Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 13:19
Static task
static1
Behavioral task
behavioral1
Sample
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe
Resource
win7-20240903-en
General
-
Target
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe
-
Size
74KB
-
MD5
c9cc7f43112a69992bd5c7adc86f70ef
-
SHA1
24bcfef4c7440ae54398e9915ee3c9643da57ca6
-
SHA256
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e
-
SHA512
569d4305f4fc15aecd0475c7e5b03207567508aa3366d62e6939d60794084f48dc9232bf44e6d1e8e85bb70043b0df34b2cac08299d0f9b813842dbd91064444
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDWiekja1br3GGBxfot3eD:ymb3NkkiQ3mdBjFWXkj7afo6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2824-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/480-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2424-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1492-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1928-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1404-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1412-281-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffxrxrl.exetnhbnn.exedvpdj.exe7dpjd.exerxfxxff.exehbtbbb.exe5ppdj.exetnttbt.exe9tnnth.exepjvjp.exe7lfrffr.exelfrxxrx.exe7bbthh.exepjddd.exepjjpp.exe5xfffxx.exe5rffflx.exe1tnhhh.exepppdd.exexllfrrr.exefflfrff.exe9rfflfl.exe9bbhnn.exepddvd.exe9pjvd.exefxxrlfx.exebhttbh.exehhhntn.exejdpjp.exe1lfrrfr.exexrfllrx.exe5bthhn.exe9tnbbt.exepppjv.exexxffllr.exe1xlfrll.exe9xrrflr.exetnbbbb.exehhntbb.exe9ppvd.exe3dpdj.exefxfrrxl.exelfllrxf.exe1rfrrlr.exe9tbhtt.exehbttnt.exejjddp.exejjjvd.exe9lxlrrx.exerlfxflr.exehbntbb.exetnnttb.exenhnhnt.exevpdjp.exe5pdpp.exerfrxrxx.exelxlrrrf.exehbntbh.exepjvvp.exevvddd.exexxlrrxl.exe7xrflxl.exe7rfflll.exenhtbnt.exepid process 2652 ffxrxrl.exe 2852 tnhbnn.exe 2664 dvpdj.exe 2548 7dpjd.exe 3016 rxfxxff.exe 480 hbtbbb.exe 568 5ppdj.exe 2892 tnttbt.exe 2424 9tnnth.exe 2392 pjvjp.exe 1836 7lfrffr.exe 2292 lfrxxrx.exe 1492 7bbthh.exe 2416 pjddd.exe 2024 pjjpp.exe 1928 5xfffxx.exe 1780 5rffflx.exe 2060 1tnhhh.exe 2288 pppdd.exe 2232 xllfrrr.exe 1404 fflfrff.exe 1560 9rfflfl.exe 1660 9bbhnn.exe 1180 pddvd.exe 1536 9pjvd.exe 2944 fxxrlfx.exe 1856 bhttbh.exe 600 hhhntn.exe 1412 jdpjp.exe 2264 1lfrrfr.exe 3060 xrfllrx.exe 2628 5bthhn.exe 2572 9tnbbt.exe 2528 pppjv.exe 1524 xxffllr.exe 2604 1xlfrll.exe 3048 9xrrflr.exe 264 tnbbbb.exe 1860 hhntbb.exe 1308 9ppvd.exe 3004 3dpdj.exe 2892 fxfrrxl.exe 1236 lfllrxf.exe 2424 1rfrrlr.exe 1448 9tbhtt.exe 1876 hbttnt.exe 2772 jjddp.exe 2596 jjjvd.exe 1420 9lxlrrx.exe 1924 rlfxflr.exe 1832 hbntbb.exe 2876 tnnttb.exe 2184 nhnhnt.exe 1352 vpdjp.exe 1864 5pdpp.exe 2144 rfrxrxx.exe 2116 lxlrrrf.exe 324 hbntbh.exe 2360 pjvvp.exe 2284 vvddd.exe 1076 xxlrrxl.exe 1296 7xrflxl.exe 1436 7rfflll.exe 1688 nhtbnt.exe -
Processes:
