Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe
-
Size
454KB
-
MD5
4b57c9766eecfcef559a26ba4b838d26
-
SHA1
5beac97aa545e79ce68ff3a5be2ed09edea83bf3
-
SHA256
ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e
-
SHA512
7378de75809f458fbe5676ea3a0d9ee689b18cc3c58fb50a55e99cb44d96a5cb80e0be003708b6db35985b9db6725e4cea79500a22ab12f93da2e186831318ef
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeToA:q7Tc2NYHUrAwfMp3CDcA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1884-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-17-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-29-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-59-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2700-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2516-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/828-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-154-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1348-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-163-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1192-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/600-253-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/944-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-297-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2080-296-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2536-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-452-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1932-459-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-468-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 9rxllrr.exe 2792 9vppv.exe 2604 3fxxxxf.exe 2780 btbttt.exe 3068 frxrrrf.exe 2836 9xflrlr.exe 2700 ppjjp.exe 2516 5lxffll.exe 2972 bttntt.exe 320 xlrxllr.exe 828 htbtbt.exe 1488 pjjjv.exe 2736 frxxfxf.exe 2824 nhttbb.exe 764 dpjjd.exe 1348 rflflfr.exe 1400 thnbbb.exe 1508 pjppd.exe 1192 3lxfrrr.exe 1540 jjpdd.exe 1980 llrfxlx.exe 2148 hbnnnt.exe 2480 djdvj.exe 1724 xfxfxrr.exe 600 9vpvj.exe 1444 ffxfrxr.exe 944 thntbh.exe 1652 dvjpv.exe 2096 xxfrlrx.exe 2080 nttbhn.exe 1516 xrfflfl.exe 2272 xxrrlfl.exe 2296 jvddd.exe 2444 pvdpj.exe 2692 rfllrll.exe 824 bnbbhn.exe 2712 1xfxlff.exe 2780 1lrrrrr.exe 2528 vpdpp.exe 2536 vjvpv.exe 2548 htntbt.exe 2700 ddppp.exe 2520 lxxxxrr.exe 1936 1thhhb.exe 2980 ddjpd.exe 704 7fxxrll.exe 1112 frrrrlr.exe 1156 hhthhh.exe 2488 pjvdj.exe 2684 djvpj.exe 2336 rlrrxxf.exe 2588 bnbbbn.exe 1932 pjvdp.exe 1756 vdppd.exe 1804 lfrrrlr.exe 2472 tnntbt.exe 2008 ppvvj.exe 2968 llllxfx.exe 1820 hthhtt.exe 2680 htbbbb.exe 2148 vjppv.exe 1700 fxfxxrx.exe 2352 7httbb.exe 860 dvjjv.exe -
resource yara_rule behavioral1/memory/1884-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2516-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1192-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/600-253-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/944-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-296-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-445-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1932-459-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1736-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-620-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrflrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2060 1884 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 28 PID 1884 wrote to memory of 2060 1884 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 28 PID 1884 wrote to memory of 2060 1884 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 