Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 04:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe
-
Size
454KB
-
MD5
bab647ed6b219dc5cf40af47a6f6796a
-
SHA1
215e1c77d9b35bdcaa112de681d81a47f9c56db5
-
SHA256
d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5
-
SHA512
17cae0ce2242c1dc5e0cf232e821881cf3cd14defcd09ab6a219696cf0b70132741dd51b2e9cf59df65a2181ae1f546216f2a37aa5cc041d793ef13a827558f3
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbex:q7Tc2NYHUrAwfMp3CDx
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/1956-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1704-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2204-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-266-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-249-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1196-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-377-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/604-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2084-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-510-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-593-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2096-715-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-1191-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2956-1215-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1544-1318-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2408 dvppj.exe 2368 lllfrrl.exe 1748 hbnthh.exe 2388 5jdjv.exe 2492 rxrxllx.exe 2820 7hbntt.exe 3036 dvppd.exe 2080 5vppd.exe 2640 xrlrflf.exe 2872 3htbbh.exe 2676 xrffrrx.exe 2664 btbhnn.exe 684 1htbhh.exe 604 jdvvd.exe 380 1fxxxxl.exe 804 rfxlxff.exe 2944 nnthbh.exe 2928 thbbnn.exe 1196 dpjjp.exe 3000 fxxrxxf.exe 2188 bnbtnt.exe 2180 tntnth.exe 2568 pjvpj.exe 1868 rrfllrr.exe 448 tbnbhb.exe 3052 hbhnbb.exe 1676 xfxfxfr.exe 788 bbttbt.exe 2448 bttbnn.exe 2512 dvdjp.exe 2460 1xrlllr.exe 400 nbtbbb.exe 1944 tbnbbh.exe 1836 fxxxflf.exe 2204 fxrrrxx.exe 2696 thtnnh.exe 1704 vpdjj.exe 1748 dpjjd.exe 2916 llrxlrf.exe 2416 rrflllx.exe 2756 5tnnbn.exe 2796 5dpvp.exe 2768 fxrfflf.exe 2904 3rllrfl.exe 2856 hhnnbn.exe 2612 vvpvd.exe 2376 dpjpv.exe 2544 5bntnt.exe 2536 nbntbb.exe 604 pdpjd.exe 1120 lrlxxxf.exe 380 tttnnb.exe 1652 jpjdd.exe 2660 xfxfllf.exe 1668 bttbbh.exe 1064 vjjjv.exe 3000 xxrrxfl.exe 1372 tnttbb.exe 2888 3nhhhh.exe 2020 jvjdd.exe 2092 fxlffff.exe 2084 3tnnhn.exe 2892 nhnttb.exe 2972 9pdvd.exe -
resource yara_rule behavioral1/memory/1956-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1704-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1196-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/684-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-377-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2084-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/484-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2096-715-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-734-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-1051-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-1088-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-1198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-1224-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/536-1237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-1298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-1311-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbthnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxfrxr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2408 1956 d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe 30 PID 1956 wrote to