Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 15:33
Static task
static1
Behavioral task
behavioral1
Sample
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe
Resource
win7-20240903-en
General
-
Target
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe
-
Size
127KB
-
MD5
0eb828ff2d44a68e0310dc9f42792e0f
-
SHA1
b263de6d8eb3076b7676d3d01802e8cf9d7ccd6f
-
SHA256
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126
-
SHA512
6d205e297295475085c4b4e44df2a54934bcbc27f545d74d6840099f43f2f79aa063f9a785e93acaf7b5a67e3795270d70f73a1f43119d700d788499b13731b1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zD+WVb+PoGSSTeV:n3C9BRo7tvnJ99mQb+PouG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/2728-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2544-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2252-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3020-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2496-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1764-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3036-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1384-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2428-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/684-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1288-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjdvd.exehhbnnn.exeppvdp.exeddvjp.exehnbntb.exeppddp.exefflrflr.exebbbntb.exejvjdj.exellffrrf.exettnthn.exevvjpj.exejjpvv.exexfxxlxr.exetnhhnb.exevvjvj.exepjddj.exe1rrxflx.exehbthnn.exevppdp.exe1vpdj.exeffflflr.exehnhhth.exejppvj.exerlxrxfr.exe5nnhhh.exe9dvjv.exefxrrxfx.exe7bhtht.exehhbhnt.exeddppv.exellfflrl.exennnhbb.exetnnhth.exe1pvjp.exeppjpd.exerfrxrxr.exennbnbb.exebbhtht.exeppjpd.exedpdpd.exerlxflxx.exebthhnt.exe5hthhn.exepppdv.exejjjpv.exe7lrrflf.exe5fxfxlf.exenhbtbb.exevvdjj.exejpjvj.exexfrrrxr.exethnnbt.exehnbhhb.exe5vdjp.exexrlxfrf.exexlfrxfx.exetnbhtt.exevdvvp.exe1pjpv.exe3rrlxfx.exe3lrfllx.exethhhtt.exejdvjv.exepid process 2684 pjdvd.exe 2744 hhbnnn.exe 1592 ppvdp.exe 2544 ddvjp.exe 2252 hnbntb.exe 264 ppddp.exe 576 fflrflr.exe 3020 bbbntb.exe 2144 jvjdj.exe 2928 llffrrf.exe 2496 ttnthn.exe 1764 vvjpj.exe 2824 jjpvv.exe 3036 xfxxlxr.exe 1788 tnhhnb.exe 1384 vvjvj.exe 1452 pjddj.exe 2428 1rrxflx.exe 2488 hbthnn.exe 684 vppdp.exe 2424 1vpdj.exe 2176 ffflflr.exe 1112 hnhhth.exe 1288 jppvj.exe 1664 rlxrxfr.exe 1904 5nnhhh.exe 2460 9dvjv.exe 2504 fxrrxfx.exe 2464 7bhtht.exe 2956 hhbhnt.exe 2736 ddppv.exe 2840 llfflrl.exe 2648 nnnhbb.exe 2692 tnnhth.exe 2740 1pvjp.exe 2668 ppjpd.exe 2604 rfrxrxr.exe 3064 nnbnbb.exe 484 bbhtht.exe 1432 ppjpd.exe 1796 dpdpd.exe 2152 rlxflxx.exe 2068 bthhnt.exe 2060 5hthhn.exe 1852 pppdv.exe 2516 jjjpv.exe 2908 7lrrflf.exe 2800 5fxfxlf.exe 2872 nhbtbb.exe 2300 vvdjj.exe 1892 jpjvj.exe 1232 xfrrrxr.exe 2296 thnnbt.exe 2708 hnbhhb.exe 2192 5vdjp.exe 2632 xrlxfrf.exe 468 xlfrxfx.exe 2392 tnbhtt.exe 2400 vdvvp.exe 444 1pjpv.exe 2128 3rrlxfx.exe 1256 3lrfllx.exe 972 thhhtt.exe 3008 jdvjv.exe -
Processes:
