Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 13:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe
-
Size
53KB
-
MD5
f137b6ff5ad0a3b66840201784875e9c
-
SHA1
5c17e8afcc7e0667646cb2d354bc725ced7db6a7
-
SHA256
73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49
-
SHA512
58d9ec00b033f24bf2245907e3328c94f4f46c12ec6533dbdb2373f081ae811a85de079722833123239896b24fc51499351c3eecfd2ef0ce6562f113919479f4
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvl5:0cdpeeBSHHMHLf9RyIa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2816-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-35-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2604-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1204-61-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2584-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3008-73-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/276-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2160-101-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2160-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/236-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1684-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/496-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1040-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-197-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/596-188-0x0000000000430000-0x0000000000459000-memory.dmp family_blackmoon behavioral1/memory/1076-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1604-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-271-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2980-279-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1596-315-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1596-314-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2744-322-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2744-342-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/1856-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1096-363-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1096-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2088-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2308-391-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/2284-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1240-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1112-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2280-444-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1712-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1920-482-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1920-501-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2804-564-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2584-595-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2420-631-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-643-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1964-791-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2288-798-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2744-854-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2612-867-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-1002-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2808-1130-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2720-1143-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2396-1157-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2076-1201-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 hbbbnn.exe 2816 nhtttt.exe 2752 pjvdj.exe 2584 frxxlrx.exe 2604 rfrrxfx.exe 1204 nhnbhh.exe 3008 3nbhnn.exe 276 llxlflr.exe 2204 ttbhtt.exe 2160 vpdjv.exe 236 pjvvv.exe 344 rflflrx.exe 1684 5bbhbn.exe 496 vpjvd.exe 2896 jdjjp.exe 596 rrflllr.exe 1040 1hnhnn.exe 2028 jjvpv.exe 2924 3vvdj.exe 1264 llrrxfl.exe 1076 ffrxlrr.exe 1968 hbnhnh.exe 1604 jdvdv.exe 2432 1lrfxlx.exe 1228 llrlrrx.exe 2388 nnbhhh.exe 272 1vjjp.exe 1940 9fxrxxx.exe 2980 xxfllxl.exe 2644 1hhhtt.exe 2788 vpppp.exe 2656 ppddj.exe 1596 rlrrrrx.exe 2744 xxfflff.exe 2884 bthhht.exe 2596 5dddd.exe 2616 vpjdd.exe 1856 lxflffl.exe 2724 7xllrrf.exe 1096 7hbhnh.exe 276 7hbttt.exe 2088 9jvvv.exe 1648 7lrrxxf.exe 2308 3rxxffl.exe 1580 bbhbhh.exe 2284 pdjjj.exe 1240 9vppd.exe 2640 rrflrrx.exe 1148 llxfrlr.exe 1760 1htbbb.exe 1112 nbnhhh.exe 2280 1pvvv.exe 1040 jdvpd.exe 2068 rfrxxfl.exe 2332 fxffxrx.exe 2176 1htttt.exe 1712 3bbttn.exe 1920 dpjpv.exe 840 jdpvv.exe 1968 5lxxffl.exe 1092 ffxrrlf.exe 712 hhhhnn.exe 2956 vdjjp.exe 2408 1lllrrr.