Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe
-
Size
454KB
-
MD5
c1a6d16797759cc2ac63467c40536031
-
SHA1
0f02a4f8b8c7793588138fd16dd8839725fcd011
-
SHA256
bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee
-
SHA512
5ffcef3740fd971c52c1913f04428a22062973442116438d79e7d3ff5aa8b71cd2335cfe138cadd6d4de1bc34fbf763b14eb19b07aa553352bf77c4a0482a646
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeqC:q7Tc2NYHUrAwfMp3CD5
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2092-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1780-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/908-127-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1320-142-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-152-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2220-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1700-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/872-216-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/608-244-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-264-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2648-369-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2228-376-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-400-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2456-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/324-477-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1640-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-544-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2216-570-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2004-577-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1328-607-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-615-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/372-666-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-674-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1652-791-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3040-799-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2504-805-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1780 rrffrxf.exe 2832 tnntbb.exe 2700 ppjjp.exe 2872 xrflllx.exe 2764 frfffxx.exe 2684 3bbttt.exe 2648 lfflllf.exe 2228 dvpvd.exe 864 nbbnnb.exe 2548 jjpdj.exe 1692 llrlxxf.exe 2896 3nbhnh.exe 908 5fxxllr.exe 2040 rlflxxf.exe 1320 jdvdv.exe 2168 rxfxxxf.exe 2220 jpddp.exe 2184 5jddp.exe 2368 ttbntt.exe 948 xxllrxf.exe 2336 1bntbt.exe 1656 5jppv.exe 872 xfxlrxr.exe 2796 3htttn.exe 1700 5ffrlrr.exe 608 fxlrxxf.exe 1640 vvjpd.exe 1984 hbhttt.exe 2268 dpdjj.exe 1744 lxfxlfr.exe 1816 jdvvd.exe 2092 9rrllfx.exe 2676 3pjjv.exe 2720 xrrxffr.exe 2820 hbtbhh.exe 2244 jdvdd.exe 2772 3xlrffr.exe 2816 hhbbnt.exe 2740 nhtbhh.exe 2600 9jjpd.exe 2588 lxrrlrf.exe 2648 btnbtt.exe 2228 vddpd.exe 1992 flxxflr.exe 2548 xllrfrl.exe 2008 hthnth.exe 2056 dpddj.exe 1996 frfrflx.exe 2456 1nthnb.exe 1660 jdvvj.exe 1644 vvvpd.exe 1624 ffxxrxl.exe 2200 3nnbnn.exe 1312 vdddp.exe 1388 3rxffrx.exe 2236 hbttbb.exe 2368 nnbntb.exe 324 vpjvj.exe 848 rlxxlxf.exe 548 nnntht.exe 2424 pjdjv.exe 2532 llfrllf.exe 2752 hbhnth.exe 1712 vjvdj.exe -
resource yara_rule behavioral1/memory/2092-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-102-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/908-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-142-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-152-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1700-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/608-244-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-264-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-291-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2244-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-346-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-418-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/324-477-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1640-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-593-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-607-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/372-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-687-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-791-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-805-0x00000000001B0000-0x00000000001DA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2092 