Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 08:49
Static task
static1
Behavioral task
behavioral1
Sample
c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe
Resource
win7-20240903-en
General
-
Target
c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe
-
Size
64KB
-
MD5
8fe9063666a5dcd8570da8663cd3e2f0
-
SHA1
5827ed7b7c3ee6ab1914d654ae9d9350bd36cc8c
-
SHA256
c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43
-
SHA512
e4cf0a002a98438d3ec7cb86ba3516d1fdbf794e58344585719c8f0e9cc864378e98f8e99af806bd8fb19fa98488baa257cb1c1aa30548d50be065e823b25ffe
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPts:ymb3NkkiQ3mdBjFIj+qK
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/2644-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1620-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2096-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2556-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2732-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1948-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/448-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1576-237-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1752-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2132-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-308-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdvjp.exevjvvv.exetnbhnn.exepjvvv.exelxllrlr.exe1hbhhb.exejdpvv.exe1jvdj.exelxfxxrx.exe3lflxfl.exe9hbbnn.exe7pdjj.exepjdpv.exelxllllx.exerlfflrx.exetnbttt.exevvpdv.exepjvdv.exe5rfxxrr.exe1rxllff.exenttnth.exe3nbhhn.exedpjpv.exelxlrrrx.exe7flxlrr.exethhhnt.exedvjdd.exelfrfrxl.exexlrrrxx.exebtntbb.exevvddv.exe1pjpp.exelxlflxl.exe7nntbh.exenbthhb.exejjvdj.exevjjdj.exerrrxrff.exerllrfxf.exebhbbbb.exehtttbh.exepjvjp.exe7jppp.exe3pdpp.exelflrrll.exe3rlrrxx.exenbnntn.exehtntbh.exenbhbbh.exe1pddd.exe9pjvj.exelfxrrlr.exe1xrlrxf.exe1hhbnn.exebthntt.exetnbnbh.exejvdjp.exejdjjp.exe1xllrxx.exe3fffrrx.exevvvdp.exedvpvd.exe1rllxrl.exellrrrxx.exepid process 2336 jdvjp.exe 1620 vjvvv.exe 2096 tnbhnn.exe 2708 pjvvv.exe 2784 lxllrlr.exe 2764 1hbhhb.exe 2940 jdpvv.exe 2556 1jvdj.exe 2732 lxfxxrx.exe 1200 3lflxfl.exe 1564 9hbbnn.exe 1948 7pdjj.exe 2376 pjdpv.exe 1516 lxllllx.exe 2752 rlfflrx.exe 1456 tnbttt.exe 1684 vvpdv.exe 2924 pjvdv.exe 776 5rfxxrr.exe 2984 1rxllff.exe 448 nttnth.exe 1972 3nbhhn.exe 1576 dpjpv.exe 1752 lxlrrrx.exe 688 7flxlrr.exe 1784 thhhnt.exe 2532 dvjdd.exe 1792 lfrfrxl.exe 2132 xlrrrxx.exe 2104 btntbb.exe 2320 vvddv.exe 284 1pjpp.exe 1632 lxlflxl.exe 2652 7nntbh.exe 2088 nbthhb.exe 2844 jjvdj.exe 2696 vjjdj.exe 2724 rrrxrff.exe 2808 rllrfxf.exe 2764 bhbbbb.exe 2592 htttbh.exe 2000 pjvjp.exe 2236 7jppp.exe 2392 3pdpp.exe 1200 lflrrll.exe 2912 3rlrrxx.exe 2372 nbnntn.exe 2036 htntbh.exe 2880 nbhbbh.exe 1852 1pddd.exe 2752 9pjvj.exe 1352 lfxrrlr.exe 2916 1xrlrxf.exe 1312 1hhbnn.exe 2328 bthntt.exe 776 tnbnbh.exe 2348 jvdjp.exe 1088 jdjjp.exe 1308 1xllrxx.exe 1916 3fffrrx.exe 2416 vvvdp.exe 1660 dvpvd.exe 2464 1rllxrl.exe 2252 llrrrxx.exe -
Processes:
