Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
24-11-2024 14:16
Static task
static1
Behavioral task
behavioral1
Sample
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe
Resource
win7-20240903-en
General
-
Target
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe
-
Size
69KB
-
MD5
4a8039cf581bbec82ee1fd8d9743cc77
-
SHA1
1cb69dd2513e70ae1f0644007ac9343e350df2da
-
SHA256
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a
-
SHA512
23b61816860e13ba4b573bce98cdfa21437d5b051547d43215ac154b32a37094c64aacbdde9881eefb6142da861c2f1b061c69143561ec68956d05beaba561f7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAch:ymb3NkkiQ3mdBjFIsIVch
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral1/memory/2316-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2316-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2288-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2468-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2508-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1312-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1060-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/288-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2960-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1740-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-304-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tttbhh.exe9jdjj.exedjpvd.exe7fxrfrl.exepvjvv.exevdddj.exe7thhnn.exe7dpdp.exerxxlflx.exenhtbnt.exetbthbn.exejvddj.exerrrlxfr.exebbbhtb.exeppjpj.exejjjdp.exefffrxxf.exehnbnbn.exevvvdp.exedpjpv.exellfxrfx.exexrffrxf.exehtbttn.exedvjdd.exe7pppd.exerxrfxlx.exentnnht.exevvvdp.exe9flrlrf.exethtttt.exevdjdv.exevvpvd.exe7lxflrf.exehhtnnn.exedjpjp.exeddvdv.exexrflxfr.exe3bbbhn.exehhhbth.exe1jdjj.exe7ddjp.exellxflrx.exebbhhtb.exettnntt.exejddpd.exeddvdv.exerlxxffl.exetnhntb.exehhbhtb.exeppdvj.exejdppj.exefffrlxr.exehtthnt.exebbbtth.exe1jddp.exevpjpj.exelfrxffl.exerxrfrfr.exettnbbn.exe7dvdv.exevvvdd.exelllrrfr.exebhhhth.exetththn.exepid process 2328 tttbhh.exe 2848 9jdjj.exe 2992 djpvd.exe 2764 7fxrfrl.exe 2828 pvjvv.exe 2620 vdddj.exe 2288 7thhnn.exe 2972 7dpdp.exe 2468 rxxlflx.exe 2880 nhtbnt.exe 2508 tbthbn.exe 1312 jvddj.exe 2372 rrrlxfr.exe 1060 bbbhtb.exe 2928 ppjpj.exe 1608 jjjdp.exe 288 fffrxxf.exe 908 hnbnbn.exe 2424 vvvdp.exe 2244 dpjpv.exe 2464 llfxrfx.exe 1308 xrffrxf.exe 408 htbttn.exe 2960 dvjdd.exe 1640 7pppd.exe 1124 rxrfxlx.exe 1284 ntnnht.exe 1740 vvvdp.exe 2240 9flrlrf.exe 2484 thtttt.exe 2160 vdjdv.exe 2748 vvpvd.exe 2760 7lxflrf.exe 2364 hhtnnn.exe 2988 djpjp.exe 2648 ddvdv.exe 2656 xrflxfr.exe 2680 3bbbhn.exe 2180 hhhbth.exe 376 1jdjj.exe 2020 7ddjp.exe 2700 llxflrx.exe 1644 bbhhtb.exe 2940 ttnntt.exe 1992 jddpd.exe 2912 ddvdv.exe 2780 rlxxffl.exe 588 tnhntb.exe 484 hhbhtb.exe 1916 ppdvj.exe 572 jdppj.exe 2052 fffrlxr.exe 688 htthnt.exe 1768 bbbtth.exe 2444 1jddp.exe 3000 vpjpj.exe 2248 lfrxffl.exe 2428 rxrfrfr.exe 2184 ttnbbn.exe 2496 7dvdv.exe 2024 vvvdd.exe 1544 lllrrfr.exe 2148 bhhhth.exe 2980 tththn.exe -
Processes:
