Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe
-
Size
453KB
-
MD5
13ed63c418584307b03ac91b1e029c28
-
SHA1
735ed9ef0d0238afc43829710724fb8d019c4e3e
-
SHA256
9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4
-
SHA512
ea24617d2ff7acb2144439b164580caecfa77e1a3dfd31ac7c6fb8e94bcf6dfc22cae3956d915e63f1347a1fca742d5542a961d2e7b85c39be44cbbaeb701a00
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe7:q7Tc2NYHUrAwfMp3CD7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2412-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-21-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/2852-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-37-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1440-42-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-41-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-62-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-60-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-79-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/576-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/536-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-210-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1392-208-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1952-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/720-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-380-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-588-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1728-595-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/692-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/316-737-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-764-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2412 llfrffr.exe 2852 tbbtnb.exe 3004 flfxrxr.exe 1440 xrlxrlf.exe 2740 9bhntb.exe 2600 dddpp.exe 2108 vjvdd.exe 2024 vvpdv.exe 2980 xxxlfrf.exe 1048 xlxxlxx.exe 576 hnnbbh.exe 1968 3btbnt.exe 2020 jjpjj.exe 1496 nhbhtb.exe 536 djdvj.exe 1504 ttthbt.exe 2200 dvvjv.exe 2220 3httbb.exe 2184 ppjpj.exe 1792 jjvdv.exe 1392 djjdv.exe 1288 pdjpd.exe 1952 ppjpj.exe 2424 1lflrxf.exe 2308 xxrfrff.exe 2084 7xrfrfr.exe 3040 1tbthn.exe 2428 ffxlrfx.exe 664 rxxlflx.exe 720 ppjdp.exe 1744 fffxrxf.exe 2096 bbbnbh.exe 2712 jjjjj.exe 1580 tbthht.exe 2864 hhhthn.exe 2724 xxxllrl.exe 2576 ffrrrxl.exe 2596 hbbnbt.exe 2764 vdpjp.exe 2684 frfflxf.exe 2632 thttnn.exe 2228 vvpdv.exe 2384 ffrlllf.exe 864 tthhhh.exe 1628 jdjdp.exe 2936 lffxlrl.exe 580 tnnbhn.exe 2928 dpppd.exe 576 7ffrflf.exe 1780 9nntht.exe 2204 3jjjd.exe 1080 ffxfrfx.exe 776 frrlxxf.exe 2776 1nhtth.exe 2392 pvpdv.exe 1312 llrxlrl.exe 2200 rlxlrrf.exe 2120 bbbnbh.exe 2112 5pvjd.exe 2792 rrlrlrf.exe 2236 9hbhnb.exe 1596 hbbhnt.exe 1752 pppdp.exe 872 lffrfrf.exe -
resource yara_rule behavioral1/memory/2412-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-42-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-62-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-60-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/576-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1288-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1392-210-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/720-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-380-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1728-567-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1568-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-650-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/692-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/316-737-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-764-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3htthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrflx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2412 