Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe
-
Size
454KB
-
MD5
e7f447eac120811f0a2b4539dccc0771
-
SHA1
66a2f961fbfb85e3f56acf8ab9232af03f714d7f
-
SHA256
18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7
-
SHA512
82a118ed96d2bfc17b6da3dd944a87bc5a8309c690da3713b0ac963190355402979f0cf11c6213780a4c8a3542eab3c6587942648ab903d70c483fc5ed7ecbd5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe8:q7Tc2NYHUrAwfMp3CD8
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2092-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-76-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/272-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-121-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2828-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-174-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/752-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-242-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1712-251-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/672-294-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2080-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-342-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-349-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-356-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-415-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-443-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1684-457-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/816-458-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-497-0x0000000000250000-0x000000000027A000-memory.dmp family_blackmoon behavioral1/memory/2876-510-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2060-525-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1260-578-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-585-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-617-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-796-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/768-974-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-1000-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2092 xllrfxr.exe 2748 nhbbhb.exe 2612 rlrxxxl.exe 2620 ppvdd.exe 2484 lfllxrx.exe 2632 3frllll.exe 2532 pjpdd.exe 272 lxllrrx.exe 532 bnbnbb.exe 344 1vjpp.exe 1580 3lrrrrr.exe 2796 nhnnbb.exe 2828 lxfflrr.exe 2520 3nhhhb.exe 1020 vjdpp.exe 1968 hnbnnh.exe 1616 pvvjd.exe 2684 xlxxrll.exe 2004 jdjdd.exe 1868 xlxxxxf.exe 1592 bthhhn.exe 2352 jvjpv.exe 2112 rlffrxl.exe 752 1ntnhb.exe 1132 vjvdd.exe 2984 1rfffff.exe 1712 jdppp.exe 908 flxrxrx.exe 552 1dvvd.exe 2012 3vjpp.exe 888 1hbbbt.exe 672 ddvvd.exe 2204 7frrxrr.exe 1596 hbnthh.exe 2080 vpdjp.exe 1648 frxfrlf.exe 2764 xxxxfrf.exe 2584 5tbnht.exe 2736 ppjjv.exe 2132 5rllrrx.exe 2596 nbnhnh.exe 2484 pjdvd.exe 2512 ppjdd.exe 2928 lfrrxfx.exe 2944 tnbhtt.exe 476 9pdjp.exe 1576 3xllrxx.exe 1080 3hbtbt.exe 344 7nhbbb.exe 2696 jvpjj.exe 2688 lllrlrx.exe 2824 bntnnh.exe 1928 hnhtnb.exe 2520 vpdvj.exe 356 rfllflr.exe 1684 xlfffxf.exe 816 9nnhtt.exe 1996 1jpvj.exe 1872 5lflxxx.exe 1856 xlrrlff.exe 2304 ttnntt.exe 2328 djjpv.exe 2320 rfxxlrl.exe 2876 3lllffx.exe -
resource yara_rule behavioral1/memory/2092-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2620-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2632-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-76-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/272-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-121-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1968-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-174-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/752-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-242-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1712-251-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/672-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2080-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-335-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