resource yara_rule behavioral1/memory/2328-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2316-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2848-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2764-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2288-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2972-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2468-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2508-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1312-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2372-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1060-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/288-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2960-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-259-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1740-277-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-295-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2160-304-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5hhtnt.exeppjpj.exebbtthh.exebnnbhn.exejjvdj.exe7llrlrf.exeb99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exebbbnhb.exerfrxlrx.exe7jdvd.exevvdpd.exe7tttbt.exe5pjvj.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exetttbhh.exe9jdjj.exedjpvd.exe7fxrfrl.exepvjvv.exevdddj.exe7thhnn.exe7dpdp.exerxxlflx.exenhtbnt.exetbthbn.exejvddj.exerrrlxfr.exebbbhtb.exeppjpj.exedescription pid process target process PID 2316 wrote to memory of 2328 2316 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe tttbhh.exe PID 2316 wrote to memory of 2328 2316 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe tttbhh.exe PID 2316 wrote to memory of 2328 2316 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe tttbhh.exe PID 2316 wrote to memory of 2328 2316 b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe tttbhh.exe PID 2328 wrote to memory of 2848 2328 tttbhh.exe 9jdjj.exe PID 2328 wrote to memory of 2848 2328 tttbhh.exe 9jdjj.exe PID 2328 wrote to memory of 2848 2328 tttbhh.exe 9jdjj.exe PID 2328 wrote to memory of 2848 2328 tttbhh.exe 9jdjj.exe PID 2848 wrote to memory of 2992 2848 9jdjj.exe djpvd.exe PID 2848 wrote to memory of 2992 2848 9jdjj.exe djpvd.exe PID 2848 wrote to memory of 2992 2848 9jdjj.exe djpvd.exe PID 2848 wrote to memory of 2992 2848 9jdjj.exe djpvd.exe PID 2992 wrote to memory of 2764 2992 djpvd.exe 7fxrfrl.exe PID 2992 wrote to memory of 2764 2992 djpvd.exe 7fxrfrl.exe PID 2992 wrote to memory of 2764 2992 djpvd.exe 7fxrfrl.exe PID 2992 wrote to memory of 2764 2992 djpvd.exe 7fxrfrl.exe PID 2764 wrote to memory of 2828 2764 7fxrfrl.exe pvjvv.exe PID 2764 wrote to memory of 2828 2764 7fxrfrl.exe pvjvv.exe PID 2764 wrote to memory of 2828 2764 7fxrfrl.exe pvjvv.exe PID 2764 wrote to memory of 2828 2764 7fxrfrl.exe pvjvv.exe PID 2828 wrote to memory of 2620 2828 pvjvv.exe vdddj.exe PID 2828 wrote to memory of 2620 2828 pvjvv.exe vdddj.exe PID 2828 wrote to memory of 2620 2828 pvjvv.exe vdddj.exe PID 2828 wrote to memory of 2620 2828 pvjvv.exe vdddj.exe PID 2620 wrote to memory of 2288 2620 vdddj.exe 7thhnn.exe PID 2620 wrote to memory of 2288 2620 vdddj.exe 7thhnn.exe PID 2620 wrote to memory of 2288 2620 vdddj.exe 7thhnn.exe PID 2620 wrote to memory of 2288 2620 vdddj.exe 7thhnn.exe PID 2288 wrote to memory of 2972 2288 7thhnn.exe 7dpdp.exe PID 2288 wrote to memory