2664 9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe 30 PID 2664 wrote to memory of 2412 2664 9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe 30 PID 2664 wrote to memory of 2412 2664 9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe 30 PID 2664 wrote to memory of 2412 2664 9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe 30 PID 2412 wrote to memory of 2852 2412 llfrffr.exe 31 PID 2412 wrote to memory of 2852 2412 llfrffr.exe 31 PID 2412 wrote to memory of 2852 2412 llfrffr.exe 31 PID 2412 wrote to memory of 2852 2412 llfrffr.exe 31 PID 2852 wrote to memory of 3004 2852 tbbtnb.exe 32 PID 2852 wrote to memory of 3004 2852 tbbtnb.exe 32 PID 2852 wrote to memory of 3004 2852 tbbtnb.exe 32 PID 2852 wrote to memory of 3004 2852 tbbtnb.exe 32 PID 3004 wrote to memory of 1440 3004 flfxrxr.exe 33 PID 3004 wrote to memory of 1440 3004 flfxrxr.exe 33 PID 3004 wrote to memory of 1440 3004 flfxrxr.exe 33 PID 3004 wrote to memory of 1440 3004 flfxrxr.exe 33 PID 1440 wrote to memory of 2740 1440 xrlxrlf.exe 34 PID 1440 wrote to memory of 2740 1440 xrlxrlf.exe 34 PID 1440 wrote to memory of 2740 1440 xrlxrlf.exe 34 PID 1440 wrote to memory of 2740 1440 xrlxrlf.exe 34 PID 2740 wrote to memory of 2600 2740 9bhntb.exe 35 PID 2740 wrote to memory of 2600 2740 9bhntb.exe 35 PID 2740 wrote to memory of 2600 2740 9bhntb.exe 35 PID 2740 wrote to memory of 2600 2740 9bhntb.exe 35 PID 2600 wrote to memory of 2108 2600 dddpp.exe 36 PID 2600 wrote to memory of 2108 2600 dddpp.exe 36 PID 2600 wrote to memory of 2108 2600 dddpp.exe 36 PID 2600 wrote to memory of 2108 2600 dddpp.exe 36 PID 2108 wrote to memory of 2024 2108 vjvdd.exe 37 PID 2108 wrote to memory of 2024 2108 vjvdd.exe 37 PID 2108 wrote to memory of 2024 2108 vjvdd.exe 37 PID 2108 wrote to memory of 2024 2108 vjvdd.exe 37 PID 2024 wrote to memory of 2980 2024 vvpdv.exe 38 PID 2024 wrote to memory of 2980 2024 vvpdv.exe 38 PID 2024 wrote to memory of 2980 2024 vvpdv.exe 38 PID 2024 wrote to memory of 2980 2024 vvpdv.exe 38 PID 2980 wrote to memory of 1048 2980 xxxlfrf.exe 39 PID 2980 wrote to memory of 1048 2980 xxxlfrf.exe 39 PID 2980 wrote to memory of 1048 2980 xxxlfrf.exe 39 PID 2980 wrote to memory of 1048 2980 xxxlfrf.exe 39 PID 1048 wrote to memory of 576 1048 xlxxlxx.exe 40 PID 1048 wrote to memory of 576 1048 xlxxlxx.exe 40 PID 1048 wrote to memory of 576 1048 xlxxlxx.exe 40 PID 1048 wrote to memory of 576 1048 xlxxlxx.exe 40 PID 576 wrote to memory of 1968 576 hnnbbh.exe 41 PID 576 wrote to memory of 1968 576 hnnbbh.exe 41 PID 576 wrote to memory of 1968 576 hnnbbh.exe 41 PID 576 wrote to memory of 1968 576 hnnbbh.exe 41 PID 1968 wrote to memory of 2020 1968 3btbnt.exe 42 PID 1968 wrote to memory of 2020 1968 3btbnt.exe 42 PID 1968 wrote to memory of 2020 1968 3btbnt.exe 42 PID 1968 wrote to memory of 2020 1968 3btbnt.exe 42 PID 2020 wrote to memory of 1496 2020 jjpjj.exe 43 PID 2020 wrote to memory of 1496 2020 jjpjj.exe 43 PID 2020 wrote to memory of 1496 2020 jjpjj.exe 43 PID 2020 wrote to memory of 1496 2020 jjpjj.exe 43 PID 1496 wrote to memory of 536 1496 nhbhtb.exe 44 PID 1496 wrote to memory of 536 1496 nhbhtb.exe 44 PID 1496 wrote to memory of 536 1496 nhbhtb.exe 44 PID 1496 wrote to memory of 536 1496 nhbhtb.exe 44 PID 536 wrote to memory of 1504 536 djdvj.exe 45 PID 536 wrote to memory of 1504 536 djdvj.exe 45 PID 536 wrote to memory of 1504 536 djdvj.exe 45 PID 536 wrote to memory of 1504 536 