-342-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-349-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-356-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-415-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-458-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-525-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1260-578-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-585-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-617-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/332-680-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-731-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-796-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-942-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/768-974-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/332-975-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-1161-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlflxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2092 2656 18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe 28 PID 2656 wrote to memory of 2092 2656 18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe 28 PID 2656 wrote to memory of 2092 2656 18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe 28 PID 2656 wrote to memory of 2092 2656 18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe 28 PID 2092 wrote to memory of 2748 2092 xllrfxr.exe 29 PID 2092 wrote to memory of 2748 2092 xllrfxr.exe 29 PID 2092 wrote to memory of 2748 2092 xllrfxr.exe 29 PID 2092 wrote to memory of 2748 2092 xllrfxr.exe 29 PID 2748 wrote to memory of 2612 2748 nhbbhb.exe 30 PID 2748 wrote to memory of 2612 2748 nhbbhb.exe 30 PID 2748 wrote to memory of 2612 2748 nhbbhb.exe 30 PID 2748 wrote to memory of 2612 2748 nhbbhb.exe 30 PID 2612 wrote to memory of 2620 2612 rlrxxxl.exe 31 PID 2612 wrote to memory of 2620 2612 rlrxxxl.exe 31 PID 2612 wrote to memory of 2620 2612 rlrxxxl.exe 31 PID 2612 wrote to memory of 2620 2612 rlrxxxl.exe 31 PID 2620 wrote to memory of 2484 2620 ppvdd.exe 32 PID 2620 wrote to memory of 2484 2620 ppvdd.exe 32 PID 2620 wrote to memory of 2484 2620 ppvdd.exe 32 PID 2620 wrote to memory of 2484 2620 ppvdd.exe 32 PID 2484 wrote to memory of 2632 2484 lfllxrx.exe 33 PID 2484 wrote to memory of 2632 2484 lfllxrx.exe 33 PID 2484 wrote to memory of 2632 2484 lfllxrx.exe 33 PID 2484 wrote to memory of 2632 2484 lfllxrx.exe 33 PID 2632 wrote to memory of 2532 2632 3frllll.exe 34 PID 2632 wrote to memory of 2532 2632 3frllll.exe 34 PID 2632 wrote to memory of 2532 2632 3frllll.exe 34 PID 2632 wrote to memory of 2532 2632 3frllll.exe 34 PID 2532 wrote to memory of 272 2532 pjpdd.exe 35 PID 2532 wrote to memory of 272 2532 pjpdd.exe 35 PID 2532 wrote to memory of 272 2532 pjpdd.exe 35 PID 2532 wrote to memory of 272 2532 pjpdd.exe 35 PID 272 wrote to memory of 532 272 lxllrrx.exe 36 PID 272 wrote to memory of 532 272 lxllrrx.exe 36 PID 272 wrote to memory of 532 272 lxllrrx.exe 36 PID 272 wrote to memory of 532 272 lxllrrx.exe 36 PID 532 wrote to memory of 344 532 bnbnbb.exe 37 PID 532 wrote to memory of 344 532 bnbnbb.exe 37 PID 532 wrote to memory of 344 532 bnbnbb.exe 37 PID 532 wrote to memory of 344 532 bnbnbb.exe 37 PID 344 wrote to memory of 1580 344 1vjpp.exe 38 PID 344 wrote to memory of 1580 344 1vjpp.exe 38 PID 344 wrote to memory of 1580 344 1vjpp.exe 38 PID 344 wrote to memory of 1580 344 1vjpp.exe 38 PID 1580 wrote to memory of 2796 1580 3lrrrrr.exe 39 PID 1580 wrote to memory of 2796 1580 3lrrrrr.exe 39 PID 1580 wrote to memory of 2796 1580 3lrrrrr.exe 39 PID 1580 wrote to memory of 2796 1580 3lrrrrr.exe 39 PID 2796 wrote to memory of 2828 2796 nhnnbb.exe 40 PID 2796 wrote to memory of 2828 2796 nhnnbb.exe 40 PID 2796 wrote to memory of 2828 2796 nhnnbb.exe 40 PID 2796 wrote to memory of 2828 2796 nhnnbb.exe 40 PID 2828 wrote to memory of 2520 2828 lxfflrr.exe 41 PID 2828 wrote to memory of 2520 2828 lxfflrr.exe 41 