Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
20-12-2024 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe
-
Size
454KB
-
MD5
c6835b55b37f64d046e346494f92da10
-
SHA1
323fbb8ab5f998999bb9023848117425e7fa5e2c
-
SHA256
f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23
-
SHA512
4ff2f78eba394e872661638841867bd507303704abc5730a104c48070c8dd67aa56b8f5cbd080ed94841c019d68ece543ee51a53301bc6530c9dd0faeace281e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeb:q7Tc2NYHUrAwfMp3CDb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2980-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-86-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/328-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-109-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2652-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1180-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/988-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-318-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-358-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-382-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-435-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2388-473-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-533-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1752-549-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1480-713-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-941-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2728 hbntbb.exe 2692 vvpdj.exe 2836 xxfxrrf.exe 2852 9pppj.exe 2848 5pjpd.exe 836 llffrfx.exe 2540 hbthtn.exe 2148 vvjpj.exe 2072 fxffrrx.exe 328 fxlllxl.exe 2104 djdpj.exe 1808 hbttbh.exe 2788 jjjvj.exe 2652 fxrlrfr.exe 1180 vpdpv.exe 1864 1hbbhh.exe 2904 dvvdv.exe 896 7ttnbb.exe 2200 dpvjv.exe 2184 tbbnth.exe 2080 jddpd.exe 2488 lxlfxrl.exe 932 3tnhth.exe 848 xrlxlrx.exe 2408 bttthn.exe 2332 ppdjj.exe 2732 9rffxxr.exe 988 ntnttb.exe 1700 jjvjv.exe 3024 fllffrl.exe 3052 vvjjp.exe 1800 lfxflrx.exe 2976 btnbhn.exe 2812 5ppdp.exe 1720 lfflxxl.exe 1996 hhthnn.exe 2736 5bnhbb.exe 2748 jpdjv.exe 2848 1xrxlfl.exe 2688 9dvjd.exe 2548 rlxflrf.exe 2672 xrlfrxf.exe 2596 9ttntn.exe 2276 dvpvj.exe 1824 xlrrfxf.exe 2132 hnhtnt.exe 1812 hhnbnb.exe 1808 vpjvv.exe 2768 rrrflrf.exe 2780 nbbttn.exe 2616 ddpvd.exe 2936 jjdjj.exe 2944 9llllfr.exe 1892 hhbnbn.exe 684 tnntth.exe 2100 djdjp.exe 2136 lfxxflx.exe 2388 tththh.exe 1708 jdppd.exe 2240 9xrlxxl.exe 740 xrrxrrl.exe 840 1hbhbb.exe 692 vdjvv.exe 1696 7rfrxxf.exe -
resource yara_rule behavioral1/memory/2980-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/328-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-135-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2652-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/988-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-318-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-358-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-382-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1812-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-473-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/740-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-550-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-633-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-713-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-739-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1032-788-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1404-795-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-815-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 2728 2980 