Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe
Resource
win7-20241023-en
7 signatures
150 seconds
General
-
Target
9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe
-
Size
455KB
-
MD5
8d9f18ce52e45149df11a10da21df458
-
SHA1
97428467efb4ea8e9e9d4abdda7c4bb53601dc00
-
SHA256
9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858
-
SHA512
c7ca5f26c7e51bc8c831c148596963b64ed7ca918708c5990b0d1eb6879ea0a27ad61495910cc6d14dbaf1fff8c7b3d1d969722206e55978594b9bb19fa634aa
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRn:q7Tc2NYHUrAwfMp3CDRn
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1040-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-95-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-148-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2656-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1568-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-364-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1736-452-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-478-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-921-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1608-1010-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1040-1371-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/324-1213-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-711-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1672-691-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-557-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-351-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-300-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-276-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2280-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1256-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 pjppp.exe 2396 4800668.exe 2448 jdjpp.exe 1040 g2064.exe 580 q20406.exe 2988 flrfllx.exe 2940 thtthh.exe 2308 5httht.exe 2836 btttth.exe 2708 420022.exe 2748 2462440.exe 1788 042844.exe 1688 3xllrfl.exe 2656 nnbbbt.exe 1868 vpvjp.exe 1744 tthnhh.exe 1256 0428444.exe 848 42446.exe 1568 6422828.exe 2760 tnntbt.exe 2508 04224.exe 2280 bthhnn.exe 2176 868200.exe 408 dvjdj.exe 2248 llxxxfl.exe 1560 pjvvj.exe 2576 o622444.exe 1944 e08062.exe 1268 jvddp.exe 2648 q22200.exe 1764 2648002.exe 2616 lxrrxxl.exe 2052 6000886.exe 1712 xlxfllx.exe 1112 2482006.exe 2300 5bhhbb.exe 2480 g2228.exe 2536 k60626.exe 2964 jpvjp.exe 2968 26420.exe 2696 lxlrxxf.exe 3000 bthntt.exe 2980 bbhtbh.exe 2936 5nbhtt.exe 2768 lxlllfr.exe 2864 7vjpv.exe 2692 a0624.exe 1724 868848.exe 2880 ddpjv.exe 1688 5rflxfx.exe 1792 04440.exe 1752 1nbhhb.exe 496 a8686.exe 1952 rlxfrlr.exe 2916 8644662.exe 1736 frxrxxx.exe 2676 8606880.exe 1748 u028040.exe 1044 7jvjp.exe 2064 886268.exe 1756 lrflflx.exe 1900 5rrxllr.exe 1340 i446446.exe 1560 a4242.exe -
resource yara_rule behavioral1/memory/2412-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-45-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/580-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-452-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-1024-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-1213-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/932-1052-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-1051-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/776-1031-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-822-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-691-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-648-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-557-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/496-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1256-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-36-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 08600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6460046.