Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 17:22
Static task
static1
Behavioral task
behavioral1
Sample
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe
Resource
win7-20240903-en
General
-
Target
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe
-
Size
89KB
-
MD5
f891b4e0104d419684830cfb7653df6e
-
SHA1
0558b2f23024e30754c82a8ea2450a9a923f5ba8
-
SHA256
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995
-
SHA512
8499aef9637c0e483905a2d61e7e66f9a10d56a400d2292159bfd921b786fb16bc7bd8618eb20e809612ae303b4fbbf09781ae576a6fe827d6f712b14288ae50
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vhdW/:ymb3NkkiQ3mdBjFo6Pfgy3dbc/hdW/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2068-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1996-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2108-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2856-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1016-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2460-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2156-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/848-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-218-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/668-226-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-244-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2136-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2068-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9llxfxx.exehtbhhh.exe7dpvp.exepjjpv.exe7xrxxff.exehtbtnn.exeddpdj.exe1rrflrf.exehtbntt.exe5bbttn.exepdjjv.exerlxxffl.exexrxlrxf.exe7httbt.exedvvdv.exe7jddd.exexrfrrrx.exehntnbh.exethttbb.exe5jpvp.exefrxfllr.exe5xflrlx.exe3hnhnb.exejdppd.exelfxrrrx.exefrfffff.exethhbbb.exe9nbtbh.exedvdvd.exe3lrrxxf.exefxrlrrr.exebhnnbb.exedvjjp.exexlxrrlr.exerfrrfff.exetnnhhh.exe9tnhnh.exedpdpv.exejjppd.exexrxrrlr.exefrrflfl.exenntnbn.exenhbbhn.exedvjdj.exejvddj.exejvdpv.exerlrfrxf.exexlrlrll.exehbntnt.exedpjvd.exefxlxllr.exefrffffl.exehtbbbb.exetbtttn.exejvdjp.exe3dvvp.exefxxrlll.exe5rxxrxx.exebnnhbh.exe3hhhhb.exedpvjp.exevjppv.exexlxrfff.exefrxrxrf.exepid process 1996 9llxfxx.exe 2996 htbhhh.exe 2516 7dpvp.exe 1740 pjjpv.exe 2868 7xrxxff.exe 2692 htbtnn.exe 2620 ddpdj.exe 2640 1rrflrf.exe 2616 htbntt.exe 2228 5bbttn.exe 2108 pdjjv.exe 2848 rlxxffl.exe 1648 xrxlrxf.exe 2852 7httbt.exe 2856 dvvdv.exe 1016 7jddd.exe 2928 xrfrrrx.exe 2904 hntnbh.exe 2460 thttbb.exe 2156 5jpvp.exe 848 frxfllr.exe 2564 5xflrlx.exe 668 3hnhnb.exe 1896 jdppd.exe 1940 lfxrrrx.exe 2136 frfffff.exe 3040 thhbbb.exe 1932 9nbtbh.exe 2068 dvdvd.exe 2332 3lrrxxf.exe 2500 fxrlrrr.exe 2424 bhnnbb.exe 1508 dvjjp.exe 2808 xlxrrlr.exe 2744 rfrrfff.exe 3008 tnnhhh.exe 2612 9tnhnh.exe 2608 dpdpv.exe 2620 jjppd.exe 2600 xrxrrlr.exe 2208 frrflfl.exe 1692 nntnbn.exe 1924 nhbbhn.exe 1868 dvjdj.exe 1728 jvddj.exe 2572 jvdpv.exe 2832 rlrfrxf.exe 2356 xlrlrll.exe 1836 hbntnt.exe 2956 dpjvd.exe 2988 fxlxllr.exe 988 frffffl.exe 2460 htbbbb.exe 2160 tbtttn.exe 1132 jvdjp.exe 2568 3dvvp.exe 2968 fxxrlll.exe 2480 5rxxrxx.exe 2812 bnnhbh.exe 1684 3hhhhb.exe 2952 dpvjp.exe 804 vjppv.exe 1572 xlxrfff.exe 2452 frxrxrf.exe -
Processes:
resource yara_rule behavioral1/memory/2068-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1996-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2108-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2856-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1016-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2460-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2156-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/848-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-218-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/668-226-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-244-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2136-253-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2068-280-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rlxllrl.exe7lfxlfl.exe1rrflrf.exevvpvv.exe1jdpp.exenhbbhh.exetbhbhn.exehbnttt.exefxllrlr.exelffflfl.exelfxxlrl.exepdjjv.exelrfflll.exetntntt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrflrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntntt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe9llxfxx.exehtbhhh.exe7dpvp.exepjjpv.exe7xrxxff.exehtbtnn.exeddpdj.exe1rrflrf.exehtbntt.exe5bbttn.exepdjjv.exerlxxffl.exexrxlrxf.exe7httbt.exedvvdv.exedescription pid process target process PID 2068 wrote to memory of 1996 2068 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 9llxfxx.exe PID 2068 wrote to memory of 1996 2068 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 9llxfxx.exe PID 2068 wrote to memory of 1996 2068 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 9llxfxx.exe PID 2068 wrote to memory of 1996 2068 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe 9llxfxx.exe PID 1996 wrote to memory of 2996 1996 9llxfxx.exe htbhhh.exe PID 1996 wrote to memory of 2996 1996 9llxfxx.exe htbhhh.exe PID 1996 wrote to memory of 2996 1996 9llxfxx.exe htbhhh.exe PID 1996 wrote to memory of 2996 1996 9llxfxx.exe htbhhh.exe PID 2996 wrote to memory of 2516 2996 htbhhh.exe 7dpvp.exe PID 2996 wrote to memory of 2516 2996 htbhhh.exe 7dpvp.exe PID 2996 wrote to memory of 2516 2996 htbhhh.exe 7dpvp.exe PID 2996 wrote to memory of 2516 2996 htbhhh.exe 7dpvp.exe PID 2516 wrote to memory of 1740 2516 7dpvp.exe pjjpv.exe PID 2516 wrote to memory of 1740 2516 7dpvp.exe pjjpv.exe PID 2516 wrote to memory of 1740 2516 7dpvp.exe pjjpv.exe PID 2516 wrote to memory of 1740 2516 7dpvp.exe pjjpv.exe PID 1740 wrote to memory of 2868 1740 pjjpv.exe 7xrxxff.exe PID 1740 wrote to memory of 2868 1740 pjjpv.exe 7xrxxff.exe PID 1740 wrote to memory of 2868 1740 pjjpv.exe 7xrxxff.exe PID 1740 wrote to memory of 2868 1740 pjjpv.exe 7xrxxff.exe PID 2868 wrote to memory of 2692 2868 7xrxxff.exe htbtnn.exe PID 2868 wrote to memory of 2692 2868 7xrxxff.exe htbtnn.exe PID 2868 wrote to memory of 2692 2868 7xrxxff.exe htbtnn.exe PID 2868 wrote to memory of 2692 2868 7xrxxff.exe htbtnn.exe PID 2692 wrote to memory of 2620 2692 htbtnn.exe ddpdj.exe PID 2692 wrote to memory of 2620 2692 htbtnn.exe ddpdj.exe PID 2692 wrote to memory of 2620 2692 htbtnn.exe ddpdj.exe PID 2692 wrote to memory of 2620 2692 htbtnn.exe ddpdj.exe PID 2620 wrote to memory of 2640 2620 ddpdj.exe 1rrflrf.exe