f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe 31 PID 2980 wrote to memory of 2728 2980 f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe 31 PID 2980 wrote to memory of 2728 2980 f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe 31 PID 2980 wrote to memory of 2728 2980 f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe 31 PID 2728 wrote to memory of 2692 2728 hbntbb.exe 32 PID 2728 wrote to memory of 2692 2728 hbntbb.exe 32 PID 2728 wrote to memory of 2692 2728 hbntbb.exe 32 PID 2728 wrote to memory of 2692 2728 hbntbb.exe 32 PID 2692 wrote to memory of 2836 2692 vvpdj.exe 33 PID 2692 wrote to memory of 2836 2692 vvpdj.exe 33 PID 2692 wrote to memory of 2836 2692 vvpdj.exe 33 PID 2692 wrote to memory of 2836 2692 vvpdj.exe 33 PID 2836 wrote to memory of 2852 2836 xxfxrrf.exe 34 PID 2836 wrote to memory of 2852 2836 xxfxrrf.exe 34 PID 2836 wrote to memory of 2852 2836 xxfxrrf.exe 34 PID 2836 wrote to memory of 2852 2836 xxfxrrf.exe 34 PID 2852 wrote to memory of 2848 2852 9pppj.exe 35 PID 2852 wrote to memory of 2848 2852 9pppj.exe 35 PID 2852 wrote to memory of 2848 2852 9pppj.exe 35 PID 2852 wrote to memory of 2848 2852 9pppj.exe 35 PID 2848 wrote to memory of 836 2848 5pjpd.exe 36 PID 2848 wrote to memory of 836 2848 5pjpd.exe 36 PID 2848 wrote to memory of 836 2848 5pjpd.exe 36 PID 2848 wrote to memory of 836 2848 5pjpd.exe 36 PID 836 wrote to memory of 2540 836 llffrfx.exe 37 PID 836 wrote to memory of 2540 836 llffrfx.exe 37 PID 836 wrote to memory of 2540 836 llffrfx.exe 37 PID 836 wrote to memory of 2540 836 llffrfx.exe 37 PID 2540 wrote to memory of 2148 2540 hbthtn.exe 38 PID 2540 wrote to memory of 2148 2540 hbthtn.exe 38 PID 2540 wrote to memory of 2148 2540 hbthtn.exe 38 PID 2540 wrote to memory of 2148 2540 hbthtn.exe 38 PID 2148 wrote to memory of 2072 2148 vvjpj.exe 39 PID 2148 wrote to memory of 2072 2148 vvjpj.exe 39 PID 2148 wrote to memory of 2072 2148 vvjpj.exe 39 PID 2148 wrote to memory of 2072 2148 vvjpj.exe 39 PID 2072 wrote to memory of 328 2072 fxffrrx.exe 40 PID 2072 wrote to memory of 328 2072 fxffrrx.exe 40 PID 2072 wrote to memory of 328 2072 fxffrrx.exe 40 PID 2072 wrote to memory of 328 2072 fxffrrx.exe 40 PID 328 wrote to memory of 2104 328 fxlllxl.exe 41 PID 328 wrote to memory of 2104 328 fxlllxl.exe 41 PID 328 wrote to memory of 2104 328 fxlllxl.exe 41 PID 328 wrote to memory of 2104 328 fxlllxl.exe 41 PID 2104 wrote to memory of 1808 2104 djdpj.exe 42 PID 2104 wrote to memory of 1808 2104 djdpj.exe 42 PID 2104 wrote to memory of 1808 2104 djdpj.exe 42 PID 2104 wrote to memory of 1808 2104 djdpj.exe 42 PID 1808 wrote to memory of 2788 1808 hbttbh.exe 43 PID 1808 wrote to memory of 2788 1808 hbttbh.exe 43 PID 1808 wrote to memory of 2788 1808 hbttbh.exe 43 PID 1808 wrote to memory of 2788 1808 hbttbh.exe 43 PID 2788 wrote to memory of 2652 2788 jjjvj.exe 44 PID 2788 wrote to memory of 2652 2788 jjjvj.exe 44 PID 2788 wrote to memory of 2652 2788 jjjvj.exe 44 PID 2788 wrote to memory of 2652 2788 jjjvj.exe 44 PID 2652 wrote to memory of 1180 2652 fxrlrfr.exe 45 PID 2652 wrote to memory of 1180 2652 fxrlrfr.exe 45 PID 2652 wrote to memory of 1180 2652 fxrlrfr.exe 45 PID 2652 wrote to memory of 1180 2652 fxrlrfr.exe 45 PID 1180 wrote to memory of 1864 1180 vpdpv.exe 46 PID 1180 wrote to memory of 1864 1180 vpdpv.exe 46 PID 1180 wrote to memory of 1864 1180 vpdpv.exe 46 PID 1180 wrote to memory of 1864 1180 vpdpv.