Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18-12-2024 21:24
Static task
static1
Behavioral task
behavioral1
Sample
4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe
Resource
win7-20240903-en
General
-
Target
4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe
-
Size
82KB
-
MD5
a67205c38d1e1643d6857a8ded9c3d0f
-
SHA1
c19a68e2cbea3217f0b6c44a9e5ba085ab3bb44b
-
SHA256
4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d
-
SHA512
8c5eaaad694f32815a430b6d3e58a823d12e48d019beda495e1a2417f797751f492577d900db334d821ddc33c7c4339cd2121897f2f05b8eb7e1d802220625a9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqa:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rS
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral1/memory/800-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2696-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1440-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1052-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/876-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2840-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/840-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1264-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1848-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2476-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2120-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1824-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-284-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/612-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2900 vpppp.exe 3068 lxxxfff.exe 2788 3tbbhh.exe 2696 lfrlrlr.exe 2860 7nhnbt.exe 2548 bntttn.exe 2992 pjdpv.exe 1440 fxxfllr.exe 1052 nhtbhn.exe 876 jvpvv.exe 2840 3jvvd.exe 2892 1xflxxl.exe 840 nnnbbb.exe 2340 tnhhtt.exe 1984 7vppv.exe 1264 lxlrfll.exe 2580 ffrxllr.exe 1848 7tntbh.exe 1032 bnbbhh.exe 2108 pddvd.exe 2928 flxxxfl.exe 2476 5xxrfxx.exe 2120 9thbhn.exe 1748 jpjpp.exe 2372 pdvdj.exe 1028 xxrflxf.exe 1824 llfrlfl.exe 2100 3tbtnh.exe 2332 jdpvd.exe 612 pdppv.exe 1600 lfxrxlr.exe 2620 bnbhnt.exe 2400 nnntnb.exe 2768 pdppp.exe 2784 dvvpv.exe 2388 1llllff.exe 2716 3xfxxrr.exe 2628 ntbbhb.exe 2496 nbhntt.exe 2540 jdjpv.exe 2996 vpdpd.exe 2128 xfxfrlx.exe 2152 lffxffx.exe 592 htbbhh.exe 1052 ntbbbh.exe 2700 dppvd.exe 2888 jdppp.exe 352 rfxflfx.exe 1248 xrffrlx.exe 1152 nhtttt.exe 2344 1tthnh.exe 1952 vpvvp.exe 1304 dpvpd.exe 1264 9rxxxxx.exe 2360 xrxlxfl.exe 1920 thhhtn.exe 2588 7hbtbh.exe 2924 5vpdv.exe 2156 dvpvp.exe 2132 frrrxll.exe 2476 tntbnn.exe 2120 jpdjv.exe 912 vpdjv.exe 1020 9fxxxrr.exe -
resource yara_rule behavioral1/memory/800-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/800-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2788-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2860-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1440-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/876-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2840-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2892-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/840-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2340-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1264-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1848-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-222-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2476-231-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2120-239-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1824-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-284-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/612-302-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 