Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe
-
Size
453KB
-
MD5
4ec3247ccb526f9aecdc2d4a627a3ddf
-
SHA1
a4137a09d5e726f68a82d4a0bda6fc26824af3cd
-
SHA256
4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c
-
SHA512
bd98e819d0142c9a7087ff29f1e85045c59ef132bfaefb55c161e914447a824cb3a5464ccaad02832077d844bbe4fc99c1a166db9df628ab59e17bee48424f16
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeE:q7Tc2NYHUrAwfMp3CDE
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1964-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-25-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2776-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-142-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1052-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1608-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-269-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-303-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2524-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-354-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2376-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-422-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-488-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2428-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1288-553-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2588-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-647-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2012-655-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-689-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/492-703-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1868-749-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2628 lrrxrrl.exe 2792 htbnhb.exe 2776 lfxllrx.exe 2548 frxxxxx.exe 2692 5vjpj.exe 2552 hnhnbb.exe 2980 dvpvj.exe 2336 nbbttt.exe 2408 jdvdj.exe 1516 lrfffrx.exe 2344 tnhntt.exe 2332 9jjjp.exe 1664 hnbnnh.exe 2760 pjvvd.exe 2964 3hbbnh.exe 1052 jdjjp.exe 1696 xrffxxr.exe 696 nnbthb.exe 2180 vpddd.exe 2232 xlrrlfl.exe 1608 ppddp.exe 2172 lfxxffl.exe 1336 tbnntt.exe 700 7vvjp.exe 776 flfrrrx.exe 2044 nhtbbb.exe 2140 7lllrxf.exe 1808 nhtthh.exe 1700 vvjvd.exe 896 5lffxxx.exe 2244 ppjjp.exe 2444 xflllff.exe 2680 btbbhh.exe 2652 9vdpj.exe 2300 frfllrx.exe 2684 7xfxxxx.exe 1720 9tntht.exe 2524 vjpjd.exe 2536 llfrxxl.exe 2320 1rrflrf.exe 2000 btntnn.exe 3004 dpdvd.exe 2376 3rlfllx.exe 2488 3lrfxrr.exe 2132 7tbbbt.exe 2420 vpvjd.exe 2852 pvpdp.exe 1104 rffxrrx.exe 332 tnbhhn.exe 2972 vvjpp.exe 492 jdvdj.exe 320 llflrrf.exe 2900 nhttbh.exe 2500 vpjdd.exe 2208 5lrrlff.exe 3064 3tnbnn.exe 2248 bthhhn.exe 1144 9dppv.exe 2608 9xrlxrx.exe 2172 nbhhnn.exe 268 jjpvv.exe 1532 vpdjv.exe 564 frlxllr.exe 1216 hhnnbh.exe -
resource yara_rule behavioral1/memory/1964-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1608-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-269-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-354-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-422-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-646-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2012-655-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-662-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-689-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1860-723-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-826-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxffrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5httnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2628 1964 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 1964 wrote to