of 2972 2288 7thhnn.exe 7dpdp.exe PID 2288 wrote to memory of 2972 2288 7thhnn.exe 7dpdp.exe PID 2288 wrote to memory of 2972 2288 7thhnn.exe 7dpdp.exe PID 2972 wrote to memory of 2468 2972 7dpdp.exe rxxlflx.exe PID 2972 wrote to memory of 2468 2972 7dpdp.exe rxxlflx.exe PID 2972 wrote to memory of 2468 2972 7dpdp.exe rxxlflx.exe PID 2972 wrote to memory of 2468 2972 7dpdp.exe rxxlflx.exe PID 2468 wrote to memory of 2880 2468 rxxlflx.exe nhtbnt.exe PID 2468 wrote to memory of 2880 2468 rxxlflx.exe nhtbnt.exe PID 2468 wrote to memory of 2880 2468 rxxlflx.exe nhtbnt.exe PID 2468 wrote to memory of 2880 2468 rxxlflx.exe nhtbnt.exe PID 2880 wrote to memory of 2508 2880 nhtbnt.exe tbthbn.exe PID 2880 wrote to memory of 2508 2880 nhtbnt.exe tbthbn.exe PID 2880 wrote to memory of 2508 2880 nhtbnt.exe tbthbn.exe PID 2880 wrote to memory of 2508 2880 nhtbnt.exe tbthbn.exe PID 2508 wrote to memory of 1312 2508 tbthbn.exe jvddj.exe PID 2508 wrote to memory of 1312 2508 tbthbn.exe jvddj.exe PID 2508 wrote to memory of 1312 2508 tbthbn.exe jvddj.exe PID 2508 wrote to memory of 1312 2508 tbthbn.exe jvddj.exe PID 1312 wrote to memory of 2372 1312 jvddj.exe rrrlxfr.exe PID 1312 wrote to memory of 2372 1312 jvddj.exe rrrlxfr.exe PID 1312 wrote to memory of 2372 1312 jvddj.exe rrrlxfr.exe PID 1312 wrote to memory of 2372 1312 jvddj.exe rrrlxfr.exe PID 2372 wrote to memory of 1060 2372 rrrlxfr.exe bbbhtb.exe PID 2372 wrote to memory of 1060 2372 rrrlxfr.exe bbbhtb.exe PID 2372 wrote to memory of 1060 2372 rrrlxfr.exe bbbhtb.exe PID 2372 wrote to memory of 1060 2372 rrrlxfr.exe bbbhtb.exe PID 1060 wrote to memory of 2928 1060 bbbhtb.exe ppjpj.exe PID 1060 wrote to memory of 2928 1060 bbbhtb.exe ppjpj.exe PID 1060 wrote to memory of 2928 1060 bbbhtb.exe ppjpj.exe PID 1060 wrote to memory of 2928 1060 bbbhtb.exe ppjpj.exe PID 2928 wrote to memory of 1608 2928 ppjpj.exe jjjdp.exe PID 2928 wrote to memory of 1608 2928 ppjpj.exe jjjdp.exe PID 2928 wrote to memory of 1608 2928 ppjpj.exe jjjdp.exe PID 2928 wrote to memory of 1608 2928 ppjpj.exe jjjdp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe"C:\Users\Admin\AppData\Local\Temp\b99586c3fc6e0f48f064ac8a49ddc657ab932b3c9a7b71ff8e0ceecf9494a70a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\tttbhh.exec:\tttbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\9jdjj.exec:\9jdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\djpvd.exec:\djpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\7fxrfrl.exec:\7fxrfrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\pvjvv.exec:\pvjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\vdddj.exec:\vdddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\7thhnn.exec:\7thhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\7dpdp.exec:\7dpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\rxxlflx.exec:\rxxlflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nhtbnt.exec:\nhtbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\tbthbn.exec:\tbthbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\jvddj.exec:\jvddj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\rrrlxfr.exec:\rrrlxfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\bbbhtb.exec:\bbbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\ppjpj.exec:\ppjpj.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\jjjdp.exec:\jjjdp.exe17⤵