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe"C:\Users\Admin\AppData\Local\Temp\f072f6654ae3690962b8c0a9729606ed92701d8a944f7d3c0d0f5f5e873afa23N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\hbntbb.exec:\hbntbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vvpdj.exec:\vvpdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\xxfxrrf.exec:\xxfxrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\9pppj.exec:\9pppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\5pjpd.exec:\5pjpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\llffrfx.exec:\llffrfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\hbthtn.exec:\hbthtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\vvjpj.exec:\vvjpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\fxffrrx.exec:\fxffrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\fxlllxl.exec:\fxlllxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:328 -
\??\c:\djdpj.exec:\djdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\hbttbh.exec:\hbttbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\jjjvj.exec:\jjjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\fxrlrfr.exec:\fxrlrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpdpv.exec:\vpdpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\1hbbhh.exec:\1hbbhh.exe17⤵
- Executes dropped EXE
PID:1864 -
\??\c:\dvvdv.exec:\dvvdv.exe18⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7ttnbb.exec:\7ttnbb.exe19⤵
- Executes dropped EXE
PID:896 -
\??\c:\dpvjv.exec:\dpvjv.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\tbbnth.exec:\tbbnth.exe21⤵
- Executes dropped EXE
PID:2184 -
\??\c:\jddpd.exec:\jddpd.exe22⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lxlfxrl.exec:\lxlfxrl.exe23⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3tnhth.exec:\3tnhth.exe24⤵
- Executes dropped EXE
PID:932 -
\??\c:\xrlxlrx.exec:\xrlxlrx.exe25⤵
- Executes dropped EXE
PID:848 -
\??\c:\bttthn.exec:\bttthn.exe26⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppdjj.exec:\ppdjj.exe27⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9rffxxr.exec:\9rffxxr.exe28⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ntnttb.exec:\ntnttb.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\jjvjv.exec:\jjvjv.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fllffrl.exec:\fllffrl.exe31⤵
- Executes dropped EXE
PID:3024 -
\??\c:\vvjjp.exec:\vvjjp.exe32⤵
- Executes dropped EXE
PID:3052 -
\??\c:\lfxflrx.exec:\lfxflrx.exe33⤵
- Executes dropped EXE
PID:1800 -
\??\c:\btnbhn.exec:\btnbhn.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5ppdp.exec:\5ppdp.exe35⤵
- Executes dropped EXE
PID:2812 -
\??\c:\lfflxxl.exec:\lfflxxl.exe36⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhthnn.exec:\hhthnn.exe37⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5bnhbb.exec:\5bnhbb.exe38⤵
- Executes dropped EXE
PID:2736 -
\??\c:\jpdjv.exec:\jpdjv.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1xrxlfl.exec:\1xrxlfl.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\9dvjd.exec:\9dvjd.exe41⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rlxflrf.exec:\rlxflrf.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\xrlfrxf.exec:\xrlfrxf.exe43⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9ttntn.exec:\9ttntn.exe44⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvpvj.exec:\dvpvj.exe45⤵
- Executes dropped EXE
PID:2276 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe46⤵
- Executes dropped EXE
PID:1824 -
\??\c:\hnhtnt.exec:\hnhtnt.exe47⤵
- Executes dropped EXE
PID:2132 -
\??\c:\hhnbnb.exec:\hhnbnb.exe48⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vpjvv.exec:\vpjvv.exe49⤵
- Executes dropped EXE
PID:1808 -
\??\c:\rrrflrf.exec:\rrrflrf.exe50⤵
- Executes dropped EXE
PID:2768 -