memory of 2628 1964 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 1964 wrote to memory of 2628 1964 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 1964 wrote to memory of 2628 1964 4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe 30 PID 2628 wrote to memory of 2792 2628 lrrxrrl.exe 31 PID 2628 wrote to memory of 2792 2628 lrrxrrl.exe 31 PID 2628 wrote to memory of 2792 2628 lrrxrrl.exe 31 PID 2628 wrote to memory of 2792 2628 lrrxrrl.exe 31 PID 2792 wrote to memory of 2776 2792 htbnhb.exe 32 PID 2792 wrote to memory of 2776 2792 htbnhb.exe 32 PID 2792 wrote to memory of 2776 2792 htbnhb.exe 32 PID 2792 wrote to memory of 2776 2792 htbnhb.exe 32 PID 2776 wrote to memory of 2548 2776 lfxllrx.exe 33 PID 2776 wrote to memory of 2548 2776 lfxllrx.exe 33 PID 2776 wrote to memory of 2548 2776 lfxllrx.exe 33 PID 2776 wrote to memory of 2548 2776 lfxllrx.exe 33 PID 2548 wrote to memory of 2692 2548 frxxxxx.exe 34 PID 2548 wrote to memory of 2692 2548 frxxxxx.exe 34 PID 2548 wrote to memory of 2692 2548 frxxxxx.exe 34 PID 2548 wrote to memory of 2692 2548 frxxxxx.exe 34 PID 2692 wrote to memory of 2552 2692 5vjpj.exe 35 PID 2692 wrote to memory of 2552 2692 5vjpj.exe 35 PID 2692 wrote to memory of 2552 2692 5vjpj.exe 35 PID 2692 wrote to memory of 2552 2692 5vjpj.exe 35 PID 2552 wrote to memory of 2980 2552 hnhnbb.exe 36 PID 2552 wrote to memory of 2980 2552 hnhnbb.exe 36 PID 2552 wrote to memory of 2980 2552 hnhnbb.exe 36 PID 2552 wrote to memory of 2980 2552 hnhnbb.exe 36 PID 2980 wrote to memory of 2336 2980 dvpvj.exe 37 PID 2980 wrote to memory of 2336 2980 dvpvj.exe 37 PID 2980 wrote to memory of 2336 2980 dvpvj.exe 37 PID 2980 wrote to memory of 2336 2980 dvpvj.exe 37 PID 2336 wrote to memory of 2408 2336 nbbttt.exe 38 PID 2336 wrote to memory of 2408 2336 nbbttt.exe 38 PID 2336 wrote to memory of 2408 2336 nbbttt.exe 38 PID 2336 wrote to memory of 2408 2336 nbbttt.exe 38 PID 2408 wrote to memory of 1516 2408 jdvdj.exe 39 PID 2408 wrote to memory of 1516 2408 jdvdj.exe 39 PID 2408 wrote to memory of 1516 2408 jdvdj.exe 39 PID 2408 wrote to memory of 1516 2408 jdvdj.exe 39 PID 1516 wrote to memory of 2344 1516 lrfffrx.exe 40 PID 1516 wrote to memory of 2344 1516 lrfffrx.exe 40 PID 1516 wrote to memory of 2344 1516 lrfffrx.exe 40 PID 1516 wrote to memory of 2344 1516 lrfffrx.exe 40 PID 2344 wrote to memory of 2332 2344 tnhntt.exe 41 PID 2344 wrote to memory of 2332 2344 tnhntt.exe 41 PID 2344 wrote to memory of 2332 2344 tnhntt.exe 41 PID 2344 wrote to memory of 2332 2344 tnhntt.exe 41 PID 2332 wrote to memory of 1664 2332 9jjjp.exe 42 PID 2332 wrote to memory of 1664 2332 9jjjp.exe 42 PID 2332 wrote to memory of 1664 2332 9jjjp.exe 42 PID 2332 wrote to memory of 1664 2332 9jjjp.exe 42 PID 1664 wrote to memory of 2760 1664 hnbnnh.exe 43 PID 1664 wrote to memory of 2760 1664 hnbnnh.exe 43 PID 1664 wrote to memory of 2760 1664 hnbnnh.exe 43 PID 1664 wrote to memory of 2760 1664 hnbnnh.exe 43 PID 2760 wrote to memory of 2964 2760 pjvvd.exe 44 PID 2760 wrote to memory of 2964 2760 pjvvd.exe 44 PID 2760 wrote to memory of 2964 2760 pjvvd.exe 44 PID 2760 wrote to memory of 2964 2760 pjvvd.exe 44 PID 2964 wrote to memory of 1052 2964 3hbbnh.exe 45 PID 2964 wrote to memory of 1052 2964 3hbbnh.exe 45 PID 2964 wrote to memory of 1052 2964 3hbbnh.exe 45 PID 2964 wrote to memory of 1052 2964 