wrote to memory of 1780 2092 bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe 30 PID 2092 wrote to memory of 1780 2092 bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe 30 PID 2092 wrote to memory of 1780 2092 bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe 30 PID 2092 wrote to memory of 1780 2092 bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe 30 PID 1780 wrote to memory of 2832 1780 rrffrxf.exe 31 PID 1780 wrote to memory of 2832 1780 rrffrxf.exe 31 PID 1780 wrote to memory of 2832 1780 rrffrxf.exe 31 PID 1780 wrote to memory of 2832 1780 rrffrxf.exe 31 PID 2832 wrote to memory of 2700 2832 tnntbb.exe 32 PID 2832 wrote to memory of 2700 2832 tnntbb.exe 32 PID 2832 wrote to memory of 2700 2832 tnntbb.exe 32 PID 2832 wrote to memory of 2700 2832 tnntbb.exe 32 PID 2700 wrote to memory of 2872 2700 ppjjp.exe 33 PID 2700 wrote to memory of 2872 2700 ppjjp.exe 33 PID 2700 wrote to memory of 2872 2700 ppjjp.exe 33 PID 2700 wrote to memory of 2872 2700 ppjjp.exe 33 PID 2872 wrote to memory of 2764 2872 xrflllx.exe 34 PID 2872 wrote to memory of 2764 2872 xrflllx.exe 34 PID 2872 wrote to memory of 2764 2872 xrflllx.exe 34 PID 2872 wrote to memory of 2764 2872 xrflllx.exe 34 PID 2764 wrote to memory of 2684 2764 frfffxx.exe 35 PID 2764 wrote to memory of 2684 2764 frfffxx.exe 35 PID 2764 wrote to memory of 2684 2764 frfffxx.exe 35 PID 2764 wrote to memory of 2684 2764 frfffxx.exe 35 PID 2684 wrote to memory of 2648 2684 3bbttt.exe 36 PID 2684 wrote to memory of 2648 2684 3bbttt.exe 36 PID 2684 wrote to memory of 2648 2684 3bbttt.exe 36 PID 2684 wrote to memory of 2648 2684 3bbttt.exe 36 PID 2648 wrote to memory of 2228 2648 lfflllf.exe 37 PID 2648 wrote to memory of 2228 2648 lfflllf.exe 37 PID 2648 wrote to memory of 2228 2648 lfflllf.exe 37 PID 2648 wrote to memory of 2228 2648 lfflllf.exe 37 PID 2228 wrote to memory of 864 2228 dvpvd.exe 38 PID 2228 wrote to memory of 864 2228 dvpvd.exe 38 PID 2228 wrote to memory of 864 2228 dvpvd.exe 38 PID 2228 wrote to memory of 864 2228 dvpvd.exe 38 PID 864 wrote to memory of 2548 864 nbbnnb.exe 39 PID 864 wrote to memory of 2548 864 nbbnnb.exe 39 PID 864 wrote to memory of 2548 864 nbbnnb.exe 39 PID 864 wrote to memory of 2548 864 nbbnnb.exe 39 PID 2548 wrote to memory of 1692 2548 jjpdj.exe 40 PID 2548 wrote to memory of 1692 2548 jjpdj.exe 40 PID 2548 wrote to memory of 1692 2548 jjpdj.exe 40 PID 2548 wrote to memory of 1692 2548 jjpdj.exe 40 PID 1692 wrote to memory of 2896 1692 llrlxxf.exe 41 PID 1692 wrote to memory of 2896 1692 llrlxxf.exe 41 PID 1692 wrote to memory of 2896 1692 llrlxxf.exe 41 PID 1692 wrote to memory of 2896 1692 llrlxxf.exe 41 PID 2896 wrote to memory of 908 2896 3nbhnh.exe 42 PID 2896 wrote to memory of 908 2896 3nbhnh.exe 42 PID 2896 wrote to memory of 908 2896 3nbhnh.exe 42 PID 2896 wrote to memory of 908 2896 3nbhnh.exe 42 PID 908 wrote to memory of 2040 908 5fxxllr.exe 43 PID 908 wrote to memory of 2040 908 5fxxllr.exe 43 PID 908 wrote to memory of 2040 908 5fxxllr.exe 43 PID 908 wrote to memory of 2040 908 5fxxllr.exe 43 PID 2040 wrote to memory of 1320 2040 rlflxxf.exe 44 PID 2040 wrote to memory of 1320 2040 rlflxxf.exe 44 PID 2040 wrote to memory of 1320 2040 rlflxxf.exe 44 PID 2040 wrote to memory of 1320 2040 rlflxxf.exe 44 PID 1320 wrote to memory of 2168 1320 jdvdv.exe 45 PID 1320 wrote to memory of 2168 1320 jdvdv.exe 45 PID 1320 wrote to memory of 2168 1320 jdvdv.exe 45 PID 1320 wrote to memory of 2168 1320 jdvdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe"C:\Users\Admin\AppData\Local\Temp\bceb796d470029a0803eeb8d6c6124b38536a44d837481c6d7bfadc5418500ee.