memory of 2408 1956 d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe 30 PID 1956 wrote to memory of 2408 1956 d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe 30 PID 1956 wrote to memory of 2408 1956 d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe 30 PID 2408 wrote to memory of 2368 2408 dvppj.exe 31 PID 2408 wrote to memory of 2368 2408 dvppj.exe 31 PID 2408 wrote to memory of 2368 2408 dvppj.exe 31 PID 2408 wrote to memory of 2368 2408 dvppj.exe 31 PID 2368 wrote to memory of 1748 2368 lllfrrl.exe 67 PID 2368 wrote to memory of 1748 2368 lllfrrl.exe 67 PID 2368 wrote to memory of 1748 2368 lllfrrl.exe 67 PID 2368 wrote to memory of 1748 2368 lllfrrl.exe 67 PID 1748 wrote to memory of 2388 1748 hbnthh.exe 33 PID 1748 wrote to memory of 2388 1748 hbnthh.exe 33 PID 1748 wrote to memory of 2388 1748 hbnthh.exe 33 PID 1748 wrote to memory of 2388 1748 hbnthh.exe 33 PID 2388 wrote to memory of 2492 2388 5jdjv.exe 34 PID 2388 wrote to memory of 2492 2388 5jdjv.exe 34 PID 2388 wrote to memory of 2492 2388 5jdjv.exe 34 PID 2388 wrote to memory of 2492 2388 5jdjv.exe 34 PID 2492 wrote to memory of 2820 2492 rxrxllx.exe 35 PID 2492 wrote to memory of 2820 2492 rxrxllx.exe 35 PID 2492 wrote to memory of 2820 2492 rxrxllx.exe 35 PID 2492 wrote to memory of 2820 2492 rxrxllx.exe 35 PID 2820 wrote to memory of 3036 2820 7hbntt.exe 36 PID 2820 wrote to memory of 3036 2820 7hbntt.exe 36 PID 2820 wrote to memory of 3036 2820 7hbntt.exe 36 PID 2820 wrote to memory of 3036 2820 7hbntt.exe 36 PID 3036 wrote to memory of 2080 3036 dvppd.exe 37 PID 3036 wrote to memory of 2080 3036 dvppd.exe 37 PID 3036 wrote to memory of 2080 3036 dvppd.exe 37 PID 3036 wrote to memory of 2080 3036 dvppd.exe 37 PID 2080 wrote to memory of 2640 2080 5vppd.exe 38 PID 2080 wrote to memory of 2640 2080 5vppd.exe 38 PID 2080 wrote to memory of 2640 2080 5vppd.exe 38 PID 2080 wrote to memory of 2640 2080 5vppd.exe 38 PID 2640 wrote to memory of 2872 2640 xrlrflf.exe 39 PID 2640 wrote to memory of 2872 2640 xrlrflf.exe 39 PID 2640 wrote to memory of 2872 2640 xrlrflf.exe 39 PID 2640 wrote to memory of 2872 2640 xrlrflf.exe 39 PID 2872 wrote to memory of 2676 2872 3htbbh.exe 40 PID 2872 wrote to memory of 2676 2872 3htbbh.exe 40 PID 2872 wrote to memory of 2676 2872 3htbbh.exe 40 PID 2872 wrote to memory of 2676 2872 3htbbh.exe 40 PID 2676 wrote to memory of 2664 2676 xrffrrx.exe 41 PID 2676 wrote to memory of 2664 2676 xrffrrx.exe 41 PID 2676 wrote to memory of 2664 2676 xrffrrx.exe 41 PID 2676 wrote to memory of 2664 2676 xrffrrx.exe 41 PID 2664 wrote to memory of 684 2664 btbhnn.exe 42 PID 2664 wrote to memory of 684 2664 btbhnn.exe 42 PID 2664 wrote to memory of 684 2664 btbhnn.exe 42 PID 2664 wrote to memory of 684 2664 btbhnn.exe 42 PID 684 wrote to memory of 604 684 1htbhh.exe 79 PID 684 wrote to memory of 604 684 1htbhh.exe 79 PID 684 wrote to memory of 604 684 1htbhh.exe 79 PID 684 wrote to memory of 604 684 1htbhh.exe 79 PID 604 wrote to memory of 380 604 jdvvd.exe 81 PID 604 wrote to memory of 380 604 jdvvd.exe 81 PID 604 wrote to memory of 380 604 jdvvd.exe 81 PID 604 wrote to memory of 380 604 jdvvd.exe 81 PID 380 wrote to memory of 804 380 1fxxxxl.exe 45 PID 380 wrote to memory of 804 380 1fxxxxl.exe 45 PID 380 wrote to memory of 804 380 1fxxxxl.exe 45 PID 380 wrote to memory of 804 380 1fxxxxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe"C:\Users\Admin\AppData\Local\Temp\d4adf484f02c6e93bd0759ed341b66fee884f9af9fcd5226ff96a25a1b6421c5.