Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 06:45
Static task
static1
Behavioral task
behavioral1
Sample
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe
Resource
win7-20240903-en
General
-
Target
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe
-
Size
75KB
-
MD5
3b2cfa78ac01b81ef92a5aca15213f52
-
SHA1
31a8050eaa5aa43c3cb9adab4e6ec3bbf5ea778d
-
SHA256
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce
-
SHA512
df725d212f9174c192b66510349d7cd663262b71b37dc523cb1dbdd16a0f6f62b8c4fc2aa9883f6003cbd226ca62b66f104013932a7b8be99483d9a708839136
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qiImgS5ih6:ymb3NkkiQ3mdBjFIj+qiImgS5ih6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/3012-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2576-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2180-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2716-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/320-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/760-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2024-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1656-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3000-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2124-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1156-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1964-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1616-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2300-296-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1xxxlrf.exe1thnbb.exepjvvj.exe9lfrlrf.exevppjv.exerfrlrfl.exettntht.exe7ntbbb.exepjddj.exefrxrrrl.exefxlttth.exe5bhbnb.exevpjjv.exelfxrrrx.exe5lfxfxf.exehhbbbh.exevvppj.exevvppv.exerllllrr.exebthnbn.exe3hhbnn.exejddjp.exelfrfxfl.exettnbbh.exettnthn.exe9dpjv.exerlrrrlr.exettnbnn.exevjpvp.exevpjpv.exe3xrxffl.exefrfffxl.exebthnbb.exepjpdv.exejdjjp.exe1lrrrrf.exexrxrrll.exenhbhbt.exe9vpjp.exe1jdvv.exe3lfxxxf.exelxllrlr.exe1htttt.exe5vppp.exejdvvd.exelffxfxf.exexrlfxxl.exehtttbn.exetntbhn.exevjvdj.exepjdvd.exe3lrrllf.exe9hbnbn.exetntnbb.exepjdjj.exe7vpvd.exerffrrxf.exellxlxff.exenhtttt.exedpjpd.exejjvjp.exe5lrlllf.exe9xrlxxl.exehhnbhh.exepid Process 2576 1xxxlrf.exe 2696 1thnbb.exe 2180 pjvvj.exe 2828 9lfrlrf.exe 2716 vppjv.exe 2904 rfrlrfl.exe 2652 ttntht.exe 2624 7ntbbb.exe 2324 pjddj.exe 320 frxrrrl.exe 2852 fxlttth.exe 2008 5bhbnb.exe 760 vpjjv.exe 2024 lfxrrrx.exe 1656 5lfxfxf.exe 2896 hhbbbh.exe 3000 vvppj.exe 2952 vvppv.exe 3004 rllllrr.exe 2124 bthnbn.exe 2980 3hhbnn.exe 1156 jddjp.exe 1964 lfrfxfl.exe 656 ttnbbh.exe 1616 ttnthn.exe 2176 9dpjv.exe 2492 rlrrrlr.exe 2212 ttnbnn.exe 1556 vjpvp.exe 2300 vpjpv.exe 2576 3xrxffl.exe 2488 frfffxl.exe 2508 bthnbb.exe 2740 pjpdv.exe 2848 jdjjp.exe 1076 1lrrrrf.exe 2844 xrxrrll.exe 2832 nhbhbt.exe 2632 9vpjp.exe 2904 1jdvv.exe 2604 3lfxxxf.exe 2780 lxllrlr.exe 2056 1htttt.exe 560 5vppp.exe 2680 jdvvd.exe 1796 lffxfxf.exe 556 xrlfxxl.exe 2336 htttbn.exe 2596 tntbhn.exe 2344 vjvdj.exe 1256 pjdvd.exe 1392 3lrrllf.exe 2940 9hbnbn.exe 2252 tntnbb.exe 2952 pjdjj.exe 2648 7vpvd.exe 2136 rffrrxf.exe 1668 llxlxff.exe 1456 nhtttt.exe 1320 dpjpd.exe 336 jjvjp.exe 1588 5lrlllf.exe 1808 9xrlxxl.exe 2256 hhnbhh.exe -