800 wrote to memory of 2900 800 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 28 PID 800 wrote to memory of 2900 800 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 28 PID 800 wrote to memory of 2900 800 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 28 PID 800 wrote to memory of 2900 800 4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe 28 PID 2900 wrote to memory of 3068 2900 vpppp.exe 29 PID 2900 wrote to memory of 3068 2900 vpppp.exe 29 PID 2900 wrote to memory of 3068 2900 vpppp.exe 29 PID 2900 wrote to memory of 3068 2900 vpppp.exe 29 PID 3068 wrote to memory of 2788 3068 lxxxfff.exe 30 PID 3068 wrote to memory of 2788 3068 lxxxfff.exe 30 PID 3068 wrote to memory of 2788 3068 lxxxfff.exe 30 PID 3068 wrote to memory of 2788 3068 lxxxfff.exe 30 PID 2788 wrote to memory of 2696 2788 3tbbhh.exe 31 PID 2788 wrote to memory of 2696 2788 3tbbhh.exe 31 PID 2788 wrote to memory of 2696 2788 3tbbhh.exe 31 PID 2788 wrote to memory of 2696 2788 3tbbhh.exe 31 PID 2696 wrote to memory of 2860 2696 lfrlrlr.exe 32 PID 2696 wrote to memory of 2860 2696 lfrlrlr.exe 32 PID 2696 wrote to memory of 2860 2696 lfrlrlr.exe 32 PID 2696 wrote to memory of 2860 2696 lfrlrlr.exe 32 PID 2860 wrote to memory of 2548 2860 7nhnbt.exe 33 PID 2860 wrote to memory of 2548 2860 7nhnbt.exe 33 PID 2860 wrote to memory of 2548 2860 7nhnbt.exe 33 PID 2860 wrote to memory of 2548 2860 7nhnbt.exe 33 PID 2548 wrote to memory of 2992 2548 bntttn.exe 34 PID 2548 wrote to memory of 2992 2548 bntttn.exe 34 PID 2548 wrote to memory of 2992 2548 bntttn.exe 34 PID 2548 wrote to memory of 2992 2548 bntttn.exe 34 PID 2992 wrote to memory of 1440 2992 pjdpv.exe 35 PID 2992 wrote to memory of 1440 2992 pjdpv.exe 35 PID 2992 wrote to memory of 1440 2992 pjdpv.exe 35 PID 2992 wrote to memory of 1440 2992 pjdpv.exe 35 PID 1440 wrote to memory of 1052 1440 fxxfllr.exe 36 PID 1440 wrote to memory of 1052 1440 fxxfllr.exe 36 PID 1440 wrote to memory of 1052 1440 fxxfllr.exe 36 PID 1440 wrote to memory of 1052 1440 fxxfllr.exe 36 PID 1052 wrote to memory of 876 1052 nhtbhn.exe 37 PID 1052 wrote to memory of 876 1052 nhtbhn.exe 37 PID 1052 wrote to memory of 876 1052 nhtbhn.exe 37 PID 1052 wrote to memory of 876 1052 nhtbhn.exe 37 PID 876 wrote to memory of 2840 876 jvpvv.exe 38 PID 876 wrote to memory of 2840 876 jvpvv.exe 38 PID 876 wrote to memory of 2840 876 jvpvv.exe 38 PID 876 wrote to memory of 2840 876 jvpvv.exe 38 PID 2840 wrote to memory of 2892 2840 3jvvd.exe 39 PID 2840 wrote to memory of 2892 2840 3jvvd.exe 39 PID 2840 wrote to memory of 2892 2840 3jvvd.exe 39 PID 2840 wrote to memory of 2892 2840 3jvvd.exe 39 PID 2892 wrote to memory of 840 2892 1xflxxl.exe 40 PID 2892 wrote to memory of 840 2892 1xflxxl.exe 40 PID 2892 wrote to memory of 840 2892 1xflxxl.exe 40 PID 2892 wrote to memory of 840 2892 1xflxxl.exe 40 PID 840 wrote to memory of 2340 840 nnnbbb.exe 41 PID 840 wrote to memory of 2340 840 nnnbbb.exe 41 PID 840 wrote to memory of 2340 840 nnnbbb.exe 41 PID 840 wrote to memory of 2340 840 nnnbbb.exe 41 PID 2340 wrote to memory of 1984 2340 tnhhtt.exe 42 PID 2340 wrote to memory of 1984 2340 tnhhtt.exe 42 PID 2340 wrote to memory of 1984 2340 tnhhtt.exe 42 PID 2340 wrote to memory of 1984 2340 tnhhtt.exe 42 PID 1984 wrote to memory of 1264 1984 7vppv.exe 43 PID 1984 wrote to memory of 1264 1984 7vppv.exe 43 PID 1984 wrote to memory of 1264 1984 7vppv.exe 43 PID 1984 wrote to memory of 1264 1984 7vppv.