Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/11/2024, 22:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe
-
Size
51KB
-
MD5
2a742acf382d67eb74e48a13748ea10a
-
SHA1
44b1cc81021de3f0bc79bda3ae6c299d0233a50d
-
SHA256
5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b
-
SHA512
a58b95932c99bb8ba0e052da9f241124ee445eefe7f0aff5a9512f0f7ca8174ed452680ab3c62c57f54a31ce96b32cb7fce753bb6a953ac36fc2836b897c6333
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlY:0cdpeeBSHHMHLf9RyIp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2504-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2240-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2008-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-46-0x00000000005C0000-0x00000000005E9000-memory.dmp family_blackmoon behavioral1/memory/2696-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-72-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2828-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/672-124-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/672-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/776-130-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/776-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1900-144-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/1248-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-174-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/376-192-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/376-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1592-218-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1996-236-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1996-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1148-254-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-258-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2940-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-294-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2240-307-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/1720-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-320-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2500-323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2500-322-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2236-336-0x0000000000230000-0x0000000000259000-memory.dmp family_blackmoon behavioral1/memory/2236-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-374-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2600-380-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2568-392-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2228-405-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1096-413-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1096-415-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-422-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1784-423-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2824-452-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1356-514-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/3048-543-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-555-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-562-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2236-605-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2372-669-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/800-773-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1272-785-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2932-817-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2616-909-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2008 dvjvj.exe 2240 vvjdv.exe 2480 lfxxllf.exe 2988 nhttbb.exe 2696 vvjpj.exe 2760 5pjpp.exe 2812 fxlxffl.exe 2828 btbhhn.exe 2188 tnnbth.exe 2564 jjppv.exe 2372 xxrfffr.exe 672 xffrrll.exe 776 hbbhnn.exe 1900 9dvvv.exe 1928 9lflxxf.exe 1248 fxfrxxl.exe 1476 tnbbhh.exe 1756 hhnnnb.exe 376 jjvdj.exe 2192 llxrxxr.exe 2972 tntbhn.exe 1592 