Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
Resource
win7-20240903-en
General
-
Target
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
-
Size
75KB
-
MD5
f0985b9122826e1f02a9b5c048e6eee4
-
SHA1
78296346200467974c34120e7d6ea37842c079c1
-
SHA256
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7
-
SHA512
148b7583855d3c68365ecbd98499f2c6c4fe4959eace5111bb07a2894d81b8e57d2dfade487418bb0abc2fd96a6125556bd2a86273fef7eab01a82a4c76bd51c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsL:ymb3NkkiQ3mdBjFIvl358nLA89OMFVH1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-3-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/992-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1496-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2936-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2036-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1000-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/276-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjdpv.exenbhtbt.exevdvpv.exe3rxlxrr.exehntttt.exebhnbht.exejpjdp.exeflxrrrx.exetnnbhh.exe1jpvd.exexfrlxrx.exexxfrxxx.exehntbhh.exeppvjd.exeppjdv.exexfrllfx.exettthbb.exenbntht.exe7vdvv.exe3rrxrlr.exexlflxlf.exehtthth.exetbbnbt.exejppvp.exerxlffxf.exetbtbnt.exedjvjp.exepvjdj.exeflxxxrx.exe1ntnhb.exentbtbb.exe9dpdd.exerxxrffl.exerlfflrx.exehhttnb.exettnhhn.exejpvpp.exevvvjp.exellflxfr.exebbtttn.exetnbbhh.exelrfxlfl.exelxllrlr.exenbhhnh.exehbnbtn.exeddvpv.exepjpjp.exeflrflll.exetbnhhb.exettthbt.exe1tbntn.exe5jpjv.exepjdvd.exexfrfllr.exerrrfffx.exe3hbhtb.exenntbnt.exehhhhbh.exevjvvd.exedjvpd.exexrrfxxf.exelfflrxr.exe9tbbtb.exe9jvjv.exepid process 2712 jjdpv.exe 2920 nbhtbt.exe 2720 vdvpv.exe 1952 3rxlxrr.exe 2784 hntttt.exe 1172 bhnbht.exe 2992 jpjdp.exe 2908 flxrrrx.exe 2700 tnnbhh.exe 2244 1jpvd.exe 1112 xfrlxrx.exe 992 xxfrxxx.exe 1496 hntbhh.exe 2936 ppvjd.exe 2036 ppjdv.exe 1272 xfrllfx.exe 1964 ttthbb.exe 1860 nbntht.exe 2996 7vdvv.exe 556 3rrxrlr.exe 2496 xlflxlf.exe 1000 htthth.exe 2208 tbbnbt.exe 276 jppvp.exe 2484 rxlffxf.exe 2224 tbtbnt.exe 2176 djvjp.exe 1968 pvjdj.exe 896 flxxxrx.exe 1692 1ntnhb.exe 2540 ntbtbb.exe 2072 9dpdd.exe 2712 rxxrffl.exe 2376 rlfflrx.exe 2288 hhttnb.exe 2260 ttnhhn.exe 2732 jpvpp.exe 2760 vvvjp.exe 3056 llflxfr.exe 2656 bbtttn.exe 2764 tnbbhh.exe 2640 lrfxlfl.exe 1812 lxllrlr.exe 2700 nbhhnh.exe 1040 hbnbtn.exe 1624 ddvpv.exe 2972 pjpjp.exe 2688 flrflll.exe 1244 tbnhhb.exe 2532 ttthbt.exe 2988 1tbntn.exe 672 5jpjv.exe 1532 pjdvd.exe 2360 xfrfllr.exe 2168 rrrfffx.exe 1944 3hbhtb.exe 2320 nntbnt.exe 2156 hhhhbh.exe 1956 vjvvd.exe 2608 djvpd.exe 2284 xrrfxxf.exe 708 lfflrxr.exe 316 9tbbtb.exe 2464 9jvjv.exe -
Processes:
resource yara_rule behavioral1/memory/1924-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1952-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1172-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1112-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/992-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1496-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2936-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2036-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1000-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/276-236-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-245-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-263-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rflrfxl.exe9vdjd.exehbnbtn.exexxlxflx.exefxxfrxl.exedjvdd.exe7vjdj.exelrxrrrr.exedjjvv.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exejjdpv.exenbhtbt.exevdvpv.exe3rxlxrr.exehntttt.exebhnbht.exejpjdp.exeflxrrrx.exetnnbhh.exe1jpvd.exexfrlxrx.exexxfrxxx.exehntbhh.exeppvjd.exeppjdv.exedescription pid process target process PID 1924 wrote to memory of 2712 1924 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe jjdpv.exe PID 1924 wrote to memory of 2712 1924 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe jjdpv.exe PID 1924 wrote to memory of 2712 1924 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe jjdpv.exe PID 1924 wrote to memory of 2712 1924 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe jjdpv.exe PID 2712 wrote to memory of 2920 2712 jjdpv.exe nbhtbt.exe PID 2712 wrote to memory of 2920 2712 jjdpv.exe nbhtbt.exe PID 2712 wrote to memory of 2920 2712 jjdpv.exe nbhtbt.exe PID 2712 wrote to memory of 2920 2712 jjdpv.exe nbhtbt.exe PID 2920 wrote to memory of 2720 2920 nbhtbt.exe vdvpv.exe PID 2920 wrote to memory of 2720 2920 nbhtbt.exe vdvpv.exe PID 2920 wrote to memory of 2720 2920 nbhtbt.exe vdvpv.exe PID 2920 wrote to memory of 2720 2920 nbhtbt.exe vdvpv.exe PID 2720 wrote to memory of 1952 2720 vdvpv.exe 3rxlxrr.exe PID 2720 wrote to memory of 1952 2720 vdvpv.exe 3rxlxrr.exe PID 2720 wrote to memory of 1952 2720 vdvpv.exe 3rxlxrr.exe PID 2720 wrote to memory of 1952 2720 vdvpv.exe 3rxlxrr.exe PID 1952 wrote to memory of 2784 1952 3rxlxrr.exe hntttt.exe PID 1952 wrote to memory of 2784 1952 3rxlxrr.exe hntttt.exe PID 1952 wrote to memory of 2784 1952 3rxlxrr.exe hntttt.exe PID 1952 wrote to memory of 2784 1952 3rxlxrr.exe hntttt.exe PID 2784 wrote to memory of 1172 2784 hntttt.exe bhnbht.exe PID 2784 wrote to memory of 1172 2784 hntttt.exe bhnbht.exe PID 2784 wrote to memory of 1172 2784 hntttt.exe bhnbht.exe PID 2784 wrote to memory of 1172 2784 hntttt.exe bhnbht.exe PID 1172 wrote to memory of 2992 1172 bhnbht.exe jpjdp.exe PID 1172 wrote to memory of 2992 1172 bhnbht.exe jpjdp.exe PID 1172 wrote to memory of 2992 1172 bhnbht.exe jpjdp.exe PID 1172 wrote to memory of 2992 1172 bhnbht.exe jpjdp.exe PID 2992 wrote to memory of 2908 2992 jpjdp.exe flxrrrx.exe PID 2992 wrote to memory of 2908 2992 jpjdp.exe flxrrrx.exe PID 2992 wrote to memory of 2908 2992 jpjdp.exe flxrrrx.exe PID 2992 wrote to memory of 2908 2992 jpjdp.exe flxrrrx.exe PID 2908 wrote to memory of 2700 2908 flxrrrx.exe tnnbhh.exe PID 2908 wrote to memory of 2700 2908 flxrrrx.exe tnnbhh.exe PID 2908 wrote to memory of 2700 2908 flxrrrx.exe tnnbhh.exe PID 