resource yara_rule behavioral1/memory/2824-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3016-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/480-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/568-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2424-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2292-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1492-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1928-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1404-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1412-281-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-290-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
nhttbt.exe1vjpp.exe1jjdj.exerlxrrrr.exejjvvv.exevvjvv.exerlllrrr.exehnnbnt.exerfrrllr.exexxxxrrx.exefxxrlfx.exe3lffflx.exe3rlxffr.exehhbtbh.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lffflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exeffxrxrl.exetnhbnn.exedvpdj.exe7dpjd.exerxfxxff.exehbtbbb.exe5ppdj.exetnttbt.exe9tnnth.exepjvjp.exe7lfrffr.exelfrxxrx.exe7bbthh.exepjddd.exepjjpp.exedescription pid process target process PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe ffxrxrl.exe PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe ffxrxrl.exe PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe ffxrxrl.exe PID 2824 wrote to memory of 2652 2824 7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe ffxrxrl.exe PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe tnhbnn.exe PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe tnhbnn.exe PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe tnhbnn.exe PID 2652 wrote to memory of 2852 2652 ffxrxrl.exe tnhbnn.exe PID 2852 wrote to memory of 2664 2852 tnhbnn.exe dvpdj.exe PID 2852 wrote to memory of 2664 2852 tnhbnn.exe dvpdj.exe PID 2852 wrote to memory of 2664 2852 tnhbnn.exe dvpdj.exe PID 2852 wrote to memory of 2664 2852 tnhbnn.exe dvpdj.exe PID 2664 wrote to memory of 2548 2664 dvpdj.exe 7dpjd.exe PID 2664 wrote to memory of 2548 2664 dvpdj.exe 7dpjd.exe PID 2664 wrote to memory of 2548 2664 dvpdj.exe 7dpjd.exe PID 2664 wrote to memory of 2548 2664 dvpdj.exe 7dpjd.exe PID 2548 wrote to memory of 3016 2548 7dpjd.exe rxfxxff.exe PID 2548 wrote to memory of 3016 2548 7dpjd.exe rxfxxff.exe PID 2548 wrote to memory of 3016 2548 7dpjd.exe rxfxxff.exe PID 2548 wrote to memory of 3016 2548 7dpjd.exe rxfxxff.exe PID 3016 wrote to memory of 480 3016 rxfxxff.exe hbtbbb.exe PID 3016 wrote to memory of 480 3016 rxfxxff.exe hbtbbb.exe PID 3016 wrote to memory of 480 3016 rxfxxff.exe hbtbbb.exe PID 3016 wrote to memory of 480 3016 rxfxxff.exe hbtbbb.exe PID 480 wrote to memory of 568 480 hbtbbb.exe 5ppdj.exe PID 480 wrote to memory of 568 480 hbtbbb.exe 5ppdj.exe PID 480 wrote to memory of 568 480 hbtbbb.exe 5ppdj.exe PID 480 wrote to memory of 568 480 hbtbbb.exe 5ppdj.exe PID 568 wrote to memory of 2892 568 5ppdj.exe tnttbt.exe PID 568 wrote to memory of 2892 568 5ppdj.exe tnttbt.exe PID 568 wrote to memory of 2892 568 5ppdj.exe tnttbt.exe PID 568 wrote to memory of 2892 568 5ppdj.exe tnttbt.exe PID 2892 wrote to memory of 2424 2892 tnttbt.exe 9tnnth.exe PID 2892 wrote to memory of 2424 2892 tnttbt.exe 9tnnth.exe PID 2892 wrote to memory of 2424 2892 