Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe
Resource
win7-20240708-en
windows7-x64
7 signatures
150 seconds
General
-
Target
bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe
-
Size
454KB
-
MD5
3e6f1f7480e8571754c1c49000f1e5ae
-
SHA1
f60a52d4cf86be71fa32f1841a37dc8d61d40e89
-
SHA256
bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d
-
SHA512
ef9924a742f693577a17edd73ca64b19324ca7158d62f8be76da917298123892a8e69d6dd043b53e5a5fb9e4bd2953716026b253105c0f1153572eb86e26ac2a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN:q7Tc2NYHUrAwfMp3CDN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1900-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2392-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1896-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-304-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-318-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2680-338-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2600-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-374-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-388-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-425-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1768-456-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-470-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-483-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/960-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-499-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1676-553-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1676-572-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2864-605-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-665-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2160 jdvjp.exe 2756 bttntt.exe 2676 bhhtnb.exe 2392 48286.exe 2920 6084624.exe 2600 04624.exe 2596 60406.exe 2076 jdvjp.exe 1896 820028.exe 2956 bbtnbn.exe 1324 ffrfxll.exe 2532 dpjdp.exe 1956 826400.exe 2416 7nbhhn.exe 2640 nhttbb.exe 2360 pjpvv.exe 2264 nhbbbb.exe 1156 q04066.exe 1876 080626.exe 2236 g6406.exe 1732 28808.exe 1820 9rffllx.exe 684 a2646.exe 2292 204400.exe 1468 rlfrxfx.exe 1940 jjjpj.exe 2064 bbhttb.exe 2492 2024002.exe 2528 lrlrxll.exe 1636 nhbthn.exe 1296 826806.exe 888 1jpvd.exe 2364 pjvdp.exe 1620 nhbntt.exe 2784 9lfrfxl.exe 2676 9bnhnt.exe 2712 llfrflr.exe 2680 lfflxfr.exe 2812 nnhtnb.exe 2600 vpddd.exe 2924 5thbbb.exe 2720 o268024.exe 2960 m6062.exe 276 ppjpj.exe 1308 82024.exe 432 264640.exe 3020 rrffrrx.exe 2532 820686.exe 2168 44666.exe 2348 q82428.exe 2012 rrflfll.exe 2156 424444.exe 2888 hbtnnn.exe 2476 g2046.exe 1768 w46620.exe 2504 048640.exe 2252 066200.exe 2096 7bnnnt.exe 1748 202848.exe 960 8200280.exe 2508 rfrlrrf.exe 1364 ffrxflf.exe 2000 8688002.exe 1560 246426.exe -
resource yara_rule behavioral1/memory/1900-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1896-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2416-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-304-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2712-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-388-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1768-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-464-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-470-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-483-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/960-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-499-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-507-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-572-0x00000000003B0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2864-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2188-749-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64282.