Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 05:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe
-
Size
453KB
-
MD5
c5d9399bdf4980b8ad641ab5d17d8a98
-
SHA1
50035fa797db18a83cabb3911c7394f0ca052c36
-
SHA256
efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e
-
SHA512
30347dd145554dd1aed8a09b584542ea8b06e94ca8c7ef36fadd4793531f1fcbb95318e7a9974445e951b068e9b8e0eaf7393a6dad00c78da7b40edb9c77383a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbetX:q7Tc2NYHUrAwfMp3CDtX
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 44 IoCs
resource yara_rule behavioral1/memory/1580-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-36-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1012-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-105-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1408-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-115-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2788-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-130-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2656-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-150-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2964-168-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1908-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-316-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-337-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-352-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2692-359-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-450-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/448-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-537-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/540-544-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-603-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/880-610-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-611-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2576-639-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-646-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2092-655-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2608 84688.exe 2568 602466.exe 2892 nbnhnh.exe 2712 e26206.exe 2720 btnthh.exe 2700 btnbtb.exe 2480 082244.exe 1012 646688.exe 320 dvpvv.exe 1408 6026228.exe 1804 hhthnb.exe 2788 3jpdj.exe 2820 jjdjj.exe 2656 8262402.exe 1316 llxfxfr.exe 2660 ttnntt.exe 2964 rfflffl.exe 2976 7bthbh.exe 2972 pvvpd.exe 904 4862402.exe 2252 dvpvj.exe 1108 q60284.exe 1020 vpjpv.exe 2308 xxlrxxl.exe 3040 fxrxflx.exe 1716 fffrflx.exe 2400 ppjjp.exe 1908 nnbbnt.exe 1500 u840246.exe 752 8202068.exe 1104 rrrrffr.exe 2316 rrrlflr.exe 2736 pdddj.exe 1652 hnhnbn.exe 2692 9pjvv.exe 2612 thttbn.exe 2544 0624024.exe 2728 jjppd.exe 1744 vjjjv.exe 2584 64260.exe 2416 4266440.exe 2468 xrxfrxf.exe 2080 nhbnhh.exe 2488 666840.exe 788 bbnnht.exe 1044 4064444.exe 320 ppdjp.exe 1408 1lflrrl.exe 2780 0828008.exe 2840 1vpdj.exe 2844 hhhnbb.exe 1892 i428686.exe 1640 48246.exe 1596 2606842.exe 1624 3jvvd.exe 2652 tnhbhn.exe 1860 m8262.exe 3004 1hbnbh.exe 2776 440862.exe 2108 8822062.exe 2908 dvjpv.exe 668 660684.exe 1556 486262.exe 448 620688.exe -
resource yara_rule behavioral1/memory/1580-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-162-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2964-170-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2964-168-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3040-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1908-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-316-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/448-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-544-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-577-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1960-603-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/880-610-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1672-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-639-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language m2680.