Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 10:31
Static task
static1
Behavioral task
behavioral1
Sample
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe
Resource
win7-20240729-en
General
-
Target
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe
-
Size
81KB
-
MD5
7293c0318ee84d9610d992e01f80dcd1
-
SHA1
aeafb464d6a1fd880c24d4b292e2c1df1c20df29
-
SHA256
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17
-
SHA512
009586e0bbc71ca72da8d6bd6dfb6f97db7c7d617a672e17df42da839aecaf41de8e9d3824792caa8d318079bd5290fba39107d88cda1cbac135dcde199e6525
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqY:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4k
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1096-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1984-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2920-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2996-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2784-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1200-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1980-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1924-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2884-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/264-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2084-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/864-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flrxfrx.exehbhbtn.exejpvpd.exe3nhthn.exehtbnth.exejdpvv.exehnhttb.exentbthb.exelrxlxlr.exexxlxflr.exehnhhbh.exe3jjvj.exe3pppd.exe5rlrflx.exetbntht.exetbttbb.exedjvjv.exefllfflf.exe5rlxfrx.exenththn.exevvjdp.exe1vjjv.exerrfrxlx.exexxrfrfr.exe3hhtnb.exe1dppd.exexlxxfxl.exebbhnnb.exeppdjv.exejjjvp.exe3rlrxlr.exe7rrlflx.exehnnnbn.exedpjpv.exevdvdj.exexfrrxfr.exeflrfrfx.exentbhbh.exepdjpj.exe9ddjj.exexlrfxlf.exelrxlffr.exetthhtt.exe5ththh.exedjdpd.exejpdjd.exeffrfrfr.exe1xrflxl.exenhnntt.exehnbhbn.exevdppd.exexfxfflx.exexxlfxrf.exennhbnt.exebhtbnt.exe7pdpd.exe9pjjv.exeflxlxxf.exe7bbnht.exentbbnt.exejpdvp.exeppvdv.exelxffrrf.exellxxlrf.exepid Process 2944 flrxfrx.exe 1984 hbhbtn.exe 2980 jpvpd.exe 2824 3nhthn.exe 2920 htbnth.exe 2996 jdpvv.exe 2784 hnhttb.exe 2764 ntbthb.exe 1200 lrxlxlr.exe 1180 xxlxflr.exe 1980 hnhhbh.exe 2064 3jjvj.exe 2264 3pppd.exe 2948 5rlrflx.exe 1924 tbntht.exe 2884 tbttbb.exe 264 djvjv.exe 2408 fllfflf.exe 2400 5rlxfrx.exe 2324 nththn.exe 2336 vvjdp.exe 1648 1vjjv.exe 2084 rrfrxlx.exe 800 xxrfrfr.exe 864 3hhtnb.exe 988 1dppd.exe 2456 xlxxfxl.exe 2656 bbhnnb.exe 1736 ppdjv.exe 2252 jjjvp.exe 1096 3rlrxlr.exe 1572 7rrlflx.exe 2856 hnnnbn.exe 2848 dpjpv.exe 2044 vdvdj.exe 3032 xfrrxfr.exe 2072 flrfrfx.exe 2704 ntbhbh.exe 2720 pdjpj.exe 2760 9ddjj.exe 1604 xlrfxlf.exe 2236 lrxlffr.exe 2764 tthhtt.exe 1744 5ththh.exe 2244 djdpd.exe 2912 jpdjd.exe 2204 ffrfrfr.exe 2064 1xrflxl.exe 3056 nhnntt.exe 2260 hnbhbn.exe 2304 vdppd.exe 1016 xfxfflx.exe 1652 xxlfxrf.exe 1932 nnhbnt.exe 2300 bhtbnt.exe 2428 7pdpd.exe 2412 9pjjv.exe 2776 flxlxxf.exe 2336 7bbnht.exe 2580 ntbbnt.exe 1068 jpdvp.exe 1612 ppvdv.exe 1416 lxffrrf.exe 1588 llxxlrf.exe -
Processes:
resource yara_rule behavioral1/memory/1096-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1096-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2944-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1984-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2980-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2824-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2920-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2996-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2784-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1200-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1980-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1924-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2884-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/264-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2336-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-227-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2084-235-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/864-253-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
1vpvd.exehnbbhn.exebbhttb.exevvjjv.exevdvdp.exepdjvv.exelfxrrrf.exetbttbb.exefxxlrfr.exeppvvd.exedjjvp.exe3dvvj.exebhtnth.exelrxlxxl.exetttthn.exerrfffxf.exelfllxxf.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfffxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllxxf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exeflrxfrx.exehbhbtn.exejpvpd.exe3nhthn.exehtbnth.exejdpvv.exehnhttb.exentbthb.exelrxlxlr.exexxlxflr.exehnhhbh.exe3jjvj.exe3pppd.exe5rlrflx.exetbntht.exedescription pid Process procid_target PID 1096 wrote to memory of 2944 1096 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 30 PID 1096 wrote to memory of 2944 1096 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 30 PID 1096 wrote to memory of 2944 1096 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 30 PID 1096 wrote to memory of 2944 1096 8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe 30 PID 2944 wrote to memory of 1984 2944 flrxfrx.exe 31 PID 2944 wrote to memory of 1984 2944 flrxfrx.exe 31 PID 2944 wrote to memory of 1984 2944 flrxfrx.exe 31 PID 2944 wrote to memory of 1984 2944 flrxfrx.exe 31 PID 1984 wrote to memory of 2980 1984 hbhbtn.exe 32 PID 1984 wrote to memory of 2980 1984 hbhbtn.exe 32 PID 1984 wrote to memory of 2980 1984 hbhbtn.exe 32 PID 1984 wrote to memory of 2980 1984 hbhbtn.exe 32 PID 2980 wrote to memory of 2824 2980 jpvpd.exe 33 PID 2980 wrote to memory of 2824 2980 jpvpd.exe 33 PID 2980 wrote to memory of 2824 2980 jpvpd.exe 33 PID 2980 wrote to memory of 2824 2980 jpvpd.exe 33 PID 2824 wrote to memory of 2920 2824 3nhthn.exe 34 PID 2824 wrote to memory of 2920 2824 3nhthn.exe 34 PID 2824 wrote to memory of 2920 2824 3nhthn.exe 34 PID 2824 wrote to memory of 2920 2824 3nhthn.exe 34 PID 2920 wrote to memory of 2996 2920 htbnth.exe 35 PID 2920 wrote to memory of 2996 2920 htbnth.exe 35 PID 2920 wrote to memory of 2996 2920 htbnth.exe 35 PID 2920 wrote to memory of 2996 2920 htbnth.exe 35 PID 2996 wrote to memory of 2784 2996 jdpvv.exe 36 PID 2996 wrote to memory of 2784 2996 jdpvv.exe 36 PID 2996 wrote to memory of 2784 2996 jdpvv.exe 