djdvj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe"C:\Users\Admin\AppData\Local\Temp\9d9929eebfd300ef9d13550e4fe2c2fe2b4d622b354fa41b8e9da6b5dff3bca4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\llfrffr.exec:\llfrffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\tbbtnb.exec:\tbbtnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\flfxrxr.exec:\flfxrxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xrlxrlf.exec:\xrlxrlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\9bhntb.exec:\9bhntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dddpp.exec:\dddpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vjvdd.exec:\vjvdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\vvpdv.exec:\vvpdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\xlxxlxx.exec:\xlxxlxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\hnnbbh.exec:\hnnbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576 -
\??\c:\3btbnt.exec:\3btbnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\jjpjj.exec:\jjpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nhbhtb.exec:\nhbhtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\djdvj.exec:\djdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\ttthbt.exec:\ttthbt.exe17⤵
- Executes dropped EXE
PID:1504 -
\??\c:\dvvjv.exec:\dvvjv.exe18⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3httbb.exec:\3httbb.exe19⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ppjpj.exec:\ppjpj.exe20⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jjvdv.exec:\jjvdv.exe21⤵
- Executes dropped EXE
PID:1792 -
\??\c:\djjdv.exec:\djjdv.exe22⤵
- Executes dropped EXE
PID:1392 -
\??\c:\pdjpd.exec:\pdjpd.exe23⤵
- Executes dropped EXE
PID:1288 -
\??\c:\ppjpj.exec:\ppjpj.exe24⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1lflrxf.exec:\1lflrxf.exe25⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xxrfrff.exec:\xxrfrff.exe26⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7xrfrfr.exec:\7xrfrfr.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1tbthn.exec:\1tbthn.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\ffxlrfx.exec:\ffxlrfx.exe29⤵
- Executes dropped EXE
PID:2428 -
\??\c:\rxxlflx.exec:\rxxlflx.exe30⤵
- Executes dropped EXE
PID:664 -
\??\c:\ppjdp.exec:\ppjdp.exe31⤵
- Executes dropped EXE
PID:720 -
\??\c:\fffxrxf.exec:\fffxrxf.exe32⤵
- Executes dropped EXE
PID:1744 -
\??\c:\bbbnbh.exec:\bbbnbh.exe33⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jjjjj.exec:\jjjjj.exe34⤵
- Executes dropped EXE
PID:2712 -
\??\c:\tbthht.exec:\tbthht.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\hhhthn.exec:\hhhthn.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\xxxllrl.exec:\xxxllrl.exe37⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ffrrrxl.exec:\ffrrrxl.exe38⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbbnbt.exec:\hbbnbt.exe39⤵
- Executes dropped EXE
PID:2596 -
\??\c:\vdpjp.exec:\vdpjp.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\frfflxf.exec:\frfflxf.exe41⤵
- Executes dropped EXE
PID:2684 -
\??\c:\thttnn.exec:\thttnn.exe42⤵
- Executes dropped EXE
PID:2632 -
\??\c:\vvpdv.exec:\vvpdv.exe43⤵
- Executes dropped EXE
PID:2228 -
\??\c:\ffrlllf.exec:\ffrlllf.exe44⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tthhhh.exec:\tthhhh.exe45⤵
- Executes dropped EXE
PID:864 -
\??\c:\jdjdp.exec:\jdjdp.exe46⤵
- Executes dropped EXE
PID:1628 -
\??\c:\lffxlrl.exec:\lffxlrl.exe47⤵
- Executes dropped EXE
PID:2936 -
\??\c:\tnnbhn.exec:\tnnbhn.exe48⤵
- Executes dropped EXE
PID:580 -
\??\c:\dpppd.exec:\dpppd.exe49⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7ffrflf.exec:\7ffrflf.exe50⤵
- Executes dropped EXE
PID:576 -
\??\c:\9nntht.exec:\9nntht.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\3jjjd.exec:\3jjjd.exe52⤵