pvddp.exe 1208 dvjvd.exe 1996 rxlfffl.exe 1620 nnbhbn.exe 1148 tbbtbh.exe 3004 5jpvv.exe 2332 rlrxlll.exe 2940 bbbbhb.exe 3032 9nbbbb.exe 2060 ddddv.exe 2240 rrffllx.exe 1720 tnbhtt.exe 2500 tbtbhh.exe 2348 jdjdd.exe 2236 fxllrrf.exe 2764 tnhhnn.exe 2832 7btbbh.exe 2800 ppdvv.exe 2860 vdjpj.exe 2900 5lxxxxl.exe 2668 xxfxlxl.exe 2600 nhtbhn.exe 2568 vpdjd.exe 2372 dvjpd.exe 2228 ddpvd.exe 1096 btbnnn.exe 1596 3nhhtt.exe 1784 pjvpv.exe 1908 7vvjp.exe 2476 xxlfrrf.exe 1160 flxfllr.exe 2824 bthbbb.exe 1760 3bttbb.exe 1944 jdjpj.exe 2064 vpjpd.exe 2376 xlxxxxl.exe 2140 nhthht.exe 1848 jjpjj.exe 1144 xrxrrlx.exe 1208 fxlrlfx.exe 1356 nntnbt.exe 960 hbhnbn.exe 2300 jpddd.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2008 2504 5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe 30 PID 2504 wrote to memory of 2008 2504 5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe 30 PID 2504 wrote to memory of 2008 2504 5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe 30 PID 2504 wrote to memory of 2008 2504 5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe 30 PID 2008 wrote to memory of 2240 2008 dvjvj.exe 31 PID 2008 wrote to memory of 2240 2008 dvjvj.exe 31 PID 2008 wrote to memory of 2240 2008 dvjvj.exe 31 PID 2008 wrote to memory of 2240 2008 dvjvj.exe 31 PID 2240 wrote to memory of 2480 2240 vvjdv.exe 32 PID 2240 wrote to memory of 2480 2240 vvjdv.exe 32 PID 2240 wrote to memory of 2480 2240 vvjdv.exe 32 PID 2240 wrote to memory of 2480 2240 vvjdv.exe 32 PID 2480 wrote to memory of 2988 2480 lfxxllf.exe 33 PID 2480 wrote to memory of 2988 2480 lfxxllf.exe 33 PID 2480 wrote to memory of 2988 2480 lfxxllf.exe 33 PID 2480 wrote to memory of 2988 2480 lfxxllf.exe 33 PID 2988 wrote to memory of 2696 2988 nhttbb.exe 34 PID 2988 wrote to memory of 2696 2988 nhttbb.exe 34 PID 2988 wrote to memory of 2696 2988 nhttbb.exe 34 PID 2988 wrote to memory of 2696 2988 nhttbb.exe 34 PID 2696 wrote to memory of 2760 2696 vvjpj.exe 35 PID 2696 wrote to memory of 2760 2696 vvjpj.exe 35 PID 2696 wrote to memory of 2760 2696 vvjpj.exe 35 PID 2696 wrote to memory of 2760 2696 vvjpj.exe 35 PID 2760 wrote to memory of 2812 2760 5pjpp.exe 36 PID 2760 wrote to memory of 2812 2760 5pjpp.exe 36 PID 2760 wrote to memory of 2812 2760 5pjpp.exe 36 PID 2760 wrote to memory of 2812 2760 5pjpp.exe 36 PID 2812 wrote to memory of 2828 2812 fxlxffl.exe 37 PID 2812 wrote to memory of 2828 2812 fxlxffl.exe 37 PID 2812 wrote to memory of 2828 2812 fxlxffl.exe 37 PID 2812 wrote to memory of 2828 2812 fxlxffl.exe 37 PID 2828 wrote to memory of 2188 2828 btbhhn.exe 38 PID 2828 wrote to memory of 2188 2828 btbhhn.exe 38 PID 2828 wrote to memory of 2188 2828 btbhhn.exe 38 PID 2828 wrote to memory of 2188 2828 btbhhn.exe 38 PID 2188 wrote to memory of 2564 2188 tnnbth.exe 39 PID 2188 wrote to memory of 2564 2188 tnnbth.exe 39 PID 2188 wrote to memory of 2564 2188 tnnbth.exe 39 PID 2188 wrote to memory of 2564 2188 tnnbth.exe 39 PID 2564 wrote to memory of 2372 2564 jjppv.exe 40 PID 2564 wrote to memory of 2372 2564 jjppv.exe 40 PID 2564 wrote to memory of 2372 2564 jjppv.exe 40 PID 2564 wrote to memory of 2372 2564 jjppv.exe 40 PID 2372 wrote to memory of 672 2372 xxrfffr.exe 41 PID 2372 wrote to memory of 672 2372 xxrfffr.exe 41 PID 2372 wrote to memory of 672 2372 xxrfffr.exe 41 PID 2372 wrote to memory of 672 2372 xxrfffr.exe 41 PID 672 wrote to memory of 776 672 xffrrll.exe 42 PID 672 wrote to memory of 776 672 xffrrll.exe 42 PID 672 wrote to memory of 776 672 xffrrll.exe 42 PID 672 wrote to memory of 776 672 xffrrll.exe 42 PID 776 wrote to memory of 1900 776 hbbhnn.exe 43 PID 776 wrote to memory of 1900 776 hbbhnn.exe 43 PID 776 wrote to memory of 1900 776 hbbhnn.exe 43 PID 776 wrote to memory of 1900 776 hbbhnn.exe 43 PID 1900 wrote to memory of 1928 1900 9dvvv.exe 44 PID 1900 wrote to memory of 1928 1900 9dvvv.exe 44 PID 1900 wrote to memory of 