2908 wrote to memory of 2700 2908 flxrrrx.exe tnnbhh.exe PID 2700 wrote to memory of 2244 2700 tnnbhh.exe 1jpvd.exe PID 2700 wrote to memory of 2244 2700 tnnbhh.exe 1jpvd.exe PID 2700 wrote to memory of 2244 2700 tnnbhh.exe 1jpvd.exe PID 2700 wrote to memory of 2244 2700 tnnbhh.exe 1jpvd.exe PID 2244 wrote to memory of 1112 2244 1jpvd.exe xfrlxrx.exe PID 2244 wrote to memory of 1112 2244 1jpvd.exe xfrlxrx.exe PID 2244 wrote to memory of 1112 2244 1jpvd.exe xfrlxrx.exe PID 2244 wrote to memory of 1112 2244 1jpvd.exe xfrlxrx.exe PID 1112 wrote to memory of 992 1112 xfrlxrx.exe xxfrxxx.exe PID 1112 wrote to memory of 992 1112 xfrlxrx.exe xxfrxxx.exe PID 1112 wrote to memory of 992 1112 xfrlxrx.exe xxfrxxx.exe PID 1112 wrote to memory of 992 1112 xfrlxrx.exe xxfrxxx.exe PID 992 wrote to memory of 1496 992 xxfrxxx.exe hntbhh.exe PID 992 wrote to memory of 1496 992 xxfrxxx.exe hntbhh.exe PID 992 wrote to memory of 1496 992 xxfrxxx.exe hntbhh.exe PID 992 wrote to memory of 1496 992 xxfrxxx.exe hntbhh.exe PID 1496 wrote to memory of 2936 1496 hntbhh.exe ppvjd.exe PID 1496 wrote to memory of 2936 1496 hntbhh.exe ppvjd.exe PID 1496 wrote to memory of 2936 1496 hntbhh.exe ppvjd.exe PID 1496 wrote to memory of 2936 1496 hntbhh.exe ppvjd.exe PID 2936 wrote to memory of 2036 2936 ppvjd.exe ppjdv.exe PID 2936 wrote to memory of 2036 2936 ppvjd.exe ppjdv.exe PID 2936 wrote to memory of 2036 2936 ppvjd.exe ppjdv.exe PID 2936 wrote to memory of 2036 2936 ppvjd.exe ppjdv.exe PID 2036 wrote to memory of 1272 2036 ppjdv.exe xfrllfx.exe PID 2036 wrote to memory of 1272 2036 ppjdv.exe xfrllfx.exe PID 2036 wrote to memory of 1272 2036 ppjdv.exe xfrllfx.exe PID 2036 wrote to memory of 1272 2036 ppjdv.exe xfrllfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\jjdpv.exec:\jjdpv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nbhtbt.exec:\nbhtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\vdvpv.exec:\vdvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3rxlxrr.exec:\3rxlxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\hntttt.exec:\hntttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\bhnbht.exec:\bhnbht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\jpjdp.exec:\jpjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\flxrrrx.exec:\flxrrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\tnnbhh.exec:\tnnbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\1jpvd.exec:\1jpvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\xfrlxrx.exec:\xfrlxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\xxfrxxx.exec:\xxfrxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\hntbhh.exec:\hntbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\ppvjd.exec:\ppvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\ppjdv.exec:\ppjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\xfrllfx.exec:\xfrllfx.exe17⤵
- Executes dropped EXE
PID:1272 -
\??\c:\ttthbb.exec:\ttthbb.exe18⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nbntht.exec:\nbntht.exe19⤵
