Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 03:07
Static task
static1
Behavioral task
behavioral1
Sample
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe
Resource
win7-20240903-en
General
-
Target
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe
-
Size
96KB
-
MD5
78df64c258f26ecec4361c803b9934a8
-
SHA1
de84e215db2887f2c0b15110f814df1a67bda402
-
SHA256
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346
-
SHA512
a7fdebceb0f20f9d01d66cb04be1b6f64b4c0843fb73dc8f26fe798fac1bf629e331173b1682d7e4dcdde7a0c76fb6938e3114428ed263625e560e9d62f86b69
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlZMzcLI:ymb3NkkiQ3mdBjFoLucjD7cM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1684-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2916-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2748-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2536-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/596-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1724-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1252-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2304-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1756-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2112-307-0x0000000077810000-0x000000007792F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7xlflfr.exe5bnnbb.exevpppv.exe1vpvd.exelflxfrx.exennhbnn.exejjddp.exetnhtbh.exejpjpd.exepjdjj.exerrlfrrf.exe9nbbnh.exetnbnnt.exejdvjp.exelrrrfff.exe9lxlxxl.exehbtttt.exeddvpd.exefxxrxfr.exelffrflf.exethtnnn.exethhhbb.exedvjjp.exerrfffxf.exethtntt.exenhhtbh.exe3jdvj.exelfllllr.exehbnntt.exevjpjv.exejdpvd.exebnbhhh.exedpvvj.exejpvdv.exexrflxfl.exerlfxxxf.exe5nbhbn.exethhhhh.exe7dppv.exe5vjdd.exefxffrrx.exefffrflr.exenhthnb.exe1tttbb.exejdjpd.exerfllxrx.exehthnhh.exedjpjp.exejdppp.exerfllxxx.exelfxfffl.exetnhnbb.exedvjvj.exevddjd.exexrfxllx.exelflxlll.exehbnnnn.exe7tnttt.exevpjjv.exejdvvj.exelfrrxfx.exexlflffr.exerxllrrx.exehhbbtt.exepid process 2916 7xlflfr.exe 2324 5bnnbb.exe 2584 vpppv.exe 2748 1vpvd.exe 2616 lflxfrx.exe 2800 nnhbnn.exe 2548 jjddp.exe 2536 tnhtbh.exe 2952 jpjpd.exe 596 pjdjj.exe 1040 rrlfrrf.exe 584 9nbbnh.exe 1848 tnbnnt.exe 1724 jdvjp.exe 1252 lrrrfff.exe 2000 9lxlxxl.exe 2304 hbtttt.exe 2024 ddvpd.exe 1960 fxxrxfr.exe 1756 lffrflf.exe 2712 thtnnn.exe 2124 thhhbb.exe 2476 dvjjp.exe 2360 rrfffxf.exe 2348 thtntt.exe 1744 nhhtbh.exe 1640 3jdvj.exe 1908 lfllllr.exe 992 hbnntt.exe 884 vjpjv.exe 2112 jdpvd.exe 1596 bnbhhh.exe 2052 dpvvj.exe 2196 jpvdv.exe 2752 xrflxfl.exe 2744 rlfxxxf.exe 2792 5nbhbn.exe 2820 thhhhh.exe 2728 7dppv.exe 2044 5vjdd.exe 2800 fxffrrx.exe 2568 fffrflr.exe 2512 nhthnb.exe 2388 1tttbb.exe 332 jdjpd.exe 536 rfllxrx.exe 736 hthnhh.exe 2456 djpjp.exe 1432 jdppp.exe 2256 rfllxxx.exe 2308 lfxfffl.exe 1188 tnhnbb.exe 1716 dvjvj.exe 2296 vddjd.exe 2252 xrfxllx.exe 2316 lflxlll.exe 2720 hbnnnn.exe 2700 7tnttt.exe 2848 vpjjv.exe 2900 jdvvj.exe 2124 lfrrxfx.exe 2472 xlflffr.exe 444 rxllrrx.exe 3060 hhbbtt.exe -
Processes:
resource yara_rule behavioral1/memory/1684-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2748-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2584-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2536-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/596-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1040-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1724-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1252-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2304-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1756-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1908-286-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2112-307-0x0000000077810000-0x000000007792F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3dppv.exejvdpj.exe5jvvd.exerxllrrx.exeddpdv.exe9xrrxxf.exedvjdj.exe5vpdj.exerlxxfll.exerfrrffl.exexxrxrrx.exelfllllr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe7xlflfr.exe5bnnbb.exevpppv.exe1vpvd.exelflxfrx.exennhbnn.exejjddp.exetnhtbh.exejpjpd.exepjdjj.exerrlfrrf.exe9nbbnh.exetnbnnt.exejdvjp.exelrrrfff.exedescription pid process target process PID 1684 wrote to memory of 2916 1684 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 7xlflfr.exe PID 1684 wrote to memory of 2916 1684 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 7xlflfr.exe PID 1684 wrote to memory of 2916 1684 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 7xlflfr.exe PID 1684 wrote to memory of 2916 1684 c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe 7xlflfr.exe PID 2916 wrote to memory of 2324 2916 7xlflfr.exe 5bnnbb.exe PID 2916 wrote to memory of 2324 2916 7xlflfr.exe 5bnnbb.exe PID 2916 wrote to memory of 2324 2916 7xlflfr.exe 5bnnbb.exe PID 2916 wrote to memory of 2324 2916 7xlflfr.exe 5bnnbb.exe PID 2324 wrote to memory of 2584 2324 5bnnbb.exe vpppv.exe PID 2324 wrote to memory of 2584 2324 5bnnbb.exe vpppv.exe PID 2324 wrote to memory of 2584 2324 5bnnbb.exe vpppv.exe PID 2324 wrote to memory of 2584 2324 5bnnbb.exe vpppv.exe PID 2584 wrote to memory of 2748 2584 vpppv.exe 1vpvd.exe PID 2584 wrote to memory of 2748 2584 vpppv.exe 1vpvd.exe PID 2584 wrote to memory of 2748 2584 vpppv.exe 1vpvd.exe PID 2584 wrote to memory of 2748 2584 vpppv.exe 1vpvd.exe PID 2748 wrote to memory of 2616 2748 1vpvd.exe lflxfrx.exe PID 2748 wrote to memory of 2616 2748 1vpvd.exe lflxfrx.exe PID 2748 wrote to memory of 2616 2748 1vpvd.exe lflxfrx.exe PID 2748 wrote to memory of 2616 2748 1vpvd.exe lflxfrx.exe PID 2616 wrote to memory of 2800 2616 lflxfrx.exe nnhbnn.exe PID 2616 wrote to memory of 2800 2616 lflxfrx.exe nnhbnn.exe PID 2616 wrote to memory of 2800 2616 lflxfrx.exe nnhbnn.exe PID 2616 wrote to memory of 2800 2616 lflxfrx.exe nnhbnn.exe PID 2800 wrote to memory of 2548 2800 nnhbnn.exe jjddp.exe PID 2800 wrote to memory of 2548 2800 nnhbnn.exe jjddp.exe PID 2800 wrote to memory of 2548 2800 nnhbnn.exe jjddp.exe PID 2800 wrote to memory of 2548 2800 nnhbnn.exe jjddp.exe PID 2548 wrote to memory of 2536 2548 jjddp.exe tnhtbh.exe PID 2548 wrote to memory of 2536 2548 jjddp.exe tnhtbh.exe PID 2548 wrote to memory of 2536 2548 jjddp.exe tnhtbh.exe PID 2548 wrote to memory of 2536 2548 jjddp.exe tnhtbh.exe PID 2536 