1928 1900 9dvvv.exe 44 PID 1900 wrote to memory of 1928 1900 9dvvv.exe 44 PID 1928 wrote to memory of 1248 1928 9lflxxf.exe 45 PID 1928 wrote to memory of 1248 1928 9lflxxf.exe 45 PID 1928 wrote to memory of 1248 1928 9lflxxf.exe 45 PID 1928 wrote to memory of 1248 1928 9lflxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe"C:\Users\Admin\AppData\Local\Temp\5343748ccb81b104ce5ab9f621af4991b389ec566864cbbbfc2def6be0b58c5b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dvjvj.exec:\dvjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\vvjdv.exec:\vvjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\lfxxllf.exec:\lfxxllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nhttbb.exec:\nhttbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\vvjpj.exec:\vvjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\5pjpp.exec:\5pjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\fxlxffl.exec:\fxlxffl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\btbhhn.exec:\btbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\tnnbth.exec:\tnnbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\jjppv.exec:\jjppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xxrfffr.exec:\xxrfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\xffrrll.exec:\xffrrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\hbbhnn.exec:\hbbhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\9dvvv.exec:\9dvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9lflxxf.exec:\9lflxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\fxfrxxl.exec:\fxfrxxl.exe17⤵
- Executes dropped EXE
PID:1248 -
\??\c:\tnbbhh.exec:\tnbbhh.exe18⤵
- Executes dropped EXE
PID:1476 -
\??\c:\hhnnnb.exec:\hhnnnb.exe19⤵
- Executes dropped EXE
PID:1756 -
\??\c:\jjvdj.exec:\jjvdj.exe20⤵
- Executes dropped EXE
PID:376 -
\??\c:\llxrxxr.exec:\llxrxxr.exe21⤵
- Executes dropped EXE
PID:2192 -
\??\c:\tntbhn.exec:\tntbhn.exe22⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pvddp.exec:\pvddp.exe23⤵
- Executes dropped EXE
PID:1592 -
\??\c:\dvjvd.exec:\dvjvd.exe24⤵
- Executes dropped EXE
PID:1208 -
\??\c:\rxlfffl.exec:\rxlfffl.exe25⤵
- Executes dropped EXE
PID:1996 -
\??\c:\nnbhbn.exec:\nnbhbn.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tbbtbh.exec:\tbbtbh.exe27⤵
- Executes dropped EXE
PID:1148 -
\??\c:\5jpvv.exec:\5jpvv.exe28⤵
- Executes dropped EXE
PID:3004 -
\??\c:\rlrxlll.exec:\rlrxlll.exe29⤵
- Executes dropped EXE
PID:2332 -
\??\c:\bbbbhb.exec:\bbbbhb.exe30⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9nbbbb.exec:\9nbbbb.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ddddv.exec:\ddddv.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rrffllx.exec:\rrffllx.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnbhtt.exec:\tnbhtt.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\tbtbhh.exec:\tbtbhh.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\jdjdd.exec:\jdjdd.exe36⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fxllrrf.exec:\fxllrrf.exe37⤵
- Executes dropped EXE
PID:2236 -
\??\c:\tnhhnn.exec:\tnhhnn.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7btbbh.exec:\7btbbh.exe39⤵
- Executes dropped EXE
PID:2832 -
\??\c:\ppdvv.exec:\ppdvv.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2800 -
\??\c:\vdjpj.exec:\vdjpj.exe41⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5lxxxxl.exec:\5lxxxxl.exe42⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xxfxlxl.exec:\xxfxlxl.exe43⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nhtbhn.exec:\nhtbhn.exe44⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpdjd.exec:\vpdjd.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\dvjpd.exec:\dvjpd.exe46⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ddpvd.exec:\ddpvd.exe47⤵
- Executes dropped EXE
PID:2228 -