resource yara_rule behavioral1/memory/2728-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1592-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2544-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2252-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/576-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3020-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2496-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1764-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3036-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1384-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2428-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/684-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1288-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-249-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2956-294-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1pjpv.exe5pdjp.exetnbntt.exevvdjj.exexrfxxfx.exerflllll.exehbtthh.exejdjvd.exeddjjj.exe1pddp.exebbhnbt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exepjdvd.exehhbnnn.exeppvdp.exeddvjp.exehnbntb.exeppddp.exefflrflr.exebbbntb.exejvjdj.exellffrrf.exettnthn.exevvjpj.exejjpvv.exexfxxlxr.exetnhhnb.exedescription pid process target process PID 2728 wrote to memory of 2684 2728 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe pjdvd.exe PID 2728 wrote to memory of 2684 2728 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe pjdvd.exe PID 2728 wrote to memory of 2684 2728 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe pjdvd.exe PID 2728 wrote to memory of 2684 2728 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe pjdvd.exe PID 2684 wrote to memory of 2744 2684 pjdvd.exe hhbnnn.exe PID 2684 wrote to memory of 2744 2684 pjdvd.exe hhbnnn.exe PID 2684 wrote to memory of 2744 2684 pjdvd.exe hhbnnn.exe PID 2684 wrote to memory of 2744 2684 pjdvd.exe hhbnnn.exe PID 2744 wrote to memory of 1592 2744 hhbnnn.exe ppvdp.exe PID 2744 wrote to memory of 1592 2744 hhbnnn.exe ppvdp.exe PID 2744 wrote to memory of 1592 2744 hhbnnn.exe ppvdp.exe PID 2744 wrote to memory of 1592 2744 hhbnnn.exe ppvdp.exe PID 1592 wrote to memory of 2544 1592 ppvdp.exe ddvjp.exe PID 1592 wrote to memory of 2544 1592 ppvdp.exe ddvjp.exe PID 1592 wrote to memory of 2544 1592 ppvdp.exe ddvjp.exe PID 1592 wrote to memory of 2544 1592 ppvdp.exe ddvjp.exe PID 2544 wrote to memory of 2252 2544 ddvjp.exe hnbntb.exe PID 2544 wrote to memory of 2252 2544 ddvjp.exe hnbntb.exe PID 2544 wrote to memory of 2252 2544 ddvjp.exe hnbntb.exe PID 2544 wrote to memory of 2252 2544 ddvjp.exe hnbntb.exe PID 2252 wrote to memory of 264 2252 hnbntb.exe ppddp.exe PID 2252 wrote to memory of 264 2252 hnbntb.exe ppddp.exe PID 2252 wrote to memory of 264 2252 hnbntb.exe ppddp.exe PID 2252 wrote to memory of 264 2252 hnbntb.exe ppddp.exe PID 264 wrote to memory of 576 264 ppddp.exe fflrflr.exe PID 264 wrote to memory of 576 264 ppddp.exe fflrflr.exe PID 264 wrote to memory of 576 264 ppddp.exe fflrflr.exe PID 264 wrote to memory of 576 264 ppddp.exe fflrflr.exe PID 576 wrote to memory of 3020 576 fflrflr.exe bbbntb.exe PID 576 wrote to memory of 3020 576 fflrflr.exe bbbntb.exe PID 576 