wrote to memory of 2952 2536 tnhtbh.exe jpjpd.exe PID 2536 wrote to memory of 2952 2536 tnhtbh.exe jpjpd.exe PID 2536 wrote to memory of 2952 2536 tnhtbh.exe jpjpd.exe PID 2536 wrote to memory of 2952 2536 tnhtbh.exe jpjpd.exe PID 2952 wrote to memory of 596 2952 jpjpd.exe pjdjj.exe PID 2952 wrote to memory of 596 2952 jpjpd.exe pjdjj.exe PID 2952 wrote to memory of 596 2952 jpjpd.exe pjdjj.exe PID 2952 wrote to memory of 596 2952 jpjpd.exe pjdjj.exe PID 596 wrote to memory of 1040 596 pjdjj.exe rrlfrrf.exe PID 596 wrote to memory of 1040 596 pjdjj.exe rrlfrrf.exe PID 596 wrote to memory of 1040 596 pjdjj.exe rrlfrrf.exe PID 596 wrote to memory of 1040 596 pjdjj.exe rrlfrrf.exe PID 1040 wrote to memory of 584 1040 rrlfrrf.exe 9nbbnh.exe PID 1040 wrote to memory of 584 1040 rrlfrrf.exe 9nbbnh.exe PID 1040 wrote to memory of 584 1040 rrlfrrf.exe 9nbbnh.exe PID 1040 wrote to memory of 584 1040 rrlfrrf.exe 9nbbnh.exe PID 584 wrote to memory of 1848 584 9nbbnh.exe tnbnnt.exe PID 584 wrote to memory of 1848 584 9nbbnh.exe tnbnnt.exe PID 584 wrote to memory of 1848 584 9nbbnh.exe tnbnnt.exe PID 584 wrote to memory of 1848 584 9nbbnh.exe tnbnnt.exe PID 1848 wrote to memory of 1724 1848 tnbnnt.exe jdvjp.exe PID 1848 wrote to memory of 1724 1848 tnbnnt.exe jdvjp.exe PID 1848 wrote to memory of 1724 1848 tnbnnt.exe jdvjp.exe PID 1848 wrote to memory of 1724 1848 tnbnnt.exe jdvjp.exe PID 1724 wrote to memory of 1252 1724 jdvjp.exe lrrrfff.exe PID 1724 wrote to memory of 1252 1724 jdvjp.exe lrrrfff.exe PID 1724 wrote to memory of 1252 1724 jdvjp.exe lrrrfff.exe PID 1724 wrote to memory of 1252 1724 jdvjp.exe lrrrfff.exe PID 1252 wrote to memory of 2000 1252 lrrrfff.exe 9lxlxxl.exe PID 1252 wrote to memory of 2000 1252 lrrrfff.exe 9lxlxxl.exe PID 1252 wrote to memory of 2000 1252 lrrrfff.exe 9lxlxxl.exe PID 1252 wrote to memory of 2000 1252 lrrrfff.exe 9lxlxxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe"C:\Users\Admin\AppData\Local\Temp\c4e8ca21bb6882fccd0e899a6d93aa473b859e60423db6eca0645c9316169346.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\7xlflfr.exec:\7xlflfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\5bnnbb.exec:\5bnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\vpppv.exec:\vpppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\1vpvd.exec:\1vpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lflxfrx.exec:\lflxfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\nnhbnn.exec:\nnhbnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\jjddp.exec:\jjddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\tnhtbh.exec:\tnhtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\jpjpd.exec:\jpjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\pjdjj.exec:\pjdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\rrlfrrf.exec:\rrlfrrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\9nbbnh.exec:\9nbbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\tnbnnt.exec:\tnbnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\jdvjp.exec:\jdvjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\lrrrfff.exec:\lrrrfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\9lxlxxl.exec:\9lxlxxl.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\hbtttt.exec:\hbtttt.exe18⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddvpd.exec:\ddvpd.exe19⤵