Processes:
resource yara_rule behavioral1/memory/3012-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2576-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2180-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2716-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/320-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2008-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/760-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2024-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1656-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3000-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2124-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1156-224-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1964-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1616-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-296-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
nhtbnn.exerllflfr.exe7htbnt.exexlfrxfx.exexrfxffl.exe9llxrrx.exehhbnbh.exe9vpjp.exexxrfxrx.exehbnbnn.exe5pdjp.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrfxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdjp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe1xxxlrf.exe1thnbb.exepjvvj.exe9lfrlrf.exevppjv.exerfrlrfl.exettntht.exe7ntbbb.exepjddj.exefrxrrrl.exefxlttth.exe5bhbnb.exevpjjv.exelfxrrrx.exe5lfxfxf.exedescription pid Process procid_target PID 3012 wrote to memory of 2576 3012 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 30 PID 3012 wrote to memory of 2576 3012 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 30 PID 3012 wrote to memory of 2576 3012 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 30 PID 3012 wrote to memory of 2576 3012 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 30 PID 2576 wrote to memory of 2696 2576 1xxxlrf.exe 31 PID 2576 wrote to memory of 2696 2576 1xxxlrf.exe 31 PID 2576 wrote to memory of 2696 2576 1xxxlrf.exe 31 PID 2576 wrote to memory of 2696 2576 1xxxlrf.exe 31 PID 2696 wrote to memory of 2180 2696 1thnbb.exe 32 PID 2696 wrote to memory of 2180 2696 1thnbb.exe 32 PID 2696 wrote to memory of 2180 2696 1thnbb.exe 32 PID 2696 wrote to memory of 2180 2696 1thnbb.exe 32 PID 2180 wrote to memory of 2828 2180 pjvvj.exe 33 PID 2180 wrote to memory of 2828 2180 pjvvj.exe 33 PID 2180 wrote to memory of 2828 2180 pjvvj.exe 33 PID 2180 wrote to memory of 2828 2180 pjvvj.exe 33 PID 2828 wrote to memory of 2716 2828 9lfrlrf.exe 34 PID 2828 wrote to memory of 2716 2828 9lfrlrf.exe 34 PID 2828 wrote to memory of 2716 2828 9lfrlrf.exe 34 PID 2828 wrote to memory of 2716 2828 9lfrlrf.exe 34 PID 2716 wrote to memory of 2904 2716 vppjv.exe 35 PID 2716 wrote to memory of 2904 2716 vppjv.exe 35 PID 2716 wrote to memory of 2904 2716 vppjv.exe 35 PID 2716 wrote to memory of 2904 2716 vppjv.exe 35 PID 2904 wrote to memory of 2652 2904 rfrlrfl.exe 36 PID 2904 wrote to memory of 2652 2904 rfrlrfl.exe 36 PID 2904 