36 PID 2996 wrote to memory of 2784 2996 jdpvv.exe 36 PID 2784 wrote to memory of 2764 2784 hnhttb.exe 37 PID 2784 wrote to memory of 2764 2784 hnhttb.exe 37 PID 2784 wrote to memory of 2764 2784 hnhttb.exe 37 PID 2784 wrote to memory of 2764 2784 hnhttb.exe 37 PID 2764 wrote to memory of 1200 2764 ntbthb.exe 38 PID 2764 wrote to memory of 1200 2764 ntbthb.exe 38 PID 2764 wrote to memory of 1200 2764 ntbthb.exe 38 PID 2764 wrote to memory of 1200 2764 ntbthb.exe 38 PID 1200 wrote to memory of 1180 1200 lrxlxlr.exe 39 PID 1200 wrote to memory of 1180 1200 lrxlxlr.exe 39 PID 1200 wrote to memory of 1180 1200 lrxlxlr.exe 39 PID 1200 wrote to memory of 1180 1200 lrxlxlr.exe 39 PID 1180 wrote to memory of 1980 1180 xxlxflr.exe 40 PID 1180 wrote to memory of 1980 1180 xxlxflr.exe 40 PID 1180 wrote to memory of 1980 1180 xxlxflr.exe 40 PID 1180 wrote to memory of 1980 1180 xxlxflr.exe 40 PID 1980 wrote to memory of 2064 1980 hnhhbh.exe 41 PID 1980 wrote to memory of 2064 1980 hnhhbh.exe 41 PID 1980 wrote to memory of 2064 1980 hnhhbh.exe 41 PID 1980 wrote to memory of 2064 1980 hnhhbh.exe 41 PID 2064 wrote to memory of 2264 2064 3jjvj.exe 42 PID 2064 wrote to memory of 2264 2064 3jjvj.exe 42 PID 2064 wrote to memory of 2264 2064 3jjvj.exe 42 PID 2064 wrote to memory of 2264 2064 3jjvj.exe 42 PID 2264 wrote to memory of 2948 2264 3pppd.exe 43 PID 2264 wrote to memory of 2948 2264 3pppd.exe 43 PID 2264 wrote to memory of 2948 2264 3pppd.exe 43 PID 2264 wrote to memory of 2948 2264 3pppd.exe 43 PID 2948 wrote to memory of 1924 2948 5rlrflx.exe 44 PID 2948 wrote to memory of 1924 2948 5rlrflx.exe 44 PID 2948 wrote to memory of 1924 2948 5rlrflx.exe 44 PID 2948 wrote to memory of 1924 2948 5rlrflx.exe 44 PID 1924 wrote to memory of 2884 1924 tbntht.exe 45 PID 1924 wrote to memory of 2884 1924 tbntht.exe 45 PID 1924 wrote to memory of 2884 1924 tbntht.exe 45 PID 1924 wrote to memory of 2884 1924 tbntht.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe"C:\Users\Admin\AppData\Local\Temp\8e7e3e221d0f25f1823b2acf0be4670947e7556c7ef5f95e9188fa5ed89a5d17.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\flrxfrx.exec:\flrxfrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\hbhbtn.exec:\hbhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\jpvpd.exec:\jpvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\3nhthn.exec:\3nhthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\htbnth.exec:\htbnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jdpvv.exec:\jdpvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\hnhttb.exec:\hnhttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\ntbthb.exec:\ntbthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lrxlxlr.exec:\lrxlxlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\xxlxflr.exec:\xxlxflr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\hnhhbh.exec:\hnhhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\3jjvj.exec:\3jjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\3pppd.exec:\3pppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\5rlrflx.exec:\5rlrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\tbntht.exec:\tbntht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\tbttbb.exec:\tbttbb.exe17⤵