- Executes dropped EXE
PID:2024 -
\??\c:\fxxrxfr.exec:\fxxrxfr.exe20⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lffrflf.exec:\lffrflf.exe21⤵
- Executes dropped EXE
PID:1756 -
\??\c:\thtnnn.exec:\thtnnn.exe22⤵
- Executes dropped EXE
PID:2712 -
\??\c:\thhhbb.exec:\thhhbb.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dvjjp.exec:\dvjjp.exe24⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rrfffxf.exec:\rrfffxf.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\thtntt.exec:\thtntt.exe26⤵
- Executes dropped EXE
PID:2348 -
\??\c:\nhhtbh.exec:\nhhtbh.exe27⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3jdvj.exec:\3jdvj.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\lfllllr.exec:\lfllllr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1908 -
\??\c:\hbnntt.exec:\hbnntt.exe30⤵
- Executes dropped EXE
PID:992 -
\??\c:\vjpjv.exec:\vjpjv.exe31⤵
- Executes dropped EXE
PID:884 -
\??\c:\jdpvd.exec:\jdpvd.exe32⤵
- Executes dropped EXE
PID:2112 -
\??\c:\9lflxxf.exec:\9lflxxf.exe33⤵PID:2432
-
\??\c:\bnbhhh.exec:\bnbhhh.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dpvvj.exec:\dpvvj.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\jpvdv.exec:\jpvdv.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xrflxfl.exec:\xrflxfl.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlfxxxf.exec:\rlfxxxf.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\5nbhbn.exec:\5nbhbn.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\thhhhh.exec:\thhhhh.exe40⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7dppv.exec:\7dppv.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5vjdd.exec:\5vjdd.exe42⤵
- Executes dropped EXE
PID:2044 -
\??\c:\fxffrrx.exec:\fxffrrx.exe43⤵
- Executes dropped EXE
PID:2800 -
\??\c:\fffrflr.exec:\fffrflr.exe44⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nhthnb.exec:\nhthnb.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1tttbb.exec:\1tttbb.exe46⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdjpd.exec:\jdjpd.exe47⤵
- Executes dropped EXE
PID:332 -
\??\c:\rfllxrx.exec:\rfllxrx.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\hthnhh.exec:\hthnhh.exe49⤵
- Executes dropped EXE
PID:736 -
\??\c:\djpjp.exec:\djpjp.exe50⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdppp.exec:\jdppp.exe51⤵
- Executes dropped EXE
PID:1432 -
\??\c:\rfllxxx.exec:\rfllxxx.exe52⤵
- Executes dropped EXE
PID:2256 -
\??\c:\lfxfffl.exec:\lfxfffl.exe53⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tnhnbb.exec:\tnhnbb.exe54⤵
- Executes dropped EXE
PID:1188 -
\??\c:\dvjvj.exec:\dvjvj.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\vddjd.exec:\vddjd.exe56⤵
- Executes dropped EXE
PID:2296 -
\??\c:\xrfxllx.exec:\xrfxllx.exe57⤵
- Executes dropped EXE
PID:2252 -
\??\c:\lflxlll.exec:\lflxlll.exe58⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hbnnnn.exec:\hbnnnn.exe59⤵
- Executes dropped EXE