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rrffrxf.exec:\rrffrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\tnntbb.exec:\tnntbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\ppjjp.exec:\ppjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\xrflllx.exec:\xrflllx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\frfffxx.exec:\frfffxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\3bbttt.exec:\3bbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\lfflllf.exec:\lfflllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\dvpvd.exec:\dvpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\nbbnnb.exec:\nbbnnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\jjpdj.exec:\jjpdj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\llrlxxf.exec:\llrlxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\3nbhnh.exec:\3nbhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\5fxxllr.exec:\5fxxllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\rlflxxf.exec:\rlflxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jdvdv.exec:\jdvdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\rxfxxxf.exec:\rxfxxxf.exe17⤵
- Executes dropped EXE
PID:2168 -
\??\c:\jpddp.exec:\jpddp.exe18⤵
- Executes dropped EXE
PID:2220 -
\??\c:\5jddp.exec:\5jddp.exe19⤵
- Executes dropped EXE
PID:2184 -
\??\c:\ttbntt.exec:\ttbntt.exe20⤵
- Executes dropped EXE
PID:2368 -
\??\c:\xxllrxf.exec:\xxllrxf.exe21⤵
- Executes dropped EXE
PID:948 -
\??\c:\1bntbt.exec:\1bntbt.exe22⤵
- Executes dropped EXE
PID:2336 -
\??\c:\5jppv.exec:\5jppv.exe23⤵
- Executes dropped EXE
PID:1656 -
\??\c:\xfxlrxr.exec:\xfxlrxr.exe24⤵
- Executes dropped EXE
PID:872 -
\??\c:\3htttn.exec:\3htttn.exe25⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5ffrlrr.exec:\5ffrlrr.exe26⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe27⤵
- Executes dropped EXE
PID:608 -
\??\c:\vvjpd.exec:\vvjpd.exe28⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hbhttt.exec:\hbhttt.exe29⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dpdjj.exec:\dpdjj.exe30⤵
- Executes dropped EXE
PID:2268 -
\??\c:\lxfxlfr.exec:\lxfxlfr.exe31⤵
- Executes dropped EXE
PID:1744 -
\??\c:\jdvvd.exec:\jdvvd.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\9rrllfx.exec:\9rrllfx.exe33⤵
- Executes dropped EXE
PID:2092 -
\??\c:\3pjjv.exec:\3pjjv.exe34⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrrxffr.exec:\xrrxffr.exe35⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hbtbhh.exec:\hbtbhh.exe36⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jdvdd.exec:\jdvdd.exe37⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3xlrffr.exec:\3xlrffr.exe38⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hhbbnt.exec:\hhbbnt.exe39⤵
- Executes dropped EXE
PID:2816 -
\??\c:\nhtbhh.exec:\nhtbhh.exe40⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9jjpd.exec:\9jjpd.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\lxrrlrf.exec:\lxrrlrf.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\btnbtt.exec:\btnbtt.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vddpd.exec:\vddpd.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\flxxflr.exec:\flxxflr.exe45⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xllrfrl.exec:\xllrfrl.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hthnth.exec:\hthnth.exe47⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dpddj.exec:\dpddj.exe48⤵
- Executes dropped EXE
PID:2056 -