resource yara_rule behavioral1/memory/2644-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1620-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2096-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2732-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1948-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/448-219-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1576-237-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1752-246-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1784-263-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-272-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2132-290-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-308-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
fxrllll.exe9xrlxxl.exerlxfrlr.exepjjjd.exevppvp.exe3pjjp.exe5rrfrrl.exerlfxffx.exevpdjp.exedvjvv.exepjdjd.exejdpvj.exethbtbb.exelxxflrr.exetnhnhh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exejdvjp.exevjvvv.exetnbhnn.exepjvvv.exelxllrlr.exe1hbhhb.exejdpvv.exe1jvdj.exelxfxxrx.exe3lflxfl.exe9hbbnn.exe7pdjj.exepjdpv.exelxllllx.exerlfflrx.exedescription pid process target process PID 2644 wrote to memory of 2336 2644 c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe jdvjp.exe PID 2644 wrote to memory of 2336 2644 c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe jdvjp.exe PID 2644 wrote to memory of 2336 2644 c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe jdvjp.exe PID 2644 wrote to memory of 2336 2644 c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe jdvjp.exe PID 2336 wrote to memory of 1620 2336 jdvjp.exe vjvvv.exe PID 2336 wrote to memory of 1620 2336 jdvjp.exe vjvvv.exe PID 2336 wrote to memory of 1620 2336 jdvjp.exe vjvvv.exe PID 2336 wrote to memory of 1620 2336 jdvjp.exe vjvvv.exe PID 1620 wrote to memory of 2096 1620 vjvvv.exe tnbhnn.exe PID 1620 wrote to memory of 2096 1620 vjvvv.exe tnbhnn.exe PID 1620 wrote to memory of 2096 1620 vjvvv.exe tnbhnn.exe PID 1620 wrote to memory of 2096 1620 vjvvv.exe tnbhnn.exe PID 2096 wrote to memory of 2708 2096 tnbhnn.exe pjvvv.exe PID 2096 wrote to memory of 2708 2096 tnbhnn.exe pjvvv.exe PID 2096 wrote to memory of 2708 2096 tnbhnn.exe pjvvv.exe PID 2096 wrote to memory of 2708 2096 tnbhnn.exe pjvvv.exe PID 2708 wrote to memory of 2784 2708 pjvvv.exe lxllrlr.exe PID 2708 wrote to memory of 2784 2708 pjvvv.exe lxllrlr.exe PID 2708 wrote to memory of 2784 2708 pjvvv.exe lxllrlr.exe PID 2708 wrote to memory of 2784 2708 pjvvv.exe lxllrlr.exe PID 2784 wrote to memory of 2764 2784 lxllrlr.exe 1hbhhb.exe PID 2784 wrote to memory of 2764 2784 lxllrlr.exe 1hbhhb.exe PID 2784 wrote to memory of 2764 2784 lxllrlr.exe 1hbhhb.exe PID 2784 wrote to memory of 2764 2784 lxllrlr.exe 1hbhhb.exe PID 2764 wrote to memory of 2940 2764 1hbhhb.exe jdpvv.exe PID 2764 wrote to memory of 2940 2764 1hbhhb.exe jdpvv.exe PID 2764 wrote to memory of 2940 2764 1hbhhb.exe jdpvv.exe PID 2764 wrote to memory of 2940 2764 1hbhhb.exe jdpvv.exe PID 2940 wrote to memory of 2556 2940 jdpvv.exe 1jvdj.exe PID 2940 wrote to memory of 2556 2940 jdpvv.exe 1jvdj.exe PID 2940 wrote to memory of 2556 2940 jdpvv.exe 1jvdj.exe PID 2940 wrote to memory of 2556 2940 jdpvv.exe 