Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 01:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe
-
Size
453KB
-
MD5
5c608f30b7ae2164e8b1670a1e1bd270
-
SHA1
f861e7ec850942d6b6ffca7f5f4b7774b415f12d
-
SHA256
a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6
-
SHA512
c1ee64d60172d901adc7e88a6c34a59d0d0df6c6d6a14b98f1f3f02b3f7a113ec15948c654594c5dbdb0f3533d998ac5ff6aaf944699be25d9676598677a87c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbel:q7Tc2NYHUrAwfMp3CDl
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2720-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2192-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2068-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-65-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/596-85-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2156-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2884-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-139-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1152-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2200-208-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2420-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/376-252-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1900-288-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2284-303-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1012-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-408-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1752-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1244-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-422-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2472-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-437-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1724-451-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-477-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1120-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-566-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2444-573-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2736-580-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2004-674-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-832-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2844-834-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2720 jpvpd.exe 2780 5xflrxf.exe 2692 hbnhnh.exe 3036 3vppj.exe 1532 7lxlrxl.exe 2652 xlfrllx.exe 2068 hbtntt.exe 596 3vddp.exe 1220 5lfxxff.exe 2396 1thbnh.exe 2156 dddpj.exe 2884 nbhhbb.exe 2132 3vjjp.exe 1152 frllflr.exe 2872 frffxxf.exe 2476 3xrxxff.exe 1372 9nbnhh.exe 2752 dpjpj.exe 2456 rlxfxrx.exe 2308 ddvjd.exe 2200 btnntt.exe 1412 pjvpj.exe 1120 bbhhtt.exe 2420 pdvdv.exe 372 thhhnn.exe 376 nbtbtb.exe 832 5dvvv.exe 1420 jddjd.exe 3024 nnbhnt.exe 1900 1dvpp.exe 1600 5httbb.exe 2284 hbnbtb.exe 2736 dvvvd.exe 2600 rfxflrr.exe 2916 3nnntt.exe 1012 pjppj.exe 2588 fflrxxf.exe 2640 htbhtt.exe 3008 7hnnhh.exe 480 pdpjv.exe 596 5flfflx.exe 264 rfxrrxl.exe 2540 hbhtbt.exe 2152 dpddj.exe 2104 rrffrrf.exe 1852 rrfrffr.exe 628 9bnttn.exe 1752 pdvvj.exe 1244 1frfllr.exe 1880 hbnbnt.exe 2472 1jpvv.exe 2476 1vddd.exe 2960 3rxfllr.exe 1724 fxlrfxl.exe 2232 bnnntb.exe 2136 9dvjp.exe 2312 9jdpv.exe 2440 3rlfrxx.exe 2036 bnhnnt.exe 916 3nbhhn.exe 1120 vvjjp.exe 1672 xlrrfxf.exe 1620 btnbnn.exe 372 tnbbnt.exe -