PID 2828 wrote to memory of 2520 2828 lxfflrr.exe 41 PID 2828 wrote to memory of 2520 2828 lxfflrr.exe 41 PID 2520 wrote to memory of 1020 2520 3nhhhb.exe 42 PID 2520 wrote to memory of 1020 2520 3nhhhb.exe 42 PID 2520 wrote to memory of 1020 2520 3nhhhb.exe 42 PID 2520 wrote to memory of 1020 2520 3nhhhb.exe 42 PID 1020 wrote to memory of 1968 1020 vjdpp.exe 43 PID 1020 wrote to memory of 1968 1020 vjdpp.exe 43 PID 1020 wrote to memory of 1968 1020 vjdpp.exe 43 PID 1020 wrote to memory of 1968 1020 vjdpp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe"C:\Users\Admin\AppData\Local\Temp\18e4a02f7035b621266238709121c8e99e92924bdf1f5638d278a0a021643fd7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\xllrfxr.exec:\xllrfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\nhbbhb.exec:\nhbbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rlrxxxl.exec:\rlrxxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\ppvdd.exec:\ppvdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\lfllxrx.exec:\lfllxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3frllll.exec:\3frllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pjpdd.exec:\pjpdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lxllrrx.exec:\lxllrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:272 -
\??\c:\bnbnbb.exec:\bnbnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\1vjpp.exec:\1vjpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\3lrrrrr.exec:\3lrrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\nhnnbb.exec:\nhnnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\lxfflrr.exec:\lxfflrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\3nhhhb.exec:\3nhhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\vjdpp.exec:\vjdpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\hnbnnh.exec:\hnbnnh.exe17⤵
- Executes dropped EXE
PID:1968 -
\??\c:\pvvjd.exec:\pvvjd.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xlxxrll.exec:\xlxxrll.exe19⤵
- Executes dropped EXE
PID:2684 -
\??\c:\jdjdd.exec:\jdjdd.exe20⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xlxxxxf.exec:\xlxxxxf.exe21⤵
- Executes dropped EXE
PID:1868 -
\??\c:\bthhhn.exec:\bthhhn.exe22⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jvjpv.exec:\jvjpv.exe23⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rlffrxl.exec:\rlffrxl.exe24⤵
- Executes dropped EXE
PID:2112 -
\??\c:\1ntnhb.exec:\1ntnhb.exe25⤵
- Executes dropped EXE
PID:752 -
\??\c:\vjvdd.exec:\vjvdd.exe26⤵
- Executes dropped EXE
PID:1132 -
\??\c:\1rfffff.exec:\1rfffff.exe27⤵
- Executes dropped EXE
PID:2984 -
\??\c:\jdppp.exec:\jdppp.exe28⤵
- Executes dropped EXE
PID:1712 -
\??\c:\flxrxrx.exec:\flxrxrx.exe29⤵
- Executes dropped EXE
PID:908 -
\??\c:\1dvvd.exec:\1dvvd.exe30⤵
- Executes dropped EXE
PID:552 -
\??\c:\3vjpp.exec:\3vjpp.exe31⤵
- Executes dropped EXE
PID:2012 -
\??\c:\1hbbbt.exec:\1hbbbt.exe32⤵
- Executes dropped EXE
PID:888 -
\??\c:\ddvvd.exec:\ddvvd.exe33⤵
- Executes dropped EXE
PID:672 -
\??\c:\7frrxrr.exec:\7frrxrr.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2204 -
\??\c:\hbnthh.exec:\hbnthh.exe35⤵
- Executes dropped EXE
PID:1596 -
\??\c:\vpdjp.exec:\vpdjp.exe36⤵
- Executes dropped EXE
PID:2080 -
\??\c:\frxfrlf.exec:\frxfrlf.exe37⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxxxfrf.exec:\xxxxfrf.exe38⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5tbnht.exec:\5tbnht.exe39⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ppjjv.exec:\ppjjv.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5rllrrx.exec:\5rllrrx.exe41⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nbnhnh.exec:\nbnhnh.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\pjdvd.exec:\pjdvd.exe43⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ppjdd.exec:\ppjdd.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\lfrrxfx.exec:\lfrrxfx.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\tnbhtt.exec:\tnbhtt.exe46⤵
- Executes dropped EXE
PID:2944 -