wrote to memory of 3020 576 fflrflr.exe bbbntb.exe PID 576 wrote to memory of 3020 576 fflrflr.exe bbbntb.exe PID 3020 wrote to memory of 2144 3020 bbbntb.exe jvjdj.exe PID 3020 wrote to memory of 2144 3020 bbbntb.exe jvjdj.exe PID 3020 wrote to memory of 2144 3020 bbbntb.exe jvjdj.exe PID 3020 wrote to memory of 2144 3020 bbbntb.exe jvjdj.exe PID 2144 wrote to memory of 2928 2144 jvjdj.exe llffrrf.exe PID 2144 wrote to memory of 2928 2144 jvjdj.exe llffrrf.exe PID 2144 wrote to memory of 2928 2144 jvjdj.exe llffrrf.exe PID 2144 wrote to memory of 2928 2144 jvjdj.exe llffrrf.exe PID 2928 wrote to memory of 2496 2928 llffrrf.exe ttnthn.exe PID 2928 wrote to memory of 2496 2928 llffrrf.exe ttnthn.exe PID 2928 wrote to memory of 2496 2928 llffrrf.exe ttnthn.exe PID 2928 wrote to memory of 2496 2928 llffrrf.exe ttnthn.exe PID 2496 wrote to memory of 1764 2496 ttnthn.exe vvjpj.exe PID 2496 wrote to memory of 1764 2496 ttnthn.exe vvjpj.exe PID 2496 wrote to memory of 1764 2496 ttnthn.exe vvjpj.exe PID 2496 wrote to memory of 1764 2496 ttnthn.exe vvjpj.exe PID 1764 wrote to memory of 2824 1764 vvjpj.exe jjpvv.exe PID 1764 wrote to memory of 2824 1764 vvjpj.exe jjpvv.exe PID 1764 wrote to memory of 2824 1764 vvjpj.exe jjpvv.exe PID 1764 wrote to memory of 2824 1764 vvjpj.exe jjpvv.exe PID 2824 wrote to memory of 3036 2824 jjpvv.exe xfxxlxr.exe PID 2824 wrote to memory of 3036 2824 jjpvv.exe xfxxlxr.exe PID 2824 wrote to memory of 3036 2824 jjpvv.exe xfxxlxr.exe PID 2824 wrote to memory of 3036 2824 jjpvv.exe xfxxlxr.exe PID 3036 wrote to memory of 1788 3036 xfxxlxr.exe tnhhnb.exe PID 3036 wrote to memory of 1788 3036 xfxxlxr.exe tnhhnb.exe PID 3036 wrote to memory of 1788 3036 xfxxlxr.exe tnhhnb.exe PID 3036 wrote to memory of 1788 3036 xfxxlxr.exe tnhhnb.exe PID 1788 wrote to memory of 1384 1788 tnhhnb.exe vvjvj.exe PID 1788 wrote to memory of 1384 1788 tnhhnb.exe vvjvj.exe PID 1788 wrote to memory of 1384 1788 tnhhnb.exe vvjvj.exe PID 1788 wrote to memory of 1384 1788 tnhhnb.exe vvjvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe"C:\Users\Admin\AppData\Local\Temp\e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pjdvd.exec:\pjdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\hhbnnn.exec:\hhbnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ppvdp.exec:\ppvdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\ddvjp.exec:\ddvjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\hnbntb.exec:\hnbntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\ppddp.exec:\ppddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\fflrflr.exec:\fflrflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\bbbntb.exec:\bbbntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\jvjdj.exec:\jvjdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\llffrrf.exec:\llffrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ttnthn.exec:\ttnthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\vvjpj.exec:\vvjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\jjpvv.exec:\jjpvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xfxxlxr.exec:\xfxxlxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tnhhnb.exec:\tnhhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vvjvj.exec:\vvjvj.exe17⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pjddj.exec:\pjddj.exe18⤵