- Executes dropped EXE
PID:1608 -
\??\c:\fffrxxf.exec:\fffrxxf.exe18⤵
- Executes dropped EXE
PID:288 -
\??\c:\hnbnbn.exec:\hnbnbn.exe19⤵
- Executes dropped EXE
PID:908 -
\??\c:\vvvdp.exec:\vvvdp.exe20⤵
- Executes dropped EXE
PID:2424 -
\??\c:\dpjpv.exec:\dpjpv.exe21⤵
- Executes dropped EXE
PID:2244 -
\??\c:\llfxrfx.exec:\llfxrfx.exe22⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xrffrxf.exec:\xrffrxf.exe23⤵
- Executes dropped EXE
PID:1308 -
\??\c:\htbttn.exec:\htbttn.exe24⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvjdd.exec:\dvjdd.exe25⤵
- Executes dropped EXE
PID:2960 -
\??\c:\7pppd.exec:\7pppd.exe26⤵
- Executes dropped EXE
PID:1640 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe27⤵
- Executes dropped EXE
PID:1124 -
\??\c:\ntnnht.exec:\ntnnht.exe28⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vvvdp.exec:\vvvdp.exe29⤵
- Executes dropped EXE
PID:1740 -
\??\c:\9flrlrf.exec:\9flrlrf.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\thtttt.exec:\thtttt.exe31⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vdjdv.exec:\vdjdv.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\vvpvd.exec:\vvpvd.exe33⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7lxflrf.exec:\7lxflrf.exe34⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hhtnnn.exec:\hhtnnn.exe35⤵
- Executes dropped EXE
PID:2364 -
\??\c:\djpjp.exec:\djpjp.exe36⤵
- Executes dropped EXE
PID:2988 -
\??\c:\ddvdv.exec:\ddvdv.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\xrflxfr.exec:\xrflxfr.exe38⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3bbbhn.exec:\3bbbhn.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hhhbth.exec:\hhhbth.exe40⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1jdjj.exec:\1jdjj.exe41⤵
- Executes dropped EXE
PID:376 -
\??\c:\7ddjp.exec:\7ddjp.exe42⤵
- Executes dropped EXE
PID:2020 -
\??\c:\llxflrx.exec:\llxflrx.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbhhtb.exec:\bbhhtb.exe44⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ttnntt.exec:\ttnntt.exe45⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jddpd.exec:\jddpd.exe46⤵
- Executes dropped EXE
PID:1992 -
\??\c:\ddvdv.exec:\ddvdv.exe47⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rlxxffl.exec:\rlxxffl.exe48⤵
- Executes dropped EXE
PID:2780 -
\??\c:\tnhntb.exec:\tnhntb.exe49⤵
- Executes dropped EXE
PID:588 -
\??\c:\hhbhtb.exec:\hhbhtb.exe50⤵
- Executes dropped EXE
PID:484 -
\??\c:\ppdvj.exec:\ppdvj.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jdppj.exec:\jdppj.exe52⤵
- Executes dropped EXE
PID:572 -
\??\c:\fffrlxr.exec:\fffrlxr.exe53⤵
- Executes dropped EXE
PID:2052 -
\??\c:\htthnt.exec:\htthnt.exe54⤵
- Executes dropped EXE
PID:688 -
\??\c:\bbbtth.exec:\bbbtth.exe55⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1jddp.exec:\1jddp.exe56⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vpjpj.exec:\vpjpj.exe57⤵
- Executes dropped EXE
PID:3000 -
\??\c:\lfrxffl.exec:\lfrxffl.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rxrfrfr.exec:\rxrfrfr.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ttnbbn.exec:\ttnbbn.exe60⤵