28 PID 1884 wrote to memory of 2060 1884 ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe 28 PID 2060 wrote to memory of 2792 2060 9rxllrr.exe 29 PID 2060 wrote to memory of 2792 2060 9rxllrr.exe 29 PID 2060 wrote to memory of 2792 2060 9rxllrr.exe 29 PID 2060 wrote to memory of 2792 2060 9rxllrr.exe 29 PID 2792 wrote to memory of 2604 2792 9vppv.exe 30 PID 2792 wrote to memory of 2604 2792 9vppv.exe 30 PID 2792 wrote to memory of 2604 2792 9vppv.exe 30 PID 2792 wrote to memory of 2604 2792 9vppv.exe 30 PID 2604 wrote to memory of 2780 2604 3fxxxxf.exe 31 PID 2604 wrote to memory of 2780 2604 3fxxxxf.exe 31 PID 2604 wrote to memory of 2780 2604 3fxxxxf.exe 31 PID 2604 wrote to memory of 2780 2604 3fxxxxf.exe 31 PID 2780 wrote to memory of 3068 2780 btbttt.exe 32 PID 2780 wrote to memory of 3068 2780 btbttt.exe 32 PID 2780 wrote to memory of 3068 2780 btbttt.exe 32 PID 2780 wrote to memory of 3068 2780 btbttt.exe 32 PID 3068 wrote to memory of 2836 3068 frxrrrf.exe 33 PID 3068 wrote to memory of 2836 3068 frxrrrf.exe 33 PID 3068 wrote to memory of 2836 3068 frxrrrf.exe 33 PID 3068 wrote to memory of 2836 3068 frxrrrf.exe 33 PID 2836 wrote to memory of 2700 2836 9xflrlr.exe 34 PID 2836 wrote to memory of 2700 2836 9xflrlr.exe 34 PID 2836 wrote to memory of 2700 2836 9xflrlr.exe 34 PID 2836 wrote to memory of 2700 2836 9xflrlr.exe 34 PID 2700 wrote to memory of 2516 2700 ppjjp.exe 35 PID 2700 wrote to memory of 2516 2700 ppjjp.exe 35 PID 2700 wrote to memory of 2516 2700 ppjjp.exe 35 PID 2700 wrote to memory of 2516 2700 ppjjp.exe 35 PID 2516 wrote to memory of 2972 2516 5lxffll.exe 36 PID 2516 wrote to memory of 2972 2516 5lxffll.exe 36 PID 2516 wrote to memory of 2972 2516 5lxffll.exe 36 PID 2516 wrote to memory of 2972 2516 5lxffll.exe 36 PID 2972 wrote to memory of 320 2972 bttntt.exe 37 PID 2972 wrote to memory of 320 2972 bttntt.exe 37 PID 2972 wrote to memory of 320 2972 bttntt.exe 37 PID 2972 wrote to memory of 320 2972 bttntt.exe 37 PID 320 wrote to memory of 828 320 xlrxllr.exe 38 PID 320 wrote to memory of 828 320 xlrxllr.exe 38 PID 320 wrote to memory of 828 320 xlrxllr.exe 38 PID 320 wrote to memory of 828 320 xlrxllr.exe 38 PID 828 wrote to memory of 1488 828 htbtbt.exe 39 PID 828 wrote to memory of 1488 828 htbtbt.exe 39 PID 828 wrote to memory of 1488 828 htbtbt.exe 39 PID 828 wrote to memory of 1488 828 htbtbt.exe 39 PID 1488 wrote to memory of 2736 1488 pjjjv.exe 40 PID 1488 wrote to memory of 2736 1488 pjjjv.exe 40 PID 1488 wrote to memory of 2736 1488 pjjjv.exe 40 PID 1488 wrote to memory of 2736 1488 pjjjv.exe 40 PID 2736 wrote to memory of 2824 2736 frxxfxf.exe 41 PID 2736 wrote to memory of 2824 2736 frxxfxf.exe 41 PID 2736 wrote to memory of 2824 2736 frxxfxf.exe 41 PID 2736 wrote to memory of 2824 2736 frxxfxf.exe 41 PID 2824 wrote to memory of 764 2824 nhttbb.exe 42 PID 2824 wrote to memory of 764 2824 nhttbb.exe 42 PID 2824 wrote to memory of 764 2824 nhttbb.exe 42 PID 2824 wrote to memory of 764 2824 nhttbb.exe 42 PID 764 wrote to memory of 1348 764 dpjjd.exe 43 PID 764 wrote to memory of 1348 764 dpjjd.exe 43 PID 764 wrote to memory of 1348 764 dpjjd.exe 43 PID 764 wrote to memory of 1348 764 dpjjd.