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8206402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60806.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82020.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0862402.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26224.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 840848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a6080.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2246.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2608 1580 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 28 PID 1580 wrote to memory of 2608 1580 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 28 PID 1580 wrote to memory of 2608 1580 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 28 PID 1580 wrote to memory of 2608 1580 efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe 28 PID 2608 wrote to memory of 2568 2608 84688.exe 29 PID 2608 wrote to memory of 2568 2608 84688.exe 29 PID 2608 wrote to memory of 2568 2608 84688.exe 29 PID 2608 wrote to memory of 2568 2608 84688.exe 29 PID 2568 wrote to memory of 2892 2568 602466.exe 30 PID 2568 wrote to memory of 2892 2568 602466.exe 30 PID 2568 wrote to memory of 2892 2568 602466.exe 30 PID 2568 wrote to memory of 2892 2568 602466.exe 30 PID 2892 wrote to memory of 2712 2892 nbnhnh.exe 31 PID 2892 wrote to memory of 2712 2892 nbnhnh.exe 31 PID 2892 wrote to memory of 2712 2892 nbnhnh.exe 31 PID 2892 wrote to memory of 2712 2892 nbnhnh.exe 31 PID 2712 wrote to memory of 2720 2712 e26206.exe 32 PID 2712 wrote to memory of 2720 2712 e26206.exe 32 PID 2712 wrote to memory of 2720 2712 e26206.exe 32 PID 2712 wrote to memory of 2720 2712 e26206.exe 32 PID 2720 wrote to memory of 2700 2720 btnthh.exe 33 PID 2720 wrote to memory of 2700 2720 btnthh.exe 33 PID 2720 wrote to memory of 2700 2720 btnthh.exe 33 PID 2720 wrote to memory of 2700 2720 btnthh.exe 33 PID 2700 wrote to memory of 2480 2700 btnbtb.exe 34 PID 2700 wrote to memory of 2480 2700 btnbtb.exe 34 PID 2700 wrote to memory of 2480 2700 btnbtb.exe 34 PID 2700 wrote to memory of 2480 2700 btnbtb.exe 34 PID 2480 wrote to memory of 1012 2480 082244.exe 35 PID 2480 wrote to memory of 1012 2480 082244.exe 35 PID 2480 wrote to memory of 1012 2480 082244.exe 35 PID 2480 wrote to memory of 1012 2480 082244.exe 35 PID 1012 wrote to memory of 320 1012 646688.exe 36 PID 1012 wrote to memory of 320 1012 646688.exe 36 PID 1012 wrote to memory of 320 1012 646688.exe 36 PID 1012 wrote to memory of 320 1012 646688.exe 36 PID 320 wrote to memory of 1408 320 dvpvv.exe 37 PID 320 wrote to memory of 1408 320 dvpvv.exe 37 PID 320 wrote to memory of 1408 320 dvpvv.exe 37 PID 320 wrote to memory of 1408 320 dvpvv.exe 37 PID 1408 wrote to memory of 1804 1408 6026228.exe 38 PID 1408 wrote to memory of 1804 1408 6026228.exe 38 PID 1408 wrote to memory of 1804 1408 6026228.exe 38 PID 1408 wrote to memory of 1804 1408 6026228.exe 38 PID 1804 wrote to memory of 2788 1804 hhthnb.exe 39 PID 1804 wrote to memory of 2788 1804 hhthnb.exe 39 PID 1804 wrote to memory of 2788 1804 hhthnb.exe 39 PID 1804 wrote to memory of 2788 1804 hhthnb.exe 39 PID 2788 wrote to memory of 2820 2788 3jpdj.exe 40 PID 2788 wrote to memory of 2820 2788 3jpdj.exe 40 PID 2788 wrote to memory of 2820 2788 3jpdj.exe 40 PID 2788 wrote to memory of 2820 2788 3jpdj.exe 40 PID 2820 wrote to memory of 2656 2820 jjdjj.exe 41 PID 2820 wrote to memory of 2656 2820 jjdjj.exe 41 PID 2820 wrote to memory of 2656 2820 jjdjj.exe 41 PID 2820 wrote to memory of 2656 2820 jjdjj.exe 41 PID 2656 wrote to memory of 1316 2656 8262402.exe 42 PID 2656 wrote to memory of 1316 2656 8262402.exe 42 PID 2656 wrote to memory of 1316 2656 8262402.exe 42 PID 2656 wrote to memory of 1316 2656 8262402.exe 42 PID 1316 wrote to memory of 2660 1316 llxfxfr.exe 43 PID 1316 wrote to memory of 2660 1316 llxfxfr.exe 43 PID 1316 wrote to memory of 2660 1316 llxfxfr.exe 43 PID 1316 wrote to memory of 2660 1316 llxfxfr.