Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-12-2024 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe
-
Size
454KB
-
MD5
22de0ac9b93345e4b13913035fe0b3cf
-
SHA1
2129c6e6a5fc00548b6a4e19e95b35a0f08b2427
-
SHA256
db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c
-
SHA512
04e34c950fc1fce9717018eb2d0edbbdbc9cb502984e3ba028bff3b8de19c3a9366e8e219e88d62a340f1c0eb1e566b12398813899a3d58fc2fd7f45b106bc8d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeToD:q7Tc2NYHUrAwfMp3CDcD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2716-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-140-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/772-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1864-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1868-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-230-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-310-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2480-406-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2468-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-497-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-523-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-549-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-582-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2360-603-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-602-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/276-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-659-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-809-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1652-865-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 ppjjv.exe 2700 7rllfrf.exe 2844 pjpvd.exe 3036 1nhbbh.exe 2840 7vjjj.exe 2404 tthhnn.exe 580 fflfflr.exe 2324 flxrxfl.exe 2148 htntnn.exe 2368 rlrfxlr.exe 1236 ttbnnn.exe 2480 3xrxrxl.exe 2820 hhthtb.exe 348 vpjjp.exe 1688 xfxxlxl.exe 600 1djpv.exe 772 3hthhb.exe 2268 vpvdj.exe 2196 5lrxflr.exe 1864 7ttbhh.exe 2436 hnbnbb.exe 1176 ntbbnt.exe 1868 pvdjp.exe 2452 rrfrfxl.exe 1964 7xfxfff.exe 2488 3bbhtt.exe 1128 jjvjv.exe 3028 hhttbb.exe 2504 bhhbbt.exe 2244 nnbbnn.exe 3044 vdvpv.exe 2792 3thbhb.exe 2580 xxlrflr.exe 1524 rfrxfrx.exe 2700 hnttbb.exe 2664 3dpdp.exe 2768 3rlrfll.exe 2164 xllxxlr.exe 2616 bhbhht.exe 3012 jpjvd.exe 2404 xlllrxl.exe 2952 5tnbhn.exe 2548 3hnthn.exe 2264 ppdvj.exe 2176 7xxxlrf.exe 640 bhntnn.exe 352 jdppp.exe 1236 rxllxfr.exe 2480 llllffr.exe 2872 7nnbnt.exe 1640 5jdjv.exe 1644 xxflrfr.exe 1420 hhtbnn.exe 2468 htbnhb.exe 1084 ppvdp.exe 1708 llrxrrr.exe 2212 ttbbhh.exe 2416 jpjpp.exe 1648 pvvpp.exe 296 fxrxrfl.exe 2888 bhtbhn.exe 976 pjdvj.exe 1504 vvpjv.exe 1960 lffrxff.exe -
resource yara_rule behavioral1/memory/2772-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/772-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1868-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-310-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2480-406-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2468-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-471-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-497-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-523-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-549-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-865-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7llfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2772 2716 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 30 PID 2716 wrote to memory of 2772 2716 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 30 PID 2716 wrote