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 048406.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2062844.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4806220.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language o084000.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0462440.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82008.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2160 1900 bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe 30 PID 1900 wrote to memory of 2160 1900 bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe 30 PID 1900 wrote to memory of 2160 1900 bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe 30 PID 1900 wrote to memory of 2160 1900 bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe 30 PID 2160 wrote to memory of 2756 2160 jdvjp.exe 31 PID 2160 wrote to memory of 2756 2160 jdvjp.exe 31 PID 2160 wrote to memory of 2756 2160 jdvjp.exe 31 PID 2160 wrote to memory of 2756 2160 jdvjp.exe 31 PID 2756 wrote to memory of 2676 2756 bttntt.exe 32 PID 2756 wrote to memory of 2676 2756 bttntt.exe 32 PID 2756 wrote to memory of 2676 2756 bttntt.exe 32 PID 2756 wrote to memory of 2676 2756 bttntt.exe 32 PID 2676 wrote to memory of 2392 2676 bhhtnb.exe 33 PID 2676 wrote to memory of 2392 2676 bhhtnb.exe 33 PID 2676 wrote to memory of 2392 2676 bhhtnb.exe 33 PID 2676 wrote to memory of 2392 2676 bhhtnb.exe 33 PID 2392 wrote to memory of 2920 2392 48286.exe 34 PID 2392 wrote to memory of 2920 2392 48286.exe 34 PID 2392 wrote to memory of 2920 2392 48286.exe 34 PID 2392 wrote to memory of 2920 2392 48286.exe 34 PID 2920 wrote to memory of 2600 2920 6084624.exe 35 PID 2920 wrote to memory of 2600 2920 6084624.exe 35 PID 2920 wrote to memory of 2600 2920 6084624.exe 35 PID 2920 wrote to memory of 2600 2920 6084624.exe 35 PID 2600 wrote to memory of 2596 2600 04624.exe 36 PID 2600 wrote to memory of 2596 2600 04624.exe 36 PID 2600 wrote to memory of 2596 2600 04624.exe 36 PID 2600 wrote to memory of 2596 2600 04624.exe 36 PID 2596 wrote to memory of 2076 2596 60406.exe 37 PID 2596 wrote to memory of 2076 2596 60406.exe 37 PID 2596 wrote to memory of 2076 2596 60406.exe 37 PID 2596 wrote to memory of 2076 2596 60406.exe 37 PID 2076 wrote to memory of 1896 2076 jdvjp.exe 38 PID 2076 wrote to memory of 1896 2076 jdvjp.exe 38 PID 2076 wrote to memory of 1896 2076 jdvjp.exe 38 PID 2076 wrote to memory of 1896 2076 jdvjp.exe 38 PID 1896 wrote to memory of 2956 1896 820028.exe 39 PID 1896 wrote to memory of 2956 1896 820028.exe 39 PID 1896 wrote to memory of 2956 1896 820028.exe 39 PID 1896 wrote to memory of 2956 1896 820028.exe 39 PID 2956 wrote to memory of 1324 2956 bbtnbn.exe 40 PID 2956 wrote to memory of 1324 2956 bbtnbn.exe 40 PID 2956 wrote to memory of 1324 2956 bbtnbn.exe 40 PID 2956 wrote to memory of 1324 2956 bbtnbn.exe 40 PID 1324 wrote to memory of 2532 1324 ffrfxll.exe 41 PID 1324 wrote to memory of 2532 1324 ffrfxll.exe 41 PID 1324 wrote to memory of 2532 1324 ffrfxll.exe 41 PID 1324 wrote to memory of 2532 1324 ffrfxll.exe 41 PID 2532 wrote to memory of 1956 2532 dpjdp.exe 42 PID 2532 wrote to memory of 1956 2532 dpjdp.exe 42 PID 2532 wrote to memory of 1956 2532 dpjdp.exe 42 PID 2532 wrote to memory of 1956 2532 dpjdp.exe 42 PID 1956 wrote to memory of 2416 1956 826400.exe 43 PID 1956 wrote to memory of 2416 1956 826400.exe 43 PID 1956 wrote to memory of 2416 1956 826400.exe 43 PID 1956 wrote to memory of 2416 1956 826400.exe 43 PID 2416 wrote to memory of 2640 2416 7nbhhn.exe 44 PID 2416 wrote to memory of 2640 2416 7nbhhn.exe 44 PID 2416 wrote to memory of 2640 2416 7nbhhn.exe 44 PID 2416 wrote to memory of 2640 2416 7nbhhn.exe 44 PID 2640 wrote to memory of 2360 2640 nhttbb.exe 45 PID 2640 wrote to memory of 2360 2640 nhttbb.exe 45 PID 2640 wrote to memory of 2360 2640 nhttbb.exe 45 PID 2640 wrote to memory of 2360 2640 nhttbb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe"C:\Users\Admin\AppData\Local\Temp\bd20a5cd3986550e04c854e6d2ae4fbe9b01ef44c43137f3754e334e7296436d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\jdvjp.exec:\jdvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\bttntt.exec:\bttntt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\bhhtnb.exec:\bhhtnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\48286.exec:\48286.