\??\c:\frfrflx.exec:\frfrflx.exe49⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1nthnb.exec:\1nthnb.exe50⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdvvj.exec:\jdvvj.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\vvvpd.exec:\vvvpd.exe52⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ffxxrxl.exec:\ffxxrxl.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\3nnbnn.exec:\3nnbnn.exe54⤵
- Executes dropped EXE
PID:2200 -
\??\c:\vdddp.exec:\vdddp.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3rxffrx.exec:\3rxffrx.exe56⤵
- Executes dropped EXE
PID:1388 -
\??\c:\hbttbb.exec:\hbttbb.exe57⤵
- Executes dropped EXE
PID:2236 -
\??\c:\nnbntb.exec:\nnbntb.exe58⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vpjvj.exec:\vpjvj.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\rlxxlxf.exec:\rlxxlxf.exe60⤵
- Executes dropped EXE
PID:848 -
\??\c:\nnntht.exec:\nnntht.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:548 -
\??\c:\pjdjv.exec:\pjdjv.exe62⤵
- Executes dropped EXE
PID:2424 -
\??\c:\llfrllf.exec:\llfrllf.exe63⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbhnth.exec:\hbhnth.exe64⤵
- Executes dropped EXE
PID:2752 -
\??\c:\vjvdj.exec:\vjvdj.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\ppjvd.exec:\ppjvd.exe66⤵PID:2276
-
\??\c:\ffxflxl.exec:\ffxflxl.exe67⤵PID:2192
-
\??\c:\hnnthn.exec:\hnnthn.exe68⤵PID:1640
-
\??\c:\jpjvd.exec:\jpjvd.exe69⤵PID:2544
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe70⤵PID:2104
-
\??\c:\ttbntb.exec:\ttbntb.exe71⤵PID:2004
-
\??\c:\5hhhnn.exec:\5hhhnn.exe72⤵PID:1444
-
\??\c:\vjddj.exec:\vjddj.exe73⤵PID:2216
-
\??\c:\lxflflx.exec:\lxflflx.exe74⤵PID:2848
-
\??\c:\tnhhnt.exec:\tnhhnt.exe75⤵PID:2908
-
\??\c:\vpjpd.exec:\vpjpd.exe76⤵PID:2680
-
\??\c:\7fflxlr.exec:\7fflxlr.exe77⤵PID:2856
-
\??\c:\bhtnhn.exec:\bhtnhn.exe78⤵PID:2700
-
\??\c:\djdjd.exec:\djdjd.exe79⤵PID:1328
-
\??\c:\jjvvp.exec:\jjvvp.exe80⤵PID:2624
-
\??\c:\1thntt.exec:\1thntt.exe81⤵PID:2740
-
\??\c:\hbttbb.exec:\hbttbb.exe82⤵PID:2600
-
\??\c:\1pjvp.exec:\1pjvp.exe83⤵PID:996
-
\??\c:\rxlxxxr.exec:\rxlxxxr.exe84⤵PID:1052
-
\??\c:\hbnthb.exec:\hbnthb.exe85⤵PID:2980
-
\??\c:\dpvdj.exec:\dpvdj.exe86⤵PID:3032
-
\??\c:\jvppp.exec:\jvppp.exe87⤵PID:372
-
\??\c:\xrfxffl.exec:\xrfxffl.exe88⤵PID:1740
-
\??\c:\tnbhnt.exec:\tnbhnt.exe89⤵PID:2900
-
\??\c:\5jvjp.exec:\5jvjp.exe90⤵PID:580
-
\??\c:\lllxxlx.exec:\lllxxlx.exe91⤵PID:2640
-
\??\c:\lfrxrrx.exec:\lfrxrrx.exe92⤵PID:2452
-
\??\c:\btnbnt.exec:\btnbnt.exe93⤵PID:1080
-
\??\c:\vvpdj.exec:\vvpdj.exe94⤵PID:1644
-
\??\c:\rllrllf.exec:\rllrllf.exe95⤵PID:2212
-
\??\c:\1fxflrl.exec:\1fxflrl.exe96⤵PID:2484
-
\??\c:\nthtnb.exec:\nthtnb.exe97⤵PID:2052
-
\??\c:\jjvvv.exec:\jjvvv.exe98⤵PID:2112
-
\??\c:\fflxffx.exec:\fflxffx.exe99⤵PID:2364
-
\??\c:\frlfrfr.exec:\frlfrfr.exe100⤵PID:1852
-
\??\c:\nbbhtb.exec:\nbbhtb.exe101⤵PID:324
-
\??\c:\vpdjv.exec:\vpdjv.exe102⤵PID:848
-
\??\c:\xxxxfrf.exec:\xxxxfrf.exe103⤵PID:1784
-
\??\c:\thbthb.exec:\thbthb.exe104⤵
- System Location Discovery: System Language Discovery
PID:2424 -
\??\c:\1pjvd.exec:\1pjvd.exe105⤵PID:2508
-
\??\c:\dpjvp.exec:\dpjvp.exe106⤵PID:1652
-
\??\c:\rrllrxl.exec:\rrllrxl.exe107⤵PID:3040
-
\??\c:\bhbnht.exec:\bhbnht.exe108⤵PID:2504
-
\??\c:\pjdjd.exec:\pjdjd.exe109⤵PID:1936
-
\??\c:\vvppj.exec:\vvppj.exe110⤵PID:2316
-
\??\c:\llfrfrl.exec:\llfrfrl.exe111⤵PID:1008
-
\??\c:\ntntht.exec:\ntntht.exe112⤵PID:2012
-
\??\c:\jdvdj.exec:\jdvdj.exe113⤵PID:2252
-
\??\c:\lllrflr.exec:\lllrflr.exe114⤵PID:1568
-
\??\c:\nhtthn.exec:\nhtthn.exe115⤵PID:2092
-
\??\c:\7tbnbb.exec:\7tbnbb.exe116⤵PID:1580
-
\??\c:\vdvdp.exec:\vdvdp.exe117⤵PID:2724
-
\??\c:\5rrxlrx.exec:\5rrxlrx.exe118⤵PID:2576
-
\??\c:\fflxrxf.exec:\fflxrxf.exe119⤵PID:2856
-
\??\c:\hnnhht.exec:\hnnhht.exe120⤵PID:2700
-
\??\c:\pvpvp.exec:\pvpvp.exe121⤵PID:2816
-
\??\c:\1jdpp.exec:\1jdpp.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-