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"C:\Users\Admin\AppData\Local\Temp\efd50b3a0fd41475d23ff86d24be6efeeb422ce0100cfa6190804df49197d66e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\84688.exec:\84688.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\602466.exec:\602466.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\nbnhnh.exec:\nbnhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\e26206.exec:\e26206.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\btnthh.exec:\btnthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\btnbtb.exec:\btnbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\082244.exec:\082244.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\646688.exec:\646688.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\dvpvv.exec:\dvpvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\6026228.exec:\6026228.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\hhthnb.exec:\hhthnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\3jpdj.exec:\3jpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jjdjj.exec:\jjdjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\8262402.exec:\8262402.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\llxfxfr.exec:\llxfxfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\ttnntt.exec:\ttnntt.exe17⤵
- Executes dropped EXE
PID:2660 -
\??\c:\rfflffl.exec:\rfflffl.exe18⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7bthbh.exec:\7bthbh.exe19⤵
- Executes dropped EXE
PID:2976 -
\??\c:\pvvpd.exec:\pvvpd.exe20⤵
- Executes dropped EXE
PID:2972 -
\??\c:\4862402.exec:\4862402.exe21⤵
- Executes dropped EXE
PID:904 -
\??\c:\dvpvj.exec:\dvpvj.exe22⤵
- Executes dropped EXE
PID:2252 -
\??\c:\q60284.exec:\q60284.exe23⤵
- Executes dropped EXE
PID:1108 -
\??\c:\vpjpv.exec:\vpjpv.exe24⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xxlrxxl.exec:\xxlrxxl.exe25⤵
- Executes dropped EXE
PID:2308 -
\??\c:\fxrxflx.exec:\fxrxflx.exe26⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fffrflx.exec:\fffrflx.exe27⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ppjjp.exec:\ppjjp.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnbbnt.exec:\nnbbnt.exe29⤵
- Executes dropped EXE
PID:1908 -
\??\c:\u840246.exec:\u840246.exe30⤵
- Executes dropped EXE
PID:1500 -
\??\c:\8202068.exec:\8202068.exe31⤵
- Executes dropped EXE
PID:752 -
\??\c:\rrrrffr.exec:\rrrrffr.exe32⤵
- Executes dropped EXE
PID:1104 -
\??\c:\rrrlflr.exec:\rrrlflr.exe33⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pdddj.exec:\pdddj.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hnhnbn.exec:\hnhnbn.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\9pjvv.exec:\9pjvv.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\thttbn.exec:\thttbn.exe37⤵
- Executes dropped EXE
PID:2612 -
\??\c:\0624024.exec:\0624024.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jjppd.exec:\jjppd.exe39⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vjjjv.exec:\vjjjv.exe40⤵
- Executes dropped EXE
PID:1744 -
\??\c:\64260.exec:\64260.exe41⤵
- Executes dropped EXE
PID:2584 -
\??\c:\4266440.exec:\4266440.exe42⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xrxfrxf.exec:\xrxfrxf.exe43⤵
- Executes dropped EXE
PID:2468 -
\??\c:\nhbnhh.exec:\nhbnhh.exe44⤵
- Executes dropped EXE
PID:2080 -
\??\c:\666840.exec:\666840.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bbnnht.exec:\bbnnht.exe46⤵
- Executes dropped EXE
PID:788 -
\??\c:\4064444.exec:\4064444.exe47⤵
- Executes dropped EXE
PID:1044 -
\??\c:\ppdjp.exec:\ppdjp.exe48⤵
- Executes dropped EXE
