Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 03:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe
-
Size
454KB
-
MD5
de5c08d30ffc3d71b3f752517686fd50
-
SHA1
2dda48bc45bde07e993fbcf51ec71405b74588fc
-
SHA256
c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7
-
SHA512
9e25ab1e3a03cf77d1fc72a29c23d3f0466358721467ec5b7064bf0f878ad540f77cd861147527795b7784e51378c337f3824e78f24b770b038eeaec5112a518
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbet:q7Tc2NYHUrAwfMp3CDt
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 41 IoCs
resource yara_rule behavioral1/memory/1548-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-69-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-88-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2924-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-99-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/1916-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2292-193-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-245-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2224-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-326-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2592-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2352-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1636-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-80-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2672-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-657-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-665-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-693-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1176-724-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2740-731-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-743-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/636-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/772-793-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1872 jjvdj.exe 2328 1fxlflf.exe 2072 nhbbhn.exe 2668 pjjdd.exe 2864 lfxfxrx.exe 2604 9xrxxfr.exe 2472 btnnhn.exe 2448 vvjpd.exe 2924 ffxxrlx.exe 1916 3htbhh.exe 1160 llxlxlx.exe 2544 bbnbnb.exe 1636 jjjvv.exe 2248 xfrfxfr.exe 1648 tbbhnb.exe 1656 rlffllx.exe 3048 jdjdj.exe 484 5hbhnt.exe 2292 dpvdj.exe 1900 jpvvd.exe 2484 frrlrfx.exe 1600 7thnth.exe 276 vppdv.exe 1308 vdjdd.exe 2224 1bbtht.exe 1704 3vvvv.exe 3008 tbnnbb.exe 1480 9hnnht.exe 2380 ppvjd.exe 2984 rrrrrxx.exe 2280 jvpdp.exe 2324 flfxrxl.exe 544 bbtbht.exe 892 jdvvj.exe 1984 xxxfxfr.exe 1528 nttbnh.exe 2132 dddjv.exe 2072 3llxflx.exe 2644 thtnht.exe 2592 hthttb.exe 2864 vvpvd.exe 2964 5xlxlxr.exe 2764 xlxxxrf.exe 2468 bthhtn.exe 2344 pddvv.exe 1720 jpjvp.exe 1508 lrfrxrl.exe 2680 3btntb.exe 844 bhnbtb.exe 2760 3vpvv.exe 1636 5vjjd.exe 2352 xrxfllr.exe 1276 htbtbb.exe 2692 ddvvp.exe 1784 7pvdd.exe 2264 xrlxflr.exe 2304 5frlllr.exe 1768 5bntbb.exe 1404 7pvvj.exe 1740 flfxfff.exe 2368 rlflxfr.exe 1992 btnhnt.exe 1596 jpjdp.exe 276 jvddj.exe -
resource yara_rule behavioral1/memory/1548-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1916-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-193-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2352-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-80-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-609-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2672-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1176-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/636-769-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/636-773-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1548 wrote to memory of 1872 1548 