵
- Executes dropped EXE
PID:1504 -
\??\c:\1pvvj.exec:\1pvvj.exe51⤵
- Executes dropped EXE
PID:1272 -
\??\c:\flllxxx.exec:\flllxxx.exe52⤵
- Executes dropped EXE
PID:1900 -
\??\c:\xfxrxrr.exec:\xfxrxrr.exe53⤵
- Executes dropped EXE
PID:1860 -
\??\c:\btnttt.exec:\btnttt.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\pdvpv.exec:\pdvpv.exe55⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xrlrflx.exec:\xrlrflx.exe56⤵
- Executes dropped EXE
PID:2352 -
\??\c:\7flxrxx.exec:\7flxrxx.exe57⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bbttht.exec:\bbttht.exe58⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pddpd.exec:\pddpd.exe59⤵
- Executes dropped EXE
PID:1628 -
\??\c:\fxrrrrx.exec:\fxrrrrx.exe60⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5hthnb.exec:\5hthnb.exe61⤵
- Executes dropped EXE
PID:276 -
\??\c:\jdpjj.exec:\jdpjj.exe62⤵
- Executes dropped EXE
PID:2484 -
\??\c:\pdpvv.exec:\pdpvv.exe63⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xfxrfrx.exec:\xfxrfrx.exe64⤵
- Executes dropped EXE
PID:1528 -
\??\c:\hththb.exec:\hththb.exe65⤵
- Executes dropped EXE
PID:1184 -
\??\c:\vdjdd.exec:\vdjdd.exe66⤵PID:2332
-
\??\c:\ddddj.exec:\ddddj.exe67⤵PID:1816
-
\??\c:\ffxrfxf.exec:\ffxrfxf.exe68⤵PID:1692
-
\??\c:\hnthnn.exec:\hnthnn.exe69⤵PID:884
-
\??\c:\pdvdd.exec:\pdvdd.exe70⤵PID:2540
-
\??\c:\xlfxlff.exec:\xlfxlff.exe71⤵PID:2428
-
\??\c:\bthntt.exec:\bthntt.exe72⤵PID:2076
-
\??\c:\pvddv.exec:\pvddv.exe73⤵PID:2060
-
\??\c:\jjppv.exec:\jjppv.exe74⤵PID:2736
-
\??\c:\lxlxfrf.exec:\lxlxfrf.exe75⤵PID:2856
-
\??\c:\xxxrxfr.exec:\xxxrxfr.exe76⤵PID:2772
-
\??\c:\9bhhhb.exec:\9bhhhb.exe77⤵PID:2872
-
\??\c:\jvpjp.exec:\jvpjp.exe78⤵PID:2864
-
\??\c:\frflxff.exec:\frflxff.exe79⤵PID:2796
-
\??\c:\hhbthb.exec:\hhbthb.exe80⤵PID:2908
-
\??\c:\vjjpd.exec:\vjjpd.exe81⤵PID:2684
-
\??\c:\hnbhnn.exec:\hnbhnn.exe82⤵PID:1296
-
\??\c:\3nhbnb.exec:\3nhbnb.exe83⤵
- System Location Discovery: System Language Discovery
PID:2008 -
\??\c:\3lxrfxf.exec:\3lxrfxf.exe84⤵PID:684
-
\??\c:\lrlfffl.exec:\lrlfffl.exe85⤵PID:1048
-
\??\c:\thbhhn.exec:\thbhhn.exe86⤵PID:2980
-
\??\c:\vdddd.exec:\vdddd.exe87⤵PID:1520
-
\??\c:\9ffflfr.exec:\9ffflfr.exe88⤵PID:3012
-
\??\c:\llxrflx.exec:\llxrflx.exe89⤵PID:2896
-
\??\c:\1btnnn.exec:\1btnnn.exe90⤵PID:2932
-
\??\c:\dpddp.exec:\dpddp.exe91⤵PID:672
-
\??\c:\jvjpv.exec:\jvjpv.exe92⤵PID:1516
-
\??\c:\fxllxrr.exec:\fxllxrr.exe93⤵PID:1532
-
\??\c:\3lllfxr.exec:\3lllfxr.exe94⤵PID:2052
-
\??\c:\bhhbbt.exec:\bhhbbt.exe95⤵PID:1944
-
\??\c:\vpvdv.exec:\vpvdv.exe96⤵PID:840
-
\??\c:\jdpjv.exec:\jdpjv.exe97⤵PID:2156
-
\??\c:\ffxffxl.exec:\ffxffxl.exe98⤵PID:1060
-
\??\c:\hhhtht.exec:\hhhtht.exe99⤵PID:760
-
\??\c:\hbtntt.exec:\hbtntt.exe100⤵PID:1356
-
\??\c:\3jvvv.exec:\3jvvv.exe101⤵PID:1092
-
\??\c:\ffrfllr.exec:\ffrfllr.exe102⤵PID:1652
-
\??\c:\bntbnt.exec:\bntbnt.exe103⤵PID:2176
-
\??\c:\thnhbt.exec:\thnhbt.exe104⤵PID:2220
-
\??\c:\jpjdd.exec:\jpjdd.exe105⤵PID:2204
-
\??\c:\xlfrlxx.exec:\xlfrlxx.exe106⤵PID:3052
-
\??\c:\3ttttn.exec:\3ttttn.exe107⤵PID:1608
-
\??\c:\vpjpd.exec:\vpjpd.exe108⤵PID:852
-
\??\c:\jjpjp.exec:\jjpjp.exe109⤵
- System Location Discovery: System Language Discovery
PID:2072 -
\??\c:\vpvpv.exec:\vpvpv.exe110⤵PID:1600
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe111⤵PID:1716
-
\??\c:\5hthhh.exec:\5hthhh.exe112⤵PID:2228
-
\??\c:\pdpjp.exec:\pdpjp.exe113⤵PID:1720
-
\??\c:\dpvjj.exec:\dpvjj.exe114⤵PID:336
-
\??\c:\lxrxrxl.exec:\lxrxrxl.exe115⤵PID:2852
-
\??\c:\htnbbn.exec:\htnbbn.exe116⤵PID:2900
-
\??\c:\thtbnt.exec:\thtbnt.exe117⤵PID:2828
-
\??\c:\dppvd.exec:\dppvd.exe118⤵PID:2336
-
\??\c:\7rxrllf.exec:\7rxrllf.exe119⤵PID:2764
-
\??\c:\llxlrfr.exec:\llxlrfr.exe120⤵PID:2676
-
\??\c:\htnnnh.exec:\htnnnh.exe121⤵PID:2624
-
\??\c:\nhhthh.exec:\nhhthh.exe122⤵PID:2632
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-