Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 04:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe
-
Size
59KB
-
MD5
c6b0004e44a84f3897464ef81e6b0964
-
SHA1
7e91a91f43e3f6b3b4cfb3b43a93012c480f4ed8
-
SHA256
cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b
-
SHA512
90cbcae3e89b6b6e9a82033f650433e71a1770ba62f3d1589b461df0da995d13ae0d399d83c31e24989698d9c981391483870977838ba2fe911580eb4547eeb0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFYuS:ymb3NkkiQ3mdBjFIFnS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/2792-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2580-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2052-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/816-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1904-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/112-255-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/924-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1552-291-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2380-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2080 vpvdv.exe 2760 rfxfffx.exe 2716 hhhtbn.exe 2560 vvpvv.exe 2712 fxrxlrl.exe 2580 ffrxxll.exe 2944 nnthbn.exe 536 pjddj.exe 980 3lxlrfx.exe 2688 bhbnnn.exe 2824 bnbttt.exe 2052 vpdjj.exe 1920 fxlfrrx.exe 1916 frxxfll.exe 816 nthhbh.exe 1452 vvjpv.exe 1632 9jddv.exe 1904 rrlrxfr.exe 1592 lfrxfrf.exe 2120 7nnthn.exe 3008 nbbbbb.exe 1728 pppvv.exe 1524 pjddd.exe 2900 rllrffx.exe 112 1hbtbn.exe 924 nnbhnn.exe 1200 jdjpv.exe 2788 ppppd.exe 1552 fxrlrrf.exe 1956 bbbbnt.exe 2380 3jddj.exe 2792 lxflxxf.exe 3020 1hbhnn.exe 1544 9hthhn.exe 1548 ppjpp.exe 2612 3pvdj.exe 2716 ffrxffl.exe 2104 1fffrxl.exe 2508 3hntbn.exe 2928 tttnbt.exe 2940 pjvvp.exe 1676 ddvdp.exe 988 9rfxxxf.exe 332 5xlfrxl.exe 1412 nnntbn.exe 980 1hnnbh.exe 2816 ttntbh.exe 2812 vjpjv.exe 2284 3jdjj.exe 2280 lfxflll.exe 1968 xfxxlxf.exe 1624 ntbbbb.exe 2684 1tnhht.exe 1900 1vjpj.exe 1872 5jpvd.exe 1864 fxlxxxf.exe 2064 9ffflxx.exe 1696 5thhnh.exe 2036 bttntb.exe 2340 jpdvv.exe 2108 vpppd.exe 1728 1lfxxxr.exe 596 fllxllx.exe 884 tnbbhn.exe -
resource yara_rule behavioral1/memory/2792-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2580-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2052-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1920-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/816-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1632-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1904-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/112-255-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/924-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-273-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1552-291-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2380-309-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2792 wrote to memory of 2080 2792 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 28 PID 2792 wrote to memory of 2080 2792 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 28 PID 2792 wrote to memory of 2080 2792 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 28 PID 2792 wrote to memory of 2080 2792 cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe 28 PID 2080 wrote to memory of 2760 2080 vpvdv.exe 29 PID 2080 wrote to memory of 2760 2080 vpvdv.exe 29 PID 2080 wrote to memory of 2760 2080 vpvdv.exe 29 PID 2080 wrote to memory of 2760 2080 vpvdv.exe 29 PID 2760 