Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22-12-2024 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe
-
Size
454KB
-
MD5
516d7178bbe78886fe338644fee38c4c
-
SHA1
9dad60616cbdffcee1e44291a87489bd7aeec679
-
SHA256
5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3
-
SHA512
e26911cb5265e6fbec28970b8547f211d7955370d9ebc4f93f5ed0ee49f354222c6b809193ef83822a9c7e03091dde44e29a39accbc3a186cb356720106e7560
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeVJ:q7Tc2NYHUrAwfMp3CDVJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-21-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2832-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2604-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/656-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1480-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/408-148-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1892-185-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/304-221-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-241-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-264-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2260-287-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2036-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-403-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-418-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/840-432-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1936-493-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-630-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-689-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1344-698-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-738-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1040-753-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2696 1xxrlxr.exe 2700 bbtbtb.exe 1536 xxflrxl.exe 2832 3nhnbh.exe 2604 9rlfllr.exe 2580 7tnntb.exe 2596 ffrfrxr.exe 656 9pjjv.exe 1088 9rflrxl.exe 2392 1jpvj.exe 1532 9xxxrxf.exe 2068 9rllxxl.exe 1480 pjjjp.exe 1860 ntbtnh.exe 408 jjjjv.exe 1448 bnhnbh.exe 788 dvvdj.exe 1772 9nhhtb.exe 1892 5jdjv.exe 2008 1hbhnn.exe 1936 9jjjp.exe 1744 ttntnb.exe 304 9vvdp.exe 288 btnttt.exe 1800 tnbbhn.exe 1612 fxxlrfl.exe 2484 nhtbbb.exe 2180 xrllrxr.exe 1684 1tnttb.exe 2260 lrlrxfr.exe 1756 hhtbbh.exe 2424 lfxflxl.exe 2692 tntbnn.exe 2752 jdvdj.exe 2704 7lfrxfr.exe 2808 1bthnh.exe 2636 3jvvv.exe 2548 flrlflf.exe 2624 frlrfrf.exe 3032 9hbhtt.exe 2036 5jvdp.exe 2244 fflrflf.exe 828 hnnbth.exe 2964 ppddp.exe 2148 ffxlxfr.exe 2504 tbtbhn.exe 2384 bnhntt.exe 2052 9ddjp.exe 2000 fxllflx.exe 840 nbnnbh.exe 2020 3pjjp.exe 2516 xxxxrxl.exe 2616 3frrxxf.exe 1740 hhbbtt.exe 2088 vjvdj.exe 2176 ffxfrxx.exe 2980 rllrflf.exe 2132 nbttbh.exe 1300 ppjjv.exe 1936 lfxlrxl.exe 3068 tnbnhn.exe 1896 ddpjv.exe 2864 rrlxlxx.exe 1388 3nnbnt.exe -
resource yara_rule behavioral1/memory/2196-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1536-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/656-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2392-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1480-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-149-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/408-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1892-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/304-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-241-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-287-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2036-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-403-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/840-432-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1936-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-623-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-630-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rlflfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2696 