1jvdj.exe PID 2556 wrote to memory of 2732 2556 1jvdj.exe lxfxxrx.exe PID 2556 wrote to memory of 2732 2556 1jvdj.exe lxfxxrx.exe PID 2556 wrote to memory of 2732 2556 1jvdj.exe lxfxxrx.exe PID 2556 wrote to memory of 2732 2556 1jvdj.exe lxfxxrx.exe PID 2732 wrote to memory of 1200 2732 lxfxxrx.exe 3lflxfl.exe PID 2732 wrote to memory of 1200 2732 lxfxxrx.exe 3lflxfl.exe PID 2732 wrote to memory of 1200 2732 lxfxxrx.exe 3lflxfl.exe PID 2732 wrote to memory of 1200 2732 lxfxxrx.exe 3lflxfl.exe PID 1200 wrote to memory of 1564 1200 3lflxfl.exe 9hbbnn.exe PID 1200 wrote to memory of 1564 1200 3lflxfl.exe 9hbbnn.exe PID 1200 wrote to memory of 1564 1200 3lflxfl.exe 9hbbnn.exe PID 1200 wrote to memory of 1564 1200 3lflxfl.exe 9hbbnn.exe PID 1564 wrote to memory of 1948 1564 9hbbnn.exe 7pdjj.exe PID 1564 wrote to memory of 1948 1564 9hbbnn.exe 7pdjj.exe PID 1564 wrote to memory of 1948 1564 9hbbnn.exe 7pdjj.exe PID 1564 wrote to memory of 1948 1564 9hbbnn.exe 7pdjj.exe PID 1948 wrote to memory of 2376 1948 7pdjj.exe pjdpv.exe PID 1948 wrote to memory of 2376 1948 7pdjj.exe pjdpv.exe PID 1948 wrote to memory of 2376 1948 7pdjj.exe pjdpv.exe PID 1948 wrote to memory of 2376 1948 7pdjj.exe pjdpv.exe PID 2376 wrote to memory of 1516 2376 pjdpv.exe lxllllx.exe PID 2376 wrote to memory of 1516 2376 pjdpv.exe lxllllx.exe PID 2376 wrote to memory of 1516 2376 pjdpv.exe lxllllx.exe PID 2376 wrote to memory of 1516 2376 pjdpv.exe lxllllx.exe PID 1516 wrote to memory of 2752 1516 lxllllx.exe rlfflrx.exe PID 1516 wrote to memory of 2752 1516 lxllllx.exe rlfflrx.exe PID 1516 wrote to memory of 2752 1516 lxllllx.exe rlfflrx.exe PID 1516 wrote to memory of 2752 1516 lxllllx.exe rlfflrx.exe PID 2752 wrote to memory of 1456 2752 rlfflrx.exe tnbttt.exe PID 2752 wrote to memory of 1456 2752 rlfflrx.exe tnbttt.exe PID 2752 wrote to memory of 1456 2752 rlfflrx.exe tnbttt.exe PID 2752 wrote to memory of 1456 2752 rlfflrx.exe tnbttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe"C:\Users\Admin\AppData\Local\Temp\c2bb50c66d74e1b6fbcdb5d4253c7bd4f9a12a083db9a40ba3889cb8d8fd8f43N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\jdvjp.exec:\jdvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\vjvvv.exec:\vjvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\tnbhnn.exec:\tnbhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\pjvvv.exec:\pjvvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\lxllrlr.exec:\lxllrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\1hbhhb.exec:\1hbhhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jdpvv.exec:\jdpvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\1jvdj.exec:\1jvdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\lxfxxrx.exec:\lxfxxrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\3lflxfl.exec:\3lflxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\9hbbnn.exec:\9hbbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\7pdjj.exec:\7pdjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\pjdpv.exec:\pjdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\lxllllx.exec:\lxllllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\rlfflrx.exec:\rlfflrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\tnbttt.exec:\tnbttt.exe17⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vvpdv.exec:\vvpdv.exe18⤵