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe"C:\Users\Admin\AppData\Local\Temp\4efbe558859c51d8abbe470c1aad9054f7dc0a2493c8f823b990894b4f74ab3d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\vpppp.exec:\vpppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\lxxxfff.exec:\lxxxfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\3tbbhh.exec:\3tbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7nhnbt.exec:\7nhnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\bntttn.exec:\bntttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\pjdpv.exec:\pjdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\fxxfllr.exec:\fxxfllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\nhtbhn.exec:\nhtbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\jvpvv.exec:\jvpvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\3jvvd.exec:\3jvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\1xflxxl.exec:\1xflxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\nnnbbb.exec:\nnnbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\tnhhtt.exec:\tnhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\7vppv.exec:\7vppv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\lxlrfll.exec:\lxlrfll.exe17⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ffrxllr.exec:\ffrxllr.exe18⤵
- Executes dropped EXE
PID:2580 -
\??\c:\7tntbh.exec:\7tntbh.exe19⤵
- Executes dropped EXE
PID:1848 -
\??\c:\bnbbhh.exec:\bnbbhh.exe20⤵
- Executes dropped EXE
PID:1032 -
\??\c:\pddvd.exec:\pddvd.exe21⤵
- Executes dropped EXE
PID:2108 -
\??\c:\flxxxfl.exec:\flxxxfl.exe22⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5xxrfxx.exec:\5xxrfxx.exe23⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9thbhn.exec:\9thbhn.exe24⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jpjpp.exec:\jpjpp.exe25⤵
- Executes dropped EXE
PID:1748 -
\??\c:\pdvdj.exec:\pdvdj.exe26⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xxrflxf.exec:\xxrflxf.exe27⤵
- Executes dropped EXE
PID:1028 -
\??\c:\llfrlfl.exec:\llfrlfl.exe28⤵
- Executes dropped EXE
PID:1824 -
\??\c:\3tbtnh.exec:\3tbtnh.exe29⤵
- Executes dropped EXE
PID:2100 -
\??\c:\jdpvd.exec:\jdpvd.exe30⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pdppv.exec:\pdppv.exe31⤵
- Executes dropped EXE
PID:612 -
\??\c:\lfxrxlr.exec:\lfxrxlr.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\bnbhnt.exec:\bnbhnt.exe33⤵
- Executes dropped EXE
PID:2620 -
\??\c:\nnntnb.exec:\nnntnb.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2400 -
\??\c:\pdppp.exec:\pdppp.exe35⤵
- Executes dropped EXE
PID:2768 -
\??\c:\dvvpv.exec:\dvvpv.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1llllff.exec:\1llllff.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\3xfxxrr.exec:\3xfxxrr.exe38⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ntbbhb.exec:\ntbbhb.exe39⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nbhntt.exec:\nbhntt.exe40⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jdjpv.exec:\jdjpv.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vpdpd.exec:\vpdpd.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xfxfrlx.exec:\xfxfrlx.exe43⤵
- Executes dropped EXE
PID:2128 -
\??\c:\lffxffx.exec:\lffxffx.exe44⤵
- Executes dropped EXE
PID:2152 -
\??\c:\htbbhh.exec:\htbbhh.exe45⤵
- Executes dropped EXE
PID:592 -
\??\c:\ntbbbh.exec:\ntbbbh.exe46⤵
- Executes dropped EXE
PID:1052 -
\??\c:\dppvd.exec:\dppvd.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jdppp.exec:\jdppp.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\rfxflfx.exec:\rfxflfx.exe49⤵
- Executes dropped EXE
PID:352 -