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe"C:\Users\Admin\AppData\Local\Temp\ba36e7c1629787156004b83faab397024927a6dd2d89ee1d7c8759bda5c7f34e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\9rxllrr.exec:\9rxllrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\9vppv.exec:\9vppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\3fxxxxf.exec:\3fxxxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\btbttt.exec:\btbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\frxrrrf.exec:\frxrrrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\9xflrlr.exec:\9xflrlr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\ppjjp.exec:\ppjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\5lxffll.exec:\5lxffll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\bttntt.exec:\bttntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\xlrxllr.exec:\xlrxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\htbtbt.exec:\htbtbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\pjjjv.exec:\pjjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\frxxfxf.exec:\frxxfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nhttbb.exec:\nhttbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\dpjjd.exec:\dpjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\rflflfr.exec:\rflflfr.exe17⤵
- Executes dropped EXE
PID:1348 -
\??\c:\thnbbb.exec:\thnbbb.exe18⤵
- Executes dropped EXE
PID:1400 -
\??\c:\pjppd.exec:\pjppd.exe19⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3lxfrrr.exec:\3lxfrrr.exe20⤵
- Executes dropped EXE
PID:1192 -
\??\c:\jjpdd.exec:\jjpdd.exe21⤵
- Executes dropped EXE
PID:1540 -
\??\c:\llrfxlx.exec:\llrfxlx.exe22⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hbnnnt.exec:\hbnnnt.exe23⤵
- Executes dropped EXE
PID:2148 -
\??\c:\djdvj.exec:\djdvj.exe24⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xfxfxrr.exec:\xfxfxrr.exe25⤵
- Executes dropped EXE
PID:1724 -
\??\c:\9vpvj.exec:\9vpvj.exe26⤵
- Executes dropped EXE
PID:600 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe27⤵
- Executes dropped EXE
PID:1444 -
\??\c:\thntbh.exec:\thntbh.exe28⤵
- Executes dropped EXE
PID:944 -
\??\c:\dvjpv.exec:\dvjpv.exe29⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xxfrlrx.exec:\xxfrlrx.exe30⤵
- Executes dropped EXE
PID:2096 -
\??\c:\nttbhn.exec:\nttbhn.exe31⤵
- Executes dropped EXE
PID:2080 -
\??\c:\xrfflfl.exec:\xrfflfl.exe32⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xxrrlfl.exec:\xxrrlfl.exe33⤵
- Executes dropped EXE
PID:2272 -
\??\c:\jvddd.exec:\jvddd.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\pvdpj.exec:\pvdpj.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\rfllrll.exec:\rfllrll.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\bnbbhn.exec:\bnbbhn.exe37⤵
- Executes dropped EXE
PID:824 -
\??\c:\1xfxlff.exec:\1xfxlff.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1lrrrrr.exec:\1lrrrrr.exe39⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpdpp.exec:\vpdpp.exe40⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vjvpv.exec:\vjvpv.exe41⤵
- Executes dropped EXE
PID:2536 -
\??\c:\htntbt.exec:\htntbt.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ddppp.exec:\ddppp.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lxxxxrr.exec:\lxxxxrr.exe44⤵
- Executes dropped EXE
PID:2520 -
\??\c:\1thhhb.exec:\1thhhb.exe45⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ddjpd.exec:\ddjpd.exe46⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7fxxrll.exec:\7fxxrll.exe47⤵
- Executes dropped EXE
PID:704 -
\??\c:\frrrrlr.exec:\frrrrlr.exe48⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hhthhh.exec:\hhthhh.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\pjvdj.exec:\pjvdj.exe50⤵
- Executes dropped EXE
PID:2488 -
\??\c:\djvpj.exec:\djvpj.exe51⤵
- Executes dropped EXE
PID:2684 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe52⤵
- Executes dropped EXE
PID:2336 -
