Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 01:48
Static task
static1
Behavioral task
behavioral1
Sample
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe
Resource
win7-20240903-en
General
-
Target
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe
-
Size
81KB
-
MD5
b6cf6aadf7676a92e6bda3f5a15aba80
-
SHA1
a328464a4187e48dad5e28121068ae690fd4c872
-
SHA256
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7
-
SHA512
b3492d1cc071908d5af85951d90d79b775495f2542f87dcedb74abc2682a2f5ffa41a775e772a94391bad219b0fe6f172cda46fa04eebc05e2347855d13ea8d0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqx:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu41
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2444-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2728-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1636-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1452-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1484-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2964-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1376-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1108-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1556-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/948-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1580-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2064-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1532-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvpvd.exellfrxxr.exehhbhnh.exedvpjd.exefxlrxlf.exenhntbb.exejdpdp.exedvppv.exebthnbn.exe5hhttt.exejdvjv.exe5rffffr.exellxxfrx.exebntbnt.exejdvdp.exe9djvd.exeffxxxrx.exexrfrrxx.exenhbbnb.exenhtnnt.exepjdjd.exefrxrrlf.exelfxfrxr.exe7bhnbn.exetthhnt.exedvjpv.exefxfflll.exetnbhhh.exehbnhnn.exe5vppv.exerfrfllr.exellrrxfr.exenntnbh.exe1jddj.exejddpp.exerfllxrr.exexxfflrr.exe3hbbhb.exe1jvvv.exedpdjj.exerrffrxl.exe7tnnbn.exepjjpp.exevjvpp.exexlflfrx.exehthntn.exehtbhhh.exe7jjjv.exe7dppj.exelxrrxxf.exe1htnbt.exepjjjd.exe7jdvd.exe1xxxffl.exelfflffx.exe1tthtb.exejdvjd.exepdpjv.exe1xrrxxr.exennhhhh.exebnbbnt.exevvpdv.exerrlfxrx.exexrlflrx.exepid process 2992 dvpvd.exe 2372 llfrxxr.exe 1864 hhbhnh.exe 2756 dvpjd.exe 3000 fxlrxlf.exe 2728 nhntbb.exe 2604 jdpdp.exe 1636 dvppv.exe 2016 bthnbn.exe 2880 5hhttt.exe 1452 jdvjv.exe 1484 5rffffr.exe 2736 llxxfrx.exe 2884 bntbnt.exe 628 jdvdp.exe 2964 9djvd.exe 1840 ffxxxrx.exe 1376 xrfrrxx.exe 1260 nhbbnb.exe 1108 nhtnnt.exe 1224 pjdjd.exe 1300 frxrrlf.exe 1556 lfxfrxr.exe 1956 7bhnbn.exe 948 tthhnt.exe 1580 dvjpv.exe 2120 fxfflll.exe 2844 tnbhhh.exe 2064 hbnhnn.exe 1532 5vppv.exe 1964 rfrfllr.exe 2416 llrrxfr.exe 2644 nntnbh.exe 2824 1jddj.exe 3004 jddpp.exe 2784 rfllxrr.exe 2156 xxfflrr.exe 2776 3hbbhb.exe 2568 1jvvv.exe 2604 dpdjj.exe 2672 rrffrxl.exe 1892 7tnnbn.exe 1008 pjjpp.exe 2880 vjvpp.exe 2440 xlflfrx.exe 2512 hthntn.exe 2896 htbhhh.exe 1588 7jjjv.exe 1916 7dppj.exe 2940 lxrrxxf.exe 3060 1htnbt.exe 2948 pjjjd.exe 1748 7jdvd.exe 1696 1xxxffl.exe 448 lfflffx.exe 2532 1tthtb.exe 1156 jdvjd.exe 1624 pdpjv.exe 1312 1xrrxxr.exe 912 nnhhhh.exe 2000 bnbbnt.exe 1432 vvpdv.exe 1584 rrlfxrx.exe 1580 xrlflrx.exe -
Processes:
resource yara_rule behavioral1/memory/2444-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2444-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2756-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2728-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1636-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1452-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1484-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2964-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1376-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1108-214-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1556-240-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/948-258-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1580-268-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2064-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1532-304-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
lfrxfrx.exerlfrfrx.exetnbtnt.exenhnthn.exe7pppv.exentbnnh.exehttnnh.exellxlxlr.exellxrflx.exexrrlxxl.exepjppd.exejvdpd.exe9tbbhn.exeppppd.exehbhhnn.exepjppd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exedvpvd.exellfrxxr.exehhbhnh.exedvpjd.exefxlrxlf.exenhntbb.exejdpdp.exedvppv.exebthnbn.exe5hhttt.exejdvjv.exe5rffffr.exellxxfrx.exebntbnt.exejdvdp.exedescription pid process target process PID 2444 wrote to memory of 2992 2444 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe dvpvd.exe PID 2444 wrote to memory of 2992 2444 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe dvpvd.exe PID 2444 wrote to memory of 2992 2444 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe dvpvd.exe PID 2444 wrote to memory of 2992 2444 c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe dvpvd.exe PID 2992 wrote to memory of 2372 2992 dvpvd.exe llfrxxr.exe PID 2992 wrote to memory of 2372 2992 dvpvd.exe llfrxxr.exe PID 2992 wrote to memory of 2372 2992 dvpvd.exe llfrxxr.exe PID 2992 wrote to memory of 2372 2992 dvpvd.exe llfrxxr.exe PID 2372 wrote to memory of 1864 2372 llfrxxr.exe hhbhnh.exe PID 2372 wrote to memory of 1864 2372 llfrxxr.exe hhbhnh.exe PID 2372 wrote to memory of 1864 2372 llfrxxr.exe hhbhnh.exe PID 2372 wrote to memory of 1864 2372 llfrxxr.exe hhbhnh.exe PID 1864 wrote to memory of 2756 1864 hhbhnh.exe dvpjd.exe PID 1864 wrote to memory of 2756 1864 hhbhnh.exe dvpjd.exe PID 1864 wrote to memory of 2756 1864 hhbhnh.exe dvpjd.exe PID 1864 wrote to memory of 2756 1864 hhbhnh.exe dvpjd.exe PID 2756 wrote to memory of 3000 2756 dvpjd.exe fxlrxlf.exe PID 2756 wrote to memory of 3000 2756 dvpjd.exe fxlrxlf.exe PID 2756 wrote to memory of 3000 2756 dvpjd.exe fxlrxlf.exe PID 2756 wrote to memory of 3000 2756 dvpjd.exe fxlrxlf.exe PID 3000 wrote to memory of 2728 3000 fxlrxlf.exe nhntbb.exe PID 3000 wrote to memory of 2728 3000 fxlrxlf.exe nhntbb.exe PID 3000 wrote to memory of 2728 3000 fxlrxlf.exe nhntbb.exe PID 3000 wrote to memory of 2728 3000 fxlrxlf.exe nhntbb.exe PID 2728 wrote to memory of 2604 2728 nhntbb.exe jdpdp.exe PID 2728 wrote to memory of 2604 2728 nhntbb.exe jdpdp.exe PID 2728 wrote to memory of 2604 2728 nhntbb.exe jdpdp.exe PID 2728 wrote to memory of 2604 2728 nhntbb.exe jdpdp.exe PID 2604 wrote to