\??\c:\nbbttn.exec:\nbbttn.exe51⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ddpvd.exec:\ddpvd.exe52⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jjdjj.exec:\jjdjj.exe53⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9llllfr.exec:\9llllfr.exe54⤵
- Executes dropped EXE
PID:2944 -
\??\c:\hhbnbn.exec:\hhbnbn.exe55⤵
- Executes dropped EXE
PID:1892 -
\??\c:\tnntth.exec:\tnntth.exe56⤵
- Executes dropped EXE
PID:684 -
\??\c:\djdjp.exec:\djdjp.exe57⤵
- Executes dropped EXE
PID:2100 -
\??\c:\lfxxflx.exec:\lfxxflx.exe58⤵
- Executes dropped EXE
PID:2136 -
\??\c:\tththh.exec:\tththh.exe59⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jdppd.exec:\jdppd.exe60⤵
- Executes dropped EXE
PID:1708 -
\??\c:\9xrlxxl.exec:\9xrlxxl.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\xrrxrrl.exec:\xrrxrrl.exe62⤵
- Executes dropped EXE
PID:740 -
\??\c:\1hbhbb.exec:\1hbhbb.exe63⤵
- Executes dropped EXE
PID:840 -
\??\c:\vdjvv.exec:\vdjvv.exe64⤵
- Executes dropped EXE
PID:692 -
\??\c:\7rfrxxf.exec:\7rfrxxf.exe65⤵
- Executes dropped EXE
PID:1696 -
\??\c:\lfxflfr.exec:\lfxflfr.exe66⤵PID:1544
-
\??\c:\tthtth.exec:\tthtth.exe67⤵PID:2408
-
\??\c:\3vpjv.exec:\3vpjv.exe68⤵PID:2028
-
\??\c:\7xxxfxf.exec:\7xxxfxf.exe69⤵PID:1572
-
\??\c:\7xxfflf.exec:\7xxfflf.exe70⤵PID:1752
-
\??\c:\1djjp.exec:\1djjp.exe71⤵PID:1700
-
\??\c:\1jjvj.exec:\1jjvj.exe72⤵PID:1744
-
\??\c:\fxrrllr.exec:\fxrrllr.exe73⤵PID:888
-
\??\c:\tbthhn.exec:\tbthhn.exe74⤵PID:892
-
\??\c:\1pjpd.exec:\1pjpd.exe75⤵PID:2860
-
\??\c:\dvpvj.exec:\dvpvj.exe76⤵PID:1580
-
\??\c:\llxfrxf.exec:\llxfrxf.exe77⤵PID:2820
-
\??\c:\nbnttt.exec:\nbnttt.exe78⤵PID:1584
-
\??\c:\1ddvp.exec:\1ddvp.exe79⤵PID:1996
-
\??\c:\flflxxr.exec:\flflxxr.exe80⤵PID:2824
-
\??\c:\rrlrfll.exec:\rrlrfll.exe81⤵PID:2852
-
\??\c:\hhhthn.exec:\hhhthn.exe82⤵PID:2664
-
\??\c:\pddpj.exec:\pddpj.exe83⤵PID:2592
-
\??\c:\dvjjp.exec:\dvjjp.exe84⤵PID:1408
-
\??\c:\xlxffrl.exec:\xlxffrl.exe85⤵PID:1796
-
\??\c:\btnbnn.exec:\btnbnn.exe86⤵PID:320
-
\??\c:\ddvvj.exec:\ddvvj.exe87⤵PID:1740
-
\??\c:\vpjjd.exec:\vpjjd.exe88⤵PID:1804
-
\??\c:\ffxlffr.exec:\ffxlffr.exe89⤵PID:2176
-
\??\c:\hhhtth.exec:\hhhtth.exe90⤵PID:3048
-
\??\c:\hhttbn.exec:\hhttbn.exe91⤵PID:1284
-
\??\c:\9vpvp.exec:\9vpvp.exe92⤵PID:2784
-
\??\c:\xfxlxfr.exec:\xfxlxfr.exe93⤵PID:2900
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe94⤵PID:2764
-
\??\c:\nnbtbh.exec:\nnbtbh.exe95⤵PID:2652
-
\??\c:\nhbbhh.exec:\nhbbhh.exe96⤵PID:2968
-
\??\c:\1jpvj.exec:\1jpvj.exe97⤵PID:1480
-
\??\c:\rflxfxf.exec:\rflxfxf.exe98⤵PID:280
-
\??\c:\xrffffx.exec:\xrffffx.exe99⤵PID:1632
-
\??\c:\hntbnn.exec:\hntbnn.exe100⤵PID:2168
-
\??\c:\ddvvp.exec:\ddvvp.exe101⤵PID:2524
-
\??\c:\lrlxrxl.exec:\lrlxrxl.exe102⤵PID:2200
-
\??\c:\xxxlxfr.exec:\xxxlxfr.exe103⤵PID:2184
-
\??\c:\5tnttb.exec:\5tnttb.exe104⤵PID:324
-
\??\c:\hnhnbb.exec:\hnhnbb.exe105⤵PID:1356
-
\??\c:\jjpvj.exec:\jjpvj.exe106⤵PID:740
-
\??\c:\ffxrflf.exec:\ffxrflf.exe107⤵PID:2488
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe108⤵PID:864
-
\??\c:\1thttb.exec:\1thttb.exe109⤵PID:1032
-
\??\c:\7ppvj.exec:\7ppvj.exe110⤵PID:1404
-
\??\c:\5llrxfr.exec:\5llrxfr.exe111⤵PID:2408
-
\??\c:\nnbbhn.exec:\nnbbhn.exe112⤵PID:2028
-
\??\c:\hhhnhh.exec:\hhhnhh.exe113⤵PID:2484
-
\??\c:\ppvdv.exec:\ppvdv.exe114⤵PID:1316
-
\??\c:\9lrlfxx.exec:\9lrlfxx.exe115⤵PID:2144
-
\??\c:\lfxlxfl.exec:\lfxlxfl.exe116⤵PID:1692
-
\??\c:\btntnn.exec:\btntnn.exe117⤵PID:2436
-
\??\c:\9jvdp.exec:\9jvdp.exe118⤵PID:2108
-
\??\c:\5xxxxfx.exec:\5xxxxfx.exe119⤵PID:2804
-
\??\c:\9rfxfff.exec:\9rfxfff.exe120⤵PID:2660
-
\??\c:\9bnhnn.exec:\9bnhnn.exe121⤵PID:1580
-
\??\c:\7pjpp.exec:\7pjpp.exe122⤵PID:2836
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-