PID:2720 -
\??\c:\7tnttt.exec:\7tnttt.exe60⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpjjv.exec:\vpjjv.exe61⤵
- Executes dropped EXE
PID:2848 -
\??\c:\jdvvj.exec:\jdvvj.exe62⤵
- Executes dropped EXE
PID:2900 -
\??\c:\lfrrxfx.exec:\lfrrxfx.exe63⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xlflffr.exec:\xlflffr.exe64⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rxllrrx.exec:\rxllrrx.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:444 -
\??\c:\hhbbtt.exec:\hhbbtt.exe66⤵
- Executes dropped EXE
PID:3060 -
\??\c:\jvjvd.exec:\jvjvd.exe67⤵PID:1160
-
\??\c:\pdvjj.exec:\pdvjj.exe68⤵PID:896
-
\??\c:\xrlxxxf.exec:\xrlxxxf.exe69⤵PID:1860
-
\??\c:\xrlflff.exec:\xrlflff.exe70⤵PID:2416
-
\??\c:\btbhnn.exec:\btbhnn.exe71⤵PID:3068
-
\??\c:\bbttbb.exec:\bbttbb.exe72⤵PID:1520
-
\??\c:\pjjpp.exec:\pjjpp.exe73⤵PID:2060
-
\??\c:\jjdpp.exec:\jjdpp.exe74⤵PID:1940
-
\??\c:\rfxxlfl.exec:\rfxxlfl.exe75⤵PID:2432
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe76⤵PID:1596
-
\??\c:\nthnbb.exec:\nthnbb.exe77⤵PID:1568
-
\??\c:\bthnbb.exec:\bthnbb.exe78⤵PID:2992
-
\??\c:\vjpvp.exec:\vjpvp.exe79⤵PID:2836
-
\??\c:\vjpvd.exec:\vjpvd.exe80⤵PID:2352
-
\??\c:\flffrrf.exec:\flffrrf.exe81⤵PID:2632
-
\??\c:\rfrrrxr.exec:\rfrrrxr.exe82⤵PID:2672
-
\??\c:\9ttnnt.exec:\9ttnnt.exe83⤵PID:2784
-
\??\c:\nhhnnt.exec:\nhhnnt.exe84⤵PID:1028
-
\??\c:\3pdvv.exec:\3pdvv.exe85⤵PID:2548
-
\??\c:\dpddd.exec:\dpddd.exe86⤵PID:2504
-
\??\c:\xlfxxxl.exec:\xlfxxxl.exe87⤵PID:2536
-
\??\c:\1rrrlfr.exec:\1rrrlfr.exe88⤵PID:600
-
\??\c:\bnbntb.exec:\bnbntb.exe89⤵PID:1096
-
\??\c:\thtnnh.exec:\thtnnh.exe90⤵PID:748
-
\??\c:\9jvpv.exec:\9jvpv.exe91⤵PID:840
-
\??\c:\pjvpv.exec:\pjvpv.exe92⤵PID:556
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe93⤵PID:2008
-
\??\c:\thhbnn.exec:\thhbnn.exe94⤵PID:1528
-
\??\c:\nbnnbt.exec:\nbnnbt.exe95⤵PID:1780
-
\??\c:\pjpdv.exec:\pjpdv.exe96⤵PID:1244
-
\??\c:\pdpdv.exec:\pdpdv.exe97⤵PID:2480
-
\??\c:\fffxffl.exec:\fffxffl.exe98⤵PID:1796
-
\??\c:\flflrrx.exec:\flflrrx.exe99⤵PID:1308
-
\??\c:\hbnhbh.exec:\hbnhbh.exe100⤵PID:1948
-
\??\c:\thtbtn.exec:\thtbtn.exe101⤵PID:2716
-
\??\c:\5htbhn.exec:\5htbhn.exe102⤵PID:2804
-
\??\c:\dvdjp.exec:\dvdjp.exe103⤵PID:2692
-
\??\c:\pjvdp.exec:\pjvdp.exe104⤵PID:2392
-
\??\c:\7lrlxfr.exec:\7lrlxfr.exe105⤵PID:676
-
\??\c:\frfrlrf.exec:\frfrlrf.exe106⤵PID:1148
-
\??\c:\thnnbt.exec:\thnnbt.exe107⤵PID:1088
-
\??\c:\tnbhnn.exec:\tnbhnn.exe108⤵PID:912
-
\??\c:\bnhnbh.exec:\bnhnbh.exe109⤵PID:1156
-
\??\c:\vvjdj.exec:\vvjdj.exe110⤵PID:2100
-
\??\c:\9dvdv.exec:\9dvdv.exe111⤵PID:2372
-
\??\c:\3rffllx.exec:\3rffllx.exe112⤵PID:2152
-
\??\c:\xlflrrr.exec:\xlflrrr.exe113⤵PID:1508
-
\??\c:\bttttt.exec:\bttttt.exe114⤵PID:816
-
\??\c:\9bnbhn.exec:\9bnbhn.exe115⤵PID:2112
-
\??\c:\pjpjp.exec:\pjpjp.exe116⤵PID:2916
-
\??\c:\jjvdd.exec:\jjvdd.exe117⤵PID:1940
-
\??\c:\lfrxxrx.exec:\lfrxxrx.exe118⤵PID:3008
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe119⤵PID:2620
-
\??\c:\tthbhn.exec:\tthbhn.exe120⤵PID:2740
-
\??\c:\btnntt.exec:\btnntt.exe121⤵PID:2748
-
\??\c:\bnhnbb.exec:\bnhnbb.exe122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-