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tntbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xlxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2120 2644 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 30 PID 2644 wrote to memory of 2120 2644 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 30 PID 2644 wrote to memory of 2120 2644 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 30 PID 2644 wrote to memory of 2120 2644 73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe 30 PID 2120 wrote to memory of 2816 2120 hbbbnn.exe 31 PID 2120 wrote to memory of 2816 2120 hbbbnn.exe 31 PID 2120 wrote to memory of 2816 2120 hbbbnn.exe 31 PID 2120 wrote to memory of 2816 2120 hbbbnn.exe 31 PID 2816 wrote to memory of 2752 2816 nhtttt.exe 32 PID 2816 wrote to memory of 2752 2816 nhtttt.exe 32 PID 2816 wrote to memory of 2752 2816 nhtttt.exe 32 PID 2816 wrote to memory of 2752 2816 nhtttt.exe 32 PID 2752 wrote to memory of 2584 2752 pjvdj.exe 33 PID 2752 wrote to memory of 2584 2752 pjvdj.exe 33 PID 2752 wrote to memory of 2584 2752 pjvdj.exe 33 PID 2752 wrote to memory of 2584 2752 pjvdj.exe 33 PID 2584 wrote to memory of 2604 2584 frxxlrx.exe 34 PID 2584 wrote to memory of 2604 2584 frxxlrx.exe 34 PID 2584 wrote to memory of 2604 2584 frxxlrx.exe 34 PID 2584 wrote to memory of 2604 2584 frxxlrx.exe 34 PID 2604 wrote to memory of 1204 2604 rfrrxfx.exe 35 PID 2604 wrote to memory of 1204 2604 rfrrxfx.exe 35 PID 2604 wrote to memory of 1204 2604 rfrrxfx.exe 35 PID 2604 wrote to memory of 1204 2604 rfrrxfx.exe 35 PID 1204 wrote to memory of 3008 1204 nhnbhh.exe 36 PID 1204 wrote to memory of 3008 1204 nhnbhh.exe 36 PID 1204 wrote to memory of 3008 1204 nhnbhh.exe 36 PID 1204 wrote to memory of 3008 1204 nhnbhh.exe 36 PID 3008 wrote to memory of 276 3008 3nbhnn.exe 37 PID 3008 wrote to memory of 276 3008 3nbhnn.exe 37 PID 3008 wrote to memory of 276 3008 3nbhnn.exe 37 PID 3008 wrote to memory of 276 3008 3nbhnn.exe 37 PID 276 wrote to memory of 2204 276 llxlflr.exe 38 PID 276 wrote to memory of 2204 276 llxlflr.exe 38 PID 276 wrote to memory of 2204 276 llxlflr.exe 38 PID 276 wrote to memory of 2204 276 llxlflr.exe 38 PID 2204 wrote to memory of 2160 2204 ttbhtt.exe 39 PID 2204 wrote to memory of 2160 2204 ttbhtt.exe 39 PID 2204 wrote to memory of 2160 2204 ttbhtt.exe 39 PID 2204 wrote to memory of 2160 2204 ttbhtt.exe 39 PID 2160 wrote to memory of 236 2160 vpdjv.exe 40 PID 2160 wrote to memory of 236 2160 vpdjv.exe 40 PID 2160 wrote to memory of 236 2160 vpdjv.exe 40 PID 2160 wrote to memory of 236 2160 vpdjv.exe 40 PID 236 wrote to memory of 344 236 pjvvv.exe 41 PID 236 wrote to memory of 344 236 pjvvv.exe 41 PID 236 wrote to memory of 344 236 pjvvv.exe 41 PID 236 wrote to memory of 344 236 pjvvv.exe 41 PID 344 wrote to memory of 1684 344 rflflrx.exe 42 PID 344 wrote to memory of 1684 344 rflflrx.exe 42 PID 344 wrote to memory of 1684 344 rflflrx.exe 42 PID 344 wrote to memory of 1684 344 rflflrx.exe 42 PID 1684 wrote to memory of 496 1684 5bbhbn.exe 43 PID 1684 wrote to memory of 496 1684 5bbhbn.exe 43 PID 1684 wrote to memory of 496 1684 5bbhbn.exe 43 PID 1684 wrote to memory of 496 1684 5bbhbn.exe 43 PID 496 wrote to memory of 2896 496 vpjvd.exe 44 PID 496 wrote to memory of 2896 496 vpjvd.exe 44 PID 496 wrote to memory of 2896 496 vpjvd.exe 44 PID 496 wrote to memory of 2896 496 vpjvd.exe 44 PID 2896 wrote to memory of 596 2896 jdjjp.exe 45 PID 2896 wrote to memory of 596 2896 jdjjp.exe 45 PID 2896 wrote to memory of 596 2896 jdjjp.exe 45 PID 2896 wrote to memory of 596 2896 jdjjp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe"C:\Users\Admin\AppData\Local\Temp\73fb34e2780202a04e897ba7a581e2db5423643b71c8d440eb92daa298b1cd49.