- Executes dropped EXE
PID:2204 -
\??\c:\ffxfrfx.exec:\ffxfrfx.exe53⤵
- Executes dropped EXE
PID:1080 -
\??\c:\frrlxxf.exec:\frrlxxf.exe54⤵
- Executes dropped EXE
PID:776 -
\??\c:\1nhtth.exec:\1nhtth.exe55⤵
- Executes dropped EXE
PID:2776 -
\??\c:\pvpdv.exec:\pvpdv.exe56⤵
- Executes dropped EXE
PID:2392 -
\??\c:\llrxlrl.exec:\llrxlrl.exe57⤵
- Executes dropped EXE
PID:1312 -
\??\c:\rlxlrrf.exec:\rlxlrrf.exe58⤵
- Executes dropped EXE
PID:2200 -
\??\c:\bbbnbh.exec:\bbbnbh.exe59⤵
- Executes dropped EXE
PID:2120 -
\??\c:\5pvjd.exec:\5pvjd.exe60⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rrlrlrf.exec:\rrlrlrf.exe61⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9hbhnb.exec:\9hbhnb.exe62⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbbhnt.exec:\hbbhnt.exe63⤵
- Executes dropped EXE
PID:1596 -
\??\c:\pppdp.exec:\pppdp.exe64⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lffrfrf.exec:\lffrfrf.exe65⤵
- Executes dropped EXE
PID:872 -
\??\c:\tnntnb.exec:\tnntnb.exe66⤵PID:1952
-
\??\c:\ddvdv.exec:\ddvdv.exe67⤵PID:1772
-
\??\c:\frlxrxf.exec:\frlxrxf.exe68⤵PID:2752
-
\??\c:\1hbbtb.exec:\1hbbtb.exe69⤵PID:608
-
\??\c:\dvppj.exec:\dvppj.exe70⤵PID:2436
-
\??\c:\9rxfrrl.exec:\9rxfrrl.exe71⤵PID:1268
-
\??\c:\7hbbhn.exec:\7hbbhn.exe72⤵PID:2104
-
\??\c:\jvdjp.exec:\jvdjp.exe73⤵PID:1728
-
\??\c:\7rllxfr.exec:\7rllxfr.exe74⤵PID:2748
-
\??\c:\lllllrl.exec:\lllllrl.exe75⤵PID:268
-
\??\c:\bthhnn.exec:\bthhnn.exe76⤵PID:2252
-
\??\c:\5ppjd.exec:\5ppjd.exe77⤵PID:1568
-
\??\c:\9xrfxff.exec:\9xrfxff.exe78⤵PID:2412
-
\??\c:\tnthhb.exec:\tnthhb.exe79⤵PID:2832
-
\??\c:\vvvjv.exec:\vvvjv.exe80⤵PID:2824
-
\??\c:\ffxxrll.exec:\ffxxrll.exe81⤵PID:2876
-
\??\c:\xrrxfrr.exec:\xrrxfrr.exe82⤵PID:2744
-
\??\c:\ttnhht.exec:\ttnhht.exe83⤵PID:2604
-
\??\c:\jpjdv.exec:\jpjdv.exe84⤵PID:2580
-
\??\c:\rrlrflx.exec:\rrlrflx.exe85⤵PID:692
-
\??\c:\hnhthn.exec:\hnhthn.exe86⤵PID:2088
-
\??\c:\pvdjj.exec:\pvdjj.exe87⤵PID:1052
-
\??\c:\5lrffrr.exec:\5lrffrr.exe88⤵PID:3020
-
\??\c:\tnnhht.exec:\tnnhht.exe89⤵PID:2400
-
\??\c:\jdvpj.exec:\jdvpj.exe90⤵
- System Location Discovery: System Language Discovery
PID:1308 -
\??\c:\ffflrxl.exec:\ffflrxl.exe91⤵PID:908
-
\??\c:\7rflrfx.exec:\7rflrfx.exe92⤵PID:1732
-
\??\c:\7bnthn.exec:\7bnthn.exe93⤵PID:2452
-
\??\c:\jjvvv.exec:\jjvvv.exe94⤵PID:2668
-
\??\c:\3lfxxlf.exec:\3lfxxlf.exe95⤵PID:2020
-
\??\c:\3htthn.exec:\3htthn.exe96⤵
- System Location Discovery: System Language Discovery
PID:684 -
\??\c:\7pjjp.exec:\7pjjp.exe97⤵PID:316
-
\??\c:\xrlrflr.exec:\xrlrflr.exe98⤵PID:2808
-
\??\c:\tbhbnh.exec:\tbhbnh.exe99⤵PID:2128
-
\??\c:\7jddd.exec:\7jddd.exe100⤵PID:2232
-
\??\c:\frrlfrl.exec:\frrlfrl.exe101⤵PID:2484
-
\??\c:\rxrfxlr.exec:\rxrfxlr.exe102⤵PID:2240
-
\??\c:\hhntht.exec:\hhntht.exe103⤵PID:2784
-
\??\c:\jdpdv.exec:\jdpdv.exe104⤵PID:836
-
\??\c:\1rlxrxf.exec:\1rlxrxf.exe105⤵PID:764
-
\??\c:\bbbnbn.exec:\bbbnbn.exe106⤵PID:944
-
\??\c:\ntthhn.exec:\ntthhn.exe107⤵PID:1288
-
\??\c:\vdvpj.exec:\vdvpj.exe108⤵PID:804
-
\??\c:\rxffxll.exec:\rxffxll.exe109⤵PID:984
-
\??\c:\5hhthn.exec:\5hhthn.exe110⤵PID:1724
-
\??\c:\dddvj.exec:\dddvj.exe111⤵PID:1672
-
\??\c:\dvvjv.exec:\dvvjv.exe112⤵PID:2504
-
\??\c:\9xrrllx.exec:\9xrrllx.exe113⤵PID:2192
-
\??\c:\5nhtbh.exec:\5nhtbh.exe114⤵PID:2428
-
\??\c:\jvvjd.exec:\jvvjd.exe115⤵PID:2316
-
\??\c:\pppvv.exec:\pppvv.exe116⤵PID:1756
-
\??\c:\lxxrxlf.exec:\lxxrxlf.exe117⤵PID:992
-
\??\c:\ttbthh.exec:\ttbthh.exe118⤵PID:1144
-
\??\c:\tnhnbh.exec:\tnhnbh.exe119⤵PID:2848
-
\??\c:\jddjj.exec:\jddjj.exe120⤵PID:1572
-
\??\c:\rlllffr.exec:\rlllffr.exe121⤵PID:2912
-
\??\c:\1hnnnn.exec:\1hnnnn.exe122⤵PID:2704
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-