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language k80282.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48006.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 2516 2412 9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe 30 PID 2412 wrote to memory of 2516 2412 9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe 30 PID 2412 wrote to memory of 2516 2412 9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe 30 PID 2412 wrote to memory of 2516 2412 9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe 30 PID 2516 wrote to memory of 2396 2516 pjppp.exe 666 PID 2516 wrote to memory of 2396 2516 pjppp.exe 666 PID 2516 wrote to memory of 2396 2516 pjppp.exe 666 PID 2516 wrote to memory of 2396 2516 pjppp.exe 666 PID 2396 wrote to memory of 2448 2396 4800668.exe 189 PID 2396 wrote to memory of 2448 2396 4800668.exe 189 PID 2396 wrote to memory of 2448 2396 4800668.exe 189 PID 2396 wrote to memory of 2448 2396 4800668.exe 189 PID 2448 wrote to memory of 1040 2448 jdjpp.exe 106 PID 2448 wrote to memory of 1040 2448 jdjpp.exe 106 PID 2448 wrote to memory of 1040 2448 jdjpp.exe 106 PID 2448 wrote to memory of 1040 2448 jdjpp.exe 106 PID 1040 wrote to memory of 580 1040 g2064.exe 34 PID 1040 wrote to memory of 580 1040 g2064.exe 34 PID 1040 wrote to memory of 580 1040 g2064.exe 34 PID 1040 wrote to memory of 580 1040 g2064.exe 34 PID 580 wrote to memory of 2988 580 q20406.exe 35 PID 580 wrote to memory of 2988 580 q20406.exe 35 PID 580 wrote to memory of 2988 580 q20406.exe 35 PID 580 wrote to memory of 2988 580 q20406.exe 35 PID 2988 wrote to memory of 2940 2988 flrfllx.exe 374 PID 2988 wrote to memory of 2940 2988 flrfllx.exe 374 PID 2988 wrote to memory of 2940 2988 flrfllx.exe 374 PID 2988 wrote to memory of 2940 2988 flrfllx.exe 374 PID 2940 wrote to memory of 2308 2940 thtthh.exe 37 PID 2940 wrote to memory of 2308 2940 thtthh.exe 37 PID 2940 wrote to memory of 2308 2940 thtthh.exe 37 PID 2940 wrote to memory of 2308 2940 thtthh.exe 37 PID 2308 wrote to memory of 2836 2308 5httht.exe 38 PID 2308 wrote to memory of 2836 2308 5httht.exe 38 PID 2308 wrote to memory of 2836 2308 5httht.exe 38 PID 2308 wrote to memory of 2836 2308 5httht.exe 38 PID 2836 wrote to memory of 2708 2836 btttth.exe 39 PID 2836 wrote to memory of 2708 2836 btttth.exe 39 PID 2836 wrote to memory of 2708 2836 btttth.exe 39 PID 2836 wrote to memory of 2708 2836 btttth.exe 39 PID 2708 wrote to memory of 2748 2708 420022.exe 40 PID 2708 wrote to memory of 2748 2708 420022.exe 40 PID 2708 wrote to memory of 2748 2708 420022.exe 40 PID 2708 wrote to memory of 2748 2708 420022.exe 40 PID 2748 wrote to memory of 1788 2748 2462440.exe 41 PID 2748 wrote to memory of 1788 2748 2462440.exe 41 PID 2748 wrote to memory of 1788 2748 2462440.exe 41 PID 2748 wrote to memory of 1788 2748 2462440.exe 41 PID 1788 wrote to memory of 1688 1788 042844.exe 42 PID 1788 wrote to memory of 1688 1788 042844.exe 42 PID 1788 wrote to memory of 1688 1788 042844.exe 42 PID 1788 wrote to memory of 1688 1788 042844.exe 42 PID 1688 wrote to memory of 2656 1688 3xllrfl.exe 204 PID 1688 wrote to memory of 2656 1688 3xllrfl.exe 204 PID 1688 wrote to memory of 2656 1688 3xllrfl.exe 204 PID 1688 wrote to memory of 2656 1688 3xllrfl.exe 204 PID 2656 wrote to memory of 1868 2656 nnbbbt.exe 44 PID 2656 wrote to memory of 1868 2656 nnbbbt.exe 44 PID 2656 wrote to memory of 1868 2656 nnbbbt.exe 44 PID 2656 wrote to memory of 1868 2656 nnbbbt.exe 44 PID 1868 wrote to memory of 1744 1868 vpvjp.exe 665 PID 1868 wrote to memory of 1744 1868 vpvjp.exe 665 PID 1868 wrote to memory of 1744 1868 vpvjp.exe 665 PID 1868 wrote to memory of 1744 1868 vpvjp.exe 665