memory of 1636 2604 jdpdp.exe dvppv.exe PID 2604 wrote to memory of 1636 2604 jdpdp.exe dvppv.exe PID 2604 wrote to memory of 1636 2604 jdpdp.exe dvppv.exe PID 2604 wrote to memory of 1636 2604 jdpdp.exe dvppv.exe PID 1636 wrote to memory of 2016 1636 dvppv.exe bthnbn.exe PID 1636 wrote to memory of 2016 1636 dvppv.exe bthnbn.exe PID 1636 wrote to memory of 2016 1636 dvppv.exe bthnbn.exe PID 1636 wrote to memory of 2016 1636 dvppv.exe bthnbn.exe PID 2016 wrote to memory of 2880 2016 bthnbn.exe 5hhttt.exe PID 2016 wrote to memory of 2880 2016 bthnbn.exe 5hhttt.exe PID 2016 wrote to memory of 2880 2016 bthnbn.exe 5hhttt.exe PID 2016 wrote to memory of 2880 2016 bthnbn.exe 5hhttt.exe PID 2880 wrote to memory of 1452 2880 5hhttt.exe jdvjv.exe PID 2880 wrote to memory of 1452 2880 5hhttt.exe jdvjv.exe PID 2880 wrote to memory of 1452 2880 5hhttt.exe jdvjv.exe PID 2880 wrote to memory of 1452 2880 5hhttt.exe jdvjv.exe PID 1452 wrote to memory of 1484 1452 jdvjv.exe 5rffffr.exe PID 1452 wrote to memory of 1484 1452 jdvjv.exe 5rffffr.exe PID 1452 wrote to memory of 1484 1452 jdvjv.exe 5rffffr.exe PID 1452 wrote to memory of 1484 1452 jdvjv.exe 5rffffr.exe PID 1484 wrote to memory of 2736 1484 5rffffr.exe llxxfrx.exe PID 1484 wrote to memory of 2736 1484 5rffffr.exe llxxfrx.exe PID 1484 wrote to memory of 2736 1484 5rffffr.exe llxxfrx.exe PID 1484 wrote to memory of 2736 1484 5rffffr.exe llxxfrx.exe PID 2736 wrote to memory of 2884 2736 llxxfrx.exe bntbnt.exe PID 2736 wrote to memory of 2884 2736 llxxfrx.exe bntbnt.exe PID 2736 wrote to memory of 2884 2736 llxxfrx.exe bntbnt.exe PID 2736 wrote to memory of 2884 2736 llxxfrx.exe bntbnt.exe PID 2884 wrote to memory of 628 2884 bntbnt.exe jdvdp.exe PID 2884 wrote to memory of 628 2884 bntbnt.exe jdvdp.exe PID 2884 wrote to memory of 628 2884 bntbnt.exe jdvdp.exe PID 2884 wrote to memory of 628 2884 bntbnt.exe jdvdp.exe PID 628 wrote to memory of 2964 628 jdvdp.exe 9djvd.exe PID 628 wrote to memory of 2964 628 jdvdp.exe 9djvd.exe PID 628 wrote to memory of 2964 628 jdvdp.exe 9djvd.exe PID 628 wrote to memory of 2964 628 jdvdp.exe 9djvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe"C:\Users\Admin\AppData\Local\Temp\c81a98664ccc133419938b9cf45b3cacfef17d1532cf2268d9781234d77795e7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\dvpvd.exec:\dvpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\llfrxxr.exec:\llfrxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\hhbhnh.exec:\hhbhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\dvpjd.exec:\dvpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\fxlrxlf.exec:\fxlrxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nhntbb.exec:\nhntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\jdpdp.exec:\jdpdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\dvppv.exec:\dvppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\bthnbn.exec:\bthnbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\5hhttt.exec:\5hhttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\jdvjv.exec:\jdvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\5rffffr.exec:\5rffffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\llxxfrx.exec:\llxxfrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bntbnt.exec:\bntbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jdvdp.exec:\jdvdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\9djvd.exec:\9djvd.exe17⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ffxxxrx.exec:\ffxxxrx.exe18⤵