to memory of 2772 2716 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 30 PID 2716 wrote to memory of 2772 2716 db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe 30 PID 2772 wrote to memory of 2700 2772 ppjjv.exe 31 PID 2772 wrote to memory of 2700 2772 ppjjv.exe 31 PID 2772 wrote to memory of 2700 2772 ppjjv.exe 31 PID 2772 wrote to memory of 2700 2772 ppjjv.exe 31 PID 2700 wrote to memory of 2844 2700 7rllfrf.exe 32 PID 2700 wrote to memory of 2844 2700 7rllfrf.exe 32 PID 2700 wrote to memory of 2844 2700 7rllfrf.exe 32 PID 2700 wrote to memory of 2844 2700 7rllfrf.exe 32 PID 2844 wrote to memory of 3036 2844 pjpvd.exe 33 PID 2844 wrote to memory of 3036 2844 pjpvd.exe 33 PID 2844 wrote to memory of 3036 2844 pjpvd.exe 33 PID 2844 wrote to memory of 3036 2844 pjpvd.exe 33 PID 3036 wrote to memory of 2840 3036 1nhbbh.exe 34 PID 3036 wrote to memory of 2840 3036 1nhbbh.exe 34 PID 3036 wrote to memory of 2840 3036 1nhbbh.exe 34 PID 3036 wrote to memory of 2840 3036 1nhbbh.exe 34 PID 2840 wrote to memory of 2404 2840 7vjjj.exe 35 PID 2840 wrote to memory of 2404 2840 7vjjj.exe 35 PID 2840 wrote to memory of 2404 2840 7vjjj.exe 35 PID 2840 wrote to memory of 2404 2840 7vjjj.exe 35 PID 2404 wrote to memory of 580 2404 tthhnn.exe 36 PID 2404 wrote to memory of 580 2404 tthhnn.exe 36 PID 2404 wrote to memory of 580 2404 tthhnn.exe 36 PID 2404 wrote to memory of 580 2404 tthhnn.exe 36 PID 580 wrote to memory of 2324 580 fflfflr.exe 37 PID 580 wrote to memory of 2324 580 fflfflr.exe 37 PID 580 wrote to memory of 2324 580 fflfflr.exe 37 PID 580 wrote to memory of 2324 580 fflfflr.exe 37 PID 2324 wrote to memory of 2148 2324 flxrxfl.exe 38 PID 2324 wrote to memory of 2148 2324 flxrxfl.exe 38 PID 2324 wrote to memory of 2148 2324 flxrxfl.exe 38 PID 2324 wrote to memory of 2148 2324 flxrxfl.exe 38 PID 2148 wrote to memory of 2368 2148 htntnn.exe 39 PID 2148 wrote to memory of 2368 2148 htntnn.exe 39 PID 2148 wrote to memory of 2368 2148 htntnn.exe 39 PID 2148 wrote to memory of 2368 2148 htntnn.exe 39 PID 2368 wrote to memory of 1236 2368 rlrfxlr.exe 40 PID 2368 wrote to memory of 1236 2368 rlrfxlr.exe 40 PID 2368 wrote to memory of 1236 2368 rlrfxlr.exe 40 PID 2368 wrote to memory of 1236 2368 rlrfxlr.exe 40 PID 1236 wrote to memory of 2480 1236 ttbnnn.exe 41 PID 1236 wrote to memory of 2480 1236 ttbnnn.exe 41 PID 1236 wrote to memory of 2480 1236 ttbnnn.exe 41 PID 1236 wrote to memory of 2480 1236 ttbnnn.exe 41 PID 2480 wrote to memory of 2820 2480 3xrxrxl.exe 42 PID 2480 wrote to memory of 2820 2480 3xrxrxl.exe 42 PID 2480 wrote to memory of 2820 2480 3xrxrxl.exe 42 PID 2480 wrote to memory of 2820 2480 3xrxrxl.exe 42 PID 2820 wrote to memory of 348 2820 hhthtb.exe 43 PID 2820 wrote to memory of 348 2820 hhthtb.exe 43 PID 2820 wrote to memory of 348 2820 hhthtb.exe 43 PID 2820 wrote to memory of 348 2820 hhthtb.exe 43 PID 348 wrote to memory of 1688 348 vpjjp.exe 44 PID 348 wrote to memory of 1688 348 vpjjp.exe 44 PID 348 wrote to memory of 1688 348 vpjjp.exe 44 PID 348 wrote to memory of 1688 348 vpjjp.exe 44 PID 1688 wrote to memory of 600 1688 xfxxlxl.exe 45 PID 1688 wrote to memory of 600 1688 xfxxlxl.exe 45 PID 1688 wrote to memory of 600 1688 xfxxlxl.exe 45 PID 1688 wrote to memory of 600 1688 xfxxlxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe"C:\Users\Admin\AppData\Local\Temp\db19bf2fbdefa3906ce1c0f5e163d96db101e0116d42032f1febe79f450fa61c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\ppjjv.exec:\ppjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\7rllfrf.exec:\7rllfrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\pjpvd.exec:\pjpvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1nhbbh.exec:\1nhbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\7vjjj.exec:\7vjjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\tthhnn.exec:\tthhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\fflfflr.exec:\fflfflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\flxrxfl.exec:\flxrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\htntnn.exec:\htntnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\rlrfxlr.exec:\rlrfxlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ttbnnn.exec:\ttbnnn.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\3xrxrxl.exec:\3xrxrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hhthtb.exec:\hhthtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vpjjp.exec:\vpjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\xfxxlxl.exec:\xfxxlxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\1djpv.exec:\1djpv.exe17⤵
- Executes dropped EXE
PID:600 -
\??\c:\3hthhb.exec:\3hthhb.exe18⤵
- Executes dropped EXE
PID:772 -
\??\c:\vpvdj.exec:\vpvdj.exe19⤵
- Executes dropped EXE
PID:2268 -
\??\c:\5lrxflr.exec:\5lrxflr.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\7ttbhh.exec:\7ttbhh.exe21⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hnbnbb.exec:\hnbnbb.exe22⤵
- Executes dropped EXE
PID:2436 -
\??\c:\ntbbnt.exec:\ntbbnt.exe23⤵
- Executes dropped EXE
PID:1176 -
\??\c:\pvdjp.exec:\pvdjp.exe24⤵
- Executes dropped EXE
PID:1868 -
\??\c:\rrfrfxl.exec:\rrfrfxl.exe25⤵
- Executes dropped EXE
PID:2452 -
\??\c:\7xfxfff.exec:\7xfxfff.exe26⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3bbhtt.exec:\3bbhtt.exe27⤵
- Executes dropped EXE
PID:2488 -
\??\c:\jjvjv.exec:\jjvjv.exe28⤵
- Executes dropped EXE
PID:1128 -
\??\c:\hhttbb.exec:\hhttbb.exe29⤵
- Executes dropped EXE
PID:3028 -
\??\c:\bhhbbt.exec:\bhhbbt.exe30⤵
- Executes dropped EXE
PID:2504 -
\??\c:\nnbbnn.exec:\nnbbnn.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\vdvpv.exec:\vdvpv.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3thbhb.exec:\3thbhb.exe33⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xxlrflr.exec:\xxlrflr.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rfrxfrx.exec:\rfrxfrx.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\hnttbb.exec:\hnttbb.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3dpdp.exec:\3dpdp.exe37⤵
- Executes dropped EXE
PID:2664 -
\??\c:\3rlrfll.exec:\3rlrfll.exe38⤵
- Executes dropped EXE
PID:2768 -
\??\c:\xllxxlr.exec:\xllxxlr.exe39⤵
- Executes dropped EXE
PID:2164 -
\??\c:\bhbhht.exec:\bhbhht.exe40⤵
- Executes dropped EXE
PID:2616 -
\??\c:\jpjvd.exec:\jpjvd.exe41⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xlllrxl.exec:\xlllrxl.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\5tnbhn.exec:\5tnbhn.exe43⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3hnthn.exec:\3hnthn.exe44⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ppdvj.exec:\ppdvj.exe45⤵
- Executes dropped EXE
PID:2264 -
\??\c:\7xxxlrf.exec:\7xxxlrf.exe46⤵
- Executes dropped EXE
PID:2176 -
\??\c:\bhntnn.exec:\bhntnn.exe47⤵
- Executes dropped EXE
PID:640 -
\??\c:\jdppp.exec:\jdppp.exe48⤵
- Executes dropped EXE
PID:352 -
\??\c:\rxllxfr.exec:\rxllxfr.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\llllffr.exec:\llllffr.exe50⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7nnbnt.exec:\7nnbnt.exe51⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5jdjv.exec:\5jdjv.exe52⤵
- Executes dropped EXE
PID:1640 -
\??\c:\xxflrfr.exec:\xxflrfr.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhtbnn.exec:\hhtbnn.exe54⤵