- Executes dropped EXE
PID:1452 -
\??\c:\1rrxflx.exec:\1rrxflx.exe19⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hbthnn.exec:\hbthnn.exe20⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vppdp.exec:\vppdp.exe21⤵
- Executes dropped EXE
PID:684 -
\??\c:\1vpdj.exec:\1vpdj.exe22⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffflflr.exec:\ffflflr.exe23⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hnhhth.exec:\hnhhth.exe24⤵
- Executes dropped EXE
PID:1112 -
\??\c:\jppvj.exec:\jppvj.exe25⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rlxrxfr.exec:\rlxrxfr.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5nnhhh.exec:\5nnhhh.exe27⤵
- Executes dropped EXE
PID:1904 -
\??\c:\9dvjv.exec:\9dvjv.exe28⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fxrrxfx.exec:\fxrrxfx.exe29⤵
- Executes dropped EXE
PID:2504 -
\??\c:\7bhtht.exec:\7bhtht.exe30⤵
- Executes dropped EXE
PID:2464 -
\??\c:\hhbhnt.exec:\hhbhnt.exe31⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ddppv.exec:\ddppv.exe32⤵
- Executes dropped EXE
PID:2736 -
\??\c:\llfflrl.exec:\llfflrl.exe33⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nnnhbb.exec:\nnnhbb.exe34⤵
- Executes dropped EXE
PID:2648 -
\??\c:\tnnhth.exec:\tnnhth.exe35⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1pvjp.exec:\1pvjp.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\ppjpd.exec:\ppjpd.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nnbnbb.exec:\nnbnbb.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bbhtht.exec:\bbhtht.exe40⤵
- Executes dropped EXE
PID:484 -
\??\c:\ppjpd.exec:\ppjpd.exe41⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dpdpd.exec:\dpdpd.exe42⤵
- Executes dropped EXE
PID:1796 -
\??\c:\rlxflxx.exec:\rlxflxx.exe43⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bthhnt.exec:\bthhnt.exe44⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5hthhn.exec:\5hthhn.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pppdv.exec:\pppdv.exe46⤵
- Executes dropped EXE
PID:1852 -
\??\c:\jjjpv.exec:\jjjpv.exe47⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7lrrflf.exec:\7lrrflf.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5fxfxlf.exec:\5fxfxlf.exe49⤵
- Executes dropped EXE
PID:2800 -
\??\c:\nhbtbb.exec:\nhbtbb.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vvdjj.exec:\vvdjj.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
\??\c:\jpjvj.exec:\jpjvj.exe52⤵
- Executes dropped EXE
PID:1892 -
\??\c:\xfrrrxr.exec:\xfrrrxr.exe53⤵
- Executes dropped EXE
PID:1232 -
\??\c:\thnnbt.exec:\thnnbt.exe54⤵
- Executes dropped EXE
PID:2296 -
\??\c:\hnbhhb.exec:\hnbhhb.exe55⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5vdjp.exec:\5vdjp.exe56⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xrlxfrf.exec:\xrlxfrf.exe57⤵
- Executes dropped EXE
PID:2632 -
\??\c:\xlfrxfx.exec:\xlfrxfx.exe58⤵
- Executes dropped EXE
PID:468 -