- Executes dropped EXE
PID:2884 -
\??\c:\djvjv.exec:\djvjv.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\fllfflf.exec:\fllfflf.exe19⤵
- Executes dropped EXE
PID:2408 -
\??\c:\5rlxfrx.exec:\5rlxfrx.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nththn.exec:\nththn.exe21⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vvjdp.exec:\vvjdp.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1vjjv.exec:\1vjjv.exe23⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rrfrxlx.exec:\rrfrxlx.exe24⤵
- Executes dropped EXE
PID:2084 -
\??\c:\xxrfrfr.exec:\xxrfrfr.exe25⤵
- Executes dropped EXE
PID:800 -
\??\c:\3hhtnb.exec:\3hhtnb.exe26⤵
- Executes dropped EXE
PID:864 -
\??\c:\1dppd.exec:\1dppd.exe27⤵
- Executes dropped EXE
PID:988 -
\??\c:\xlxxfxl.exec:\xlxxfxl.exe28⤵
- Executes dropped EXE
PID:2456 -
\??\c:\bbhnnb.exec:\bbhnnb.exe29⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ppdjv.exec:\ppdjv.exe30⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jjjvp.exec:\jjjvp.exe31⤵
- Executes dropped EXE
PID:2252 -
\??\c:\3rlrxlr.exec:\3rlrxlr.exe32⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7rrlflx.exec:\7rrlflx.exe33⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hnnnbn.exec:\hnnnbn.exe34⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dpjpv.exec:\dpjpv.exe35⤵
- Executes dropped EXE
PID:2848 -
\??\c:\vdvdj.exec:\vdvdj.exe36⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xfrrxfr.exec:\xfrrxfr.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\flrfrfx.exec:\flrfrfx.exe38⤵
- Executes dropped EXE
PID:2072 -
\??\c:\ntbhbh.exec:\ntbhbh.exe39⤵
- Executes dropped EXE
PID:2704 -
\??\c:\pdjpj.exec:\pdjpj.exe40⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9ddjj.exec:\9ddjj.exe41⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xlrfxlf.exec:\xlrfxlf.exe42⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lrxlffr.exec:\lrxlffr.exe43⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tthhtt.exec:\tthhtt.exe44⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5ththh.exec:\5ththh.exe45⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djdpd.exec:\djdpd.exe46⤵
- Executes dropped EXE
PID:2244 -
\??\c:\jpdjd.exec:\jpdjd.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe48⤵
- Executes dropped EXE
PID:2204 -
\??\c:\1xrflxl.exec:\1xrflxl.exe49⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nhnntt.exec:\nhnntt.exe50⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hnbhbn.exec:\hnbhbn.exe51⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vdppd.exec:\vdppd.exe52⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xfxfflx.exec:\xfxfflx.exe53⤵
- Executes dropped EXE
PID:1016 -
\??\c:\xxlfxrf.exec:\xxlfxrf.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nnhbnt.exec:\nnhbnt.exe55⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bhtbnt.exec:\bhtbnt.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7pdpd.exec:\7pdpd.exe57⤵
- Executes dropped EXE
PID:2428 -