- Executes dropped EXE
PID:1860 -
\??\c:\7vdvv.exec:\7vdvv.exe20⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3rrxrlr.exec:\3rrxrlr.exe21⤵
- Executes dropped EXE
PID:556 -
\??\c:\xlflxlf.exec:\xlflxlf.exe22⤵
- Executes dropped EXE
PID:2496 -
\??\c:\htthth.exec:\htthth.exe23⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tbbnbt.exec:\tbbnbt.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\jppvp.exec:\jppvp.exe25⤵
- Executes dropped EXE
PID:276 -
\??\c:\rxlffxf.exec:\rxlffxf.exe26⤵
- Executes dropped EXE
PID:2484 -
\??\c:\tbtbnt.exec:\tbtbnt.exe27⤵
- Executes dropped EXE
PID:2224 -
\??\c:\djvjp.exec:\djvjp.exe28⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pvjdj.exec:\pvjdj.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\flxxxrx.exec:\flxxxrx.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\1ntnhb.exec:\1ntnhb.exe31⤵
- Executes dropped EXE
PID:1692 -
\??\c:\ntbtbb.exec:\ntbtbb.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\9dpdd.exec:\9dpdd.exe33⤵
- Executes dropped EXE
PID:2072 -
\??\c:\rxxrffl.exec:\rxxrffl.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\rlfflrx.exec:\rlfflrx.exe35⤵
- Executes dropped EXE
PID:2376 -
\??\c:\hhttnb.exec:\hhttnb.exe36⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ttnhhn.exec:\ttnhhn.exe37⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jpvpp.exec:\jpvpp.exe38⤵
- Executes dropped EXE
PID:2732 -
\??\c:\vvvjp.exec:\vvvjp.exe39⤵
- Executes dropped EXE
PID:2760 -
\??\c:\llflxfr.exec:\llflxfr.exe40⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bbtttn.exec:\bbtttn.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnbbhh.exec:\tnbbhh.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\lrfxlfl.exec:\lrfxlfl.exe43⤵
- Executes dropped EXE
PID:2640 -
\??\c:\lxllrlr.exec:\lxllrlr.exe44⤵
- Executes dropped EXE
PID:1812 -
\??\c:\nbhhnh.exec:\nbhhnh.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hbnbtn.exec:\hbnbtn.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1040 -
\??\c:\ddvpv.exec:\ddvpv.exe47⤵
- Executes dropped EXE
PID:1624 -
\??\c:\pjpjp.exec:\pjpjp.exe48⤵
- Executes dropped EXE
PID:2972 -
\??\c:\flrflll.exec:\flrflll.exe49⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tbnhhb.exec:\tbnhhb.exe50⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ttthbt.exec:\ttthbt.exe51⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1tbntn.exec:\1tbntn.exe52⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5jpjv.exec:\5jpjv.exe53⤵
- Executes dropped EXE
PID:672 -
\??\c:\pjdvd.exec:\pjdvd.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xfrfllr.exec:\xfrfllr.exe55⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rrrfffx.exec:\rrrfffx.exe56⤵
- Executes dropped EXE
PID:2168 -
\??\c:\3hbhtb.exec:\3hbhtb.exe57⤵
- Executes dropped EXE
PID:1944 -