\??\c:\tnbhtt.exec:\tnbhtt.exe59⤵
- Executes dropped EXE
PID:2392 -
\??\c:\vdvvp.exec:\vdvvp.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\1pjpv.exec:\1pjpv.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:444 -
\??\c:\3rrlxfx.exec:\3rrlxfx.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3lrfllx.exec:\3lrfllx.exe63⤵
- Executes dropped EXE
PID:1256 -
\??\c:\thhhtt.exec:\thhhtt.exe64⤵
- Executes dropped EXE
PID:972 -
\??\c:\jdvjv.exec:\jdvjv.exe65⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ppjdj.exec:\ppjdj.exe66⤵PID:2440
-
\??\c:\ppjpd.exec:\ppjpd.exe67⤵PID:2040
-
\??\c:\7xllllx.exec:\7xllllx.exe68⤵PID:1444
-
\??\c:\3bhnht.exec:\3bhnht.exe69⤵PID:908
-
\??\c:\1nbnnb.exec:\1nbnnb.exe70⤵PID:3024
-
\??\c:\ppjpv.exec:\ppjpv.exe71⤵PID:2980
-
\??\c:\1jvdv.exec:\1jvdv.exe72⤵PID:1648
-
\??\c:\3lrffrf.exec:\3lrffrf.exe73⤵PID:2848
-
\??\c:\xrrflrr.exec:\xrrflrr.exe74⤵PID:2688
-
\??\c:\hhnhnn.exec:\hhnhnn.exe75⤵PID:2696
-
\??\c:\tbtbnt.exec:\tbtbnt.exe76⤵PID:1680
-
\??\c:\ddvdv.exec:\ddvdv.exe77⤵PID:2608
-
\??\c:\dvjvj.exec:\dvjvj.exe78⤵PID:1952
-
\??\c:\xrllrrf.exec:\xrllrrf.exe79⤵PID:2252
-
\??\c:\5rfrxfr.exec:\5rfrxfr.exe80⤵PID:332
-
\??\c:\bbbbbn.exec:\bbbbbn.exe81⤵PID:484
-
\??\c:\3nbhnb.exec:\3nbhnb.exe82⤵PID:3056
-
\??\c:\5jddp.exec:\5jddp.exe83⤵PID:2628
-
\??\c:\vvvdp.exec:\vvvdp.exe84⤵PID:2064
-
\??\c:\7lrxfxr.exec:\7lrxfxr.exe85⤵PID:2792
-
\??\c:\xrlrfrf.exec:\xrlrfrf.exe86⤵PID:2928
-
\??\c:\tnbnbh.exec:\tnbnbh.exe87⤵PID:1852
-
\??\c:\vdpjd.exec:\vdpjd.exe88⤵PID:2748
-
\??\c:\vdppv.exec:\vdppv.exe89⤵PID:2864
-
\??\c:\xrfxllr.exec:\xrfxllr.exe90⤵PID:2944
-
\??\c:\lllfrrf.exec:\lllfrrf.exe91⤵PID:3052
-
\??\c:\hnnnhn.exec:\hnnnhn.exe92⤵PID:1752
-
\??\c:\3tthhh.exec:\3tthhh.exe93⤵PID:2092
-
\??\c:\jjjvd.exec:\jjjvd.exe94⤵PID:1980
-
\??\c:\3pppj.exec:\3pppj.exe95⤵PID:2100
-
\??\c:\rlfflxr.exec:\rlfflxr.exe96⤵PID:2428
-
\??\c:\nnhtnt.exec:\nnhtnt.exe97⤵PID:2488
-
\??\c:\ntbnbh.exec:\ntbnbh.exe98⤵PID:1716
-
\??\c:\pjvdd.exec:\pjvdd.exe99⤵PID:2256
-
\??\c:\9xrlxxr.exec:\9xrlxxr.exe100⤵PID:1072
-
\??\c:\rxlffll.exec:\rxlffll.exe101⤵PID:2200
-
\??\c:\1thnbn.exec:\1thnbn.exe102⤵PID:1112
-
\??\c:\nnnhth.exec:\nnnhth.exe103⤵PID:2360
-
\??\c:\jdvjv.exec:\jdvjv.exe104⤵PID:1660
-
\??\c:\jddvv.exec:\jddvv.exe105⤵PID:1376
-
\??\c:\lfxfrxl.exec:\lfxfrxl.exe106⤵PID:2268
-
\??\c:\3frxflx.exec:\3frxflx.exe107⤵PID:2460
-
\??\c:\3tbbtb.exec:\3tbbtb.exe108⤵PID:2328
-
\??\c:\dvvjj.exec:\dvvjj.exe109⤵PID:2336
-
\??\c:\vvpdj.exec:\vvpdj.exe110⤵PID:3032
-
\??\c:\rxrrflf.exec:\rxrrflf.exe111⤵PID:1504
-
\??\c:\rrffffr.exec:\rrffffr.exe112⤵PID:2728
-
\??\c:\7nntnh.exec:\7nntnh.exe113⤵PID:2536
-
\??\c:\1ddjp.exec:\1ddjp.exe114⤵PID:2556
-
\??\c:\jjpdp.exec:\jjpdp.exe115⤵PID:2692
-
\??\c:\5xxxffx.exec:\5xxxffx.exe116⤵PID:2560
-
\??\c:\rrflxxr.exec:\rrflxxr.exe117⤵PID:1592
-
\??\c:\hbnbtt.exec:\hbnbtt.exe118⤵PID:2700
-
\??\c:\jpjpj.exec:\jpjpj.exe119⤵PID:604
-
\??\c:\ddvjj.exec:\ddvjj.exe120⤵PID:2252
-
\??\c:\xrlxllr.exec:\xrlxllr.exe121⤵PID:332
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe122⤵PID:2072
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-