PID 2620 wrote to memory of 2640 2620 ddpdj.exe 1rrflrf.exe PID 2620 wrote to memory of 2640 2620 ddpdj.exe 1rrflrf.exe PID 2620 wrote to memory of 2640 2620 ddpdj.exe 1rrflrf.exe PID 2640 wrote to memory of 2616 2640 1rrflrf.exe htbntt.exe PID 2640 wrote to memory of 2616 2640 1rrflrf.exe htbntt.exe PID 2640 wrote to memory of 2616 2640 1rrflrf.exe htbntt.exe PID 2640 wrote to memory of 2616 2640 1rrflrf.exe htbntt.exe PID 2616 wrote to memory of 2228 2616 htbntt.exe 5bbttn.exe PID 2616 wrote to memory of 2228 2616 htbntt.exe 5bbttn.exe PID 2616 wrote to memory of 2228 2616 htbntt.exe 5bbttn.exe PID 2616 wrote to memory of 2228 2616 htbntt.exe 5bbttn.exe PID 2228 wrote to memory of 2108 2228 5bbttn.exe pdjjv.exe PID 2228 wrote to memory of 2108 2228 5bbttn.exe pdjjv.exe PID 2228 wrote to memory of 2108 2228 5bbttn.exe pdjjv.exe PID 2228 wrote to memory of 2108 2228 5bbttn.exe pdjjv.exe PID 2108 wrote to memory of 2848 2108 pdjjv.exe rlxxffl.exe PID 2108 wrote to memory of 2848 2108 pdjjv.exe rlxxffl.exe PID 2108 wrote to memory of 2848 2108 pdjjv.exe rlxxffl.exe PID 2108 wrote to memory of 2848 2108 pdjjv.exe rlxxffl.exe PID 2848 wrote to memory of 1648 2848 rlxxffl.exe xrxlrxf.exe PID 2848 wrote to memory of 1648 2848 rlxxffl.exe xrxlrxf.exe PID 2848 wrote to memory of 1648 2848 rlxxffl.exe xrxlrxf.exe PID 2848 wrote to memory of 1648 2848 rlxxffl.exe xrxlrxf.exe PID 1648 wrote to memory of 2852 1648 xrxlrxf.exe 7httbt.exe PID 1648 wrote to memory of 2852 1648 xrxlrxf.exe 7httbt.exe PID 1648 wrote to memory of 2852 1648 xrxlrxf.exe 7httbt.exe PID 1648 wrote to memory of 2852 1648 xrxlrxf.exe 7httbt.exe PID 2852 wrote to memory of 2856 2852 7httbt.exe dvvdv.exe PID 2852 wrote to memory of 2856 2852 7httbt.exe dvvdv.exe PID 2852 wrote to memory of 2856 2852 7httbt.exe dvvdv.exe PID 2852 wrote to memory of 2856 2852 7httbt.exe dvvdv.exe PID 2856 wrote to memory of 1016 2856 dvvdv.exe 7jddd.exe PID 2856 wrote to memory of 1016 2856 dvvdv.exe 7jddd.exe PID 2856 wrote to memory of 1016 2856 dvvdv.exe 7jddd.exe PID 2856 wrote to memory of 1016 2856 dvvdv.exe 7jddd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe"C:\Users\Admin\AppData\Local\Temp\f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\9llxfxx.exec:\9llxfxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\htbhhh.exec:\htbhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\7dpvp.exec:\7dpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\pjjpv.exec:\pjjpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\7xrxxff.exec:\7xrxxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\htbtnn.exec:\htbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ddpdj.exec:\ddpdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\1rrflrf.exec:\1rrflrf.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\htbntt.exec:\htbntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5bbttn.exec:\5bbttn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\pdjjv.exec:\pdjjv.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\rlxxffl.exec:\rlxxffl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xrxlrxf.exec:\xrxlrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\7httbt.exec:\7httbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dvvdv.exec:\dvvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\7jddd.exec:\7jddd.exe17⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xrfrrrx.exec:\xrfrrrx.exe18⤵