\??\c:\btbnnn.exec:\btbnnn.exe48⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3nhhtt.exec:\3nhhtt.exe49⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pjvpv.exec:\pjvpv.exe50⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7vvjp.exec:\7vvjp.exe51⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xxlfrrf.exec:\xxlfrrf.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flxfllr.exec:\flxfllr.exe53⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bthbbb.exec:\bthbbb.exe54⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3bttbb.exec:\3bttbb.exe55⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jdjpj.exec:\jdjpj.exe56⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpjpd.exec:\vpjpd.exe57⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlxxxxl.exec:\xlxxxxl.exe58⤵
- Executes dropped EXE
PID:2376 -
\??\c:\nhthht.exec:\nhthht.exe59⤵
- Executes dropped EXE
PID:2140 -
\??\c:\jjpjj.exec:\jjpjj.exe60⤵
- Executes dropped EXE
PID:1848 -
\??\c:\xrxrrlx.exec:\xrxrrlx.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\fxlrlfx.exec:\fxlrlfx.exe62⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nntnbt.exec:\nntnbt.exe63⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbhnbn.exec:\hbhnbn.exe64⤵
- Executes dropped EXE
PID:960 -
\??\c:\jpddd.exec:\jpddd.exe65⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5vppv.exec:\5vppv.exe66⤵PID:1852
-
\??\c:\xxlxrrx.exec:\xxlxrrx.exe67⤵PID:2400
-
\??\c:\7fllllr.exec:\7fllllr.exe68⤵PID:3048
-
\??\c:\tnttbb.exec:\tnttbb.exe69⤵PID:892
-
\??\c:\tnttbt.exec:\tnttbt.exe70⤵PID:3044
-
\??\c:\bbntbb.exec:\bbntbb.exe71⤵PID:3032
-
\??\c:\vpvdj.exec:\vpvdj.exe72⤵PID:2060
-
\??\c:\5xfllrl.exec:\5xfllrl.exe73⤵PID:2008
-
\??\c:\5fxxllr.exec:\5fxxllr.exe74⤵PID:1624
-
\??\c:\tnnthb.exec:\tnnthb.exe75⤵PID:1608
-
\??\c:\hhnbtb.exec:\hhnbtb.exe76⤵PID:2032
-
\??\c:\5pdjj.exec:\5pdjj.exe77⤵PID:2484
-
\??\c:\dvdpv.exec:\dvdpv.exe78⤵PID:2236
-
\??\c:\7rfxxff.exec:\7rfxxff.exe79⤵PID:2080
-
\??\c:\3rflrrr.exec:\3rflrrr.exe80⤵PID:2576
-
\??\c:\lflllll.exec:\lflllll.exe81⤵PID:2728
-
\??\c:\7bbhtb.exec:\7bbhtb.exe82⤵PID:2904
-
\??\c:\vjvjd.exec:\vjvjd.exe83⤵PID:2828
-
\??\c:\vpddp.exec:\vpddp.exe84⤵PID:2584
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe85⤵PID:2564
-
\??\c:\rrlrfxx.exec:\rrlrfxx.exe86⤵PID:2844
-
\??\c:\btbhhn.exec:\btbhhn.exe87⤵PID:2640
-
\??\c:\nnhhtt.exec:\nnhhtt.exe88⤵PID:2372
-
\??\c:\9pvjj.exec:\9pvjj.exe89⤵PID:1632
-
\??\c:\ppvvj.exec:\ppvvj.exe90⤵PID:1728
-
\??\c:\rrrrrxr.exec:\rrrrrxr.exe91⤵PID:692
-
\??\c:\fffrffr.exec:\fffrffr.exe92⤵PID:2112
-
\??\c:\3tntbb.exec:\3tntbb.exe93⤵PID:536
-
\??\c:\1bbbnn.exec:\1bbbnn.exe94⤵PID:1476
-
\??\c:\9jvdv.exec:\9jvdv.exe95⤵PID:2788
-
\??\c:\pdvdv.exec:\pdvdv.exe96⤵PID:1780
-
\??\c:\rxlflff.exec:\rxlflff.exe97⤵
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\xrrxlfr.exec:\xrrxlfr.exe98⤵PID:2876
-
\??\c:\tnbthn.exec:\tnbthn.exe99⤵PID:2184
-
\??\c:\ppvvd.exec:\ppvvd.exe100⤵PID:860
-
\??\c:\vvvvv.exec:\vvvvv.exe101⤵PID:920
-
\??\c:\vjdjp.exec:\vjdjp.exe102⤵PID:1592
-
\??\c:\llxlflf.exec:\llxlflf.exe103⤵PID:1132
-
\??\c:\xlflrrr.exec:\xlflrrr.exe104⤵PID:800
-
\??\c:\7htntt.exec:\7htntt.exe105⤵PID:1272
-
\??\c:\nhthnn.exec:\nhthnn.exe106⤵PID:1544
-
\??\c:\7pvpj.exec:\7pvpj.exe107⤵PID:2964
-
\??\c:\jdpjj.exec:\jdpjj.exe108⤵PID:2956
-
\??\c:\llxlfxf.exec:\llxlfxf.exe109⤵PID:2320
-
\??\c:\5xfrrxf.exec:\5xfrrxf.exe110⤵PID:2932
-
\??\c:\tntnnn.exec:\tntnnn.exe111⤵PID:2324
-
\??\c:\bbhbtt.exec:\bbhbtt.exe112⤵PID:2368
-
\??\c:\jvdjj.exec:\jvdjj.exe113⤵PID:1056
-
\??\c:\pvdjp.exec:\pvdjp.exe114⤵PID:3032
-
\??\c:\rlrrrlx.exec:\rlrrrlx.exe115⤵PID:2336
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe116⤵PID:1812
-
\??\c:\lxrrrrl.exec:\lxrrrrl.exe117⤵PID:2536
-
\??\c:\bhbntt.exec:\bhbntt.exe118⤵PID:1720
-
\??\c:\bbnttt.exec:\bbnttt.exe119⤵PID:2172
-
\??\c:\vvjpd.exec:\vvjpd.exe120⤵PID:2348
-
\??\c:\vvjpp.exec:\vvjpp.exe121⤵PID:2724
-
\??\c:\xxffflr.exec:\xxffflr.exe122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-