wrote to memory of 2652 2904 rfrlrfl.exe 36 PID 2904 wrote to memory of 2652 2904 rfrlrfl.exe 36 PID 2652 wrote to memory of 2624 2652 ttntht.exe 37 PID 2652 wrote to memory of 2624 2652 ttntht.exe 37 PID 2652 wrote to memory of 2624 2652 ttntht.exe 37 PID 2652 wrote to memory of 2624 2652 ttntht.exe 37 PID 2624 wrote to memory of 2324 2624 7ntbbb.exe 38 PID 2624 wrote to memory of 2324 2624 7ntbbb.exe 38 PID 2624 wrote to memory of 2324 2624 7ntbbb.exe 38 PID 2624 wrote to memory of 2324 2624 7ntbbb.exe 38 PID 2324 wrote to memory of 320 2324 pjddj.exe 39 PID 2324 wrote to memory of 320 2324 pjddj.exe 39 PID 2324 wrote to memory of 320 2324 pjddj.exe 39 PID 2324 wrote to memory of 320 2324 pjddj.exe 39 PID 320 wrote to memory of 2852 320 frxrrrl.exe 40 PID 320 wrote to memory of 2852 320 frxrrrl.exe 40 PID 320 wrote to memory of 2852 320 frxrrrl.exe 40 PID 320 wrote to memory of 2852 320 frxrrrl.exe 40 PID 2852 wrote to memory of 2008 2852 fxlttth.exe 41 PID 2852 wrote to memory of 2008 2852 fxlttth.exe 41 PID 2852 wrote to memory of 2008 2852 fxlttth.exe 41 PID 2852 wrote to memory of 2008 2852 fxlttth.exe 41 PID 2008 wrote to memory of 760 2008 5bhbnb.exe 42 PID 2008 wrote to memory of 760 2008 5bhbnb.exe 42 PID 2008 wrote to memory of 760 2008 5bhbnb.exe 42 PID 2008 wrote to memory of 760 2008 5bhbnb.exe 42 PID 760 wrote to memory of 2024 760 vpjjv.exe 43 PID 760 wrote to memory of 2024 760 vpjjv.exe 43 PID 760 wrote to memory of 2024 760 vpjjv.exe 43 PID 760 wrote to memory of 2024 760 vpjjv.exe 43 PID 2024 wrote to memory of 1656 2024 lfxrrrx.exe 44 PID 2024 wrote to memory of 1656 2024 lfxrrrx.exe 44 PID 2024 wrote to memory of 1656 2024 lfxrrrx.exe 44 PID 2024 wrote to memory of 1656 2024 lfxrrrx.exe 44 PID 1656 wrote to memory of 2896 1656 5lfxfxf.exe 45 PID 1656 wrote to memory of 2896 1656 5lfxfxf.exe 45 PID 1656 wrote to memory of 2896 1656 5lfxfxf.exe 45 PID 1656 wrote to memory of 2896 1656 5lfxfxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe"C:\Users\Admin\AppData\Local\Temp\4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\1xxxlrf.exec:\1xxxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\1thnbb.exec:\1thnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\pjvvj.exec:\pjvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\9lfrlrf.exec:\9lfrlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vppjv.exec:\vppjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rfrlrfl.exec:\rfrlrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ttntht.exec:\ttntht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\7ntbbb.exec:\7ntbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\pjddj.exec:\pjddj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\frxrrrl.exec:\frxrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\fxlttth.exec:\fxlttth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5bhbnb.exec:\5bhbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vpjjv.exec:\vpjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\5lfxfxf.exec:\5lfxfxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\hhbbbh.exec:\hhbbbh.exe17⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvppj.exec:\vvppj.exe18⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvppv.exec:\vvppv.exe19⤵