resource yara_rule behavioral1/memory/2720-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2192-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-85-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2156-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2884-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2200-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-288-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1012-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-394-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1244-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-437-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-451-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-477-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-490-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1120-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-580-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2004-674-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1696-701-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-800-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-807-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xlllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2720 2192 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 30 PID 2192 wrote to memory of 2720 2192 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 30 PID 2192 wrote to memory of 2720 2192 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 30 PID 2192 wrote to memory of 2720 2192 a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe 30 PID 2720 wrote to memory of 2780 2720 jpvpd.exe 31 PID 2720 wrote to memory of 2780 2720 jpvpd.exe 31 PID 2720 wrote to memory of 2780 2720 jpvpd.exe 31 PID 2720 wrote to memory of 2780 2720 jpvpd.exe 31 PID 2780 wrote to memory of 2692 2780 5xflrxf.exe 32 PID 2780 wrote to memory of 2692 2780 5xflrxf.exe 32 PID 2780 wrote to memory of 2692 2780 5xflrxf.exe 32 PID 2780 wrote to memory of 2692 2780 5xflrxf.exe 32 PID 2692 wrote to memory of 3036 2692 hbnhnh.exe 33 PID 2692 wrote to memory of 3036 2692 hbnhnh.exe 33 PID 2692 wrote to memory of 3036 2692 hbnhnh.exe 33 PID 2692 wrote to memory of 3036 2692 hbnhnh.exe 33 PID 3036 wrote to memory of 1532 3036 3vppj.exe 34 PID 3036 wrote to memory of 1532 3036 3vppj.exe 34 PID 3036 wrote to memory of 1532 3036 3vppj.exe 34 PID 3036 wrote to memory of 1532 3036 3vppj.exe 34 PID 1532 wrote to memory of 2652 1532 7lxlrxl.exe 35 PID 1532 wrote to memory of 2652 1532 7lxlrxl.exe 35 PID 1532 wrote to memory of 2652 1532 7lxlrxl.exe 35 PID 1532 wrote to memory of 2652 1532 7lxlrxl.exe 35 PID 2652 wrote to memory of 2068 2652 xlfrllx.exe 36 PID 2652 wrote to memory of 2068 2652 xlfrllx.exe 36 PID 2652 wrote to memory of 2068 2652 xlfrllx.exe 36 PID 2652 wrote to memory of 2068 2652 xlfrllx.exe 36 PID 2068 wrote to memory of 596 2068 hbtntt.exe 37 PID 2068 wrote to memory of 596 2068 hbtntt.exe 37 PID 2068 wrote to memory of 596 2068 hbtntt.exe 37 PID 2068 wrote to memory of 596 2068 hbtntt.exe 37 PID 596 wrote to memory of 1220 596 3vddp.exe 38 PID 596 wrote to memory of 1220 596 3vddp.exe 38 PID 596 wrote to memory of 1220 596 3vddp.exe 38 PID 596 wrote to memory of 1220 596 3vddp.exe 38 PID 1220 wrote to memory of 2396 1220 5lfxxff.exe 39 PID 1220 wrote to memory of 2396 1220 5lfxxff.exe 39 PID 1220 wrote to memory of 2396 1220 5lfxxff.exe 39 PID 1220 wrote to memory of 2396 1220 5lfxxff.exe 39 PID 2396 wrote to memory of 2156 2396 1thbnh.exe 40 PID 2396 wrote to memory of 2156 2396 1thbnh.exe 40 PID 2396 wrote to memory of 2156 2396 1thbnh.exe 40 PID 2396 wrote to memory of 2156 2396 1thbnh.exe 40 PID 2156 wrote to memory of 2884 2156 dddpj.exe 41 PID 2156 wrote to memory of 2884 2156 dddpj.exe 41 PID 2156 wrote to memory of 2884 2156 dddpj.exe 41 PID 2156 wrote to memory of 2884 2156 dddpj.exe 41 PID 2884 wrote to memory of 2132 2884 nbhhbb.exe 42 PID 2884 wrote to memory of 2132 2884 nbhhbb.exe 42 PID 2884 wrote to memory of 2132 2884 nbhhbb.exe 42 PID 2884 wrote to memory of 2132 2884 nbhhbb.exe 42 PID 2132 wrote to memory of 1152 2132 3vjjp.exe 43 PID 2132 wrote to memory of 1152 2132 3vjjp.exe 43 PID 2132 wrote to memory of 1152 2132 3vjjp.exe 43 PID 2132 wrote to memory of 1152 2132 3vjjp.exe 43 PID 1152 wrote to memory of 2872 1152 frllflr.exe 44 PID 1152 wrote to memory of 2872 1152 frllflr.exe 44 PID 1152 wrote to memory of 2872 1152 frllflr.exe 44 PID 1152 wrote to memory of 2872 1152 frllflr.exe 44 PID 2872 wrote to memory of 2476 2872 frffxxf.exe 45 PID 2872 wrote to memory of 2476 2872 frffxxf.exe 45 PID 2872 wrote to memory of 2476 2872 frffxxf.exe 45 PID 2872 wrote to memory of 2476 2872 frffxxf.