Processes
-
C:\Users\Admin\AppData\Local\Temp\9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe"C:\Users\Admin\AppData\Local\Temp\9358281883e52422f109b35b1e3283e40752446d1254e606c25fa0851f902858.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pjppp.exec:\pjppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\4800668.exec:\4800668.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\jdjpp.exec:\jdjpp.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\g2064.exec:\g2064.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\q20406.exec:\q20406.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\flrfllx.exec:\flrfllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\thtthh.exec:\thtthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\5httht.exec:\5httht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\btttth.exec:\btttth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\420022.exec:\420022.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\2462440.exec:\2462440.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\042844.exec:\042844.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\3xllrfl.exec:\3xllrfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\nnbbbt.exec:\nnbbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\vpvjp.exec:\vpvjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\tthnhh.exec:\tthnhh.exe17⤵
- Executes dropped EXE
PID:1744 -
\??\c:\0428444.exec:\0428444.exe18⤵
- Executes dropped EXE
PID:1256 -
\??\c:\42446.exec:\42446.exe19⤵
- Executes dropped EXE
PID:848 -
\??\c:\6422828.exec:\6422828.exe20⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tnntbt.exec:\tnntbt.exe21⤵
- Executes dropped EXE
PID:2760 -
\??\c:\04224.exec:\04224.exe22⤵
- Executes dropped EXE
PID:2508 -
\??\c:\bthhnn.exec:\bthhnn.exe23⤵
- Executes dropped EXE
PID:2280 -
\??\c:\868200.exec:\868200.exe24⤵
- Executes dropped EXE
PID:2176 -
\??\c:\dvjdj.exec:\dvjdj.exe25⤵
- Executes dropped EXE
PID:408 -
\??\c:\llxxxfl.exec:\llxxxfl.exe26⤵
- Executes dropped EXE
PID:2248 -
\??\c:\pjvvj.exec:\pjvvj.exe27⤵
- Executes dropped EXE
PID:1560 -
\??\c:\o622444.exec:\o622444.exe28⤵
- Executes dropped EXE
PID:2576 -
\??\c:\e08062.exec:\e08062.exe29⤵
- Executes dropped EXE
PID:1944 -
\??\c:\jvddp.exec:\jvddp.exe30⤵
- Executes dropped EXE
PID:1268 -
\??\c:\q22200.exec:\q22200.exe31⤵
- Executes dropped EXE
PID:2648 -
\??\c:\2648002.exec:\2648002.exe32⤵
- Executes dropped EXE
PID:1764 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\6000886.exec:\6000886.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xlxfllx.exec:\xlxfllx.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\2482006.exec:\2482006.exe36⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5bhhbb.exec:\5bhhbb.exe37⤵
- Executes dropped EXE
PID:2300 -
\??\c:\g2228.exec:\g2228.exe38⤵
- Executes dropped EXE
PID:2480 -
\??\c:\k60626.exec:\k60626.exe39⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jpvjp.exec:\jpvjp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\26420.exec:\26420.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lxlrxxf.exec:\lxlrxxf.exe42⤵
- Executes dropped EXE
PID:2696 -
\??\c:\bthntt.exec:\bthntt.exe43⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bbhtbh.exec:\bbhtbh.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\5nbhtt.exec:\5nbhtt.exe45⤵
- Executes dropped EXE
PID:2936 -
\??\c:\lxlllfr.exec:\lxlllfr.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\7vjpv.exec:\7vjpv.exe47⤵
- Executes dropped EXE
PID:2864 -
\??\c:\a0624.exec:\a0624.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\868848.exec:\868848.exe49⤵
- Executes dropped EXE
PID:1724 -