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\dvppj.exec:\dvppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\lllfrrl.exec:\lllfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\hbnthh.exec:\hbnthh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\5jdjv.exec:\5jdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rxrxllx.exec:\rxrxllx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7hbntt.exec:\7hbntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dvppd.exec:\dvppd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\5vppd.exec:\5vppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\xrlrflf.exec:\xrlrflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3htbbh.exec:\3htbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xrffrrx.exec:\xrffrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\btbhnn.exec:\btbhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\1htbhh.exec:\1htbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\jdvvd.exec:\jdvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\1fxxxxl.exec:\1fxxxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\rfxlxff.exec:\rfxlxff.exe17⤵
- Executes dropped EXE
PID:804 -
\??\c:\nnthbh.exec:\nnthbh.exe18⤵
- Executes dropped EXE
PID:2944 -
\??\c:\thbbnn.exec:\thbbnn.exe19⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpjjp.exec:\dpjjp.exe20⤵
- Executes dropped EXE
PID:1196 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe21⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bnbtnt.exec:\bnbtnt.exe22⤵
- Executes dropped EXE
PID:2188 -
\??\c:\tntnth.exec:\tntnth.exe23⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pjvpj.exec:\pjvpj.exe24⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rrfllrr.exec:\rrfllrr.exe25⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tbnbhb.exec:\tbnbhb.exe26⤵
- Executes dropped EXE
PID:448 -
\??\c:\hbhnbb.exec:\hbhnbb.exe27⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xfxfxfr.exec:\xfxfxfr.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\bbttbt.exec:\bbttbt.exe29⤵
- Executes dropped EXE
PID:788 -
\??\c:\bttbnn.exec:\bttbnn.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\dvdjp.exec:\dvdjp.exe31⤵
- Executes dropped EXE
PID:2512 -
\??\c:\1xrlllr.exec:\1xrlllr.exe32⤵
- Executes dropped EXE
PID:2460 -
\??\c:\nbtbbb.exec:\nbtbbb.exe33⤵
- Executes dropped EXE
PID:400 -
\??\c:\tbnbbh.exec:\tbnbbh.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1944 -
\??\c:\fxxxflf.exec:\fxxxflf.exe35⤵
- Executes dropped EXE
PID:1836 -
\??\c:\fxrrrxx.exec:\fxrrrxx.exe36⤵
- Executes dropped EXE
PID:2204 -
\??\c:\thtnnh.exec:\thtnnh.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\vpdjj.exec:\vpdjj.exe38⤵
- Executes dropped EXE
PID:1704 -
\??\c:\dpjjd.exec:\dpjjd.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\llrxlrf.exec:\llrxlrf.exe40⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rrflllx.exec:\rrflllx.exe41⤵
- Executes dropped EXE
PID:2416 -
\??\c:\5tnnbn.exec:\5tnnbn.exe42⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5dpvp.exec:\5dpvp.exe43⤵
- Executes dropped EXE
PID:2796 -
\??\c:\fxrfflf.exec:\fxrfflf.exe44⤵
- Executes dropped EXE
PID:2768 -
\??\c:\3rllrfl.exec:\3rllrfl.exe45⤵
- Executes dropped EXE
PID:2904 -
\??\c:\hhnnbn.exec:\hhnnbn.exe46⤵
- Executes dropped EXE
PID:2856 -
\??\c:\vvpvd.exec:\vvpvd.exe47⤵
- Executes dropped EXE
PID:2612 -
\??\c:\dpjpv.exec:\dpjpv.exe48⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5bntnt.exec:\5bntnt.exe49⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nbntbb.exec:\nbntbb.exe50⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pdpjd.exec:\pdpjd.exe51⤵
- Executes dropped EXE
PID:604 -
\??\c:\lrlxxxf.exec:\lrlxxxf.exe52⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tttnnb.exec:\tttnnb.exe53⤵