3hbbnh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe"C:\Users\Admin\AppData\Local\Temp\4f6e7c0f8a510edbdd662d290ef1818c85b4f45c84786b8b2b1adfeec8a0874c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\lrrxrrl.exec:\lrrxrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\htbnhb.exec:\htbnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\lfxllrx.exec:\lfxllrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\frxxxxx.exec:\frxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\5vjpj.exec:\5vjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\hnhnbb.exec:\hnhnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\dvpvj.exec:\dvpvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\nbbttt.exec:\nbbttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\jdvdj.exec:\jdvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\lrfffrx.exec:\lrfffrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\tnhntt.exec:\tnhntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\9jjjp.exec:\9jjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hnbnnh.exec:\hnbnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\pjvvd.exec:\pjvvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\3hbbnh.exec:\3hbbnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\jdjjp.exec:\jdjjp.exe17⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xrffxxr.exec:\xrffxxr.exe18⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nnbthb.exec:\nnbthb.exe19⤵
- Executes dropped EXE
PID:696 -
\??\c:\vpddd.exec:\vpddd.exe20⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xlrrlfl.exec:\xlrrlfl.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ppddp.exec:\ppddp.exe22⤵
- Executes dropped EXE
PID:1608 -
\??\c:\lfxxffl.exec:\lfxxffl.exe23⤵
- Executes dropped EXE
PID:2172 -
\??\c:\tbnntt.exec:\tbnntt.exe24⤵
- Executes dropped EXE
PID:1336 -
\??\c:\7vvjp.exec:\7vvjp.exe25⤵
- Executes dropped EXE
PID:700 -
\??\c:\flfrrrx.exec:\flfrrrx.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\nhtbbb.exec:\nhtbbb.exe27⤵
- Executes dropped EXE
PID:2044 -
\??\c:\7lllrxf.exec:\7lllrxf.exe28⤵
- Executes dropped EXE
PID:2140 -
\??\c:\nhtthh.exec:\nhtthh.exe29⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vvjvd.exec:\vvjvd.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\5lffxxx.exec:\5lffxxx.exe31⤵
- Executes dropped EXE
PID:896 -
\??\c:\ppjjp.exec:\ppjjp.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xflllff.exec:\xflllff.exe33⤵
- Executes dropped EXE
PID:2444 -
\??\c:\btbbhh.exec:\btbbhh.exe34⤵
- Executes dropped EXE
PID:2680 -
\??\c:\9vdpj.exec:\9vdpj.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\frfllrx.exec:\frfllrx.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7xfxxxx.exec:\7xfxxxx.exe37⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9tntht.exec:\9tntht.exe38⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vjpjd.exec:\vjpjd.exe39⤵
- Executes dropped EXE
PID:2524 -
\??\c:\llfrxxl.exec:\llfrxxl.exe40⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1rrflrf.exec:\1rrflrf.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\btntnn.exec:\btntnn.exe42⤵
- Executes dropped EXE
PID:2000 -
\??\c:\dpdvd.exec:\dpdvd.exe43⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3rlfllx.exec:\3rlfllx.exe44⤵
- Executes dropped EXE
PID:2376 -
\??\c:\3lrfxrr.exec:\3lrfxrr.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7tbbbt.exec:\7tbbbt.exe46⤵
- Executes dropped EXE
PID:2132 -
\??\c:\vpvjd.exec:\vpvjd.exe47⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pvpdp.exec:\pvpdp.exe48⤵
- Executes dropped EXE
PID:2852 -
\??\c:\rffxrrx.exec:\rffxrrx.exe49⤵
- Executes dropped EXE
PID:1104 -
\??\c:\tnbhhn.exec:\tnbhhn.exe50⤵
- Executes dropped EXE
PID:332 -
\??\c:\vvjpp.exec:\vvjpp.exe51⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jdvdj.exec:\jdvdj.exe52⤵
- Executes dropped EXE
PID:492 -