\??\c:\nntbnt.exec:\nntbnt.exe58⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hhhhbh.exec:\hhhhbh.exe59⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vjvvd.exec:\vjvvd.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\djvpd.exec:\djvpd.exe61⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xrrfxxf.exec:\xrrfxxf.exe62⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lfflrxr.exec:\lfflrxr.exe63⤵
- Executes dropped EXE
PID:708 -
\??\c:\9tbbtb.exec:\9tbbtb.exe64⤵
- Executes dropped EXE
PID:316 -
\??\c:\9jvjv.exec:\9jvjv.exe65⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pjddd.exec:\pjddd.exe66⤵PID:2368
-
\??\c:\9flxfxr.exec:\9flxfxr.exe67⤵PID:2612
-
\??\c:\lfxfxlf.exec:\lfxfxlf.exe68⤵PID:3064
-
\??\c:\nnhthb.exec:\nnhthb.exe69⤵PID:1876
-
\??\c:\tttbth.exec:\tttbth.exe70⤵PID:2420
-
\??\c:\dvjjp.exec:\dvjjp.exe71⤵PID:1692
-
\??\c:\vvjvd.exec:\vvjvd.exe72⤵PID:1748
-
\??\c:\xrffrrf.exec:\xrffrrf.exe73⤵PID:1404
-
\??\c:\fllxrxl.exec:\fllxrxl.exe74⤵PID:2572
-
\??\c:\nttnnn.exec:\nttnnn.exe75⤵PID:1136
-
\??\c:\djpjp.exec:\djpjp.exe76⤵PID:2924
-
\??\c:\ddvdj.exec:\ddvdj.exe77⤵PID:2308
-
\??\c:\rlxlflx.exec:\rlxlflx.exe78⤵PID:2848
-
\??\c:\ffrflrf.exec:\ffrflrf.exe79⤵PID:3060
-
\??\c:\1nnntb.exec:\1nnntb.exe80⤵PID:2900
-
\??\c:\nntbhn.exec:\nntbhn.exe81⤵PID:2756
-
\??\c:\3jpjp.exec:\3jpjp.exe82⤵PID:2656
-
\??\c:\9pppp.exec:\9pppp.exe83⤵PID:2908
-
\??\c:\xrrxlxr.exec:\xrrxlxr.exe84⤵PID:572
-
\??\c:\flrlrll.exec:\flrlrll.exe85⤵PID:2008
-
\??\c:\hntntn.exec:\hntntn.exe86⤵PID:2040
-
\??\c:\tbttnn.exec:\tbttnn.exe87⤵PID:2948
-
\??\c:\djpdp.exec:\djpdp.exe88⤵PID:992
-
\??\c:\jdjpj.exec:\jdjpj.exe89⤵PID:2928
-
\??\c:\xlxlflf.exec:\xlxlflf.exe90⤵PID:2956
-
\??\c:\rflffxf.exec:\rflffxf.exe91⤵PID:1072
-
\??\c:\nnbtbt.exec:\nnbtbt.exe92⤵PID:2036
-
\??\c:\tttbbh.exec:\tttbbh.exe93⤵PID:1272
-
\??\c:\dppjv.exec:\dppjv.exe94⤵PID:2272
-
\??\c:\vjpdd.exec:\vjpdd.exe95⤵PID:3032
-
\??\c:\3lrrrxr.exec:\3lrrrxr.exe96⤵PID:1764
-
\??\c:\1lrfrxl.exec:\1lrfrxl.exe97⤵PID:2392
-
\??\c:\bnhhbt.exec:\bnhhbt.exe98⤵PID:556
-
\??\c:\hbttbn.exec:\hbttbn.exe99⤵PID:2132
-
\??\c:\ppjvd.exec:\ppjvd.exe100⤵PID:2184
-
\??\c:\jjvpp.exec:\jjvpp.exe101⤵PID:1308
-
\??\c:\rffxfxf.exec:\rffxfxf.exe102⤵PID:304
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe103⤵PID:1696
-
\??\c:\bnbbhb.exec:\bnbbhb.exe104⤵PID:1092
-
\??\c:\pvjpd.exec:\pvjpd.exe105⤵PID:2224
-
\??\c:\djvpv.exec:\djvpv.exe106⤵PID:3008
-
\??\c:\xrlrlll.exec:\xrlrlll.exe107⤵PID:1336
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe108⤵PID:1908
-
\??\c:\tbhhhn.exec:\tbhhhn.exe109⤵PID:2428
-
\??\c:\vdvjv.exec:\vdvjv.exe110⤵PID:536
-
\??\c:\ppvpp.exec:\ppvpp.exe111⤵PID:1808
-
\??\c:\1rfrrll.exec:\1rfrrll.exe112⤵PID:2576
-
\??\c:\hntnnn.exec:\hntnnn.exe113⤵PID:2552
-
\??\c:\7ntnbh.exec:\7ntnbh.exe114⤵PID:1596
-
\??\c:\ppvdd.exec:\ppvdd.exe115⤵PID:2228
-
\??\c:\5jddp.exec:\5jddp.exe116⤵PID:2840
-
\??\c:\llrffrr.exec:\llrffrr.exe117⤵PID:2260
-
\??\c:\xlfffrx.exec:\xlfffrx.exe118⤵PID:2744
-
\??\c:\7bbntn.exec:\7bbntn.exe119⤵PID:1172
-
\??\c:\djvjd.exec:\djvjd.exe120⤵PID:3068
-
\??\c:\jjjjj.exec:\jjjjj.exe121⤵PID:2912
-
\??\c:\lllxxrr.exec:\lllxxrr.exe122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-