tnttbt.exe 9tnnth.exe PID 2892 wrote to memory of 2424 2892 tnttbt.exe 9tnnth.exe PID 2424 wrote to memory of 2392 2424 9tnnth.exe pjvjp.exe PID 2424 wrote to memory of 2392 2424 9tnnth.exe pjvjp.exe PID 2424 wrote to memory of 2392 2424 9tnnth.exe pjvjp.exe PID 2424 wrote to memory of 2392 2424 9tnnth.exe pjvjp.exe PID 2392 wrote to memory of 1836 2392 pjvjp.exe 7lfrffr.exe PID 2392 wrote to memory of 1836 2392 pjvjp.exe 7lfrffr.exe PID 2392 wrote to memory of 1836 2392 pjvjp.exe 7lfrffr.exe PID 2392 wrote to memory of 1836 2392 pjvjp.exe 7lfrffr.exe PID 1836 wrote to memory of 2292 1836 7lfrffr.exe lfrxxrx.exe PID 1836 wrote to memory of 2292 1836 7lfrffr.exe lfrxxrx.exe PID 1836 wrote to memory of 2292 1836 7lfrffr.exe lfrxxrx.exe PID 1836 wrote to memory of 2292 1836 7lfrffr.exe lfrxxrx.exe PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 7bbthh.exe PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 7bbthh.exe PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 7bbthh.exe PID 2292 wrote to memory of 1492 2292 lfrxxrx.exe 7bbthh.exe PID 1492 wrote to memory of 2416 1492 7bbthh.exe pjddd.exe PID 1492 wrote to memory of 2416 1492 7bbthh.exe pjddd.exe PID 1492 wrote to memory of 2416 1492 7bbthh.exe pjddd.exe PID 1492 wrote to memory of 2416 1492 7bbthh.exe pjddd.exe PID 2416 wrote to memory of 2024 2416 pjddd.exe pjjpp.exe PID 2416 wrote to memory of 2024 2416 pjddd.exe pjjpp.exe PID 2416 wrote to memory of 2024 2416 pjddd.exe pjjpp.exe PID 2416 wrote to memory of 2024 2416 pjddd.exe pjjpp.exe PID 2024 wrote to memory of 1928 2024 pjjpp.exe 5xfffxx.exe PID 2024 wrote to memory of 1928 2024 pjjpp.exe 5xfffxx.exe PID 2024 wrote to memory of 1928 2024 pjjpp.exe 5xfffxx.exe PID 2024 wrote to memory of 1928 2024 pjjpp.exe 5xfffxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe"C:\Users\Admin\AppData\Local\Temp\7f64ff1d4813dfe2e0da443ab23eb2a3cf4bbaa19defc8e391790ff012dafa0e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\ffxrxrl.exec:\ffxrxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\tnhbnn.exec:\tnhbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dvpdj.exec:\dvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7dpjd.exec:\7dpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rxfxxff.exec:\rxfxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\hbtbbb.exec:\hbtbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\5ppdj.exec:\5ppdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:568 -
\??\c:\tnttbt.exec:\tnttbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\9tnnth.exec:\9tnnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\pjvjp.exec:\pjvjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\7lfrffr.exec:\7lfrffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\lfrxxrx.exec:\lfrxxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\7bbthh.exec:\7bbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\pjddd.exec:\pjddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\pjjpp.exec:\pjjpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5xfffxx.exec:\5xfffxx.exe17⤵