\??\c:\xrffrlx.exec:\xrffrlx.exe50⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nhtttt.exec:\nhtttt.exe51⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1tthnh.exec:\1tthnh.exe52⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vpvvp.exec:\vpvvp.exe53⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpvpd.exec:\dpvpd.exe54⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9rxxxxx.exec:\9rxxxxx.exe55⤵
- Executes dropped EXE
PID:1264 -
\??\c:\xrxlxfl.exec:\xrxlxfl.exe56⤵
- Executes dropped EXE
PID:2360 -
\??\c:\thhhtn.exec:\thhhtn.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\7hbtbh.exec:\7hbtbh.exe58⤵
- Executes dropped EXE
PID:2588 -
\??\c:\5vpdv.exec:\5vpdv.exe59⤵
- Executes dropped EXE
PID:2924 -
\??\c:\dvpvp.exec:\dvpvp.exe60⤵
- Executes dropped EXE
PID:2156 -
\??\c:\frrrxll.exec:\frrrxll.exe61⤵
- Executes dropped EXE
PID:2132 -
\??\c:\tntbnn.exec:\tntbnn.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jpdjv.exec:\jpdjv.exe63⤵
- Executes dropped EXE
PID:2120 -
\??\c:\vpdjv.exec:\vpdjv.exe64⤵
- Executes dropped EXE
PID:912 -
\??\c:\9fxxxrr.exec:\9fxxxrr.exe65⤵
- Executes dropped EXE
PID:1020 -
\??\c:\fxfxffl.exec:\fxfxffl.exe66⤵PID:2904
-
\??\c:\nbhntt.exec:\nbhntt.exe67⤵PID:1516
-
\??\c:\ttbbbt.exec:\ttbbbt.exe68⤵PID:944
-
\??\c:\jvjjd.exec:\jvjjd.exe69⤵PID:1416
-
\??\c:\dpvpd.exec:\dpvpd.exe70⤵PID:2276
-
\??\c:\lfffrrr.exec:\lfffrrr.exe71⤵PID:1120
-
\??\c:\lxllxrx.exec:\lxllxrx.exe72⤵PID:612
-
\??\c:\7tnntt.exec:\7tnntt.exe73⤵PID:1600
-
\??\c:\7tbntn.exec:\7tbntn.exe74⤵PID:2216
-
\??\c:\dvpjv.exec:\dvpjv.exe75⤵PID:1732
-
\??\c:\pjvpv.exec:\pjvpv.exe76⤵PID:2632
-
\??\c:\xlfxfxl.exec:\xlfxfxl.exe77⤵PID:2796
-
\??\c:\fxflrrx.exec:\fxflrrx.exe78⤵PID:2600
-
\??\c:\5hbhhh.exec:\5hbhhh.exe79⤵PID:2244
-
\??\c:\tbnhbb.exec:\tbnhbb.exe80⤵PID:2528
-
\??\c:\vpdpv.exec:\vpdpv.exe81⤵PID:2664
-
\??\c:\pdvpv.exec:\pdvpv.exe82⤵PID:2548
-
\??\c:\xlrxfrx.exec:\xlrxfrx.exe83⤵PID:2564
-
\??\c:\bnnnhb.exec:\bnnnhb.exe84⤵PID:2404
-
\??\c:\bttnbh.exec:\bttnbh.exe85⤵PID:988
-
\??\c:\ppvpd.exec:\ppvpd.exe86⤵PID:1656
-
\??\c:\jdvpp.exec:\jdvpp.exe87⤵PID:1496
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe88⤵PID:2872
-
\??\c:\lfffxrl.exec:\lfffxrl.exe89⤵PID:2592
-
\??\c:\7hhbhh.exec:\7hhbhh.exe90⤵PID:3008
-
\??\c:\1thhhn.exec:\1thhhn.exe91⤵PID:860
-
\??\c:\jdppd.exec:\jdppd.exe92⤵PID:804
-
\??\c:\7jddp.exec:\7jddp.exe93⤵PID:2552
-
\??\c:\3xllrfl.exec:\3xllrfl.exe94⤵PID:2344
-
\??\c:\fxxfxxx.exec:\fxxfxxx.exe95⤵PID:2708
-
\??\c:\hthhtn.exec:\hthhtn.exe96⤵PID:1872
-
\??\c:\nhbbhb.exec:\nhbbhb.exe97⤵
- System Location Discovery: System Language Discovery
PID:1652 -
\??\c:\jvjdj.exec:\jvjdj.exe98⤵PID:2116
-
\??\c:\1vvvd.exec:\1vvvd.exe99⤵PID:1800
-
\??\c:\lxxrxrr.exec:\lxxrxrr.exe100⤵PID:2348
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe101⤵PID:2924
-
\??\c:\tnthnt.exec:\tnthnt.exe102⤵PID:1512
-
\??\c:\bhbbbt.exec:\bhbbbt.exe103⤵PID:2204
-
\??\c:\1bhbhh.exec:\1bhbhh.exe104⤵PID:2384
-
\??\c:\pjpdv.exec:\pjpdv.exe105⤵PID:1724
-
\??\c:\pddjd.exec:\pddjd.exe106⤵PID:3052
-
\??\c:\rxxxxll.exec:\rxxxxll.exe107⤵PID:864
-
\??\c:\lxfflrr.exec:\lxfflrr.exe108⤵PID:1276
-
\??\c:\hhtbhn.exec:\hhtbhn.exe109⤵PID:2196
-
\??\c:\9nnhhn.exec:\9nnhhn.exe110⤵PID:2100
-
\??\c:\htnnhh.exec:\htnnhh.exe111⤵PID:2332
-
\??\c:\jjvpv.exec:\jjvpv.exe112⤵PID:1612
-
\??\c:\ddvvd.exec:\ddvvd.exe113⤵PID:2188
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe114⤵PID:3056
-
\??\c:\rxffrlx.exec:\rxffrlx.exe115⤵PID:2640
-
\??\c:\htnntt.exec:\htnntt.exe116⤵PID:1628
-
\??\c:\3tnthb.exec:\3tnthb.exe117⤵PID:2688
-
\??\c:\pjvdp.exec:\pjvdp.exe118⤵PID:2780
-
\??\c:\lxllrlf.exec:\lxllrlf.exe119⤵PID:2804
-
\??\c:\5rlxffx.exec:\5rlxffx.exe120⤵PID:2820
-
\??\c:\thbbbb.exec:\thbbbb.exe121⤵PID:2984
-
\??\c:\ntnhhb.exec:\ntnhhb.exe122⤵PID:2656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-