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\6084624.exec:\6084624.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\04624.exec:\04624.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\60406.exec:\60406.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\jdvjp.exec:\jdvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\820028.exec:\820028.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\bbtnbn.exec:\bbtnbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\ffrfxll.exec:\ffrfxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\dpjdp.exec:\dpjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\826400.exec:\826400.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\7nbhhn.exec:\7nbhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\nhttbb.exec:\nhttbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\pjpvv.exec:\pjpvv.exe17⤵
- Executes dropped EXE
PID:2360 -
\??\c:\nhbbbb.exec:\nhbbbb.exe18⤵
- Executes dropped EXE
PID:2264 -
\??\c:\q04066.exec:\q04066.exe19⤵
- Executes dropped EXE
PID:1156 -
\??\c:\080626.exec:\080626.exe20⤵
- Executes dropped EXE
PID:1876 -
\??\c:\g6406.exec:\g6406.exe21⤵
- Executes dropped EXE
PID:2236 -
\??\c:\28808.exec:\28808.exe22⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9rffllx.exec:\9rffllx.exe23⤵
- Executes dropped EXE
PID:1820 -
\??\c:\a2646.exec:\a2646.exe24⤵
- Executes dropped EXE
PID:684 -
\??\c:\204400.exec:\204400.exe25⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe26⤵
- Executes dropped EXE
PID:1468 -
\??\c:\jjjpj.exec:\jjjpj.exe27⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bbhttb.exec:\bbhttb.exe28⤵
- Executes dropped EXE
PID:2064 -
\??\c:\2024002.exec:\2024002.exe29⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lrlrxll.exec:\lrlrxll.exe30⤵
- Executes dropped EXE
PID:2528 -
\??\c:\nhbthn.exec:\nhbthn.exe31⤵
- Executes dropped EXE
PID:1636 -
\??\c:\826806.exec:\826806.exe32⤵
- Executes dropped EXE
PID:1296 -
\??\c:\1jpvd.exec:\1jpvd.exe33⤵
- Executes dropped EXE
PID:888 -
\??\c:\pjvdp.exec:\pjvdp.exe34⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nhbntt.exec:\nhbntt.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9lfrfxl.exec:\9lfrfxl.exe36⤵
- Executes dropped EXE
PID:2784 -
\??\c:\9bnhnt.exec:\9bnhnt.exe37⤵
- Executes dropped EXE
PID:2676 -
\??\c:\llfrflr.exec:\llfrflr.exe38⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lfflxfr.exec:\lfflxfr.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nnhtnb.exec:\nnhtnb.exe40⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpddd.exec:\vpddd.exe41⤵
- Executes dropped EXE
PID:2600 -
\??\c:\5thbbb.exec:\5thbbb.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\o268024.exec:\o268024.exe43⤵
- Executes dropped EXE
PID:2720 -
\??\c:\m6062.exec:\m6062.exe44⤵
- Executes dropped EXE
PID:2960 -
\??\c:\ppjpj.exec:\ppjpj.exe45⤵
- Executes dropped EXE
PID:276 -
\??\c:\82024.exec:\82024.exe46⤵
- Executes dropped EXE
PID:1308 -
\??\c:\264640.exec:\264640.exe47⤵
- Executes dropped EXE
PID:432 -
\??\c:\rrffrrx.exec:\rrffrrx.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\820686.exec:\820686.exe49⤵
- Executes dropped EXE
PID:2532 -
\??\c:\44666.exec:\44666.exe50⤵