- Executes dropped EXE
PID:2184 -
\??\c:\7dvdv.exec:\7dvdv.exe61⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vvvdd.exec:\vvvdd.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lllrrfr.exec:\lllrrfr.exe63⤵
- Executes dropped EXE
PID:1544 -
\??\c:\bhhhth.exec:\bhhhth.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tththn.exec:\tththn.exe65⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ppvpj.exec:\ppvpj.exe66⤵PID:2200
-
\??\c:\jjvvd.exec:\jjvvd.exe67⤵PID:284
-
\??\c:\xrfxrxl.exec:\xrfxrxl.exe68⤵PID:2292
-
\??\c:\btnnnn.exec:\btnnnn.exe69⤵PID:2348
-
\??\c:\bbtthh.exec:\bbtthh.exe70⤵
- System Location Discovery: System Language Discovery
PID:2280 -
\??\c:\jppjd.exec:\jppjd.exe71⤵PID:2708
-
\??\c:\3xrfxxl.exec:\3xrfxxl.exe72⤵PID:3004
-
\??\c:\lfrfxfl.exec:\lfrfxfl.exe73⤵PID:2800
-
\??\c:\bnnbhn.exec:\bnnbhn.exe74⤵
- System Location Discovery: System Language Discovery
PID:2720 -
\??\c:\5hnhbn.exec:\5hnhbn.exe75⤵PID:2944
-
\??\c:\1pvpd.exec:\1pvpd.exe76⤵PID:2716
-
\??\c:\rlffflx.exec:\rlffflx.exe77⤵PID:2616
-
\??\c:\9flrffx.exec:\9flrffx.exe78⤵PID:2204
-
\??\c:\hththh.exec:\hththh.exe79⤵PID:2632
-
\??\c:\9ppdj.exec:\9ppdj.exe80⤵PID:2180
-
\??\c:\1vvpd.exec:\1vvpd.exe81⤵PID:2488
-
\??\c:\frxxfxf.exec:\frxxfxf.exe82⤵PID:2312
-
\??\c:\tbtttt.exec:\tbtttt.exe83⤵PID:2888
-
\??\c:\bthnbb.exec:\bthnbb.exe84⤵PID:316
-
\??\c:\ppjdv.exec:\ppjdv.exe85⤵PID:1280
-
\??\c:\vvpjd.exec:\vvpjd.exe86⤵PID:1928
-
\??\c:\xxxxfrl.exec:\xxxxfrl.exe87⤵PID:2924
-
\??\c:\btbhhh.exec:\btbhhh.exe88⤵PID:2780
-
\??\c:\tnbthb.exec:\tnbthb.exe89⤵PID:2968
-
\??\c:\1pjvd.exec:\1pjvd.exe90⤵PID:484
-
\??\c:\jjpdj.exec:\jjpdj.exe91⤵PID:1556
-
\??\c:\rrxflfx.exec:\rrxflfx.exe92⤵PID:544
-
\??\c:\hnnhbh.exec:\hnnhbh.exe93⤵PID:980
-
\??\c:\nnhbnt.exec:\nnhbnt.exe94⤵PID:688
-
\??\c:\jdvjv.exec:\jdvjv.exe95⤵PID:3008
-
\??\c:\xlflrxl.exec:\xlflrxl.exe96⤵PID:496
-
\??\c:\lxfxlrx.exec:\lxfxlrx.exe97⤵PID:1480
-
\??\c:\nhbbnn.exec:\nhbbnn.exe98⤵PID:2448
-
\??\c:\9btthn.exec:\9btthn.exe99⤵PID:1132
-
\??\c:\dvpdj.exec:\dvpdj.exe100⤵PID:1348
-
\??\c:\7xfrflx.exec:\7xfrflx.exe101⤵PID:1696
-
\??\c:\lfrfxlf.exec:\lfrfxlf.exe102⤵PID:2400
-
\??\c:\nhntht.exec:\nhntht.exe103⤵PID:2956
-
\??\c:\btbbnh.exec:\btbbnh.exe104⤵PID:2148
-
\??\c:\7vvdv.exec:\7vvdv.exe105⤵PID:2548
-
\??\c:\pddpp.exec:\pddpp.exe106⤵PID:2200
-
\??\c:\9xrrfrr.exec:\9xrrfrr.exe107⤵PID:3052
-
\??\c:\btnntt.exec:\btnntt.exe108⤵PID:2292
-
\??\c:\3thbht.exec:\3thbht.exe109⤵PID:2240
-
\??\c:\dpppv.exec:\dpppv.exe110⤵PID:2820
-
\??\c:\jddjv.exec:\jddjv.exe111⤵PID:2708
-
\??\c:\tnthnt.exec:\tnthnt.exe112⤵PID:2864
-
\??\c:\nntbnn.exec:\nntbnn.exe113⤵PID:2848
-
\??\c:\9ppdd.exec:\9ppdd.exe114⤵PID:2720
-
\??\c:\lfrfrrr.exec:\lfrfrrr.exe115⤵PID:1576
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe116⤵PID:2772
-
\??\c:\tbnhnh.exec:\tbnhnh.exe117⤵PID:2600
-
\??\c:\ntthhn.exec:\ntthhn.exe118⤵PID:2204
-
\??\c:\dvjvp.exec:\dvjvp.exe119⤵PID:1836
-
\??\c:\rlrfrxl.exec:\rlrfrxl.exe120⤵PID:1720
-
\??\c:\fxfxffr.exec:\fxfxffr.exe121⤵PID:1804
-
\??\c:\tttbnt.exec:\tttbnt.exe122⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-