wrote to memory of 2716 2760 rfxfffx.exe 30 PID 2760 wrote to memory of 2716 2760 rfxfffx.exe 30 PID 2760 wrote to memory of 2716 2760 rfxfffx.exe 30 PID 2760 wrote to memory of 2716 2760 rfxfffx.exe 30 PID 2716 wrote to memory of 2560 2716 hhhtbn.exe 31 PID 2716 wrote to memory of 2560 2716 hhhtbn.exe 31 PID 2716 wrote to memory of 2560 2716 hhhtbn.exe 31 PID 2716 wrote to memory of 2560 2716 hhhtbn.exe 31 PID 2560 wrote to memory of 2712 2560 vvpvv.exe 32 PID 2560 wrote to memory of 2712 2560 vvpvv.exe 32 PID 2560 wrote to memory of 2712 2560 vvpvv.exe 32 PID 2560 wrote to memory of 2712 2560 vvpvv.exe 32 PID 2712 wrote to memory of 2580 2712 fxrxlrl.exe 33 PID 2712 wrote to memory of 2580 2712 fxrxlrl.exe 33 PID 2712 wrote to memory of 2580 2712 fxrxlrl.exe 33 PID 2712 wrote to memory of 2580 2712 fxrxlrl.exe 33 PID 2580 wrote to memory of 2944 2580 ffrxxll.exe 34 PID 2580 wrote to memory of 2944 2580 ffrxxll.exe 34 PID 2580 wrote to memory of 2944 2580 ffrxxll.exe 34 PID 2580 wrote to memory of 2944 2580 ffrxxll.exe 34 PID 2944 wrote to memory of 536 2944 nnthbn.exe 35 PID 2944 wrote to memory of 536 2944 nnthbn.exe 35 PID 2944 wrote to memory of 536 2944 nnthbn.exe 35 PID 2944 wrote to memory of 536 2944 nnthbn.exe 35 PID 536 wrote to memory of 980 536 pjddj.exe 36 PID 536 wrote to memory of 980 536 pjddj.exe 36 PID 536 wrote to memory of 980 536 pjddj.exe 36 PID 536 wrote to memory of 980 536 pjddj.exe 36 PID 980 wrote to memory of 2688 980 3lxlrfx.exe 37 PID 980 wrote to memory of 2688 980 3lxlrfx.exe 37 PID 980 wrote to memory of 2688 980 3lxlrfx.exe 37 PID 980 wrote to memory of 2688 980 3lxlrfx.exe 37 PID 2688 wrote to memory of 2824 2688 bhbnnn.exe 38 PID 2688 wrote to memory of 2824 2688 bhbnnn.exe 38 PID 2688 wrote to memory of 2824 2688 bhbnnn.exe 38 PID 2688 wrote to memory of 2824 2688 bhbnnn.exe 38 PID 2824 wrote to memory of 2052 2824 bnbttt.exe 39 PID 2824 wrote to memory of 2052 2824 bnbttt.exe 39 PID 2824 wrote to memory of 2052 2824 bnbttt.exe 39 PID 2824 wrote to memory of 2052 2824 bnbttt.exe 39 PID 2052 wrote to memory of 1920 2052 vpdjj.exe 40 PID 2052 wrote to memory of 1920 2052 vpdjj.exe 40 PID 2052 wrote to memory of 1920 2052 vpdjj.exe 40 PID 2052 wrote to memory of 1920 2052 vpdjj.exe 40 PID 1920 wrote to memory of 1916 1920 fxlfrrx.exe 41 PID 1920 wrote to memory of 1916 1920 fxlfrrx.exe 41 PID 1920 wrote to memory of 1916 1920 fxlfrrx.exe 41 PID 1920 wrote to memory of 1916 1920 fxlfrrx.exe 41 PID 1916 wrote to memory of 816 1916 frxxfll.exe 42 PID 1916 wrote to memory of 816 1916 frxxfll.exe 42 PID 1916 wrote to memory of 816 1916 frxxfll.exe 42 PID 1916 wrote to memory of 816 1916 frxxfll.exe 42 PID 816 wrote to memory of 1452 816 nthhbh.exe 43 PID 816 wrote to memory of 1452 816 nthhbh.exe 43 PID 816 wrote to memory of 1452 816 nthhbh.exe 43 PID 816 wrote to memory of 1452 816 nthhbh.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe"C:\Users\Admin\AppData\Local\Temp\cc69023d29f668e2275b551cb9396cce4353f0ca51f3ab8a3950af0c687df31b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vpvdv.exec:\vpvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\rfxfffx.exec:\rfxfffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\hhhtbn.exec:\hhhtbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\vvpvv.exec:\vvpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxrxlrl.exec:\fxrxlrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