\??\c:\9pjjv.exec:\9pjjv.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\flxlxxf.exec:\flxlxxf.exe59⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7bbnht.exec:\7bbnht.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ntbbnt.exec:\ntbbnt.exe61⤵
- Executes dropped EXE
PID:2580 -
\??\c:\jpdvp.exec:\jpdvp.exe62⤵
- Executes dropped EXE
PID:1068 -
\??\c:\ppvdv.exec:\ppvdv.exe63⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lxffrrf.exec:\lxffrrf.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\llxxlrf.exec:\llxxlrf.exe65⤵
- Executes dropped EXE
PID:1588 -
\??\c:\ntbhth.exec:\ntbhth.exe66⤵PID:2500
-
\??\c:\bbhntt.exec:\bbhntt.exe67⤵PID:1148
-
\??\c:\vjpdv.exec:\vjpdv.exe68⤵PID:2536
-
\??\c:\djpdv.exec:\djpdv.exe69⤵PID:872
-
\??\c:\llfrfrx.exec:\llfrfrx.exe70⤵PID:1736
-
\??\c:\7rrlxfl.exec:\7rrlxfl.exe71⤵PID:2096
-
\??\c:\hnbhbn.exec:\hnbhbn.exe72⤵PID:1448
-
\??\c:\9thhth.exec:\9thhth.exe73⤵PID:2992
-
\??\c:\pdpvj.exec:\pdpvj.exe74⤵PID:2956
-
\??\c:\jjjpd.exec:\jjjpd.exe75⤵PID:2964
-
\??\c:\7lrfrxf.exec:\7lrfrxf.exe76⤵PID:1976
-
\??\c:\rxlxfrl.exec:\rxlxfrl.exe77⤵PID:3068
-
\??\c:\hnbnbh.exec:\hnbnbh.exe78⤵PID:2844
-
\??\c:\9tttbn.exec:\9tttbn.exe79⤵PID:2876
-
\??\c:\vdjjp.exec:\vdjjp.exe80⤵PID:2780
-
\??\c:\djjjj.exec:\djjjj.exe81⤵PID:2748
-
\??\c:\rxflrfl.exec:\rxflrfl.exe82⤵PID:2784
-
\??\c:\tbtthh.exec:\tbtthh.exe83⤵PID:1700
-
\??\c:\tbthnb.exec:\tbthnb.exe84⤵PID:1380
-
\??\c:\pppvd.exec:\pppvd.exe85⤵PID:2284
-
\??\c:\ddpvj.exec:\ddpvj.exe86⤵PID:1180
-
\??\c:\jpddv.exec:\jpddv.exe87⤵PID:2124
-
\??\c:\rrrfrxl.exec:\rrrfrxl.exe88⤵PID:1940
-
\??\c:\5xrxlrf.exec:\5xrxlrf.exe89⤵PID:2136
-
\??\c:\nbnthn.exec:\nbnthn.exe90⤵PID:2904
-
\??\c:\pvdpv.exec:\pvdpv.exe91⤵PID:2948
-
\??\c:\pdpjd.exec:\pdpjd.exe92⤵PID:2520
-
\??\c:\fxllxlr.exec:\fxllxlr.exe93⤵PID:2232
-
\??\c:\7fffxxl.exec:\7fffxxl.exe94⤵PID:2184
-
\??\c:\bhntbh.exec:\bhntbh.exe95⤵PID:1944
-
\??\c:\1bnhnt.exec:\1bnhnt.exe96⤵PID:2088
-
\??\c:\9vjvj.exec:\9vjvj.exe97⤵PID:2200
-
\??\c:\pdjvv.exec:\pdjvv.exe98⤵
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\xfrrxxx.exec:\xfrrxxx.exe99⤵PID:2060
-
\??\c:\3xfxfxl.exec:\3xfxfxl.exe100⤵PID:824
-
\??\c:\hnbtbb.exec:\hnbtbb.exe101⤵PID:2604
-
\??\c:\5nhhbb.exec:\5nhhbb.exe102⤵PID:692
-
\??\c:\vvjpd.exec:\vvjpd.exe103⤵PID:2472
-
\??\c:\ppvvd.exec:\ppvvd.exe104⤵
- System Location Discovery: System Language Discovery
PID:1876 -
\??\c:\lrllxfl.exec:\lrllxfl.exe105⤵PID:1188
-
\??\c:\lrflxfl.exec:\lrflxfl.exe106⤵PID:2388
-
\??\c:\hthntt.exec:\hthntt.exe107⤵PID:376
-
\??\c:\hbnntt.exec:\hbnntt.exe108⤵PID:1072
-
\??\c:\jddpp.exec:\jddpp.exe109⤵PID:2436
-
\??\c:\xlfrrxl.exec:\xlfrrxl.exe110⤵PID:1476
-
\??\c:\flrrxfl.exec:\flrrxfl.exe111⤵PID:2180
-
\??\c:\nbtbht.exec:\nbtbht.exe112⤵PID:2892
-
\??\c:\nthbbb.exec:\nthbbb.exe113⤵PID:1548
-
\??\c:\vddpd.exec:\vddpd.exe114⤵PID:2332
-
\??\c:\9pddj.exec:\9pddj.exe115⤵PID:2868
-
\??\c:\flrrffl.exec:\flrrffl.exe116⤵PID:2732
-
\??\c:\bnnbnt.exec:\bnnbnt.exe117⤵PID:3008
-
\??\c:\9hnhtt.exec:\9hnhtt.exe118⤵PID:1872
-
\??\c:\dpdjd.exec:\dpdjd.exe119⤵PID:2796
-
\??\c:\jjpvd.exec:\jjpvd.exe120⤵PID:2720
-
\??\c:\xxfflrx.exec:\xxfflrx.exe121⤵PID:1904
-
\??\c:\xfxxlrx.exec:\xfxxlrx.exe122⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-