- Executes dropped EXE
PID:1928 -
\??\c:\5rffflx.exec:\5rffflx.exe18⤵
- Executes dropped EXE
PID:1780 -
\??\c:\1tnhhh.exec:\1tnhhh.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\pppdd.exec:\pppdd.exe20⤵
- Executes dropped EXE
PID:2288 -
\??\c:\xllfrrr.exec:\xllfrrr.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\fflfrff.exec:\fflfrff.exe22⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9rfflfl.exec:\9rfflfl.exe23⤵
- Executes dropped EXE
PID:1560 -
\??\c:\9bbhnn.exec:\9bbhnn.exe24⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pddvd.exec:\pddvd.exe25⤵
- Executes dropped EXE
PID:1180 -
\??\c:\9pjvd.exec:\9pjvd.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2944 -
\??\c:\bhttbh.exec:\bhttbh.exe28⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhhntn.exec:\hhhntn.exe29⤵
- Executes dropped EXE
PID:600 -
\??\c:\jdpjp.exec:\jdpjp.exe30⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1lfrrfr.exec:\1lfrrfr.exe31⤵
- Executes dropped EXE
PID:2264 -
\??\c:\xrfllrx.exec:\xrfllrx.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\5bthhn.exec:\5bthhn.exe33⤵
- Executes dropped EXE
PID:2628 -
\??\c:\9tnbbt.exec:\9tnbbt.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\pppjv.exec:\pppjv.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\xxffllr.exec:\xxffllr.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1xlfrll.exec:\1xlfrll.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9xrrflr.exec:\9xrrflr.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tnbbbb.exec:\tnbbbb.exe39⤵
- Executes dropped EXE
PID:264 -
\??\c:\hhntbb.exec:\hhntbb.exe40⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9ppvd.exec:\9ppvd.exe41⤵
- Executes dropped EXE
PID:1308 -
\??\c:\3dpdj.exec:\3dpdj.exe42⤵
- Executes dropped EXE
PID:3004 -
\??\c:\fxfrrxl.exec:\fxfrrxl.exe43⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lfllrxf.exec:\lfllrxf.exe44⤵
- Executes dropped EXE
PID:1236 -
\??\c:\1rfrrlr.exec:\1rfrrlr.exe45⤵
- Executes dropped EXE
PID:2424 -
\??\c:\9tbhtt.exec:\9tbhtt.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\hbttnt.exec:\hbttnt.exe47⤵
- Executes dropped EXE
PID:1876 -
\??\c:\jjddp.exec:\jjddp.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\jjjvd.exec:\jjjvd.exe49⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9lxlrrx.exec:\9lxlrrx.exe50⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rlfxflr.exec:\rlfxflr.exe51⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hbntbb.exec:\hbntbb.exe52⤵
- Executes dropped EXE
PID:1832 -
\??\c:\tnnttb.exec:\tnnttb.exe53⤵
- Executes dropped EXE
PID:2876 -
\??\c:\nhnhnt.exec:\nhnhnt.exe54⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vpdjp.exec:\vpdjp.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5pdpp.exec:\5pdpp.exe56⤵
- Executes dropped EXE
PID:1864 -
\??\c:\rfrxrxx.exec:\rfrxrxx.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\hbntbh.exec:\hbntbh.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\pjvvp.exec:\pjvvp.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vvddd.exec:\vvddd.exe61⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xxlrrxl.exec:\xxlrrxl.exe62⤵