\ffrxxll.exec:\ffrxxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nnthbn.exec:\nnthbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\pjddj.exec:\pjddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\3lxlrfx.exec:\3lxlrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\bhbnnn.exec:\bhbnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\bnbttt.exec:\bnbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vpdjj.exec:\vpdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\frxxfll.exec:\frxxfll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\nthhbh.exec:\nthhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\vvjpv.exec:\vvjpv.exe17⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9jddv.exec:\9jddv.exe18⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rrlrxfr.exec:\rrlrxfr.exe19⤵
- Executes dropped EXE
PID:1904 -
\??\c:\lfrxfrf.exec:\lfrxfrf.exe20⤵
- Executes dropped EXE
PID:1592 -
\??\c:\7nnthn.exec:\7nnthn.exe21⤵
- Executes dropped EXE
PID:2120 -
\??\c:\nbbbbb.exec:\nbbbbb.exe22⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pppvv.exec:\pppvv.exe23⤵
- Executes dropped EXE
PID:1728 -
\??\c:\pjddd.exec:\pjddd.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rllrffx.exec:\rllrffx.exe25⤵
- Executes dropped EXE
PID:2900 -
\??\c:\1hbtbn.exec:\1hbtbn.exe26⤵
- Executes dropped EXE
PID:112 -
\??\c:\nnbhnn.exec:\nnbhnn.exe27⤵
- Executes dropped EXE
PID:924 -
\??\c:\jdjpv.exec:\jdjpv.exe28⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ppppd.exec:\ppppd.exe29⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxrlrrf.exec:\fxrlrrf.exe30⤵
- Executes dropped EXE
PID:1552 -
\??\c:\bbbbnt.exec:\bbbbnt.exe31⤵
- Executes dropped EXE
PID:1956 -
\??\c:\3jddj.exec:\3jddj.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lxflxxf.exec:\lxflxxf.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\1hbhnn.exec:\1hbhnn.exe34⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9hthhn.exec:\9hthhn.exe35⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ppjpp.exec:\ppjpp.exe36⤵
- Executes dropped EXE
PID:1548 -
\??\c:\3pvdj.exec:\3pvdj.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\ffrxffl.exec:\ffrxffl.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1fffrxl.exec:\1fffrxl.exe39⤵
- Executes dropped EXE
PID:2104 -
\??\c:\3hntbn.exec:\3hntbn.exe40⤵
- Executes dropped EXE
PID:2508 -
\??\c:\tttnbt.exec:\tttnbt.exe41⤵
- Executes dropped EXE
PID:2928 -
\??\c:\pjvvp.exec:\pjvvp.exe42⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ddvdp.exec:\ddvdp.exe43⤵
- Executes dropped EXE
PID:1676 -
\??\c:\9rfxxxf.exec:\9rfxxxf.exe44⤵
- Executes dropped EXE
PID:988 -
\??\c:\5xlfrxl.exec:\5xlfrxl.exe45⤵
- Executes dropped EXE
PID:332 -
\??\c:\nnntbn.exec:\nnntbn.exe46⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1hnnbh.exec:\1hnnbh.exe47⤵
- Executes dropped EXE
PID:980 -
\??\c:\ttntbh.exec:\ttntbh.exe48⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vjpjv.exec:\vjpjv.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3jdjj.exec:\3jdjj.exe50⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lfxflll.exec:\lfxflll.exe51⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xfxxlxf.exec:\xfxxlxf.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ntbbbb.exec:\ntbbbb.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1tnhht.exec:\1tnhht.exe54⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1vjpj.exec:\1vjpj.exe55⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5jpvd.exec:\5jpvd.exe56⤵