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe"C:\Users\Admin\AppData\Local\Temp\a1c7bcdbea7d4a27c3bb4c254cbe7fb2a93937e2ee812fdd8a255b3c15e3eef6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\jpvpd.exec:\jpvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\5xflrxf.exec:\5xflrxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\hbnhnh.exec:\hbnhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3vppj.exec:\3vppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7lxlrxl.exec:\7lxlrxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\xlfrllx.exec:\xlfrllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hbtntt.exec:\hbtntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\3vddp.exec:\3vddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\5lfxxff.exec:\5lfxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\1thbnh.exec:\1thbnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dddpj.exec:\dddpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nbhhbb.exec:\nbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\3vjjp.exec:\3vjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\frllflr.exec:\frllflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\frffxxf.exec:\frffxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\3xrxxff.exec:\3xrxxff.exe17⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9nbnhh.exec:\9nbnhh.exe18⤵
- Executes dropped EXE
PID:1372 -
\??\c:\dpjpj.exec:\dpjpj.exe19⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlxfxrx.exec:\rlxfxrx.exe20⤵
- Executes dropped EXE
PID:2456 -
\??\c:\ddvjd.exec:\ddvjd.exe21⤵
- Executes dropped EXE
PID:2308 -
\??\c:\btnntt.exec:\btnntt.exe22⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjvpj.exec:\pjvpj.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bbhhtt.exec:\bbhhtt.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1120 -
\??\c:\pdvdv.exec:\pdvdv.exe25⤵
- Executes dropped EXE
PID:2420 -
\??\c:\thhhnn.exec:\thhhnn.exe26⤵
- Executes dropped EXE
PID:372 -
\??\c:\nbtbtb.exec:\nbtbtb.exe27⤵
- Executes dropped EXE
PID:376 -
\??\c:\5dvvv.exec:\5dvvv.exe28⤵
- Executes dropped EXE
PID:832 -
\??\c:\jddjd.exec:\jddjd.exe29⤵
- Executes dropped EXE
PID:1420 -
\??\c:\nnbhnt.exec:\nnbhnt.exe30⤵
- Executes dropped EXE
PID:3024 -
\??\c:\1dvpp.exec:\1dvpp.exe31⤵
- Executes dropped EXE
PID:1900 -
\??\c:\5httbb.exec:\5httbb.exe32⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hbnbtb.exec:\hbnbtb.exe33⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dvvvd.exec:\dvvvd.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rfxflrr.exec:\rfxflrr.exe35⤵
- Executes dropped EXE
PID:2600 -
\??\c:\3nnntt.exec:\3nnntt.exe36⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pjppj.exec:\pjppj.exe37⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fflrxxf.exec:\fflrxxf.exe38⤵
- Executes dropped EXE
PID:2588 -
\??\c:\htbhtt.exec:\htbhtt.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7hnnhh.exec:\7hnnhh.exe40⤵
- Executes dropped EXE
PID:3008 -
\??\c:\pdpjv.exec:\pdpjv.exe41⤵
- Executes dropped EXE
PID:480 -
\??\c:\5flfflx.exec:\5flfflx.exe42⤵
- Executes dropped EXE
PID:596 -
\??\c:\rfxrrxl.exec:\rfxrrxl.exe43⤵
- Executes dropped EXE
PID:264 -
\??\c:\hbhtbt.exec:\hbhtbt.exe44⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dpddj.exec:\dpddj.exe45⤵
- Executes dropped EXE
PID:2152 -
\??\c:\rrffrrf.exec:\rrffrrf.exe46⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrfrffr.exec:\rrfrffr.exe47⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9bnttn.exec:\9bnttn.exe48⤵