2196 5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe 30 PID 2196 wrote to memory of 2696 2196 5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe 30 PID 2196 wrote to memory of 2696 2196 5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe 30 PID 2196 wrote to memory of 2696 2196 5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe 30 PID 2696 wrote to memory of 2700 2696 1xxrlxr.exe 31 PID 2696 wrote to memory of 2700 2696 1xxrlxr.exe 31 PID 2696 wrote to memory of 2700 2696 1xxrlxr.exe 31 PID 2696 wrote to memory of 2700 2696 1xxrlxr.exe 31 PID 2700 wrote to memory of 1536 2700 bbtbtb.exe 32 PID 2700 wrote to memory of 1536 2700 bbtbtb.exe 32 PID 2700 wrote to memory of 1536 2700 bbtbtb.exe 32 PID 2700 wrote to memory of 1536 2700 bbtbtb.exe 32 PID 1536 wrote to memory of 2832 1536 xxflrxl.exe 33 PID 1536 wrote to memory of 2832 1536 xxflrxl.exe 33 PID 1536 wrote to memory of 2832 1536 xxflrxl.exe 33 PID 1536 wrote to memory of 2832 1536 xxflrxl.exe 33 PID 2832 wrote to memory of 2604 2832 3nhnbh.exe 34 PID 2832 wrote to memory of 2604 2832 3nhnbh.exe 34 PID 2832 wrote to memory of 2604 2832 3nhnbh.exe 34 PID 2832 wrote to memory of 2604 2832 3nhnbh.exe 34 PID 2604 wrote to memory of 2580 2604 9rlfllr.exe 35 PID 2604 wrote to memory of 2580 2604 9rlfllr.exe 35 PID 2604 wrote to memory of 2580 2604 9rlfllr.exe 35 PID 2604 wrote to memory of 2580 2604 9rlfllr.exe 35 PID 2580 wrote to memory of 2596 2580 7tnntb.exe 36 PID 2580 wrote to memory of 2596 2580 7tnntb.exe 36 PID 2580 wrote to memory of 2596 2580 7tnntb.exe 36 PID 2580 wrote to memory of 2596 2580 7tnntb.exe 36 PID 2596 wrote to memory of 656 2596 ffrfrxr.exe 37 PID 2596 wrote to memory of 656 2596 ffrfrxr.exe 37 PID 2596 wrote to memory of 656 2596 ffrfrxr.exe 37 PID 2596 wrote to memory of 656 2596 ffrfrxr.exe 37 PID 656 wrote to memory of 1088 656 9pjjv.exe 38 PID 656 wrote to memory of 1088 656 9pjjv.exe 38 PID 656 wrote to memory of 1088 656 9pjjv.exe 38 PID 656 wrote to memory of 1088 656 9pjjv.exe 38 PID 1088 wrote to memory of 2392 1088 9rflrxl.exe 39 PID 1088 wrote to memory of 2392 1088 9rflrxl.exe 39 PID 1088 wrote to memory of 2392 1088 9rflrxl.exe 39 PID 1088 wrote to memory of 2392 1088 9rflrxl.exe 39 PID 2392 wrote to memory of 1532 2392 1jpvj.exe 40 PID 2392 wrote to memory of 1532 2392 1jpvj.exe 40 PID 2392 wrote to memory of 1532 2392 1jpvj.exe 40 PID 2392 wrote to memory of 1532 2392 1jpvj.exe 40 PID 1532 wrote to memory of 2068 1532 9xxxrxf.exe 41 PID 1532 wrote to memory of 2068 1532 9xxxrxf.exe 41 PID 1532 wrote to memory of 2068 1532 9xxxrxf.exe 41 PID 1532 wrote to memory of 2068 1532 9xxxrxf.exe 41 PID 2068 wrote to memory of 1480 2068 9rllxxl.exe 42 PID 2068 wrote to memory of 1480 2068 9rllxxl.exe 42 PID 2068 wrote to memory of 1480 2068 9rllxxl.exe 42 PID 2068 wrote to memory of 1480 2068 9rllxxl.exe 42 PID 1480 wrote to memory of 1860 1480 pjjjp.exe 43 PID 1480 wrote to memory of 1860 1480 pjjjp.exe 43 PID 1480 wrote to memory of 1860 1480 pjjjp.exe 43 PID 1480 wrote to memory of 1860 1480 pjjjp.exe 43 PID 1860 wrote to memory of 408 1860 ntbtnh.exe 44 PID 1860 wrote to memory of 408 1860 ntbtnh.exe 44 PID 1860 wrote to memory of 408 1860 ntbtnh.exe 44 PID 1860 wrote to memory of 408 1860 ntbtnh.exe 44 PID 408 wrote to memory of 1448 408 jjjjv.exe 45 PID 408 wrote to memory of 1448 408 jjjjv.exe 45 PID 408 wrote to memory of 1448 408 jjjjv.exe 45 PID 408 wrote to memory of 1448 408 jjjjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe"C:\Users\Admin\AppData\Local\Temp\5ccf689fe23c37c94dd3cbade0646985376fabc85654b2c07a43a2f767d43ed3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\1xxrlxr.exec:\1xxrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bbtbtb.exec:\bbtbtb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xxflrxl.exec:\xxflrxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\3nhnbh.exec:\3nhnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9rlfllr.exec:\9rlfllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\7tnntb.exec:\7tnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\ffrfrxr.exec:\ffrfrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\9pjjv.exec:\9pjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\9rflrxl.exec:\9rflrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\1jpvj.exec:\1jpvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\9xxxrxf.exec:\9xxxrxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\9rllxxl.exec:\9rllxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\pjjjp.exec:\pjjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\ntbtnh.exec:\ntbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\jjjjv.exec:\jjjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\bnhnbh.exec:\bnhnbh.exe17⤵
- Executes dropped EXE
PID:1448 -
\??\c:\dvvdj.exec:\dvvdj.exe18⤵
- Executes dropped EXE
PID:788 -
\??\c:\9nhhtb.exec:\9nhhtb.exe19⤵
- Executes dropped EXE
PID:1772 -
\??\c:\5jdjv.exec:\5jdjv.exe20⤵
- Executes dropped EXE
PID:1892 -
\??\c:\1hbhnn.exec:\1hbhnn.exe21⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9jjjp.exec:\9jjjp.exe22⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ttntnb.exec:\ttntnb.exe23⤵
- Executes dropped EXE
PID:1744 -
\??\c:\9vvdp.exec:\9vvdp.exe24⤵
- Executes dropped EXE
PID:304 -
\??\c:\btnttt.exec:\btnttt.exe25⤵
- Executes dropped EXE
PID:288 -
\??\c:\tnbbhn.exec:\tnbbhn.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\fxxlrfl.exec:\fxxlrfl.exe27⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nhtbbb.exec:\nhtbbb.exe28⤵
- Executes dropped EXE
PID:2484 -
\??\c:\xrllrxr.exec:\xrllrxr.exe29⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1tnttb.exec:\1tnttb.exe30⤵
- Executes dropped EXE
PID:1684 -
\??\c:\lrlrxfr.exec:\lrlrxfr.exe31⤵
- Executes dropped EXE
PID:2260 -
\??\c:\hhtbbh.exec:\hhtbbh.exe32⤵
- Executes dropped EXE
PID:1756 -
\??\c:\lfxflxl.exec:\lfxflxl.exe33⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tntbnn.exec:\tntbnn.exe34⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jdvdj.exec:\jdvdj.exe35⤵
- Executes dropped EXE
PID:2752 -
\??\c:\7lfrxfr.exec:\7lfrxfr.exe36⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1bthnh.exec:\1bthnh.exe37⤵
- Executes dropped EXE
PID:2808 -
\??\c:\3jvvv.exec:\3jvvv.exe38⤵
- Executes dropped EXE
PID:2636 -
\??\c:\flrlflf.exec:\flrlflf.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\frlrfrf.exec:\frlrfrf.exe40⤵
- Executes dropped EXE
PID:2624 -
\??\c:\9hbhtt.exec:\9hbhtt.exe41⤵
- Executes dropped EXE
PID:3032 -
\??\c:\5jvdp.exec:\5jvdp.exe42⤵
- Executes dropped EXE
PID:2036 -
\??\c:\fflrflf.exec:\fflrflf.exe43⤵
- Executes dropped EXE
PID:2244 -
\??\c:\hnnbth.exec:\hnnbth.exe44⤵
- Executes dropped EXE
PID:828 -
\??\c:\ppddp.exec:\ppddp.exe45⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ffxlxfr.exec:\ffxlxfr.exe46⤵
- Executes dropped EXE
PID:2148 -
\??\c:\tbtbhn.exec:\tbtbhn.exe47⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bnhntt.exec:\bnhntt.exe48⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9ddjp.exec:\9ddjp.exe49⤵
- Executes dropped EXE
PID:2052 -
\??\c:\fxllflx.exec:\fxllflx.exe50⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nbnnbh.exec:\nbnnbh.exe51⤵