\??\c:\llflrrf.exec:\llflrrf.exe53⤵
- Executes dropped EXE
PID:320 -
\??\c:\nhttbh.exec:\nhttbh.exe54⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vpjdd.exec:\vpjdd.exe55⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5lrrlff.exec:\5lrrlff.exe56⤵
- Executes dropped EXE
PID:2208 -
\??\c:\3tnbnn.exec:\3tnbnn.exe57⤵
- Executes dropped EXE
PID:3064 -
\??\c:\bthhhn.exec:\bthhhn.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\9dppv.exec:\9dppv.exe59⤵
- Executes dropped EXE
PID:1144 -
\??\c:\9xrlxrx.exec:\9xrlxrx.exe60⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nbhhnn.exec:\nbhhnn.exe61⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jjpvv.exec:\jjpvv.exe62⤵
- Executes dropped EXE
PID:268 -
\??\c:\vpdjv.exec:\vpdjv.exe63⤵
- Executes dropped EXE
PID:1532 -
\??\c:\frlxllr.exec:\frlxllr.exe64⤵
- Executes dropped EXE
PID:564 -
\??\c:\hhnnbh.exec:\hhnnbh.exe65⤵
- Executes dropped EXE
PID:1216 -
\??\c:\jdpvp.exec:\jdpvp.exe66⤵PID:2112
-
\??\c:\3djdj.exec:\3djdj.exe67⤵PID:1792
-
\??\c:\rfxxllx.exec:\rfxxllx.exe68⤵PID:1960
-
\??\c:\1nbtnn.exec:\1nbtnn.exe69⤵PID:2428
-
\??\c:\3vdjp.exec:\3vdjp.exe70⤵PID:276
-
\??\c:\jpjdv.exec:\jpjdv.exe71⤵PID:1288
-
\??\c:\7fxxxfl.exec:\7fxxxfl.exe72⤵PID:1772
-
\??\c:\3nbttn.exec:\3nbttn.exe73⤵PID:2244
-
\??\c:\tnhhtb.exec:\tnhhtb.exe74⤵PID:2632
-
\??\c:\ppdvp.exec:\ppdvp.exe75⤵PID:2628
-
\??\c:\lrxxflx.exec:\lrxxflx.exe76⤵PID:2192
-
\??\c:\thtthn.exec:\thtthn.exe77⤵PID:2544
-
\??\c:\tnbbnh.exec:\tnbbnh.exe78⤵PID:2660
-
\??\c:\jppdp.exec:\jppdp.exe79⤵PID:2572
-
\??\c:\flxxxrx.exec:\flxxxrx.exe80⤵PID:2596
-
\??\c:\bbnbnt.exec:\bbnbnt.exe81⤵PID:2588
-
\??\c:\ppjvj.exec:\ppjvj.exe82⤵PID:1820
-
\??\c:\dpppj.exec:\dpppj.exe83⤵PID:3016
-
\??\c:\xxxfrxr.exec:\xxxfrxr.exe84⤵PID:1044
-
\??\c:\3fxrxxx.exec:\3fxrxxx.exe85⤵PID:2408
-
\??\c:\1hbhnt.exec:\1hbhnt.exe86⤵PID:2012
-
\??\c:\jvjdd.exec:\jvjdd.exe87⤵PID:1672
-
\??\c:\1fxxxxl.exec:\1fxxxxl.exe88⤵PID:1440
-
\??\c:\ntttht.exec:\ntttht.exe89⤵PID:568
-
\??\c:\9hhntb.exec:\9hhntb.exe90⤵PID:1664
-
\??\c:\vjvvv.exec:\vjvvv.exe91⤵PID:2708
-
\??\c:\3lxrxxf.exec:\3lxrxxf.exe92⤵PID:2940
-
\??\c:\tnbbhh.exec:\tnbbhh.exe93⤵PID:492
-
\??\c:\htbttn.exec:\htbttn.exe94⤵PID:2624
-
\??\c:\pdjjd.exec:\pdjjd.exe95⤵PID:2900
-
\??\c:\5xfllfl.exec:\5xfllfl.exe96⤵PID:2220
-
\??\c:\nhbbnt.exec:\nhbbnt.exe97⤵PID:1860
-
\??\c:\1ppvv.exec:\1ppvv.exe98⤵PID:1012
-
\??\c:\jjvjj.exec:\jjvjj.exe99⤵PID:2236
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe100⤵PID:1868
-
\??\c:\tthhbb.exec:\tthhbb.exe101⤵PID:1004
-
\??\c:\pdppd.exec:\pdppd.exe102⤵PID:2032
-
\??\c:\5flllff.exec:\5flllff.exe103⤵PID:2492
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe104⤵PID:1524
-
\??\c:\hbnnhh.exec:\hbnnhh.exe105⤵PID:944
-
\??\c:\jdvvj.exec:\jdvvj.exe106⤵PID:2432
-
\??\c:\ffxffrx.exec:\ffxffrx.exe107⤵PID:2112
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe108⤵PID:1612
-
\??\c:\tthtbb.exec:\tthtbb.exe109⤵PID:1692
-
\??\c:\jpdjv.exec:\jpdjv.exe110⤵
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\3flrllr.exec:\3flrllr.exe111⤵PID:276
-
\??\c:\lrfffxl.exec:\lrfffxl.exe112⤵PID:1644
-
\??\c:\bnnbbb.exec:\bnnbbb.exe113⤵PID:1288
-
\??\c:\ddvvj.exec:\ddvvj.exe114⤵PID:1628
-
\??\c:\llxxffr.exec:\llxxffr.exe115⤵PID:2768
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe116⤵PID:2680
-
\??\c:\nbbtnn.exec:\nbbtnn.exe117⤵PID:2712
-
\??\c:\vvvjp.exec:\vvvjp.exe118⤵PID:2744
-
\??\c:\rlrrrxx.exec:\rlrrrxx.exe119⤵PID:2540
-
\??\c:\llxffrl.exec:\llxffrl.exe120⤵PID:2584
-
\??\c:\5tnnbb.exec:\5tnnbb.exe121⤵PID:2568
-
\??\c:\7vvdd.exec:\7vvdd.exe122⤵PID:1748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-