Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 23:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe
Resource
win7-20241010-en
6 signatures
120 seconds
General
-
Target
642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe
-
Size
50KB
-
MD5
ca6728b8172836ece668a3316619d520
-
SHA1
96327c6d3592c46536c7503377438c936011e512
-
SHA256
642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02
-
SHA512
4c8d2ca4682425c723a070e04a691212a71e25991be7f982612ceced390ca38a0237bd806b4e2cb5d4c795a2e26df07163ad08624567e6028180c58e1a375e4f
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlO:0cdpeeBSHHMHLf9RyIx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 55 IoCs
resource yara_rule behavioral1/memory/2484-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2776-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2880-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-45-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2788-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-63-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2072-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2688-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3016-105-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/3016-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1104-109-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1104-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1632-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1608-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2464-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/976-204-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/552-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1468-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-267-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2532-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-286-0x00000000002B0000-0x00000000002D9000-memory.dmp family_blackmoon behavioral1/memory/1044-289-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2360-285-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1044-292-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2184-302-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1940-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-332-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-352-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-353-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2068-366-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2600-374-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-375-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1856-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1968-414-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1676-492-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/668-505-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/2052-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1464-554-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2604-645-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-667-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1952-784-0x0000000001B50000-0x0000000001B79000-memory.dmp family_blackmoon behavioral1/memory/112-826-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2184-834-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-873-0x0000000000250000-0x0000000000279000-memory.dmp family_blackmoon behavioral1/memory/2372-904-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/1744-998-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2768 lptvrxf.exe 2776 ldftj.exe 2880 lpdhr.exe 2960 txdfnhh.exe 2788 xvntbn.exe 2684 hlxxb.exe 2072 lrtxhfr.exe 2688 nrbpxpr.exe 1240 fvfvjf.exe 3016 rplljlr.exe 1104 bxllhr.exe 2944 rllbv.exe 1960 tpnvbhj.exe 1272 ntplnr.exe 1632 plpjvxb.exe 1608 htbxrbl.exe 2368 prjhxnj.exe 2468 nltrfln.exe 2332 vdfxjhd.exe 2464 dltjr.exe 976 xhhtjdp.exe 2580 jtbpnrx.exe 552 fnprd.exe 1468 bndntht.exe 2308 rnxxl.exe 2016 phpxr.exe 1788 lhdpnbr.exe 2532 tjbbh.exe 2184 dnfprx.exe 2360 nprnnd.exe 1044 jtxltfn.exe 1940 vddhfh.exe 2816 llrdxh.exe 2820 vrfdtbt.exe 2776 fxvjt.exe 2916 hprxf.exe 1540 hhpjjp.exe 2852 rnddfrv.exe 2676 xnftv.exe 2740 pvlxn.exe 2068 dfxldhr.exe 2600 rhbhlhf.exe 1856 nvrvpb.exe 1800 xjxxvxx.exe 3036 dvtvhp.exe 1132 hprrpr.exe 2608 nrjtl.exe 1968 vphpd.exe 568 lrxtrpp.exe 1868 rrtlj.exe 572 bjldfpr.exe 1600 ldbttn.exe 