- Executes dropped EXE
PID:840 -
\??\c:\3pjjp.exec:\3pjjp.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\xxxxrxl.exec:\xxxxrxl.exe53⤵
- Executes dropped EXE
PID:2516 -
\??\c:\3frrxxf.exec:\3frrxxf.exe54⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hhbbtt.exec:\hhbbtt.exe55⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vjvdj.exec:\vjvdj.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ffxfrxx.exec:\ffxfrxx.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\rllrflf.exec:\rllrflf.exe58⤵
- Executes dropped EXE
PID:2980 -
\??\c:\nbttbh.exec:\nbttbh.exe59⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ppjjv.exec:\ppjjv.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\lfxlrxl.exec:\lfxlrxl.exe61⤵
- Executes dropped EXE
PID:1936 -
\??\c:\tnbnhn.exec:\tnbnhn.exe62⤵
- Executes dropped EXE
PID:3068 -
\??\c:\ddpjv.exec:\ddpjv.exe63⤵
- Executes dropped EXE
PID:1896 -
\??\c:\rrlxlxx.exec:\rrlxlxx.exe64⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3nnbnt.exec:\3nnbnt.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1388 -
\??\c:\nhtthn.exec:\nhtthn.exe66⤵PID:1800
-
\??\c:\ddpvj.exec:\ddpvj.exe67⤵PID:1612
-
\??\c:\rxrxffr.exec:\rxrxffr.exe68⤵PID:2492
-
\??\c:\3hbhth.exec:\3hbhth.exe69⤵PID:1876
-
\??\c:\hbnntb.exec:\hbnntb.exe70⤵PID:2208
-
\??\c:\dvddp.exec:\dvddp.exe71⤵PID:1748
-
\??\c:\rrffrrf.exec:\rrffrrf.exe72⤵PID:792
-
\??\c:\fxrxllr.exec:\fxrxllr.exe73⤵PID:2144
-
\??\c:\btntbh.exec:\btntbh.exe74⤵PID:2120
-
\??\c:\vvdjv.exec:\vvdjv.exe75⤵PID:2768
-
\??\c:\lxlxfrf.exec:\lxlxfrf.exe76⤵PID:1572
-
\??\c:\rfrrxfr.exec:\rfrrxfr.exe77⤵PID:2796
-
\??\c:\1btntt.exec:\1btntt.exe78⤵PID:2664
-
\??\c:\pjjpv.exec:\pjjpv.exe79⤵PID:2576
-
\??\c:\vppvd.exec:\vppvd.exe80⤵PID:2840
-
\??\c:\1rlllrx.exec:\1rlllrx.exe81⤵PID:2636
-
\??\c:\nhbbtn.exec:\nhbbtn.exe82⤵PID:2668
-
\??\c:\vdvdp.exec:\vdvdp.exe83⤵PID:2620
-
\??\c:\fxrxffr.exec:\fxrxffr.exe84⤵PID:3032
-
\??\c:\llfxflr.exec:\llfxflr.exe85⤵PID:2036
-
\??\c:\thbbnn.exec:\thbbnn.exe86⤵PID:1872
-
\??\c:\7pdjp.exec:\7pdjp.exe87⤵PID:1292
-
\??\c:\flffrxl.exec:\flffrxl.exe88⤵PID:1052
-
\??\c:\ttthhn.exec:\ttthhn.exe89⤵PID:2148
-
\??\c:\vpdvd.exec:\vpdvd.exe90⤵PID:1216
-
\??\c:\3vpvj.exec:\3vpvj.exe91⤵PID:1344
-
\??\c:\flrxrrf.exec:\flrxrrf.exe92⤵PID:2052
-
\??\c:\nhtbtb.exec:\nhtbtb.exe93⤵PID:1676
-
\??\c:\9vpjj.exec:\9vpjj.exe94⤵PID:2352
-
\??\c:\rrlxxfx.exec:\rrlxxfx.exe95⤵PID:2536
-
\??\c:\lrxlxfx.exec:\lrxlxfx.exe96⤵PID:1448
-
\??\c:\tthnhh.exec:\tthnhh.exe97⤵PID:952
-
\??\c:\vvpjj.exec:\vvpjj.exe98⤵PID:788
-
\??\c:\1fxfllr.exec:\1fxfllr.exe99⤵PID:1040
-
\??\c:\5ffxlxl.exec:\5ffxlxl.exe100⤵PID:1892
-
\??\c:\9bbnth.exec:\9bbnth.exe101⤵PID:2096
-
\??\c:\djdjd.exec:\djdjd.exe102⤵PID:2328
-
\??\c:\lrlrfxl.exec:\lrlrfxl.exe103⤵PID:1084
-
\??\c:\rrrxrxl.exec:\rrrxrxl.exe104⤵PID:1936
-
\??\c:\btnnbb.exec:\btnnbb.exe105⤵PID:2256
-
\??\c:\vpvpp.exec:\vpvpp.exe106⤵PID:1516
-
\??\c:\vvvpv.exec:\vvvpv.exe107⤵PID:2432
-
\??\c:\fxrrfll.exec:\fxrrfll.exe108⤵PID:2192
-
\??\c:\thbhtn.exec:\thbhtn.exe109⤵PID:552
-
\??\c:\9thhtt.exec:\9thhtt.exe110⤵PID:1192
-
\??\c:\jjvjd.exec:\jjvjd.exe111⤵PID:3004
-
\??\c:\5rrfxxx.exec:\5rrfxxx.exe112⤵PID:2456
-
\??\c:\3thnbb.exec:\3thnbb.exe113⤵PID:1056
-
\??\c:\jdddj.exec:\jdddj.exe114⤵PID:2404
-
\??\c:\fxxlxlr.exec:\fxxlxlr.exe115⤵PID:2428
-
\??\c:\ttnttt.exec:\ttnttt.exe116⤵PID:1756
-
\??\c:\hhtnnn.exec:\hhtnnn.exe117⤵PID:1584
-
\??\c:\dvpdd.exec:\dvpdd.exe118⤵PID:1572
-
\??\c:\xrffrrf.exec:\xrffrrf.exe119⤵PID:2796
-
\??\c:\rlxflfr.exec:\rlxflfr.exe120⤵PID:2664
-
\??\c:\btbbhh.exec:\btbbhh.exe121⤵PID:2276
-
\??\c:\vpvpv.exec:\vpvpv.exe122⤵PID:2840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-