- Executes dropped EXE
PID:628 -
\??\c:\pdvvj.exec:\pdvvj.exe49⤵
- Executes dropped EXE
PID:1752 -
\??\c:\1frfllr.exec:\1frfllr.exe50⤵
- Executes dropped EXE
PID:1244 -
\??\c:\hbnbnt.exec:\hbnbnt.exe51⤵
- Executes dropped EXE
PID:1880 -
\??\c:\1jpvv.exec:\1jpvv.exe52⤵
- Executes dropped EXE
PID:2472 -
\??\c:\1vddd.exec:\1vddd.exe53⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3rxfllr.exec:\3rxfllr.exe54⤵
- Executes dropped EXE
PID:2960 -
\??\c:\fxlrfxl.exec:\fxlrfxl.exe55⤵
- Executes dropped EXE
PID:1724 -
\??\c:\bnnntb.exec:\bnnntb.exe56⤵
- Executes dropped EXE
PID:2232 -
\??\c:\9dvjp.exec:\9dvjp.exe57⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9jdpv.exec:\9jdpv.exe58⤵
- Executes dropped EXE
PID:2312 -
\??\c:\3rlfrxx.exec:\3rlfrxx.exe59⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bnhnnt.exec:\bnhnnt.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\3nbhhn.exec:\3nbhhn.exe61⤵
- Executes dropped EXE
PID:916 -
\??\c:\vvjjp.exec:\vvjjp.exe62⤵
- Executes dropped EXE
PID:1120 -
\??\c:\xlrrfxf.exec:\xlrrfxf.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\btnbnn.exec:\btnbnn.exe64⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tnbbnt.exec:\tnbbnt.exe65⤵
- Executes dropped EXE
PID:372 -
\??\c:\9dvvd.exec:\9dvvd.exe66⤵PID:2304
-
\??\c:\xrffllr.exec:\xrffllr.exe67⤵PID:2356
-
\??\c:\hbhntt.exec:\hbhntt.exe68⤵PID:2496
-
\??\c:\hbnnhn.exec:\hbnnhn.exe69⤵PID:2548
-
\??\c:\9djvv.exec:\9djvv.exe70⤵PID:2400
-
\??\c:\dpvdj.exec:\dpvdj.exe71⤵PID:2332
-
\??\c:\5fxxxff.exec:\5fxxxff.exe72⤵PID:2784
-
\??\c:\7bttnb.exec:\7bttnb.exe73⤵PID:2940
-
\??\c:\tnbbhh.exec:\tnbbhh.exe74⤵PID:2444
-
\??\c:\vpdjd.exec:\vpdjd.exe75⤵PID:2736
-
\??\c:\5xlxxff.exec:\5xlxxff.exe76⤵PID:2712
-
\??\c:\1tbthb.exec:\1tbthb.exe77⤵PID:2584
-
\??\c:\tnbhnh.exec:\tnbhnh.exe78⤵PID:1012
-
\??\c:\dvjvv.exec:\dvjvv.exe79⤵PID:2256
-
\??\c:\lfllrrf.exec:\lfllrrf.exe80⤵PID:2636
-
\??\c:\llxfrrx.exec:\llxfrrx.exe81⤵PID:1424
-
\??\c:\nhtbtt.exec:\nhtbtt.exe82⤵PID:576
-
\??\c:\jvjpv.exec:\jvjpv.exe83⤵PID:2272
-
\??\c:\fxrrxxf.exec:\fxrrxxf.exe84⤵PID:2464
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe85⤵PID:2212
-
\??\c:\hbnnbb.exec:\hbnnbb.exe86⤵PID:836
-
\??\c:\vvjpp.exec:\vvjpp.exe87⤵PID:2012
-
\??\c:\dvdjv.exec:\dvdjv.exe88⤵PID:1608
-
\??\c:\rrlrxxr.exec:\rrlrxxr.exe89⤵PID:2004
-
\??\c:\7thhnn.exec:\7thhnn.exe90⤵PID:2632
-
\??\c:\nbnbtt.exec:\nbnbtt.exe91⤵PID:2872
-
\??\c:\3vjdd.exec:\3vjdd.exe92⤵PID:2756
-
\??\c:\xlflxxf.exec:\xlflxxf.exe93⤵PID:1376
-
\??\c:\hbnthh.exec:\hbnthh.exe94⤵PID:1696
-
\??\c:\nhnnbh.exec:\nhnnbh.exe95⤵PID:2280
-
\??\c:\9djpv.exec:\9djpv.exe96⤵PID:2752
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe97⤵PID:2268
-
\??\c:\bbtbtt.exec:\bbtbtt.exe98⤵PID:1628
-
\??\c:\1thhhb.exec:\1thhhb.exe99⤵PID:1932
-
\??\c:\vvppd.exec:\vvppd.exe100⤵PID:1132
-
\??\c:\frxfrxx.exec:\frxfrxx.exe101⤵PID:2092
-
\??\c:\1nhbnt.exec:\1nhbnt.exe102⤵PID:1596
-
\??\c:\nnbnhb.exec:\nnbnhb.exe103⤵PID:1276
-
\??\c:\vjppj.exec:\vjppj.exe104⤵PID:2380
-
\??\c:\rxflrrx.exec:\rxflrrx.exe105⤵PID:2536
-
\??\c:\9rfxffr.exec:\9rfxffr.exe106⤵PID:2532
-
\??\c:\hbnnhh.exec:\hbnnhh.exe107⤵PID:2512
-
\??\c:\vpvvd.exec:\vpvvd.exe108⤵PID:1676
-
\??\c:\lxlrxxf.exec:\lxlrxxf.exe109⤵PID:2680
-
\??\c:\ffxrxxf.exec:\ffxrxxf.exe110⤵PID:1524
-
\??\c:\bnbhhh.exec:\bnbhhh.exe111⤵PID:2724
-
\??\c:\pjpdj.exec:\pjpdj.exe112⤵PID:2808
-
\??\c:\lxflfll.exec:\lxflfll.exe113⤵PID:2844
-
\??\c:\rfffrlr.exec:\rfffrlr.exe114⤵PID:2700
-
\??\c:\thtbnt.exec:\thtbnt.exe115⤵PID:2596
-
\??\c:\7vddj.exec:\7vddj.exe116⤵PID:2572
-
\??\c:\rfxrllx.exec:\rfxrllx.exe117⤵PID:2624
-
\??\c:\xfxllrf.exec:\xfxllrf.exe118⤵PID:1688
-
\??\c:\3nbhnn.exec:\3nbhnn.exe119⤵PID:304
-
\??\c:\btnnbb.exec:\btnnbb.exe120⤵PID:3020
-
\??\c:\vvdjp.exec:\vvdjp.exe121⤵PID:1108
-
\??\c:\1flxrll.exec:\1flxrll.exe122⤵PID:772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-