\??\c:\ddpjv.exec:\ddpjv.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5rflxfx.exec:\5rflxfx.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\04440.exec:\04440.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1nbhhb.exec:\1nbhhb.exe53⤵
- Executes dropped EXE
PID:1752 -
\??\c:\a8686.exec:\a8686.exe54⤵
- Executes dropped EXE
PID:496 -
\??\c:\rlxfrlr.exec:\rlxfrlr.exe55⤵
- Executes dropped EXE
PID:1952 -
\??\c:\8644662.exec:\8644662.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\frxrxxx.exec:\frxrxxx.exe57⤵
- Executes dropped EXE
PID:1736 -
\??\c:\8606880.exec:\8606880.exe58⤵
- Executes dropped EXE
PID:2676 -
\??\c:\u028040.exec:\u028040.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\7jvjp.exec:\7jvjp.exe60⤵
- Executes dropped EXE
PID:1044 -
\??\c:\886268.exec:\886268.exe61⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lrflflx.exec:\lrflflx.exe62⤵
- Executes dropped EXE
PID:1756 -
\??\c:\5rrxllr.exec:\5rrxllr.exe63⤵
- Executes dropped EXE
PID:1900 -
\??\c:\i446446.exec:\i446446.exe64⤵
- Executes dropped EXE
PID:1340 -
\??\c:\a4242.exec:\a4242.exe65⤵
- Executes dropped EXE
PID:1560 -
\??\c:\424844.exec:\424844.exe66⤵PID:1532
-
\??\c:\26880.exec:\26880.exe67⤵PID:3068
-
\??\c:\0466880.exec:\0466880.exe68⤵PID:916
-
\??\c:\2628444.exec:\2628444.exe69⤵PID:1268
-
\??\c:\1htntt.exec:\1htntt.exe70⤵PID:568
-
\??\c:\m0808.exec:\m0808.exe71⤵PID:2228
-
\??\c:\60842.exec:\60842.exe72⤵PID:2628
-
\??\c:\5fxxrxf.exec:\5fxxrxf.exe73⤵PID:1536
-
\??\c:\jvppd.exec:\jvppd.exe74⤵PID:2776
-
\??\c:\hbnhhh.exec:\hbnhhh.exe75⤵PID:2608
-
\??\c:\1jppp.exec:\1jppp.exe76⤵PID:2468
-
\??\c:\pdjjd.exec:\pdjjd.exe77⤵PID:2484
-
\??\c:\044022.exec:\044022.exe78⤵PID:1040
-
\??\c:\s2662.exec:\s2662.exe79⤵PID:2536
-
\??\c:\jjdjv.exec:\jjdjv.exe80⤵PID:2216
-
\??\c:\0800606.exec:\0800606.exe81⤵PID:2220
-
\??\c:\2640662.exec:\2640662.exe82⤵PID:2800
-
\??\c:\40068.exec:\40068.exe83⤵PID:2972
-
\??\c:\42406.exec:\42406.exe84⤵PID:2264
-
\??\c:\w86022.exec:\w86022.exe85⤵PID:2740
-
\??\c:\bhntbt.exec:\bhntbt.exe86⤵PID:2720
-
\??\c:\68608.exec:\68608.exe87⤵PID:1996
-
\??\c:\9lrlfxx.exec:\9lrlfxx.exe88⤵PID:632
-
\??\c:\djjdj.exec:\djjdj.exe89⤵PID:1288
-
\??\c:\fxxflfl.exec:\fxxflfl.exe90⤵PID:1800
-
\??\c:\hnhnhb.exec:\hnhnhb.exe91⤵PID:2684
-
\??\c:\fxxxrll.exec:\fxxxrll.exe92⤵PID:1524
-
\??\c:\llllffl.exec:\llllffl.exe93⤵PID:1624
-
\??\c:\8088488.exec:\8088488.exe94⤵PID:2592
-
\??\c:\6866888.exec:\6866888.exe95⤵PID:1260
-
\??\c:\4802828.exec:\4802828.exe96⤵PID:1672
-
\??\c:\a4044.exec:\a4044.exe97⤵PID:3004
-
\??\c:\nbnnnn.exec:\nbnnnn.exe98⤵PID:2916
-
\??\c:\fxxxxrl.exec:\fxxxxrl.exe99⤵PID:2688
-
\??\c:\w08444.exec:\w08444.exe100⤵PID:2676
-
\??\c:\802208.exec:\802208.exe101⤵PID:2888
-
\??\c:\86400.exec:\86400.exe102⤵PID:2780
-
\??\c:\frfxrrx.exec:\frfxrrx.exe103⤵PID:408
-
\??\c:\6084002.exec:\6084002.exe104⤵PID:1244
-
\??\c:\9pddd.exec:\9pddd.exe105⤵PID:1352
-
\??\c:\28666.exec:\28666.exe106⤵PID:1028
-
\??\c:\7dppv.exec:\7dppv.exe107⤵PID:1560
-
\??\c:\btbbhh.exec:\btbbhh.exe108⤵PID:2444
-
\??\c:\frxxxfl.exec:\frxxxfl.exe109⤵PID:912
-
\??\c:\fxrxxlr.exec:\fxrxxlr.exe110⤵PID:892
-
\??\c:\nbhnnt.exec:\nbhnnt.exe111⤵PID:352
-
\??\c:\tnntbt.exec:\tnntbt.exe112⤵PID:1516
-
\??\c:\4248828.exec:\4248828.exe113⤵PID:2108
-
\??\c:\4688484.exec:\4688484.exe114⤵PID:1584
-
\??\c:\082222.exec:\082222.exe115⤵PID:1712
-
\??\c:\m0880.exec:\m0880.exe116⤵PID:688
-
\??\c:\604400.exec:\604400.exe117⤵PID:1716
-
\??\c:\0282222.exec:\0282222.exe118⤵PID:2608
-
\??\c:\8288046.exec:\8288046.exe119⤵PID:3056
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe120⤵PID:2484
-
\??\c:\o644006.exec:\o644006.exe121⤵PID:1040
-
\??\c:\3jppp.exec:\3jppp.exe122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-