- Executes dropped EXE
PID:1684 -
\??\c:\pjvdv.exec:\pjvdv.exe19⤵
- Executes dropped EXE
PID:2924 -
\??\c:\5rfxxrr.exec:\5rfxxrr.exe20⤵
- Executes dropped EXE
PID:776 -
\??\c:\1rxllff.exec:\1rxllff.exe21⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nttnth.exec:\nttnth.exe22⤵
- Executes dropped EXE
PID:448 -
\??\c:\3nbhhn.exec:\3nbhhn.exe23⤵
- Executes dropped EXE
PID:1972 -
\??\c:\dpjpv.exec:\dpjpv.exe24⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lxlrrrx.exec:\lxlrrrx.exe25⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7flxlrr.exec:\7flxlrr.exe26⤵
- Executes dropped EXE
PID:688 -
\??\c:\thhhnt.exec:\thhhnt.exe27⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dvjdd.exec:\dvjdd.exe28⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfrfrxl.exec:\lfrfrxl.exe29⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe30⤵
- Executes dropped EXE
PID:2132 -
\??\c:\btntbb.exec:\btntbb.exe31⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vvddv.exec:\vvddv.exe32⤵
- Executes dropped EXE
PID:2320 -
\??\c:\1pjpp.exec:\1pjpp.exe33⤵
- Executes dropped EXE
PID:284 -
\??\c:\lxlflxl.exec:\lxlflxl.exe34⤵
- Executes dropped EXE
PID:1632 -
\??\c:\7nntbh.exec:\7nntbh.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\nbthhb.exec:\nbthhb.exe36⤵
- Executes dropped EXE
PID:2088 -
\??\c:\jjvdj.exec:\jjvdj.exe37⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vjjdj.exec:\vjjdj.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rrrxrff.exec:\rrrxrff.exe39⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rllrfxf.exec:\rllrfxf.exe40⤵
- Executes dropped EXE
PID:2808 -
\??\c:\bhbbbb.exec:\bhbbbb.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\htttbh.exec:\htttbh.exe42⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pjvjp.exec:\pjvjp.exe43⤵
- Executes dropped EXE
PID:2000 -
\??\c:\7jppp.exec:\7jppp.exe44⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3pdpp.exec:\3pdpp.exe45⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lflrrll.exec:\lflrrll.exe46⤵
- Executes dropped EXE
PID:1200 -
\??\c:\3rlrrxx.exec:\3rlrrxx.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nbnntn.exec:\nbnntn.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\htntbh.exec:\htntbh.exe49⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nbhbbh.exec:\nbhbbh.exe50⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1pddd.exec:\1pddd.exe51⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9pjvj.exec:\9pjvj.exe52⤵
- Executes dropped EXE
PID:2752 -
\??\c:\lfxrrlr.exec:\lfxrrlr.exe53⤵
- Executes dropped EXE
PID:1352 -
\??\c:\1xrlrxf.exec:\1xrlrxf.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\1hhbnn.exec:\1hhbnn.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bthntt.exec:\bthntt.exe56⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tnbnbh.exec:\tnbnbh.exe57⤵
- Executes dropped EXE
PID:776 -