- Executes dropped EXE
PID:1840 -
\??\c:\xrfrrxx.exec:\xrfrrxx.exe19⤵
- Executes dropped EXE
PID:1376 -
\??\c:\nhbbnb.exec:\nhbbnb.exe20⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nhtnnt.exec:\nhtnnt.exe21⤵
- Executes dropped EXE
PID:1108 -
\??\c:\pjdjd.exec:\pjdjd.exe22⤵
- Executes dropped EXE
PID:1224 -
\??\c:\frxrrlf.exec:\frxrrlf.exe23⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lfxfrxr.exec:\lfxfrxr.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7bhnbn.exec:\7bhnbn.exe25⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tthhnt.exec:\tthhnt.exe26⤵
- Executes dropped EXE
PID:948 -
\??\c:\dvjpv.exec:\dvjpv.exe27⤵
- Executes dropped EXE
PID:1580 -
\??\c:\fxfflll.exec:\fxfflll.exe28⤵
- Executes dropped EXE
PID:2120 -
\??\c:\tnbhhh.exec:\tnbhhh.exe29⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hbnhnn.exec:\hbnhnn.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5vppv.exec:\5vppv.exe31⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rfrfllr.exec:\rfrfllr.exe32⤵
- Executes dropped EXE
PID:1964 -
\??\c:\llrrxfr.exec:\llrrxfr.exe33⤵
- Executes dropped EXE
PID:2416 -
\??\c:\nntnbh.exec:\nntnbh.exe34⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1jddj.exec:\1jddj.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\jddpp.exec:\jddpp.exe36⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rfllxrr.exec:\rfllxrr.exe37⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xxfflrr.exec:\xxfflrr.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\3hbbhb.exec:\3hbbhb.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1jvvv.exec:\1jvvv.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dpdjj.exec:\dpdjj.exe41⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rrffrxl.exec:\rrffrxl.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7tnnbn.exec:\7tnnbn.exe43⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pjjpp.exec:\pjjpp.exe44⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vjvpp.exec:\vjvpp.exe45⤵
- Executes dropped EXE
PID:2880 -
\??\c:\xlflfrx.exec:\xlflfrx.exe46⤵
- Executes dropped EXE
PID:2440 -
\??\c:\hthntn.exec:\hthntn.exe47⤵
- Executes dropped EXE
PID:2512 -
\??\c:\htbhhh.exec:\htbhhh.exe48⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7jjjv.exec:\7jjjv.exe49⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7dppj.exec:\7dppj.exe50⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lxrrxxf.exec:\lxrrxxf.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\1htnbt.exec:\1htnbt.exe52⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjjjd.exec:\pjjjd.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7jdvd.exec:\7jdvd.exe54⤵
- Executes dropped EXE
PID:1748 -
\??\c:\1xxxffl.exec:\1xxxffl.exe55⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lfflffx.exec:\lfflffx.exe56⤵
- Executes dropped EXE
PID:448 -
\??\c:\1tthtb.exec:\1tthtb.exe57⤵