876 ljvvhbh.exe 2096 vnthfv.exe 2164 bxfrvh.exe 2368 ldfhn.exe 2260 bnftd.exe 2332 btpvxjb.exe 2496 ntphbx.exe 1676 ffbdh.exe 1364 xdxxbtr.exe 668 pxxlx.exe 1980 phpltlb.exe 1332 xpprhlb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxphv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnvvtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnljddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npdhffj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvrfpbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtjpvnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnddfrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlnjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvfvjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpvjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bljddbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltrjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjhlhrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntphbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tptpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbddxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbprt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trfnrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphbjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhrttj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpfbd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrtpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfllbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlfnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hljnxdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxbbxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drbrrtr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhldp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdblx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbpbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpvvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpdrnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2768 2484 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 30 PID 2484 wrote to memory of 2768 2484 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 30 PID 2484 wrote to memory of 2768 2484 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 30 PID 2484 wrote to memory of 2768 2484 642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe 30 PID 2768 wrote to memory of 2776 2768 lptvrxf.exe 31 PID 2768 wrote to memory of 2776 2768 lptvrxf.exe 31 PID 2768 wrote to memory of 2776 2768 lptvrxf.exe 31 PID 2768 wrote to memory of 2776 2768 lptvrxf.exe 31 PID 2776 wrote to memory of 2880 2776 ldftj.exe 32 PID 2776 wrote to memory of 2880 2776 ldftj.exe 32 PID 2776 wrote to memory of 2880 2776 ldftj.exe 32 PID 2776 wrote to memory of 2880 2776 ldftj.exe 32 PID 2880 wrote to memory of 2960 2880 lpdhr.exe 33 PID 2880 wrote to memory of 2960 2880 lpdhr.exe 33 PID 2880 wrote to memory of 2960 2880 lpdhr.exe 33 PID 2880 wrote to memory of 2960 2880 lpdhr.exe 33 PID 2960 wrote to memory of 2788 2960 txdfnhh.exe 34 PID 2960 wrote to memory of 2788 2960 txdfnhh.exe 34 PID 2960 wrote to memory of 2788 2960 txdfnhh.exe 34 PID 2960 wrote to memory of 2788 2960 txdfnhh.exe 34 PID 2788 wrote to memory of 2684 2788 xvntbn.exe 35 PID 2788 wrote to memory of 2684 2788 xvntbn.exe 35 PID 2788 wrote to memory of 2684 2788 xvntbn.exe 35 PID 2788 wrote to memory of 2684 2788 xvntbn.exe 35 PID 2684 wrote to memory of 2072 2684 hlxxb.exe 36 PID 2684 wrote to memory of 2072 2684 hlxxb.exe 36 PID 2684 wrote to memory of 2072 2684 hlxxb.exe 36 PID 2684 wrote to memory of 2072 2684 hlxxb.exe 36 PID 2072 wrote to memory of 2688 2072 lrtxhfr.exe 37 PID 2072 wrote to memory of 2688 2072 lrtxhfr.exe 37 PID 2072 wrote to memory of 2688 2072 lrtxhfr.exe 37 PID 2072 wrote to memory of 2688 2072 lrtxhfr.exe 37 PID 2688 wrote to memory of 1240 2688 nrbpxpr.exe 38 PID 2688 wrote to memory of 1240 2688 nrbpxpr.exe 38 PID 2688 wrote to memory of 1240 2688 nrbpxpr.exe 38 PID 2688 wrote to memory of 1240 2688 nrbpxpr.exe 38 PID 1240 wrote to memory of 3016 1240 fvfvjf.exe 39 PID 1240 wrote to memory of 3016 1240 fvfvjf.exe 39 PID 1240 wrote to memory of 3016 1240 fvfvjf.exe 39 PID 1240 wrote to memory of 3016 1240 fvfvjf.exe 39 PID 3016 wrote to memory of 1104 3016 rplljlr.exe 40 PID 3016 wrote to memory