PID:320 -
\??\c:\1lflrrl.exec:\1lflrrl.exe49⤵
- Executes dropped EXE
PID:1408 -
\??\c:\0828008.exec:\0828008.exe50⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1vpdj.exec:\1vpdj.exe51⤵
- Executes dropped EXE
PID:2840 -
\??\c:\hhhnbb.exec:\hhhnbb.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\i428686.exec:\i428686.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\48246.exec:\48246.exe54⤵
- Executes dropped EXE
PID:1640 -
\??\c:\2606842.exec:\2606842.exe55⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3jvvd.exec:\3jvvd.exe56⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tnhbhn.exec:\tnhbhn.exe57⤵
- Executes dropped EXE
PID:2652 -
\??\c:\m8262.exec:\m8262.exe58⤵
- Executes dropped EXE
PID:1860 -
\??\c:\1hbnbh.exec:\1hbnbh.exe59⤵
- Executes dropped EXE
PID:3004 -
\??\c:\440862.exec:\440862.exe60⤵
- Executes dropped EXE
PID:2776 -
\??\c:\8822062.exec:\8822062.exe61⤵
- Executes dropped EXE
PID:2108 -
\??\c:\dvjpv.exec:\dvjpv.exe62⤵
- Executes dropped EXE
PID:2908 -
\??\c:\660684.exec:\660684.exe63⤵
- Executes dropped EXE
PID:668 -
\??\c:\486262.exec:\486262.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\620688.exec:\620688.exe65⤵
- Executes dropped EXE
PID:448 -
\??\c:\6640820.exec:\6640820.exe66⤵PID:1020
-
\??\c:\426206.exec:\426206.exe67⤵PID:2024
-
\??\c:\826202.exec:\826202.exe68⤵PID:540
-
\??\c:\dpjpp.exec:\dpjpp.exe69⤵
- System Location Discovery: System Language Discovery
PID:944 -
\??\c:\ttbtbt.exec:\ttbtbt.exe70⤵PID:2128
-
\??\c:\vvvpv.exec:\vvvpv.exe71⤵PID:1852
-
\??\c:\8628624.exec:\8628624.exe72⤵PID:1028
-
\??\c:\600862.exec:\600862.exe73⤵PID:1908
-
\??\c:\9rfrlxl.exec:\9rfrlxl.exe74⤵PID:2220
-
\??\c:\660428.exec:\660428.exe75⤵PID:2156
-
\??\c:\42046.exec:\42046.exe76⤵PID:1960
-
\??\c:\xxxlxfx.exec:\xxxlxfx.exe77⤵PID:880
-
\??\c:\c602680.exec:\c602680.exe78⤵PID:3056
-
\??\c:\flxrxrf.exec:\flxrxrf.exe79⤵PID:1680
-
\??\c:\9rxfrxr.exec:\9rxfrxr.exe80⤵PID:2092
-
\??\c:\rxxfxfr.exec:\rxxfxfr.exe81⤵PID:1672
-
\??\c:\2866402.exec:\2866402.exe82⤵PID:2576
-
\??\c:\824684.exec:\824684.exe83⤵PID:2724
-
\??\c:\hhhnbh.exec:\hhhnbh.exe84⤵PID:2520
-
\??\c:\04626.exec:\04626.exe85⤵PID:2444
-
\??\c:\rrxxfrf.exec:\rrxxfrf.exe86⤵PID:2412
-
\??\c:\c606408.exec:\c606408.exe87⤵PID:2708
-
\??\c:\0828068.exec:\0828068.exe88⤵PID:2996
-
\??\c:\42664.exec:\42664.exe89⤵PID:2080
-
\??\c:\xrlflxl.exec:\xrlflxl.exe90⤵PID:768
-
\??\c:\44284.exec:\44284.exe91⤵PID:1564
-
\??\c:\jddjv.exec:\jddjv.exe92⤵PID:2684
-
\??\c:\lrrrfrl.exec:\lrrrfrl.exe93⤵PID:2516
-
\??\c:\0040408.exec:\0040408.exe94⤵PID:1804
-
\??\c:\o828064.exec:\o828064.exe95⤵PID:2804
-
\??\c:\2602680.exec:\2602680.exe96⤵PID:2820
-
\??\c:\1ddpd.exec:\1ddpd.exe97⤵PID:1676
-
\??\c:\pjvjv.exec:\pjvjv.exe98⤵PID:1192
-
\??\c:\60884.exec:\60884.exe99⤵PID:2872
-
\??\c:\e42806.exec:\e42806.exe100⤵PID:1868
-
\??\c:\208400.exec:\208400.exe101⤵PID:1880
-
\??\c:\64620.exec:\64620.exe102⤵PID:2652
-
\??\c:\bthtbh.exec:\bthtbh.exe103⤵PID:1860
-
\??\c:\a2068.exec:\a2068.exe104⤵PID:3004
-
\??\c:\04804.exec:\04804.exe105⤵PID:2968
-
\??\c:\pjdpd.exec:\pjdpd.exe106⤵PID:2108
-
\??\c:\6088668.exec:\6088668.exe107⤵PID:1712
-
\??\c:\848602.exec:\848602.exe108⤵PID:2372
-
\??\c:\48286.exec:\48286.exe109⤵PID:1144
-
\??\c:\9rrfxfr.exec:\9rrfxfr.exe110⤵PID:376
-
\??\c:\02266.exec:\02266.exe111⤵PID:2308
-
\??\c:\lxrfllx.exec:\lxrfllx.exe112⤵PID:1788
-
\??\c:\04442.exec:\04442.exe113⤵PID:2228
-
\??\c:\rrrxlxx.exec:\rrrxlxx.exe114⤵PID:1728
-
\??\c:\608424.exec:\608424.exe115⤵PID:692
-
\??\c:\vvjjp.exec:\vvjjp.exe116⤵PID:1792
-
\??\c:\662080.exec:\662080.exe117⤵PID:2300
-
\??\c:\06600.exec:\06600.exe118⤵PID:1908
-
\??\c:\7fxfllx.exec:\7fxfllx.exe119⤵PID:3064
-
\??\c:\264462.exec:\264462.exe120⤵PID:2156
-
\??\c:\0428446.exec:\0428446.exe121⤵PID:1960
-
\??\c:\c224280.exec:\c224280.exe122⤵PID:880
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-