\??\c:\bnbbbn.exec:\bnbbbn.exe53⤵
- Executes dropped EXE
PID:2588 -
\??\c:\pjvdp.exec:\pjvdp.exe54⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vdppd.exec:\vdppd.exe55⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lfrrrlr.exec:\lfrrrlr.exe56⤵
- Executes dropped EXE
PID:1804 -
\??\c:\tnntbt.exec:\tnntbt.exe57⤵
- Executes dropped EXE
PID:2472 -
\??\c:\ppvvj.exec:\ppvvj.exe58⤵
- Executes dropped EXE
PID:2008 -
\??\c:\llllxfx.exec:\llllxfx.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\hthhtt.exec:\hthhtt.exe60⤵
- Executes dropped EXE
PID:1820 -
\??\c:\htbbbb.exec:\htbbbb.exe61⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vjppv.exec:\vjppv.exe62⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe63⤵
- Executes dropped EXE
PID:1700 -
\??\c:\7httbb.exec:\7httbb.exe64⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dvjjv.exec:\dvjjv.exe65⤵
- Executes dropped EXE
PID:860 -
\??\c:\xxffffr.exec:\xxffffr.exe66⤵PID:1832
-
\??\c:\xrxxxrx.exec:\xrxxxrx.exe67⤵PID:2260
-
\??\c:\3nbbbh.exec:\3nbbbh.exe68⤵PID:2132
-
\??\c:\3djdp.exec:\3djdp.exe69⤵PID:2896
-
\??\c:\dvddd.exec:\dvddd.exe70⤵PID:2244
-
\??\c:\1lrxrlr.exec:\1lrxrlr.exe71⤵PID:2264
-
\??\c:\nbnttt.exec:\nbnttt.exe72⤵PID:2300
-
\??\c:\nbhtbn.exec:\nbhtbn.exe73⤵PID:1884
-
\??\c:\5ddvd.exec:\5ddvd.exe74⤵PID:1616
-
\??\c:\lrrxlrf.exec:\lrrxlrf.exe75⤵PID:1044
-
\??\c:\xlxrrrx.exec:\xlxrrrx.exe76⤵PID:1736
-
\??\c:\hthhhb.exec:\hthhhb.exe77⤵PID:1072
-
\??\c:\3djjp.exec:\3djjp.exe78⤵PID:2748
-
\??\c:\rrrxrrr.exec:\rrrxrrr.exe79⤵
- System Location Discovery: System Language Discovery
PID:2892 -
\??\c:\frfrlfx.exec:\frfrlfx.exe80⤵PID:2728
-
\??\c:\nhtnnh.exec:\nhtnnh.exe81⤵PID:2508
-
\??\c:\5pvvp.exec:\5pvvp.exe82⤵PID:2708
-
\??\c:\vjvpd.exec:\vjvpd.exe83⤵PID:2556
-
\??\c:\frfffff.exec:\frfffff.exe84⤵PID:2544
-
\??\c:\7ntnhb.exec:\7ntnhb.exe85⤵PID:2756
-
\??\c:\bntbhh.exec:\bntbhh.exe86⤵PID:628
-
\??\c:\vdjvd.exec:\vdjvd.exe87⤵PID:588
-
\??\c:\ffrrfff.exec:\ffrrfff.exe88⤵PID:1604
-
\??\c:\1xllrlx.exec:\1xllrlx.exe89⤵PID:1660
-
\??\c:\3httht.exec:\3httht.exe90⤵PID:792
-
\??\c:\dpdvv.exec:\dpdvv.exe91⤵PID:2776
-
\??\c:\3pjjd.exec:\3pjjd.exe92⤵PID:2816
-
\??\c:\lxxxxrr.exec:\lxxxxrr.exe93⤵PID:2844
-
\??\c:\xlfxxrx.exec:\xlfxxrx.exe94⤵PID:2036
-
\??\c:\hhttbb.exec:\hhttbb.exe95⤵PID:2864
-
\??\c:\vdpdd.exec:\vdpdd.exe96⤵PID:2400
-
\??\c:\jdppp.exec:\jdppp.exe97⤵PID:1740
-
\??\c:\rfxxfxx.exec:\rfxxfxx.exe98⤵PID:2996
-
\??\c:\ntbnnb.exec:\ntbnnb.exe99⤵PID:1028
-
\??\c:\thtnnh.exec:\thtnnh.exe100⤵PID:2472
-
\??\c:\djvpp.exec:\djvpp.exe101⤵PID:1988
-
\??\c:\1xrllfx.exec:\1xrllfx.exe102⤵PID:2404
-
\??\c:\1xfxrll.exec:\1xfxrll.exe103⤵PID:2004
-
\??\c:\thhbbb.exec:\thhbbb.exe104⤵PID:1820
-
\??\c:\vjjdd.exec:\vjjdd.exe105⤵PID:2900
-
\??\c:\3dvvp.exec:\3dvvp.exe106⤵PID:2480
-
\??\c:\rflfrrr.exec:\rflfrrr.exe107⤵PID:1700
-
\??\c:\9nnhhb.exec:\9nnhhb.exe108⤵PID:1704
-
\??\c:\1jdpj.exec:\1jdpj.exe109⤵PID:1744
-
\??\c:\dpdvv.exec:\dpdvv.exe110⤵PID:1048
-
\??\c:\1rfrlff.exec:\1rfrlff.exe111⤵PID:2260
-
\??\c:\nbhhhb.exec:\nbhhhb.exe112⤵PID:888
-
\??\c:\1jpjd.exec:\1jpjd.exe113⤵PID:2896
-
\??\c:\pjpvj.exec:\pjpvj.exe114⤵PID:2244
-
\??\c:\lxfffxx.exec:\lxfffxx.exe115⤵PID:2924
-
\??\c:\xfffllf.exec:\xfffllf.exe116⤵PID:1512
-
\??\c:\tnnnhb.exec:\tnnnhb.exe117⤵PID:1620
-
\??\c:\vjppv.exec:\vjppv.exe118⤵PID:892
-
\??\c:\3vjdv.exec:\3vjdv.exe119⤵PID:2292
-
\??\c:\rxxllll.exec:\rxxllll.exe120⤵PID:1732
-
\??\c:\5lllrff.exec:\5lllrff.exe121⤵PID:2724
-
\??\c:\5bhbbb.exec:\5bhbbb.exe122⤵PID:2640
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-