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\hbbbnn.exec:\hbbbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\nhtttt.exec:\nhtttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\pjvdj.exec:\pjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\frxxlrx.exec:\frxxlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\rfrrxfx.exec:\rfrrxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nhnbhh.exec:\nhnbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\3nbhnn.exec:\3nbhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\llxlflr.exec:\llxlflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:276 -
\??\c:\ttbhtt.exec:\ttbhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\vpdjv.exec:\vpdjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\pjvvv.exec:\pjvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:236 -
\??\c:\rflflrx.exec:\rflflrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\5bbhbn.exec:\5bbhbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\vpjvd.exec:\vpjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
\??\c:\jdjjp.exec:\jdjjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\rrflllr.exec:\rrflllr.exe17⤵
- Executes dropped EXE
PID:596 -
\??\c:\1hnhnn.exec:\1hnhnn.exe18⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jjvpv.exec:\jjvpv.exe19⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3vvdj.exec:\3vvdj.exe20⤵
- Executes dropped EXE
PID:2924 -
\??\c:\llrrxfl.exec:\llrrxfl.exe21⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ffrxlrr.exec:\ffrxlrr.exe22⤵
- Executes dropped EXE
PID:1076 -
\??\c:\hbnhnh.exec:\hbnhnh.exe23⤵
- Executes dropped EXE
PID:1968 -
\??\c:\jdvdv.exec:\jdvdv.exe24⤵
- Executes dropped EXE
PID:1604 -
\??\c:\1lrfxlx.exec:\1lrfxlx.exe25⤵
- Executes dropped EXE
PID:2432 -
\??\c:\llrlrrx.exec:\llrlrrx.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\nnbhhh.exec:\nnbhhh.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\1vjjp.exec:\1vjjp.exe28⤵
- Executes dropped EXE
PID:272 -
\??\c:\9fxrxxx.exec:\9fxrxxx.exe29⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xxfllxl.exec:\xxfllxl.exe30⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1hhhtt.exec:\1hhhtt.exe31⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vpppp.exec:\vpppp.exe32⤵
- Executes dropped EXE
PID:2788 -
\??\c:\ppddj.exec:\ppddj.exe33⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rlrrrrx.exec:\rlrrrrx.exe34⤵
- Executes dropped EXE
PID:1596 -
\??\c:\xxfflff.exec:\xxfflff.exe35⤵
- Executes dropped EXE
PID:2744 -
\??\c:\bthhht.exec:\bthhht.exe36⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5dddd.exec:\5dddd.exe37⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vpjdd.exec:\vpjdd.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\lxflffl.exec:\lxflffl.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7xllrrf.exec:\7xllrrf.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\7hbhnh.exec:\7hbhnh.exe41⤵
- Executes dropped EXE
PID:1096 -
\??\c:\7hbttt.exec:\7hbttt.exe42⤵
- Executes dropped EXE
PID:276 -
\??\c:\9jvvv.exec:\9jvvv.exe43⤵
- Executes dropped EXE
PID:2088 -
\??\c:\7lrrxxf.exec:\7lrrxxf.exe44⤵
- Executes dropped EXE
PID:1648 -
\??\c:\3rxxffl.exec:\3rxxffl.exe45⤵
- Executes dropped EXE
PID:2308 -
\??\c:\bbhbhh.exec:\bbhbhh.exe46⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pdjjj.exec:\pdjjj.exe47⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9vppd.exec:\9vppd.exe48⤵
- Executes dropped EXE
PID:1240 -
\??\c:\rrflrrx.exec:\rrflrrx.exe49⤵