- Executes dropped EXE
PID:2928 -
\??\c:\hntnbh.exec:\hntnbh.exe19⤵
- Executes dropped EXE
PID:2904 -
\??\c:\thttbb.exec:\thttbb.exe20⤵
- Executes dropped EXE
PID:2460 -
\??\c:\5jpvp.exec:\5jpvp.exe21⤵
- Executes dropped EXE
PID:2156 -
\??\c:\frxfllr.exec:\frxfllr.exe22⤵
- Executes dropped EXE
PID:848 -
\??\c:\5xflrlx.exec:\5xflrlx.exe23⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3hnhnb.exec:\3hnhnb.exe24⤵
- Executes dropped EXE
PID:668 -
\??\c:\jdppd.exec:\jdppd.exe25⤵
- Executes dropped EXE
PID:1896 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe26⤵
- Executes dropped EXE
PID:1940 -
\??\c:\frfffff.exec:\frfffff.exe27⤵
- Executes dropped EXE
PID:2136 -
\??\c:\thhbbb.exec:\thhbbb.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\9nbtbh.exec:\9nbtbh.exe29⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dvdvd.exec:\dvdvd.exe30⤵
- Executes dropped EXE
PID:2068 -
\??\c:\3lrrxxf.exec:\3lrrxxf.exe31⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxrlrrr.exec:\fxrlrrr.exe32⤵
- Executes dropped EXE
PID:2500 -
\??\c:\bhnnbb.exec:\bhnnbb.exe33⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jdvvv.exec:\jdvvv.exe34⤵PID:2076
-
\??\c:\dvjjp.exec:\dvjjp.exe35⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xlxrrlr.exec:\xlxrrlr.exe36⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rfrrfff.exec:\rfrrfff.exe37⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tnnhhh.exec:\tnnhhh.exe38⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9tnhnh.exec:\9tnhnh.exe39⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpdpv.exec:\dpdpv.exe40⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jjppd.exec:\jjppd.exe41⤵
- Executes dropped EXE
PID:2620 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\frrflfl.exec:\frrflfl.exe43⤵
- Executes dropped EXE
PID:2208 -
\??\c:\nntnbn.exec:\nntnbn.exe44⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhbbhn.exec:\nhbbhn.exe45⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dvjdj.exec:\dvjdj.exe46⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jvddj.exec:\jvddj.exe47⤵
- Executes dropped EXE
PID:1728 -
\??\c:\jvdpv.exec:\jvdpv.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlrfrxf.exec:\rlrfrxf.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xlrlrll.exec:\xlrlrll.exe50⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hbntnt.exec:\hbntnt.exe51⤵
- Executes dropped EXE
PID:1836 -
\??\c:\dpjvd.exec:\dpjvd.exe52⤵
- Executes dropped EXE
PID:2956 -
\??\c:\fxlxllr.exec:\fxlxllr.exe53⤵
- Executes dropped EXE
PID:2988 -
\??\c:\frffffl.exec:\frffffl.exe54⤵
- Executes dropped EXE
PID:988 -
\??\c:\htbbbb.exec:\htbbbb.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\tbtttn.exec:\tbtttn.exe56⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jvdjp.exec:\jvdjp.exe57⤵
- Executes dropped EXE
PID:1132 -
\??\c:\3dvvp.exec:\3dvvp.exe58⤵
- Executes dropped EXE
PID:2568 -