- Executes dropped EXE
PID:2952 -
\??\c:\rllllrr.exec:\rllllrr.exe20⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bthnbn.exec:\bthnbn.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3hhbnn.exec:\3hhbnn.exe22⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jddjp.exec:\jddjp.exe23⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lfrfxfl.exec:\lfrfxfl.exe24⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ttnbbh.exec:\ttnbbh.exe25⤵
- Executes dropped EXE
PID:656 -
\??\c:\ttnthn.exec:\ttnthn.exe26⤵
- Executes dropped EXE
PID:1616 -
\??\c:\9dpjv.exec:\9dpjv.exe27⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\ttnbnn.exec:\ttnbnn.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\vjpvp.exec:\vjpvp.exe30⤵
- Executes dropped EXE
PID:1556 -
\??\c:\vpjpv.exec:\vpjpv.exe31⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3xrxffl.exec:\3xrxffl.exe32⤵
- Executes dropped EXE
PID:2576 -
\??\c:\frfffxl.exec:\frfffxl.exe33⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bthnbb.exec:\bthnbb.exe34⤵
- Executes dropped EXE
PID:2508 -
\??\c:\pjpdv.exec:\pjpdv.exe35⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jdjjp.exec:\jdjjp.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1lrrrrf.exec:\1lrrrrf.exe37⤵
- Executes dropped EXE
PID:1076 -
\??\c:\xrxrrll.exec:\xrxrrll.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\nhbhbt.exec:\nhbhbt.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\9vpjp.exec:\9vpjp.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2632 -
\??\c:\1jdvv.exec:\1jdvv.exe41⤵
- Executes dropped EXE
PID:2904 -
\??\c:\3lfxxxf.exec:\3lfxxxf.exe42⤵
- Executes dropped EXE
PID:2604 -
\??\c:\lxllrlr.exec:\lxllrlr.exe43⤵
- Executes dropped EXE
PID:2780 -
\??\c:\1htttt.exec:\1htttt.exe44⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5vppp.exec:\5vppp.exe45⤵
- Executes dropped EXE
PID:560 -
\??\c:\jdvvd.exec:\jdvvd.exe46⤵
- Executes dropped EXE
PID:2680 -
\??\c:\lffxfxf.exec:\lffxfxf.exe47⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xrlfxxl.exec:\xrlfxxl.exe48⤵
- Executes dropped EXE
PID:556 -
\??\c:\htttbn.exec:\htttbn.exe49⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tntbhn.exec:\tntbhn.exe50⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vjvdj.exec:\vjvdj.exe51⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pjdvd.exec:\pjdvd.exe52⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3lrrllf.exec:\3lrrllf.exe53⤵
- Executes dropped EXE
PID:1392 -
\??\c:\9hbnbn.exec:\9hbnbn.exe54⤵
- Executes dropped EXE
PID:2940 -
\??\c:\tntnbb.exec:\tntnbb.exe55⤵
- Executes dropped EXE
PID:2252 -
\??\c:\pjdjj.exec:\pjdjj.exe56⤵
- Executes dropped EXE
PID:2952 -
\??\c:\7vpvd.exec:\7vpvd.exe57⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rffrrxf.exec:\rffrrxf.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\llxlxff.exec:\llxlxff.exe59⤵