- Executes dropped EXE
PID:2640 -
\??\c:\llxfrlr.exec:\llxfrlr.exe50⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1htbbb.exec:\1htbbb.exe51⤵
- Executes dropped EXE
PID:1760 -
\??\c:\nbnhhh.exec:\nbnhhh.exe52⤵
- Executes dropped EXE
PID:1112 -
\??\c:\1pvvv.exec:\1pvvv.exe53⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jdvpd.exec:\jdvpd.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rfrxxfl.exec:\rfrxxfl.exe55⤵
- Executes dropped EXE
PID:2068 -
\??\c:\fxffxrx.exec:\fxffxrx.exe56⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1htttt.exec:\1htttt.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3bbttn.exec:\3bbttn.exe58⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dpjpv.exec:\dpjpv.exe59⤵
- Executes dropped EXE
PID:1920 -
\??\c:\jdpvv.exec:\jdpvv.exe60⤵
- Executes dropped EXE
PID:840 -
\??\c:\5lxxffl.exec:\5lxxffl.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ffxrrlf.exec:\ffxrrlf.exe62⤵
- Executes dropped EXE
PID:1092 -
\??\c:\hhhhnn.exec:\hhhhnn.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:712 -
\??\c:\vdjjp.exec:\vdjjp.exe64⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1lllrrr.exec:\1lllrrr.exe65⤵
- Executes dropped EXE
PID:2408 -
\??\c:\llflxrx.exec:\llflxrx.exe66⤵PID:2236
-
\??\c:\bbnbhn.exec:\bbnbhn.exe67⤵PID:1736
-
\??\c:\tnnhnt.exec:\tnnhnt.exe68⤵PID:1948
-
\??\c:\3hnnnt.exec:\3hnnnt.exe69⤵PID:1752
-
\??\c:\vvppj.exec:\vvppj.exe70⤵PID:3032
-
\??\c:\5jvpp.exec:\5jvpp.exe71⤵PID:2800
-
\??\c:\3rflxxx.exec:\3rflxxx.exe72⤵PID:2804
-
\??\c:\xlrxxxf.exec:\xlrxxxf.exe73⤵PID:2704
-
\??\c:\xrflrrf.exec:\xrflrrf.exe74⤵PID:2740
-
\??\c:\thbbbt.exec:\thbbbt.exe75⤵PID:2916
-
\??\c:\thtnnt.exec:\thtnnt.exe76⤵PID:2872
-
\??\c:\ddpvp.exec:\ddpvp.exe77⤵PID:2584
-
\??\c:\ddpvd.exec:\ddpvd.exe78⤵PID:2808
-
\??\c:\5lxfflf.exec:\5lxfflf.exe79⤵PID:2564
-
\??\c:\5xlrlrr.exec:\5xlrlrr.exe80⤵PID:1204
-
\??\c:\1rllffl.exec:\1rllffl.exe81⤵PID:2568
-
\??\c:\bbnnhn.exec:\bbnnhn.exe82⤵
- System Location Discovery: System Language Discovery
PID:2976 -
\??\c:\3jvdj.exec:\3jvdj.exe83⤵PID:2420
-
\??\c:\5vddj.exec:\5vddj.exe84⤵PID:2204
-
\??\c:\xlfxxxf.exec:\xlfxxxf.exe85⤵PID:1664
-
\??\c:\xlxlrrr.exec:\xlxlrrr.exe86⤵PID:2060
-
\??\c:\tthhnn.exec:\tthhnn.exe87⤵PID:2440
-
\??\c:\nnbhtt.exec:\nnbhtt.exe88⤵PID:1704
-
\??\c:\hhhntb.exec:\hhhntb.exe89⤵PID:1304
-
\??\c:\ppvvj.exec:\ppvvj.exe90⤵PID:2888
-
\??\c:\xlrxfll.exec:\xlrxfll.exe91⤵PID:896
-
\??\c:\1xfxrff.exec:\1xfxrff.exe92⤵PID:1148
-
\??\c:\rrxflll.exec:\rrxflll.exe93⤵PID:264
-
\??\c:\htbttn.exec:\htbttn.exe94⤵PID:1112
-
\??\c:\hbbbbb.exec:\hbbbbb.exe95⤵PID:2352
-
\??\c:\vpjpv.exec:\vpjpv.exe96⤵PID:2028
-
\??\c:\5jppj.exec:\5jppj.exe97⤵PID:2180
-
\??\c:\pjppv.exec:\pjppv.exe98⤵PID:2100
-
\??\c:\llllffl.exec:\llllffl.exe99⤵PID:1984
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe100⤵PID:2152
-
\??\c:\bbhnnh.exec:\bbhnnh.exe101⤵PID:952
-
\??\c:\hbhhhb.exec:\hbhhhb.exe102⤵PID:2448
-
\??\c:\jdpvj.exec:\jdpvj.exe103⤵PID:2436
-
\??\c:\ppvjp.exec:\ppvjp.exe104⤵PID:908
-
\??\c:\lfxxxff.exec:\lfxxxff.exe105⤵PID:2528
-
\??\c:\lfflxrx.exec:\lfflxrx.exe106⤵PID:1644
-
\??\c:\thhnth.exec:\thhnth.exe107⤵PID:2972
-
\??\c:\nnhbbh.exec:\nnhbbh.exe108⤵PID:1964
-
\??\c:\ddddj.exec:\ddddj.exe109⤵PID:2288
-
\??\c:\jjddp.exec:\jjddp.exe110⤵PID:1008
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe111⤵PID:1000
-
\??\c:\ffxrrxf.exec:\ffxrrxf.exe112⤵PID:2784
-
\??\c:\bttttt.exec:\bttttt.exe113⤵PID:2644
-
\??\c:\nhbhnh.exec:\nhbhnh.exe114⤵PID:2816
-
\??\c:\ppvvj.exec:\ppvvj.exe115⤵PID:1584
-
\??\c:\jdjjd.exec:\jdjjd.exe116⤵PID:2136
-
\??\c:\7xfxxrx.exec:\7xfxxrx.exe117⤵PID:1596
-
\??\c:\rffxxrr.exec:\rffxxrr.exe118⤵PID:2744
-
\??\c:\nhnntt.exec:\nhnntt.exe119⤵PID:2884
-
\??\c:\tntttn.exec:\tntttn.exe120⤵PID:2596
-
\??\c:\ddpdj.exec:\ddpdj.exe121⤵PID:2612
-
\??\c:\pjppv.exec:\pjppv.exe122⤵PID:576
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-