- Executes dropped EXE
PID:380 -
\??\c:\jpjdd.exec:\jpjdd.exe54⤵
- Executes dropped EXE
PID:1652 -
\??\c:\xfxfllf.exec:\xfxfllf.exe55⤵
- Executes dropped EXE
PID:2660 -
\??\c:\bttbbh.exec:\bttbbh.exe56⤵
- Executes dropped EXE
PID:1668 -
\??\c:\vjjjv.exec:\vjjjv.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xxrrxfl.exec:\xxrrxfl.exe58⤵
- Executes dropped EXE
PID:3000 -
\??\c:\tnttbb.exec:\tnttbb.exe59⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3nhhhh.exec:\3nhhhh.exe60⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jvjdd.exec:\jvjdd.exe61⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxlffff.exec:\fxlffff.exe62⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3tnnhn.exec:\3tnnhn.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nhnttb.exec:\nhnttb.exe64⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9pdvd.exec:\9pdvd.exe65⤵
- Executes dropped EXE
PID:2972 -
\??\c:\7xxxxrr.exec:\7xxxxrr.exe66⤵PID:1400
-
\??\c:\nbnttb.exec:\nbnttb.exe67⤵PID:2000
-
\??\c:\1hbbbn.exec:\1hbbbn.exe68⤵PID:908
-
\??\c:\7dvvd.exec:\7dvvd.exe69⤵PID:484
-
\??\c:\3fxflrr.exec:\3fxflrr.exe70⤵PID:1728
-
\??\c:\7bntnn.exec:\7bntnn.exe71⤵PID:1348
-
\??\c:\3nhnnt.exec:\3nhnnt.exe72⤵PID:1976
-
\??\c:\pvvdv.exec:\pvvdv.exe73⤵PID:1824
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe74⤵PID:880
-
\??\c:\nbtttb.exec:\nbtttb.exe75⤵PID:2060
-
\??\c:\5nbtbb.exec:\5nbtbb.exe76⤵
- System Location Discovery: System Language Discovery
PID:2200 -
\??\c:\lfrflrx.exec:\lfrflrx.exe77⤵PID:2920
-
\??\c:\5lfllfl.exec:\5lfllfl.exe78⤵PID:1808
-
\??\c:\nhbhnt.exec:\nhbhnt.exe79⤵PID:496
-
\??\c:\nhntnn.exec:\nhntnn.exe80⤵PID:1804
-
\??\c:\5vppv.exec:\5vppv.exe81⤵PID:1456
-
\??\c:\7rlxflx.exec:\7rlxflx.exe82⤵PID:2372
-
\??\c:\rrlxllx.exec:\rrlxllx.exe83⤵PID:2216
-
\??\c:\5bttbb.exec:\5bttbb.exe84⤵PID:2752
-
\??\c:\vvjjj.exec:\vvjjj.exe85⤵PID:2832
-
\??\c:\xrffflx.exec:\xrffflx.exe86⤵PID:2768
-
\??\c:\ffxflrf.exec:\ffxflrf.exe87⤵PID:2760
-
\??\c:\9hbhtb.exec:\9hbhtb.exe88⤵PID:2480
-
\??\c:\djdpd.exec:\djdpd.exe89⤵PID:1768
-
\??\c:\pjddj.exec:\pjddj.exe90⤵PID:2668
-
\??\c:\lfxfxlx.exec:\lfxfxlx.exe91⤵PID:2616
-
\??\c:\frfxfxf.exec:\frfxfxf.exe92⤵PID:3028
-
\??\c:\nnhnhn.exec:\nnhnhn.exe93⤵PID:2684
-
\??\c:\dvppj.exec:\dvppj.exe94⤵PID:2900
-
\??\c:\1xrxlrr.exec:\1xrxlrr.exe95⤵PID:2956
-
\??\c:\1lflrfl.exec:\1lflrfl.exe96⤵PID:2960
-
\??\c:\1tnnth.exec:\1tnnth.exe97⤵PID:840
-
\??\c:\ddvvd.exec:\ddvvd.exe98⤵PID:2700
-
\??\c:\jdjvj.exec:\jdjvj.exe99⤵PID:1504
-
\??\c:\rllfrxf.exec:\rllfrxf.exe100⤵PID:2660
-
\??\c:\nttntt.exec:\nttntt.exe101⤵PID:1168
-
\??\c:\bbbbhh.exec:\bbbbhh.exe102⤵PID:1668
-
\??\c:\vvvjv.exec:\vvvjv.exe103⤵PID:2096
-
\??\c:\xrlllrx.exec:\xrlllrx.exe104⤵PID:468
-
\??\c:\rxxflrf.exec:\rxxflrf.exe105⤵PID:1828
-
\??\c:\nhbhhn.exec:\nhbhhn.exe106⤵PID:2364
-
\??\c:\jpdvv.exec:\jpdvv.exe107⤵PID:1812
-
\??\c:\rfrxxxx.exec:\rfrxxxx.exe108⤵PID:2228
-
\??\c:\7fxfxfx.exec:\7fxfxfx.exe109⤵PID:1816
-
\??\c:\hthntt.exec:\hthntt.exe110⤵PID:352
-
\??\c:\dpppd.exec:\dpppd.exe111⤵PID:316
-
\??\c:\pjvdj.exec:\pjvdj.exe112⤵PID:1512
-
\??\c:\fxxflrf.exec:\fxxflrf.exe113⤵PID:1664
-
\??\c:\rllfflf.exec:\rllfflf.exe114⤵PID:1756
-
\??\c:\tnhntb.exec:\tnhntb.exe115⤵PID:1556
-
\??\c:\7pdjv.exec:\7pdjv.exe116⤵PID:1244
-
\??\c:\7xxlxfr.exec:\7xxlxfr.exe117⤵PID:772
-
\??\c:\xrflrrx.exec:\xrflrrx.exe118⤵PID:1824
-
\??\c:\htntnt.exec:\htntnt.exe119⤵PID:1096
-
\??\c:\jjvpv.exec:\jjvpv.exe120⤵PID:1100
-
\??\c:\djjvj.exec:\djjvj.exe121⤵PID:1928
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe122⤵PID:2220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-