\??\c:\jvdjp.exec:\jvdjp.exe58⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdjjp.exec:\jdjjp.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\1xllrxx.exec:\1xllrxx.exe60⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3fffrrx.exec:\3fffrrx.exe61⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vvvdp.exec:\vvvdp.exe62⤵
- Executes dropped EXE
PID:2416 -
\??\c:\dvpvd.exec:\dvpvd.exe63⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1rllxrl.exec:\1rllxrl.exe64⤵
- Executes dropped EXE
PID:2464 -
\??\c:\llrrrxx.exec:\llrrrxx.exe65⤵
- Executes dropped EXE
PID:2252 -
\??\c:\nhtbnt.exec:\nhtbnt.exe66⤵PID:1256
-
\??\c:\3hnttt.exec:\3hnttt.exe67⤵PID:1800
-
\??\c:\jjppv.exec:\jjppv.exe68⤵PID:1860
-
\??\c:\jdvpv.exec:\jdvpv.exe69⤵PID:2996
-
\??\c:\rrrxrxf.exec:\rrrxrxf.exe70⤵PID:1520
-
\??\c:\5llffrf.exec:\5llffrf.exe71⤵PID:1500
-
\??\c:\nhtbbh.exec:\nhtbbh.exe72⤵PID:1592
-
\??\c:\hhttnn.exec:\hhttnn.exe73⤵PID:2872
-
\??\c:\pjjvp.exec:\pjjvp.exe74⤵PID:1712
-
\??\c:\1vjdv.exec:\1vjdv.exe75⤵PID:2412
-
\??\c:\1dvjj.exec:\1dvjj.exe76⤵PID:2088
-
\??\c:\xrxxffr.exec:\xrxxffr.exe77⤵PID:2436
-
\??\c:\lfflfrf.exec:\lfflfrf.exe78⤵PID:2696
-
\??\c:\1nhhtt.exec:\1nhhtt.exe79⤵PID:2596
-
\??\c:\5nhtth.exec:\5nhtth.exe80⤵PID:2616
-
\??\c:\jpddj.exec:\jpddj.exe81⤵PID:2676
-
\??\c:\ddvdp.exec:\ddvdp.exe82⤵PID:2592
-
\??\c:\xxrxrfr.exec:\xxrxrfr.exe83⤵PID:1636
-
\??\c:\fxrxllf.exec:\fxrxllf.exe84⤵PID:2408
-
\??\c:\1hhbtt.exec:\1hhbtt.exe85⤵PID:1184
-
\??\c:\thtthb.exec:\thtthb.exe86⤵PID:2904
-
\??\c:\jjjvj.exec:\jjjvj.exe87⤵PID:2896
-
\??\c:\jdvvv.exec:\jdvvv.exe88⤵PID:2372
-
\??\c:\fxrxlrx.exec:\fxrxlrx.exe89⤵PID:2620
-
\??\c:\nnhtbh.exec:\nnhtbh.exe90⤵PID:2888
-
\??\c:\nhhhbh.exec:\nhhhbh.exe91⤵PID:1364
-
\??\c:\tntthh.exec:\tntthh.exe92⤵PID:2752
-
\??\c:\9pdpp.exec:\9pdpp.exe93⤵PID:2976
-
\??\c:\7ppvj.exec:\7ppvj.exe94⤵PID:2916
-
\??\c:\xrrlflx.exec:\xrrlflx.exe95⤵PID:1076
-
\??\c:\xxlrffr.exec:\xxlrffr.exe96⤵PID:2656
-
\??\c:\1thnhh.exec:\1thnhh.exe97⤵PID:1608
-
\??\c:\vvpdd.exec:\vvpdd.exe98⤵PID:664
-
\??\c:\pjvvd.exec:\pjvvd.exe99⤵PID:1004
-
\??\c:\ppdjv.exec:\ppdjv.exe100⤵PID:1548
-
\??\c:\xlflrxl.exec:\xlflrxl.exe101⤵PID:1648
-
\??\c:\tthnbb.exec:\tthnbb.exe102⤵PID:2416
-
\??\c:\nhbnbn.exec:\nhbnbn.exe103⤵PID:1752
-
\??\c:\7ppvj.exec:\7ppvj.exe104⤵PID:2464
-
\??\c:\3jdvd.exec:\3jdvd.exe105⤵PID:2252
-
\??\c:\rrrxllr.exec:\rrrxllr.exe106⤵PID:2504
-
\??\c:\lfrxflr.exec:\lfrxflr.exe107⤵PID:1800
-
\??\c:\9bttbb.exec:\9bttbb.exe108⤵PID:2132
-
\??\c:\hhnbhn.exec:\hhnbhn.exe109⤵PID:2996
-
\??\c:\dddvj.exec:\dddvj.exe110⤵PID:572
-
\??\c:\5lrrfxl.exec:\5lrrfxl.exe111⤵PID:1500
-
\??\c:\lfxxfrf.exec:\lfxxfrf.exe112⤵PID:2360
-
\??\c:\ttntnt.exec:\ttntnt.exe113⤵PID:2872
-
\??\c:\9bnnnn.exec:\9bnnnn.exe114⤵PID:2712
-
\??\c:\pdvjd.exec:\pdvjd.exe115⤵PID:2412
-
\??\c:\pjvjv.exec:\pjvjv.exe116⤵PID:2844
-
\??\c:\xrlrrxf.exec:\xrlrrxf.exe117⤵PID:2436
-
\??\c:\rrlxfxl.exec:\rrlxfxl.exe118⤵PID:2696
-
\??\c:\hhthtb.exec:\hhthtb.exe119⤵PID:2596
-
\??\c:\9hntbh.exec:\9hntbh.exe120⤵PID:2616
-
\??\c:\7dpjd.exec:\7dpjd.exe121⤵PID:2676
-
\??\c:\pdpjp.exec:\pdpjp.exe122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-