\??\c:\9pdjp.exec:\9pdjp.exe47⤵
- Executes dropped EXE
PID:476 -
\??\c:\3xllrxx.exec:\3xllrxx.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3hbtbt.exec:\3hbtbt.exe49⤵
- Executes dropped EXE
PID:1080 -
\??\c:\7nhbbb.exec:\7nhbbb.exe50⤵
- Executes dropped EXE
PID:344 -
\??\c:\jvpjj.exec:\jvpjj.exe51⤵
- Executes dropped EXE
PID:2696 -
\??\c:\lllrlrx.exec:\lllrlrx.exe52⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bntnnh.exec:\bntnnh.exe53⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hnhtnb.exec:\hnhtnb.exe54⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vpdvj.exec:\vpdvj.exe55⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rfllflr.exec:\rfllflr.exe56⤵
- Executes dropped EXE
PID:356 -
\??\c:\xlfffxf.exec:\xlfffxf.exe57⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9nnhtt.exec:\9nnhtt.exe58⤵
- Executes dropped EXE
PID:816 -
\??\c:\1jpvj.exec:\1jpvj.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5lflxxx.exec:\5lflxxx.exe60⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xlrrlff.exec:\xlrrlff.exe61⤵
- Executes dropped EXE
PID:1856 -
\??\c:\ttnntt.exec:\ttnntt.exe62⤵
- Executes dropped EXE
PID:2304 -
\??\c:\djjpv.exec:\djjpv.exe63⤵
- Executes dropped EXE
PID:2328 -
\??\c:\rfxxlrl.exec:\rfxxlrl.exe64⤵
- Executes dropped EXE
PID:2320 -
\??\c:\3lllffx.exec:\3lllffx.exe65⤵
- Executes dropped EXE
PID:2876 -
\??\c:\bthnbt.exec:\bthnbt.exe66⤵PID:664
-
\??\c:\nhtnnh.exec:\nhtnnh.exe67⤵PID:2060
-
\??\c:\3vpvp.exec:\3vpvp.exe68⤵PID:2980
-
\??\c:\frxrrrx.exec:\frxrrrx.exe69⤵PID:2444
-
\??\c:\nbttbb.exec:\nbttbb.exe70⤵PID:1584
-
\??\c:\7dpvp.exec:\7dpvp.exe71⤵PID:3056
-
\??\c:\vpjpv.exec:\vpjpv.exe72⤵PID:600
-
\??\c:\lxlrrxf.exec:\lxlrrxf.exe73⤵PID:2840
-
\??\c:\tbtbhh.exec:\tbtbhh.exe74⤵PID:3044
-
\??\c:\nbnnhh.exec:\nbnnhh.exe75⤵PID:1260
-
\??\c:\3jvpp.exec:\3jvpp.exe76⤵PID:2908
-
\??\c:\lfxxlrx.exec:\lfxxlrx.exe77⤵PID:868
-
\??\c:\7bhhhn.exec:\7bhhhn.exe78⤵PID:872
-
\??\c:\9tttbb.exec:\9tttbb.exe79⤵PID:1540
-
\??\c:\vjdjv.exec:\vjdjv.exe80⤵PID:1588
-
\??\c:\xrlllff.exec:\xrlllff.exe81⤵PID:2760
-
\??\c:\bnhtbb.exec:\bnhtbb.exe82⤵PID:2776
-
\??\c:\nbhbhh.exec:\nbhbhh.exe83⤵PID:2740
-
\??\c:\ddvdp.exec:\ddvdp.exe84⤵PID:2604
-
\??\c:\3xlflfx.exec:\3xlflfx.exe85⤵PID:2620
-
\??\c:\fflxrxx.exec:\fflxrxx.exe86⤵PID:2772
-
\??\c:\nbnttn.exec:\nbnttn.exe87⤵PID:2516
-
\??\c:\dvpdp.exec:\dvpdp.exe88⤵PID:2628
-
\??\c:\1jjjp.exec:\1jjjp.exe89⤵PID:2536
-
\??\c:\xlflrrf.exec:\xlflrrf.exe90⤵PID:2952
-
\??\c:\tnhntt.exec:\tnhntt.exe91⤵PID:768
-
\??\c:\nhthbh.exec:\nhthbh.exe92⤵PID:332
-
\??\c:\ddvdd.exec:\ddvdd.exe93⤵PID:756
-
\??\c:\rlxlxfl.exec:\rlxlxfl.exe94⤵PID:2680
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe95⤵PID:2704
-
\??\c:\tthnbb.exec:\tthnbb.exe96⤵PID:2640
-
\??\c:\vdpdd.exec:\vdpdd.exe97⤵PID:2828
-
\??\c:\1jvpp.exec:\1jvpp.exe98⤵PID:2052
-
\??\c:\3xxlfff.exec:\3xxlfff.exe99⤵PID:1216
-
\??\c:\nhtbhh.exec:\nhtbhh.exe100⤵PID:2520
-
\??\c:\tnhnbb.exec:\tnhnbb.exe101⤵PID:356
-
\??\c:\3vppp.exec:\3vppp.exe102⤵PID:2224
-
\??\c:\ffxfllr.exec:\ffxfllr.exe103⤵PID:1624
-
\??\c:\xrlxllx.exec:\xrlxllx.exe104⤵PID:2692
-
\??\c:\hbnhhn.exec:\hbnhhn.exe105⤵PID:2024
-
\??\c:\7pppv.exec:\7pppv.exe106⤵PID:2156
-
\??\c:\5xlrxrx.exec:\5xlrxrx.exe107⤵PID:1868
-
\??\c:\5fxfrxl.exec:\5fxfrxl.exe108⤵PID:2272
-
\??\c:\tnbhhh.exec:\tnbhhh.exe109⤵PID:2072
-
\??\c:\ppjpv.exec:\ppjpv.exe110⤵PID:2108
-
\??\c:\fxxxxfl.exec:\fxxxxfl.exe111⤵PID:2424
-
\??\c:\tnnbnh.exec:\tnnbnh.exe112⤵PID:2336
-
\??\c:\vvjvj.exec:\vvjvj.exe113⤵PID:1084
-
\??\c:\lxllrxr.exec:\lxllrxr.exe114⤵PID:1852
-
\??\c:\flxrlfl.exec:\flxrlfl.exe115⤵PID:1740
-
\??\c:\bthnbb.exec:\bthnbb.exe116⤵PID:1736
-
\??\c:\5bhbbh.exec:\5bhbbh.exe117⤵PID:1608
-
\??\c:\ddvpp.exec:\ddvpp.exe118⤵PID:2788
-
\??\c:\ppjvj.exec:\ppjvj.exe119⤵PID:2840
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe120⤵PID:2184
-
\??\c:\thbbhh.exec:\thbbhh.exe121⤵PID:672
-
\??\c:\tnbtnn.exec:\tnbtnn.exe122⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-