of 1104 3016 rplljlr.exe 40 PID 3016 wrote to memory of 1104 3016 rplljlr.exe 40 PID 3016 wrote to memory of 1104 3016 rplljlr.exe 40 PID 1104 wrote to memory of 2944 1104 bxllhr.exe 41 PID 1104 wrote to memory of 2944 1104 bxllhr.exe 41 PID 1104 wrote to memory of 2944 1104 bxllhr.exe 41 PID 1104 wrote to memory of 2944 1104 bxllhr.exe 41 PID 2944 wrote to memory of 1960 2944 rllbv.exe 42 PID 2944 wrote to memory of 1960 2944 rllbv.exe 42 PID 2944 wrote to memory of 1960 2944 rllbv.exe 42 PID 2944 wrote to memory of 1960 2944 rllbv.exe 42 PID 1960 wrote to memory of 1272 1960 tpnvbhj.exe 43 PID 1960 wrote to memory of 1272 1960 tpnvbhj.exe 43 PID 1960 wrote to memory of 1272 1960 tpnvbhj.exe 43 PID 1960 wrote to memory of 1272 1960 tpnvbhj.exe 43 PID 1272 wrote to memory of 1632 1272 ntplnr.exe 44 PID 1272 wrote to memory of 1632 1272 ntplnr.exe 44 PID 1272 wrote to memory of 1632 1272 ntplnr.exe 44 PID 1272 wrote to memory of 1632 1272 ntplnr.exe 44 PID 1632 wrote to memory of 1608 1632 plpjvxb.exe 45 PID 1632 wrote to memory of 1608 1632 plpjvxb.exe 45 PID 1632 wrote to memory of 1608 1632 plpjvxb.exe 45 PID 1632 wrote to memory of 1608 1632 plpjvxb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe"C:\Users\Admin\AppData\Local\Temp\642688095dc619ed5f3c8e4ca9c59ac9fadbe8ded1144d162c531865871aad02N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lptvrxf.exec:\lptvrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ldftj.exec:\ldftj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\lpdhr.exec:\lpdhr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\txdfnhh.exec:\txdfnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\xvntbn.exec:\xvntbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hlxxb.exec:\hlxxb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lrtxhfr.exec:\lrtxhfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\nrbpxpr.exec:\nrbpxpr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\fvfvjf.exec:\fvfvjf.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\rplljlr.exec:\rplljlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\bxllhr.exec:\bxllhr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\rllbv.exec:\rllbv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tpnvbhj.exec:\tpnvbhj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\ntplnr.exec:\ntplnr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\plpjvxb.exec:\plpjvxb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\htbxrbl.exec:\htbxrbl.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\prjhxnj.exec:\prjhxnj.exe18⤵
- Executes dropped EXE
PID:2368 -
\??\c:\nltrfln.exec:\nltrfln.exe19⤵
- Executes dropped EXE
PID:2468 -
\??\c:\vdfxjhd.exec:\vdfxjhd.exe20⤵
- Executes dropped EXE
PID:2332 -
\??\c:\dltjr.exec:\dltjr.exe21⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xhhtjdp.exec:\xhhtjdp.exe22⤵
- Executes dropped EXE
PID:976 -
\??\c:\jtbpnrx.exec:\jtbpnrx.exe23⤵
- Executes dropped EXE
PID:2580 -
\??\c:\fnprd.exec:\fnprd.exe24⤵
- Executes dropped EXE
PID:552 -
\??\c:\bndntht.exec:\bndntht.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\rnxxl.exec:\rnxxl.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\phpxr.exec:\phpxr.exe27⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lhdpnbr.exec:\lhdpnbr.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tjbbh.exec:\tjbbh.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dnfprx.exec:\dnfprx.exe30⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nprnnd.exec:\nprnnd.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jtxltfn.exec:\jtxltfn.exe32⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vddhfh.exec:\vddhfh.exe33⤵
- Executes dropped EXE
PID:1940 -
\??\c:\llrdxh.exec:\llrdxh.exe34⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vrfdtbt.exec:\vrfdtbt.exe35⤵
- Executes dropped EXE
PID:2820 -
\??\c:\fxvjt.exec:\fxvjt.exe36⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hprxf.exec:\hprxf.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hhpjjp.exec:\hhpjjp.exe38⤵
- Executes dropped EXE
PID:1540 -
\??\c:\rnddfrv.exec:\rnddfrv.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2852 -
\??\c:\xnftv.exec:\xnftv.exe40⤵
- Executes dropped EXE
PID:2676 -
\??\c:\pvlxn.exec:\pvlxn.exe41⤵
- Executes dropped EXE
PID:2740 -