- Executes dropped EXE
PID:1872 -
\??\c:\fxlxxxf.exec:\fxlxxxf.exe57⤵
- Executes dropped EXE
PID:1864 -
\??\c:\9ffflxx.exec:\9ffflxx.exe58⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5thhnh.exec:\5thhnh.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bttntb.exec:\bttntb.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\jpdvv.exec:\jpdvv.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vpppd.exec:\vpppd.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\1lfxxxr.exec:\1lfxxxr.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\fllxllx.exec:\fllxllx.exe64⤵
- Executes dropped EXE
PID:596 -
\??\c:\tnbbhn.exec:\tnbbhn.exe65⤵
- Executes dropped EXE
PID:884 -
\??\c:\pvdvd.exec:\pvdvd.exe66⤵PID:1368
-
\??\c:\pjvdd.exec:\pjvdd.exe67⤵PID:1028
-
\??\c:\rrllrfl.exec:\rrllrfl.exe68⤵PID:1724
-
\??\c:\lfffrrf.exec:\lfffrrf.exe69⤵PID:1200
-
\??\c:\nbtnth.exec:\nbtnth.exe70⤵PID:2012
-
\??\c:\jdjjp.exec:\jdjjp.exe71⤵PID:1172
-
\??\c:\jvppj.exec:\jvppj.exe72⤵PID:1552
-
\??\c:\xfxrfxf.exec:\xfxrfxf.exe73⤵PID:1956
-
\??\c:\5rxfxfx.exec:\5rxfxfx.exe74⤵PID:2220
-
\??\c:\nhtthh.exec:\nhtthh.exe75⤵PID:2388
-
\??\c:\nhttbb.exec:\nhttbb.exe76⤵PID:1600
-
\??\c:\thbhnb.exec:\thbhnb.exe77⤵PID:1432
-
\??\c:\pjjvd.exec:\pjjvd.exe78⤵PID:1652
-
\??\c:\flxrrxf.exec:\flxrrxf.exe79⤵PID:1548
-
\??\c:\rflfrxl.exec:\rflfrxl.exe80⤵PID:2772
-
\??\c:\9hbnbb.exec:\9hbnbb.exe81⤵PID:2716
-
\??\c:\nnhttb.exec:\nnhttb.exe82⤵PID:2104
-
\??\c:\dvdjv.exec:\dvdjv.exe83⤵PID:2532
-
\??\c:\jvjjp.exec:\jvjjp.exe84⤵PID:2596
-
\??\c:\jddjd.exec:\jddjd.exe85⤵PID:2580
-
\??\c:\5xrxffl.exec:\5xrxffl.exe86⤵PID:1576
-
\??\c:\lxllllx.exec:\lxllllx.exe87⤵PID:1960
-
\??\c:\hnnhtn.exec:\hnnhtn.exe88⤵PID:540
-
\??\c:\jvppj.exec:\jvppj.exe89⤵PID:1412
-
\??\c:\dvddj.exec:\dvddj.exe90⤵PID:980
-
\??\c:\pvddv.exec:\pvddv.exe91⤵PID:2816
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe92⤵PID:2500
-
\??\c:\bnhbtt.exec:\bnhbtt.exe93⤵PID:2284
-
\??\c:\htnttt.exec:\htnttt.exe94⤵PID:356
-
\??\c:\3vvjp.exec:\3vvjp.exe95⤵
- System Location Discovery: System Language Discovery
PID:2224 -
\??\c:\jvpjv.exec:\jvpjv.exe96⤵PID:1800
-
\??\c:\xrrxlrf.exec:\xrrxlrf.exe97⤵PID:2684
-
\??\c:\rxfxlll.exec:\rxfxlll.exe98⤵PID:2024
-
\??\c:\hnbtnt.exec:\hnbtnt.exe99⤵PID:1896
-
\??\c:\7tbntb.exec:\7tbntb.exe100⤵PID:1864
-
\??\c:\jdpjv.exec:\jdpjv.exe101⤵PID:2064
-
\??\c:\dvpdp.exec:\dvpdp.exe102⤵PID:748
-
\??\c:\xrfrrlr.exec:\xrfrrlr.exe103⤵PID:2424
-
\??\c:\llflrfl.exec:\llflrfl.exe104⤵PID:2148
-
\??\c:\xlxxffr.exec:\xlxxffr.exe105⤵PID:2108
-
\??\c:\nnhnbt.exec:\nnhnbt.exe106⤵PID:1728
-
\??\c:\9nnhtb.exec:\9nnhtb.exe107⤵PID:596
-
\??\c:\ppvvj.exec:\ppvvj.exe108⤵PID:884
-
\??\c:\jjddv.exec:\jjddv.exe109⤵PID:1368
-
\??\c:\xfrrfrf.exec:\xfrrfrf.exe110⤵PID:1028
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe111⤵PID:2184
-
\??\c:\btbhnn.exec:\btbhnn.exe112⤵PID:1200
-
\??\c:\3ntnbt.exec:\3ntnbt.exe113⤵PID:1308
-
\??\c:\vvddj.exec:\vvddj.exe114⤵PID:1172
-
\??\c:\9vvdd.exec:\9vvdd.exe115⤵PID:1596
-
\??\c:\dvjvj.exec:\dvjvj.exe116⤵PID:1956
-
\??\c:\3flllrf.exec:\3flllrf.exe117⤵PID:1588
-
\??\c:\5tnthh.exec:\5tnthh.exe118⤵PID:2744
-
\??\c:\tbnhnh.exec:\tbnhnh.exe119⤵PID:2604
-
\??\c:\jjddd.exec:\jjddd.exe120⤵PID:2132
-
\??\c:\3vjjd.exec:\3vjjd.exe121⤵PID:2584
-
\??\c:\fxlrxxx.exec:\fxlrxxx.exe122⤵PID:2488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-