- Executes dropped EXE
PID:1076 -
\??\c:\7xrflxl.exec:\7xrflxl.exe63⤵
- Executes dropped EXE
PID:1296 -
\??\c:\7rfflll.exec:\7rfflll.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\nhtbnt.exec:\nhtbnt.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\bthhtb.exec:\bthhtb.exe66⤵PID:3032
-
\??\c:\vvjpp.exec:\vvjpp.exe67⤵PID:3008
-
\??\c:\ppvvv.exec:\ppvvv.exe68⤵PID:1920
-
\??\c:\3lffflx.exec:\3lffflx.exe69⤵
- System Location Discovery: System Language Discovery
PID:880 -
\??\c:\xrxxflx.exec:\xrxxflx.exe70⤵PID:2536
-
\??\c:\7bnhbn.exec:\7bnhbn.exe71⤵PID:2684
-
\??\c:\hhtntt.exec:\hhtntt.exe72⤵PID:3060
-
\??\c:\hhtnnt.exec:\hhtnnt.exe73⤵PID:1396
-
\??\c:\dvdvd.exec:\dvdvd.exe74⤵PID:2852
-
\??\c:\1dvvv.exec:\1dvvv.exe75⤵PID:1528
-
\??\c:\lflrfxl.exec:\lflrfxl.exe76⤵PID:2600
-
\??\c:\llflxfl.exec:\llflxfl.exe77⤵PID:2696
-
\??\c:\tnbbhn.exec:\tnbbhn.exe78⤵PID:532
-
\??\c:\nnttbh.exec:\nnttbh.exe79⤵PID:1984
-
\??\c:\vvppp.exec:\vvppp.exe80⤵PID:1568
-
\??\c:\jdvvd.exec:\jdvvd.exe81⤵PID:1408
-
\??\c:\fxrxflr.exec:\fxrxflr.exe82⤵PID:2980
-
\??\c:\xffxlrx.exec:\xffxlrx.exe83⤵PID:644
-
\??\c:\bbthtb.exec:\bbthtb.exe84⤵PID:2180
-
\??\c:\tnhnbh.exec:\tnhnbh.exe85⤵PID:1368
-
\??\c:\ppjvd.exec:\ppjvd.exe86⤵PID:1980
-
\??\c:\3jvdd.exec:\3jvdd.exe87⤵PID:1256
-
\??\c:\rlllllr.exec:\rlllllr.exe88⤵PID:1724
-
\??\c:\5llxffx.exec:\5llxffx.exe89⤵PID:524
-
\??\c:\5btnbb.exec:\5btnbb.exe90⤵PID:2376
-
\??\c:\bthhnn.exec:\bthhnn.exe91⤵PID:1948
-
\??\c:\pjvvv.exec:\pjvvv.exe92⤵PID:1928
-
\??\c:\dvddv.exec:\dvddv.exe93⤵PID:2208
-
\??\c:\9fxrxxf.exec:\9fxrxxf.exe94⤵PID:1960
-
\??\c:\5flfrll.exec:\5flfrll.exe95⤵PID:2060
-
\??\c:\tbnnbn.exec:\tbnnbn.exe96⤵PID:664
-
\??\c:\bttbhh.exec:\bttbhh.exe97⤵PID:868
-
\??\c:\ppvvv.exec:\ppvvv.exe98⤵PID:1100
-
\??\c:\jdddp.exec:\jdddp.exe99⤵PID:2448
-
\??\c:\ffffllx.exec:\ffffllx.exe100⤵PID:3012
-
\??\c:\rrxfrfl.exec:\rrxfrfl.exe101⤵PID:2100
-
\??\c:\tnttbb.exec:\tnttbb.exe102⤵PID:1660
-
\??\c:\3bbnbh.exec:\3bbnbh.exe103⤵PID:1696
-
\??\c:\3dpvd.exec:\3dpvd.exe104⤵PID:328
-
\??\c:\7dvjp.exec:\7dvjp.exe105⤵PID:2352
-
\??\c:\rxrxrrf.exec:\rxrxrrf.exe106⤵PID:3024
-
\??\c:\lflrffl.exec:\lflrffl.exe107⤵PID:988
-
\??\c:\rrlrxff.exec:\rrlrxff.exe108⤵PID:1432
-
\??\c:\7nhntb.exec:\7nhntb.exe109⤵PID:2296
-
\??\c:\7jdjp.exec:\7jdjp.exe110⤵PID:2832
-
\??\c:\jjvvv.exec:\jjvvv.exe111⤵PID:2908
-
\??\c:\rlxrrxl.exec:\rlxrrxl.exe112⤵PID:2688
-
\??\c:\1fxfxfx.exec:\1fxfxfx.exe113⤵PID:2836
-
\??\c:\ttbnbn.exec:\ttbnbn.exe114⤵PID:2700
-
\??\c:\ttnnhh.exec:\ttnnhh.exe115⤵PID:2592
-
\??\c:\jjdjv.exec:\jjdjv.exe116⤵PID:2548
-
\??\c:\dddvd.exec:\dddvd.exe117⤵PID:2544
-
\??\c:\ppdjp.exec:\ppdjp.exe118⤵PID:2988
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe119⤵PID:628
-
\??\c:\ffflllx.exec:\ffflllx.exe120⤵PID:2884
-
\??\c:\3bbnnt.exec:\3bbnnt.exe121⤵PID:1852
-
\??\c:\nhbbnn.exec:\nhbbnn.exe122⤵PID:1840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-