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 28 PID 1548 wrote to memory of 1872 1548 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 28 PID 1548 wrote to memory of 1872 1548 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 28 PID 1548 wrote to memory of 1872 1548 c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe 28 PID 1872 wrote to memory of 2328 1872 jjvdj.exe 29 PID 1872 wrote to memory of 2328 1872 jjvdj.exe 29 PID 1872 wrote to memory of 2328 1872 jjvdj.exe 29 PID 1872 wrote to memory of 2328 1872 jjvdj.exe 29 PID 2328 wrote to memory of 2072 2328 1fxlflf.exe 65 PID 2328 wrote to memory of 2072 2328 1fxlflf.exe 65 PID 2328 wrote to memory of 2072 2328 1fxlflf.exe 65 PID 2328 wrote to memory of 2072 2328 1fxlflf.exe 65 PID 2072 wrote to memory of 2668 2072 nhbbhn.exe 31 PID 2072 wrote to memory of 2668 2072 nhbbhn.exe 31 PID 2072 wrote to memory of 2668 2072 nhbbhn.exe 31 PID 2072 wrote to memory of 2668 2072 nhbbhn.exe 31 PID 2668 wrote to memory of 2864 2668 pjjdd.exe 68 PID 2668 wrote to memory of 2864 2668 pjjdd.exe 68 PID 2668 wrote to memory of 2864 2668 pjjdd.exe 68 PID 2668 wrote to memory of 2864 2668 pjjdd.exe 68 PID 2864 wrote to memory of 2604 2864 lfxfxrx.exe 33 PID 2864 wrote to memory of 2604 2864 lfxfxrx.exe 33 PID 2864 wrote to memory of 2604 2864 lfxfxrx.exe 33 PID 2864 wrote to memory of 2604 2864 lfxfxrx.exe 33 PID 2604 wrote to memory of 2472 2604 9xrxxfr.exe 34 PID 2604 wrote to memory of 2472 2604 9xrxxfr.exe 34 PID 2604 wrote to memory of 2472 2604 9xrxxfr.exe 34 PID 2604 wrote to memory of 2472 2604 9xrxxfr.exe 34 PID 2472 wrote to memory of 2448 2472 btnnhn.exe 35 PID 2472 wrote to memory of 2448 2472 btnnhn.exe 35 PID 2472 wrote to memory of 2448 2472 btnnhn.exe 35 PID 2472 wrote to memory of 2448 2472 btnnhn.exe 35 PID 2448 wrote to memory of 2924 2448 vvjpd.exe 36 PID 2448 wrote to memory of 2924 2448 vvjpd.exe 36 PID 2448 wrote to memory of 2924 2448 vvjpd.exe 36 PID 2448 wrote to memory of 2924 2448 vvjpd.exe 36 PID 2924 wrote to memory of 1916 2924 ffxxrlx.exe 37 PID 2924 wrote to memory of 1916 2924 ffxxrlx.exe 37 PID 2924 wrote to memory of 1916 2924 ffxxrlx.exe 37 PID 2924 wrote to memory of 1916 2924 ffxxrlx.exe 37 PID 1916 wrote to memory of 1160 1916 3htbhh.exe 38 PID 1916 wrote to memory of 1160 1916 3htbhh.exe 38 PID 1916 wrote to memory of 1160 1916 3htbhh.exe 38 PID 1916 wrote to memory of 1160 1916 3htbhh.exe 38 PID 1160 wrote to memory of 2544 1160 llxlxlx.exe 39 PID 1160 wrote to memory of 2544 1160 llxlxlx.exe 39 PID 1160 wrote to memory of 2544 1160 llxlxlx.exe 39 PID 1160 wrote to memory of 2544 1160 llxlxlx.exe 39 PID 2544 wrote to memory of 1636 2544 bbnbnb.exe 40 PID 2544 wrote to memory of 1636 2544 bbnbnb.exe 40 PID 2544 wrote to memory of 1636 2544 bbnbnb.exe 40 PID 2544 wrote to memory of 1636 2544 bbnbnb.exe 40 PID 1636 wrote to memory of 2248 1636 jjjvv.exe 41 PID 1636 wrote to memory of 2248 1636 jjjvv.exe 41 PID 1636 wrote to memory of 2248 1636 jjjvv.exe 41 PID 1636 wrote to memory of 2248 1636 jjjvv.exe 41 PID 2248 wrote to memory of 1648 2248 xfrfxfr.exe 42 PID 2248 wrote to memory of 1648 2248 xfrfxfr.exe 42 PID 2248 wrote to memory of 1648 2248 xfrfxfr.exe 42 PID 2248 wrote to memory of 1648 2248 xfrfxfr.exe 42 PID 1648 wrote to memory of 1656 1648 tbbhnb.exe 43 PID 1648 wrote to memory of 1656 1648 tbbhnb.exe 43 PID 1648 wrote to memory of 1656 1648 tbbhnb.exe 43 PID 1648 wrote to memory of 1656 1648 tbbhnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe"C:\Users\Admin\AppData\Local\Temp\c393a403acaa1bb42b6a4c2f41340953603124bb97a863d1a59907400413efb7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\jjvdj.exec:\jjvdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\1fxlflf.exec:\1fxlflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nhbbhn.exec:\nhbbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\pjjdd.exec:\pjjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\lfxfxrx.exec:\lfxfxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\9xrxxfr.exec:\9xrxxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\btnnhn.exec:\btnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\vvjpd.exec:\vvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ffxxrlx.exec:\ffxxrlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\3htbhh.exec:\3htbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\llxlxlx.exec:\llxlxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\bbnbnb.exec:\bbnbnb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jjjvv.exec:\jjjvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\xfrfxfr.exec:\xfrfxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\tbbhnb.exec:\tbbhnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\rlffllx.exec:\rlffllx.exe17⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jdjdj.exec:\jdjdj.exe18⤵
- Executes dropped EXE
PID:3048 -
\??\c:\5hbhnt.exec:\5hbhnt.exe19⤵
- Executes dropped EXE
PID:484 -
\??\c:\dpvdj.exec:\dpvdj.exe20⤵
- Executes dropped EXE
PID:2292 -
\??\c:\jpvvd.exec:\jpvvd.exe21⤵
- Executes dropped EXE
PID:1900 -
\??\c:\frrlrfx.exec:\frrlrfx.exe22⤵
- Executes dropped EXE
PID:2484 -
\??\c:\7thnth.exec:\7thnth.exe23⤵
- Executes dropped EXE
PID:1600 -
\??\c:\vppdv.exec:\vppdv.exe24⤵
- Executes dropped EXE
PID:276 -
\??\c:\vdjdd.exec:\vdjdd.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\1bbtht.exec:\1bbtht.exe26⤵
- Executes dropped EXE
PID:2224 -
\??\c:\3vvvv.exec:\3vvvv.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tbnnbb.exec:\tbnnbb.exe28⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9hnnht.exec:\9hnnht.exe29⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ppvjd.exec:\ppvjd.exe30⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe31⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jvpdp.exec:\jvpdp.exe32⤵
- Executes dropped EXE
PID:2280 -
\??\c:\flfxrxl.exec:\flfxrxl.exe33⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bbtbht.exec:\bbtbht.exe34⤵
- Executes dropped EXE
PID:544 -
\??\c:\jdvvj.exec:\jdvvj.exe35⤵
- Executes dropped EXE
PID:892 -
\??\c:\xxxfxfr.exec:\xxxfxfr.exe36⤵
- Executes dropped EXE
PID:1984 -
\??\c:\nttbnh.exec:\nttbnh.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\dddjv.exec:\dddjv.exe38⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3llxflx.exec:\3llxflx.exe39⤵
- Executes dropped EXE
PID:2072 -
\??\c:\thtnht.exec:\thtnht.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\hthttb.exec:\hthttb.exe41⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vvpvd.exec:\vvpvd.exe42⤵
- Executes dropped EXE
PID:2864 -
\??\c:\5xlxlxr.exec:\5xlxlxr.exe43⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xlxxxrf.exec:\xlxxxrf.exe44⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bthhtn.exec:\bthhtn.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\pddvv.exec:\pddvv.exe46⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jpjvp.exec:\jpjvp.exe47⤵
- Executes dropped EXE
PID:1720 -
\??\c:\lrfrxrl.exec:\lrfrxrl.exe48⤵
- Executes dropped EXE
PID:1508 -
\??\c:\3btntb.exec:\3btntb.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\bhnbtb.exec:\bhnbtb.exe50⤵
- Executes dropped EXE
PID:844 -