\??\c:\dfxldhr.exec:\dfxldhr.exe42⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rhbhlhf.exec:\rhbhlhf.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\nvrvpb.exec:\nvrvpb.exe44⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xjxxvxx.exec:\xjxxvxx.exe45⤵
- Executes dropped EXE
PID:1800 -
\??\c:\dvtvhp.exec:\dvtvhp.exe46⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hprrpr.exec:\hprrpr.exe47⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nrjtl.exec:\nrjtl.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\vphpd.exec:\vphpd.exe49⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lrxtrpp.exec:\lrxtrpp.exe50⤵
- Executes dropped EXE
PID:568 -
\??\c:\rrtlj.exec:\rrtlj.exe51⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bjldfpr.exec:\bjldfpr.exe52⤵
- Executes dropped EXE
PID:572 -
\??\c:\ldbttn.exec:\ldbttn.exe53⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ljvvhbh.exec:\ljvvhbh.exe54⤵
- Executes dropped EXE
PID:876 -
\??\c:\vnthfv.exec:\vnthfv.exe55⤵
- Executes dropped EXE
PID:2096 -
\??\c:\bxfrvh.exec:\bxfrvh.exe56⤵
- Executes dropped EXE
PID:2164 -
\??\c:\ldfhn.exec:\ldfhn.exe57⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bnftd.exec:\bnftd.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\btpvxjb.exec:\btpvxjb.exe59⤵
- Executes dropped EXE
PID:2332 -
\??\c:\ntphbx.exec:\ntphbx.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2496 -
\??\c:\ffbdh.exec:\ffbdh.exe61⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xdxxbtr.exec:\xdxxbtr.exe62⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pxxlx.exec:\pxxlx.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:668 -
\??\c:\phpltlb.exec:\phpltlb.exe64⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xpprhlb.exec:\xpprhlb.exe65⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hxnjddt.exec:\hxnjddt.exe66⤵PID:1656
-
\??\c:\hjxhl.exec:\hjxhl.exe67⤵PID:1464
-
\??\c:\lnfltpn.exec:\lnfltpn.exe68⤵PID:2212
-
\??\c:\rphfb.exec:\rphfb.exe69⤵PID:2052
-
\??\c:\htrfrpv.exec:\htrfrpv.exe70⤵PID:2540
-
\??\c:\pbdnfff.exec:\pbdnfff.exe71⤵PID:1748
-
\??\c:\vprrdpl.exec:\vprrdpl.exe72⤵PID:1224
-
\??\c:\nftpx.exec:\nftpx.exe73⤵PID:1192
-
\??\c:\lxbtxt.exec:\lxbtxt.exe74⤵PID:2252
-
\??\c:\blvdnbt.exec:\blvdnbt.exe75⤵PID:2828
-
\??\c:\hrdvp.exec:\hrdvp.exe76⤵PID:1940
-
\??\c:\rxnxltt.exec:\rxnxltt.exe77⤵PID:3008
-
\??\c:\dxvnd.exec:\dxvnd.exe78⤵PID:2848
-
\??\c:\txvdln.exec:\txvdln.exe79⤵PID:2812
-
\??\c:\thbxt.exec:\thbxt.exe80⤵PID:2824
-
\??\c:\pvdjt.exec:\pvdjt.exe81⤵
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\bfllbx.exec:\bfllbx.exe82⤵
- System Location Discovery: System Language Discovery
PID:2876 -
\??\c:\ndlpd.exec:\ndlpd.exe83⤵PID:2732
-
\??\c:\fnhrpph.exec:\fnhrpph.exe84⤵PID:2080
-
\??\c:\hrthbxf.exec:\hrthbxf.exe85⤵PID:2604
-
\??\c:\nhjjnhj.exec:\nhjjnhj.exe86⤵PID:1380
-
\??\c:\hxppv.exec:\hxppv.exe87⤵PID:2940
-
\??\c:\fxfjphv.exec:\fxfjphv.exe88⤵PID:2092
-
\??\c:\frbtttf.exec:\frbtttf.exe89⤵PID:1800
-
\??\c:\xvnvlxp.exec:\xvnvlxp.exe90⤵PID:3036
-
\??\c:\ndjthn.exec:\ndjthn.exe91⤵PID:1052
-
\??\c:\brppdtn.exec:\brppdtn.exe92⤵PID:2608
-
\??\c:\jvltnxn.exec:\jvltnxn.exe93⤵PID:1968
-
\??\c:\jhhpt.exec:\jhhpt.exe94⤵PID:664
-
\??\c:\rbjxt.exec:\rbjxt.exe95⤵PID:1160
-
\??\c:\tdhjf.exec:\tdhjf.exe96⤵PID:572
-
\??\c:\hdhpptd.exec:\hdhpptd.exe97⤵PID:1152
-
\??\c:\rblnd.exec:\rblnd.exe98⤵PID:2020
-
\??\c:\nvtnv.exec:\nvtnv.exe99⤵PID:2160
-
\??\c:\xhhpb.exec:\xhhpb.exe100⤵PID:2164
-
\??\c:\nfftd.exec:\nfftd.exe101⤵PID:2368
-
\??\c:\plltnlp.exec:\plltnlp.exe102⤵PID:2356
-
\??\c:\lphlvb.exec:\lphlvb.exe103⤵PID:1396
-
\??\c:\dfflnb.exec:\dfflnb.exe104⤵PID:1580
-
\??\c:\hphhxrb.exec:\hphhxrb.exe105⤵PID:1668
-
\??\c:\hrfnnxv.exec:\hrfnnxv.exe106⤵PID:1576
-
\??\c:\jvfxpjv.exec:\jvfxpjv.exe107⤵PID:1952
-
\??\c:\vblhn.exec:\vblhn.exe108⤵PID:1772
-
\??\c:\dpxln.exec:\dpxln.exe109⤵PID:1476
-
\??\c:\lhtdh.exec:\lhtdh.exe110⤵PID:1688
-
\??\c:\dplvnhd.exec:\dplvnhd.exe111⤵PID:1992
-
\??\c:\bvvrffr.exec:\bvvrffr.exe112⤵PID:2016
-
\??\c:\lxrvrh.exec:\lxrvrh.exe113⤵PID:2220
-
\??\c:\lfrnd.exec:\lfrnd.exe114⤵PID:112
-
\??\c:\hnjxxh.exec:\hnjxxh.exe115⤵PID:3052
-
\??\c:\nvnjtvp.exec:\nvnjtvp.exe116⤵PID:2184
-
\??\c:\pjbvpxx.exec:\pjbvpxx.exe117⤵PID:1224
-
\??\c:\hvvtfl.exec:\hvvtfl.exe118⤵PID:2384
-
\??\c:\fpdlfb.exec:\fpdlfb.exe119⤵PID:2252
-
\??\c:\nfrvrvl.exec:\nfrvrvl.exe120⤵PID:2828
-
\??\c:\lphndf.exec:\lphndf.exe121⤵PID:2864
-
\??\c:\fxjvp.exec:\fxjvp.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-