- Executes dropped EXE
PID:1420 -
\??\c:\htbnhb.exec:\htbnhb.exe55⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ppvdp.exec:\ppvdp.exe56⤵
- Executes dropped EXE
PID:1084 -
\??\c:\llrxrrr.exec:\llrxrrr.exe57⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ttbbhh.exec:\ttbbhh.exe58⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jpjpp.exec:\jpjpp.exe59⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pvvpp.exec:\pvvpp.exe60⤵
- Executes dropped EXE
PID:1648 -
\??\c:\fxrxrfl.exec:\fxrxrfl.exe61⤵
- Executes dropped EXE
PID:296 -
\??\c:\bhtbhn.exec:\bhtbhn.exe62⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjdvj.exec:\pjdvj.exe63⤵
- Executes dropped EXE
PID:976 -
\??\c:\vvpjv.exec:\vvpjv.exe64⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lffrxff.exec:\lffrxff.exe65⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1nhttb.exec:\1nhttb.exe66⤵PID:1660
-
\??\c:\vpdvj.exec:\vpdvj.exe67⤵PID:3056
-
\??\c:\7xrlxfl.exec:\7xrlxfl.exe68⤵PID:2500
-
\??\c:\rrflfrx.exec:\rrflfrx.exe69⤵PID:2412
-
\??\c:\nnhhtb.exec:\nnhhtb.exe70⤵PID:1880
-
\??\c:\5jdjd.exec:\5jdjd.exe71⤵PID:2936
-
\??\c:\3lxxflx.exec:\3lxxflx.exe72⤵PID:2312
-
\??\c:\rrlfllf.exec:\rrlfllf.exe73⤵PID:964
-
\??\c:\ttnbtb.exec:\ttnbtb.exe74⤵PID:2788
-
\??\c:\ddpvj.exec:\ddpvj.exe75⤵PID:2804
-
\??\c:\xllfflx.exec:\xllfflx.exe76⤵PID:2160
-
\??\c:\3tnbtb.exec:\3tnbtb.exe77⤵PID:2400
-
\??\c:\nthnhh.exec:\nthnhh.exe78⤵PID:2928
-
\??\c:\vppdp.exec:\vppdp.exe79⤵PID:2360
-
\??\c:\rllrflx.exec:\rllrflx.exe80⤵PID:2744
-
\??\c:\fxrfllr.exec:\fxrfllr.exe81⤵PID:2592
-
\??\c:\bbbbth.exec:\bbbbth.exe82⤵PID:2164
-
\??\c:\pdvvd.exec:\pdvvd.exe83⤵PID:2632
-
\??\c:\5rlxllf.exec:\5rlxllf.exe84⤵PID:2568
-
\??\c:\rrlxffr.exec:\rrlxffr.exe85⤵PID:276
-
\??\c:\bbhthn.exec:\bbhthn.exe86⤵PID:1908
-
\??\c:\9vjvj.exec:\9vjvj.exe87⤵PID:448
-
\??\c:\flflflf.exec:\flflflf.exe88⤵PID:2168
-
\??\c:\5lrxllf.exec:\5lrxllf.exe89⤵PID:2204
-
\??\c:\9nnntb.exec:\9nnntb.exe90⤵PID:2208
-
\??\c:\pvpjv.exec:\pvpjv.exe91⤵PID:2116
-
\??\c:\xfllxlx.exec:\xfllxlx.exe92⤵PID:2820
-
\??\c:\9bhhtb.exec:\9bhhtb.exe93⤵PID:2384
-
\??\c:\nbttnt.exec:\nbttnt.exe94⤵PID:2524
-
\??\c:\jvjvj.exec:\jvjvj.exe95⤵PID:1688
-
\??\c:\rrrrrxf.exec:\rrrrrxf.exe96⤵PID:1420
-
\??\c:\9ttthn.exec:\9ttthn.exe97⤵PID:536
-
\??\c:\1btthn.exec:\1btthn.exe98⤵PID:1084
-
\??\c:\pvpvd.exec:\pvpvd.exe99⤵PID:1708
-
\??\c:\fxlxxlx.exec:\fxlxxlx.exe100⤵PID:1568
-
\??\c:\bhtnbn.exec:\bhtnbn.exe101⤵PID:1864
-
\??\c:\vjjvv.exec:\vjjvv.exe102⤵PID:652
-
\??\c:\7dvvp.exec:\7dvvp.exe103⤵PID:2904
-
\??\c:\xfffffl.exec:\xfffffl.exe104⤵PID:2084
-
\??\c:\bhtbtb.exec:\bhtbtb.exe105⤵PID:1680
-
\??\c:\1bnbht.exec:\1bnbht.exe106⤵PID:1504
-
\??\c:\3dpvj.exec:\3dpvj.exe107⤵PID:1960
-
\??\c:\llrlrlf.exec:\llrlrlf.exe108⤵PID:1660
-
\??\c:\nnbnth.exec:\nnbnth.exe109⤵PID:2076
-
\??\c:\bhbhnn.exec:\bhbhnn.exe110⤵
- System Location Discovery: System Language Discovery
PID:3048 -
\??\c:\dppdp.exec:\dppdp.exe111⤵PID:1060
-
\??\c:\xffrllf.exec:\xffrllf.exe112⤵PID:1560
-
\??\c:\hthtth.exec:\hthtth.exe113⤵PID:1448
-
\??\c:\vdpvj.exec:\vdpvj.exe114⤵PID:908
-
\??\c:\fflrrrf.exec:\fflrrrf.exe115⤵
- System Location Discovery: System Language Discovery
PID:964 -
\??\c:\9bnthh.exec:\9bnthh.exe116⤵PID:2828
-
\??\c:\hnhhhh.exec:\hnhhhh.exe117⤵PID:2808
-
\??\c:\ddjjj.exec:\ddjjj.exe118⤵PID:1652
-
\??\c:\rrllxxr.exec:\rrllxxr.exe119⤵PID:2400
-
\??\c:\nnttbb.exec:\nnttbb.exe120⤵PID:2736
-
\??\c:\bbhntb.exec:\bbhntb.exe121⤵PID:808
-
\??\c:\1dpdj.exec:\1dpdj.exe122⤵PID:2744
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-