- Executes dropped EXE
PID:2168 -
\??\c:\q82428.exec:\q82428.exe51⤵
- Executes dropped EXE
PID:2348 -
\??\c:\rrflfll.exec:\rrflfll.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\424444.exec:\424444.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hbtnnn.exec:\hbtnnn.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\g2046.exec:\g2046.exe55⤵
- Executes dropped EXE
PID:2476 -
\??\c:\w46620.exec:\w46620.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\048640.exec:\048640.exe57⤵
- Executes dropped EXE
PID:2504 -
\??\c:\066200.exec:\066200.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\7bnnnt.exec:\7bnnnt.exe59⤵
- Executes dropped EXE
PID:2096 -
\??\c:\202848.exec:\202848.exe60⤵
- Executes dropped EXE
PID:1748 -
\??\c:\8200280.exec:\8200280.exe61⤵
- Executes dropped EXE
PID:960 -
\??\c:\rfrlrrf.exec:\rfrlrrf.exe62⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ffrxflf.exec:\ffrxflf.exe63⤵
- Executes dropped EXE
PID:1364 -
\??\c:\8688002.exec:\8688002.exe64⤵
- Executes dropped EXE
PID:2000 -
\??\c:\246426.exec:\246426.exe65⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnhnhn.exec:\tnhnhn.exe66⤵PID:1996
-
\??\c:\pdvdp.exec:\pdvdp.exe67⤵PID:1940
-
\??\c:\2062844.exec:\2062844.exe68⤵
- System Location Discovery: System Language Discovery
PID:2028 -
\??\c:\fxlxffl.exec:\fxlxffl.exe69⤵PID:3000
-
\??\c:\llfrxxr.exec:\llfrxxr.exe70⤵PID:1676
-
\??\c:\2608064.exec:\2608064.exe71⤵PID:2284
-
\??\c:\448062.exec:\448062.exe72⤵PID:1636
-
\??\c:\5lxflrx.exec:\5lxflrx.exe73⤵PID:896
-
\??\c:\6664800.exec:\6664800.exe74⤵PID:2464
-
\??\c:\826200.exec:\826200.exe75⤵PID:2644
-
\??\c:\o828024.exec:\o828024.exe76⤵PID:1900
-
\??\c:\5rrxxfr.exec:\5rrxxfr.exe77⤵PID:1720
-
\??\c:\0800240.exec:\0800240.exe78⤵PID:2864
-
\??\c:\vpjvd.exec:\vpjvd.exe79⤵PID:2860
-
\??\c:\60802.exec:\60802.exe80⤵PID:2752
-
\??\c:\3jdpv.exec:\3jdpv.exe81⤵PID:2664
-
\??\c:\208206.exec:\208206.exe82⤵PID:2608
-
\??\c:\0828608.exec:\0828608.exe83⤵PID:2624
-
\??\c:\lfxrflx.exec:\lfxrflx.exe84⤵PID:2580
-
\??\c:\jjdpd.exec:\jjdpd.exe85⤵PID:2568
-
\??\c:\826624.exec:\826624.exe86⤵PID:2560
-
\??\c:\4824002.exec:\4824002.exe87⤵PID:1140
-
\??\c:\vvppj.exec:\vvppj.exe88⤵PID:2276
-
\??\c:\g6468.exec:\g6468.exe89⤵PID:1252
-
\??\c:\tbttnn.exec:\tbttnn.exe90⤵PID:3004
-
\??\c:\btbbnn.exec:\btbbnn.exe91⤵PID:2380
-
\??\c:\268002.exec:\268002.exe92⤵PID:700
-
\??\c:\a6682.exec:\a6682.exe93⤵PID:2796
-
\??\c:\04402.exec:\04402.exe94⤵PID:2328
-
\??\c:\xrrrxfx.exec:\xrrrxfx.exe95⤵PID:2896
-
\??\c:\bbnthh.exec:\bbnthh.exe96⤵PID:2420
-
\??\c:\0486426.exec:\0486426.exe97⤵PID:2260
-
\??\c:\4802886.exec:\4802886.exe98⤵PID:2476
-
\??\c:\6080224.exec:\6080224.exe99⤵PID:1156
-
\??\c:\k68002.exec:\k68002.exe100⤵PID:1744
-
\??\c:\jjpdp.exec:\jjpdp.exe101⤵PID:2188
-
\??\c:\0044064.exec:\0044064.exe102⤵PID:2096
-
\??\c:\rlffrxl.exec:\rlffrxl.exe103⤵PID:1816
-
\??\c:\40662.exec:\40662.exe104⤵PID:960
-
\??\c:\44242.exec:\44242.exe105⤵PID:1716
-
\??\c:\264624.exec:\264624.exe106⤵PID:2268
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe107⤵PID:1552
-
\??\c:\m2680.exec:\m2680.exe108⤵PID:1244
-
\??\c:\a6068.exec:\a6068.exe109⤵PID:1560
-
\??\c:\bthhnn.exec:\bthhnn.exe110⤵PID:1888
-
\??\c:\btnntb.exec:\btnntb.exe111⤵PID:1968
-
\??\c:\5bttbh.exec:\5bttbh.exe112⤵PID:2028
-
\??\c:\404040.exec:\404040.exe113⤵PID:1464
-
\??\c:\bhhbtn.exec:\bhhbtn.exe114⤵PID:2068
-
\??\c:\bhnhbh.exec:\bhnhbh.exe115⤵PID:2284
-
\??\c:\4204664.exec:\4204664.exe116⤵PID:1636
-
\??\c:\48280.exec:\48280.exe117⤵PID:896
-
\??\c:\7pppd.exec:\7pppd.exe118⤵PID:2280
-
\??\c:\rrllllx.exec:\rrllllx.exe119⤵PID:2644
-
\??\c:\g0846.exec:\g0846.exe120⤵PID:2692
-
\??\c:\tbtbhh.exec:\tbtbhh.exe121⤵PID:1620
-
\??\c:\226000.exec:\226000.exe122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-