- Executes dropped EXE
PID:2532 -
\??\c:\jdvjd.exec:\jdvjd.exe58⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pdpjv.exec:\pdpjv.exe59⤵
- Executes dropped EXE
PID:1624 -
\??\c:\1xrrxxr.exec:\1xrrxxr.exe60⤵
- Executes dropped EXE
PID:1312 -
\??\c:\nnhhhh.exec:\nnhhhh.exe61⤵
- Executes dropped EXE
PID:912 -
\??\c:\bnbbnt.exec:\bnbbnt.exe62⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vvpdv.exec:\vvpdv.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrlflrx.exec:\xrlflrx.exe65⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bbthtb.exec:\bbthtb.exe66⤵PID:2468
-
\??\c:\bbhnhb.exec:\bbhnhb.exe67⤵PID:1428
-
\??\c:\vvvpv.exec:\vvvpv.exe68⤵PID:2332
-
\??\c:\jpdpv.exec:\jpdpv.exe69⤵PID:1248
-
\??\c:\fxfxfxl.exec:\fxfxfxl.exe70⤵PID:1532
-
\??\c:\3hhnhb.exec:\3hhnhb.exe71⤵PID:2992
-
\??\c:\hhnnnn.exec:\hhnnnn.exe72⤵PID:1664
-
\??\c:\dvppv.exec:\dvppv.exe73⤵PID:2680
-
\??\c:\xxrfxxx.exec:\xxrfxxx.exe74⤵PID:2752
-
\??\c:\rlxlxrf.exec:\rlxlxrf.exe75⤵PID:2856
-
\??\c:\1ntbtb.exec:\1ntbtb.exe76⤵PID:2904
-
\??\c:\jjpvp.exec:\jjpvp.exe77⤵PID:2688
-
\??\c:\vpppp.exec:\vpppp.exe78⤵PID:2548
-
\??\c:\rxxlllf.exec:\rxxlllf.exe79⤵PID:2716
-
\??\c:\rflrxfl.exec:\rflrxfl.exe80⤵PID:1984
-
\??\c:\nntnnh.exec:\nntnnh.exe81⤵PID:2600
-
\??\c:\3jvdv.exec:\3jvdv.exe82⤵PID:2592
-
\??\c:\vvdjd.exec:\vvdjd.exe83⤵PID:236
-
\??\c:\lfflxrr.exec:\lfflxrr.exe84⤵PID:2640
-
\??\c:\xllxxrx.exec:\xllxxrx.exe85⤵PID:1452
-
\??\c:\bnhnht.exec:\bnhnht.exe86⤵PID:1140
-
\??\c:\jdppp.exec:\jdppp.exe87⤵PID:2808
-
\??\c:\pjddj.exec:\pjddj.exe88⤵PID:1612
-
\??\c:\5xxrxfl.exec:\5xxrxfl.exe89⤵PID:2956
-
\??\c:\xrrrlxf.exec:\xrrrlxf.exe90⤵PID:1628
-
\??\c:\bththt.exec:\bththt.exe91⤵PID:2964
-
\??\c:\3tnntn.exec:\3tnntn.exe92⤵PID:1840
-
\??\c:\jdjvp.exec:\jdjvp.exe93⤵PID:1704
-
\??\c:\3jpdd.exec:\3jpdd.exe94⤵PID:1992
-
\??\c:\xrrrxlr.exec:\xrrrxlr.exe95⤵PID:1188
-
\??\c:\thbnbh.exec:\thbnbh.exe96⤵PID:1252
-
\??\c:\tntbhh.exec:\tntbhh.exe97⤵PID:2516
-
\??\c:\ddppj.exec:\ddppj.exe98⤵PID:1192
-
\??\c:\dvdvp.exec:\dvdvp.exe99⤵PID:708
-
\??\c:\9lxrflr.exec:\9lxrflr.exe100⤵PID:884
-
\??\c:\7tbhbb.exec:\7tbhbb.exe101⤵PID:1700
-
\??\c:\bththt.exec:\bththt.exe102⤵PID:2780
-
\??\c:\7jdjj.exec:\7jdjj.exe103⤵PID:2632
-
\??\c:\pvjpj.exec:\pvjpj.exe104⤵PID:1012
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe105⤵PID:2488
-
\??\c:\bbtthh.exec:\bbtthh.exe106⤵PID:2844
-
\??\c:\htbhhh.exec:\htbhhh.exe107⤵PID:1640
-
\??\c:\1tthnn.exec:\1tthnn.exe108⤵PID:2396
-
\??\c:\pjjjj.exec:\pjjjj.exe109⤵PID:2392
-
\??\c:\7xrfrrf.exec:\7xrfrrf.exe110⤵PID:2732
-
\??\c:\xrfrfrr.exec:\xrfrfrr.exe111⤵PID:2424
-
\??\c:\thnhbn.exec:\thnhbn.exe112⤵PID:2152
-
\??\c:\bhttbb.exec:\bhttbb.exe113⤵PID:2740
-
\??\c:\pjvdj.exec:\pjvdj.exe114⤵PID:2696
-
\??\c:\fxlflrx.exec:\fxlflrx.exe115⤵PID:2820
-
\??\c:\llxlxlr.exec:\llxlxlr.exe116⤵
- System Location Discovery: System Language Discovery
PID:2156 -
\??\c:\lxfxllr.exec:\lxfxllr.exe117⤵PID:2980
-
\??\c:\tnbhhn.exec:\tnbhhn.exe118⤵PID:1212
-
\??\c:\djvpv.exec:\djvpv.exe119⤵PID:2544
-
\??\c:\3vpdp.exec:\3vpdp.exe120⤵PID:2564
-
\??\c:\ffrxllx.exec:\ffrxllx.exe121⤵PID:2196
-
\??\c:\7lxxllx.exec:\7lxxllx.exe122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-