\??\c:\3vpvv.exec:\3vpvv.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5vjjd.exec:\5vjjd.exe52⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xrxfllr.exec:\xrxfllr.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\htbtbb.exec:\htbtbb.exe54⤵
- Executes dropped EXE
PID:1276 -
\??\c:\ddvvp.exec:\ddvvp.exe55⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7pvdd.exec:\7pvdd.exe56⤵
- Executes dropped EXE
PID:1784 -
\??\c:\xrlxflr.exec:\xrlxflr.exe57⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5frlllr.exec:\5frlllr.exe58⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5bntbb.exec:\5bntbb.exe59⤵
- Executes dropped EXE
PID:1768 -
\??\c:\7pvvj.exec:\7pvvj.exe60⤵
- Executes dropped EXE
PID:1404 -
\??\c:\flfxfff.exec:\flfxfff.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\rlflxfr.exec:\rlflxfr.exe62⤵
- Executes dropped EXE
PID:2368 -
\??\c:\btnhnt.exec:\btnhnt.exe63⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jpjdp.exec:\jpjdp.exe64⤵
- Executes dropped EXE
PID:1596 -
\??\c:\jvddj.exec:\jvddj.exe65⤵
- Executes dropped EXE
PID:276 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe66⤵PID:1816
-
\??\c:\rrrxflx.exec:\rrrxflx.exe67⤵PID:1028
-
\??\c:\3nbhnn.exec:\3nbhnn.exe68⤵PID:1344
-
\??\c:\vjvvj.exec:\vjvvj.exe69⤵PID:776
-
\??\c:\7djdd.exec:\7djdd.exe70⤵PID:2876
-
\??\c:\xrlrfff.exec:\xrlrfff.exe71⤵PID:2112
-
\??\c:\5lxxllr.exec:\5lxxllr.exe72⤵PID:556
-
\??\c:\3bnnth.exec:\3bnnth.exe73⤵PID:1252
-
\??\c:\nnhnbh.exec:\nnhnbh.exe74⤵PID:2984
-
\??\c:\jdvdd.exec:\jdvdd.exe75⤵PID:2376
-
\??\c:\lfxflfr.exec:\lfxflfr.exe76⤵PID:2324
-
\??\c:\9tttnb.exec:\9tttnb.exe77⤵PID:2844
-
\??\c:\hhhtnn.exec:\hhhtnn.exe78⤵PID:3036
-
\??\c:\dvvjd.exec:\dvvjd.exe79⤵PID:2336
-
\??\c:\bbthth.exec:\bbthth.exe80⤵PID:2256
-
\??\c:\nnntht.exec:\nnntht.exe81⤵PID:2704
-
\??\c:\pjjvd.exec:\pjjvd.exe82⤵PID:2708
-
\??\c:\tnbhth.exec:\tnbhth.exe83⤵PID:2676
-
\??\c:\nbtbth.exec:\nbtbth.exe84⤵PID:2672
-
\??\c:\1nhntb.exec:\1nhntb.exe85⤵PID:3024
-
\??\c:\flfxlrf.exec:\flfxlrf.exe86⤵PID:2812
-
\??\c:\hhbhnn.exec:\hhbhnn.exe87⤵PID:2500
-
\??\c:\htbbnn.exec:\htbbnn.exe88⤵PID:2468
-
\??\c:\vvvdv.exec:\vvvdv.exe89⤵PID:2344
-
\??\c:\rlxfflx.exec:\rlxfflx.exe90⤵PID:2464
-
\??\c:\nhhntb.exec:\nhhntb.exe91⤵PID:1508
-
\??\c:\dvpdd.exec:\dvpdd.exe92⤵PID:2680
-
\??\c:\dvppd.exec:\dvppd.exe93⤵PID:844
-
\??\c:\lrrxflr.exec:\lrrxflr.exe94⤵PID:1180
-
\??\c:\thtttt.exec:\thtttt.exe95⤵PID:1304
-
\??\c:\jjjpd.exec:\jjjpd.exe96⤵PID:1176
-
\??\c:\ppvdp.exec:\ppvdp.exe97⤵PID:2740
-
\??\c:\xrxfrrf.exec:\xrxfrrf.exe98⤵PID:2272
-
\??\c:\hbbnbb.exec:\hbbnbb.exe99⤵PID:2832
-
\??\c:\bnthhb.exec:\bnthhb.exe100⤵PID:2816
-
\??\c:\vvpdp.exec:\vvpdp.exe101⤵PID:2268
-
\??\c:\5flflrx.exec:\5flflrx.exe102⤵PID:1088
-
\??\c:\3rrrflx.exec:\3rrrflx.exe103⤵PID:636
-
\??\c:\thnnbh.exec:\thnnbh.exe104⤵PID:2024
-
\??\c:\ddvjd.exec:\ddvjd.exe105⤵PID:2176
-
\??\c:\5xfxxfl.exec:\5xfxxfl.exe106⤵PID:772
-
\??\c:\bbnthh.exec:\bbnthh.exe107⤵PID:2148
-
\??\c:\nbthnb.exec:\nbthnb.exe108⤵PID:1308
-
\??\c:\jdjjj.exec:\jdjjj.exe109⤵PID:1692
-
\??\c:\1lflrrl.exec:\1lflrrl.exe110⤵PID:2060
-
\??\c:\bnnnnb.exec:\bnnnnb.exe111⤵PID:1344
-
\??\c:\bnbbhh.exec:\bnbbhh.exe112⤵PID:1700
-
\??\c:\djpjd.exec:\djpjd.exe113⤵PID:2384
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe114⤵PID:2896
-
\??\c:\1nhhnt.exec:\1nhhnt.exe115⤵PID:2156
-
\??\c:\dddjj.exec:\dddjj.exe116⤵PID:2992
-
\??\c:\5rlrxfl.exec:\5rlrxfl.exe117⤵PID:1896
-
\??\c:\5hbnth.exec:\5hbnth.exe118⤵PID:1796
-
\??\c:\7btbtb.exec:\7btbtb.exe119⤵PID:544
-
\??\c:\jppvd.exec:\jppvd.exe120⤵PID:892
-
\??\c:\bthhnn.exec:\bthhnn.exe121⤵PID:1872
-
\??\c:\hbthbt.exec:\hbthbt.exe122⤵PID:1528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-