- Executes dropped EXE
PID:1668 -
\??\c:\nhtttt.exec:\nhtttt.exe60⤵
- Executes dropped EXE
PID:1456 -
\??\c:\dpjpd.exec:\dpjpd.exe61⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jjvjp.exec:\jjvjp.exe62⤵
- Executes dropped EXE
PID:336 -
\??\c:\5lrlllf.exec:\5lrlllf.exe63⤵
- Executes dropped EXE
PID:1588 -
\??\c:\9xrlxxl.exec:\9xrlxxl.exe64⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hhnbhh.exec:\hhnbhh.exe65⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbtntt.exec:\hbtntt.exe66⤵PID:380
-
\??\c:\vvjpd.exec:\vvjpd.exe67⤵PID:2544
-
\??\c:\vjjdd.exec:\vjjdd.exe68⤵PID:896
-
\??\c:\xrllrlx.exec:\xrllrlx.exe69⤵PID:2520
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe70⤵PID:3060
-
\??\c:\htbtht.exec:\htbtht.exe71⤵PID:1968
-
\??\c:\bthhtn.exec:\bthhtn.exe72⤵PID:2400
-
\??\c:\5ddjd.exec:\5ddjd.exe73⤵PID:1552
-
\??\c:\pjjvj.exec:\pjjvj.exe74⤵PID:2932
-
\??\c:\xrffffr.exec:\xrffffr.exe75⤵PID:2704
-
\??\c:\rlfrxxl.exec:\rlfrxxl.exe76⤵PID:2760
-
\??\c:\bhnhhb.exec:\bhnhhb.exe77⤵PID:2736
-
\??\c:\pvvdd.exec:\pvvdd.exe78⤵PID:2924
-
\??\c:\1pvpv.exec:\1pvpv.exe79⤵PID:2756
-
\??\c:\ddvdp.exec:\ddvdp.exe80⤵PID:2776
-
\??\c:\3rllllr.exec:\3rllllr.exe81⤵PID:2608
-
\??\c:\nbhnhb.exec:\nbhnhb.exe82⤵PID:2660
-
\??\c:\nhnthh.exec:\nhnthh.exe83⤵PID:2672
-
\??\c:\1pvvv.exec:\1pvvv.exe84⤵PID:680
-
\??\c:\9ppvj.exec:\9ppvj.exe85⤵PID:852
-
\??\c:\lxfllff.exec:\lxfllff.exe86⤵PID:536
-
\??\c:\rfllxrx.exec:\rfllxrx.exe87⤵PID:596
-
\??\c:\1nbbhh.exec:\1nbbhh.exe88⤵PID:1268
-
\??\c:\tnhntb.exec:\tnhntb.exe89⤵PID:2088
-
\??\c:\pdpjj.exec:\pdpjj.exe90⤵PID:1288
-
\??\c:\ppddd.exec:\ppddd.exe91⤵PID:2596
-
\??\c:\3xrrxrx.exec:\3xrrxrx.exe92⤵PID:1620
-
\??\c:\fxrrfxf.exec:\fxrrfxf.exe93⤵PID:1912
-
\??\c:\9nhtnb.exec:\9nhtnb.exe94⤵PID:2948
-
\??\c:\hbntbh.exec:\hbntbh.exe95⤵PID:2148
-
\??\c:\ddpvp.exec:\ddpvp.exe96⤵PID:1112
-
\??\c:\xlrlxrf.exec:\xlrlxrf.exe97⤵PID:576
-
\??\c:\lrxxlll.exec:\lrxxlll.exe98⤵PID:2556
-
\??\c:\tnbbnn.exec:\tnbbnn.exe99⤵PID:448
-
\??\c:\9hbbnh.exec:\9hbbnh.exe100⤵PID:612
-
\??\c:\hbhnbb.exec:\hbhnbb.exe101⤵PID:1596
-
\??\c:\jjpdp.exec:\jjpdp.exe102⤵PID:1748
-
\??\c:\pjvvv.exec:\pjvvv.exe103⤵PID:2260
-
\??\c:\lfrflrx.exec:\lfrflrx.exe104⤵PID:2160
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe105⤵PID:2308
-
\??\c:\nhtbhh.exec:\nhtbhh.exe106⤵PID:2208
-
\??\c:\5nnntt.exec:\5nnntt.exe107⤵PID:352
-
\??\c:\pdvvj.exec:\pdvvj.exe108⤵PID:2140
-
\??\c:\pjdjj.exec:\pjdjj.exe109⤵PID:1556
-
\??\c:\5xllllr.exec:\5xllllr.exe110⤵PID:1924
-
\??\c:\rfxllxr.exec:\rfxllxr.exe111⤵PID:2928
-
\??\c:\lxrrrfl.exec:\lxrrrfl.exe112⤵PID:1572
-
\??\c:\bntttt.exec:\bntttt.exe113⤵PID:2796
-
\??\c:\nntbth.exec:\nntbth.exe114⤵PID:2296
-
\??\c:\3pppd.exec:\3pppd.exe115⤵PID:2820
-
\??\c:\jdpdd.exec:\jdpdd.exe116⤵PID:2720
-
\??\c:\3lrxfxf.exec:\3lrxfxf.exe117⤵PID:3020
-
\??\c:\xllllll.exec:\xllllll.exe118⤵PID:2884
-
\??\c:\bnbbtt.exec:\bnbbtt.exe119⤵PID:2316
-
\??\c:\tnbhtb.exec:\tnbhtb.exe120⤵PID:2784
-
\??\c:\pdjpj.exec:\pdjpj.exe121⤵PID:2688
-
\??\c:\pddvd.exec:\pddvd.exe122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-