\??\c:\fxxrlll.exec:\fxxrlll.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\5rxxrxx.exec:\5rxxrxx.exe60⤵
- Executes dropped EXE
PID:2480 -
\??\c:\bnnhbh.exec:\bnnhbh.exe61⤵
- Executes dropped EXE
PID:2812 -
\??\c:\3hhhhb.exec:\3hhhhb.exe62⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dpvjp.exec:\dpvjp.exe63⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vjppv.exec:\vjppv.exe64⤵
- Executes dropped EXE
PID:804 -
\??\c:\xlxrfff.exec:\xlxrfff.exe65⤵
- Executes dropped EXE
PID:1572 -
\??\c:\frxrxrf.exec:\frxrxrf.exe66⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nbnntn.exec:\nbnntn.exe67⤵PID:2348
-
\??\c:\7nhhnh.exec:\7nhhnh.exe68⤵PID:2432
-
\??\c:\9jjpd.exec:\9jjpd.exe69⤵PID:2332
-
\??\c:\vpdjp.exec:\vpdjp.exe70⤵PID:2532
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe71⤵PID:2424
-
\??\c:\5frxxxx.exec:\5frxxxx.exe72⤵PID:2516
-
\??\c:\rflfffl.exec:\rflfffl.exe73⤵PID:2316
-
\??\c:\5htttt.exec:\5htttt.exe74⤵PID:2740
-
\??\c:\bntntt.exec:\bntntt.exe75⤵PID:2868
-
\??\c:\pjdvp.exec:\pjdvp.exe76⤵PID:2836
-
\??\c:\3jpvd.exec:\3jpvd.exe77⤵PID:2804
-
\??\c:\rrfrxxf.exec:\rrfrxxf.exe78⤵PID:2792
-
\??\c:\lflxffr.exec:\lflxffr.exe79⤵PID:2588
-
\??\c:\lxrrxlx.exec:\lxrrxlx.exe80⤵PID:2324
-
\??\c:\hbntht.exec:\hbntht.exe81⤵PID:2100
-
\??\c:\bnnhbt.exec:\bnnhbt.exe82⤵PID:1200
-
\??\c:\pjpjp.exec:\pjpjp.exe83⤵PID:2108
-
\??\c:\pjvvv.exec:\pjvvv.exe84⤵PID:316
-
\??\c:\xrlrffx.exec:\xrlrffx.exe85⤵PID:1912
-
\??\c:\3lffffl.exec:\3lffffl.exe86⤵PID:2408
-
\??\c:\fxlfllr.exec:\fxlfllr.exe87⤵PID:1780
-
\??\c:\tntthh.exec:\tntthh.exe88⤵PID:1248
-
\??\c:\nnbhhh.exec:\nnbhhh.exe89⤵PID:1016
-
\??\c:\5vdvd.exec:\5vdvd.exe90⤵PID:2688
-
\??\c:\pdjpd.exec:\pdjpd.exe91⤵PID:2268
-
\??\c:\5lrflff.exec:\5lrflff.exe92⤵PID:3064
-
\??\c:\rlrfrxf.exec:\rlrfrxf.exe93⤵PID:2200
-
\??\c:\xrlflll.exec:\xrlflll.exe94⤵PID:1084
-
\??\c:\3bttbb.exec:\3bttbb.exe95⤵PID:2976
-
\??\c:\bttntt.exec:\bttntt.exe96⤵PID:1532
-
\??\c:\vjjjp.exec:\vjjjp.exe97⤵PID:1224
-
\??\c:\dpppp.exec:\dpppp.exe98⤵PID:1604
-
\??\c:\fxlllrr.exec:\fxlllrr.exe99⤵PID:828
-
\??\c:\lrfflll.exec:\lrfflll.exe100⤵
- System Location Discovery: System Language Discovery
PID:572 -
\??\c:\thtntn.exec:\thtntn.exe101⤵PID:2136
-
\??\c:\bttbbb.exec:\bttbbb.exe102⤵PID:3040
-
\??\c:\jppjv.exec:\jppjv.exe103⤵PID:2428
-
\??\c:\vjvdp.exec:\vjvdp.exe104⤵PID:1632
-
\??\c:\rflfllr.exec:\rflfllr.exe105⤵PID:1712
-
\??\c:\lflrrrl.exec:\lflrrrl.exe106⤵PID:2440
-
\??\c:\thnhtb.exec:\thnhtb.exe107⤵PID:2900
-
\??\c:\bnhhbh.exec:\bnhhbh.exe108⤵PID:2504
-
\??\c:\htnhtt.exec:\htnhtt.exe109⤵PID:580
-
\??\c:\5vjdj.exec:\5vjdj.exe110⤵PID:1624
-
\??\c:\pdpjj.exec:\pdpjj.exe111⤵PID:1740
-
\??\c:\rfxrrrf.exec:\rfxrrrf.exe112⤵PID:2824
-
\??\c:\llfxffr.exec:\llfxffr.exe113⤵PID:3004
-
\??\c:\nbnntt.exec:\nbnntt.exe114⤵PID:2704
-
\??\c:\nbbntb.exec:\nbbntb.exe115⤵PID:2096
-
\??\c:\vpdjp.exec:\vpdjp.exe116⤵PID:2792
-
\??\c:\vpvvd.exec:\vpvvd.exe117⤵PID:2588
-
\??\c:\7pvjj.exec:\7pvjj.exe118⤵PID:2652
-
\??\c:\1frlrrx.exec:\1frlrrx.exe119⤵PID:2212
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe120⤵PID:1468
-
\??\c:\nnhthn.exec:\nnhthn.exe121⤵PID:2916
-
\??\c:\bnbttt.exec:\bnbttt.exe122⤵PID:2016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-