Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 17:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe
-
Size
453KB
-
MD5
08209054ad33ea477d1ccfd94857f84a
-
SHA1
cd38d36d0ee3b8a1f7beefc5a06e4dca91ceaec5
-
SHA256
810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42
-
SHA512
98a7cf3f4284b220cd5bb099201707f1e185dce844dfd731f2aa3a48bf8c2b6a3c4e84c43107cf02aa70bbab99016f5744d1e81c8c901f817b00a57a5a6b552b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbep:q7Tc2NYHUrAwfMp3CDp
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 34 IoCs
resource yara_rule behavioral1/memory/2888-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-47-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/604-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2100-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2688-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1764-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2044-160-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1544-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1536-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/916-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-281-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-325-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-339-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/528-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1072-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2280-430-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/920-495-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1144-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-642-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2940-693-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-706-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2416-827-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2416-828-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2772 lfxfrfr.exe 2904 pjpjj.exe 1808 ffrxllr.exe 2636 thhtht.exe 2196 jdvvd.exe 604 lxlllrx.exe 696 dvdvd.exe 1992 lfrrxfl.exe 1748 thttbt.exe 2100 dpvdv.exe 3056 rflrxfr.exe 2688 nbhhtn.exe 2964 pjdjv.exe 1764 fxfrrll.exe 2516 bntttt.exe 2044 lxlxlfl.exe 1276 thbhnn.exe 2460 vdjjj.exe 1544 llrxlrr.exe 2008 nhhtbt.exe 2292 3pvpj.exe 2456 3rffrrx.exe 2588 5bhbbt.exe 3052 jjvvd.exe 1536 xlffllx.exe 916 hbnbhn.exe 1740 xrfxfxf.exe 1752 btbtnn.exe 2332 7xlllll.exe 2064 lxffxll.exe 2836 3vddv.exe 396 rrflxrl.exe 1612 1thbhn.exe 2328 vjpdd.exe 2788 9lfxxxl.exe 2816 hhtttt.exe 2632 1pppv.exe 2368 dvdvv.exe 2344 rlllrfl.exe 320 thtbbb.exe 2664 dvjpd.exe 1500 dvpvj.exe 528 fxrxfff.exe 2068 nbtbnn.exe 1532 dpvvj.exe 2600 rrffllf.exe 2100 ththnh.exe 2924 7hhhhb.exe 2608 1vpvv.exe 1072 lflrxxf.exe 2968 hbnntb.exe 2280 tnhbhh.exe 2236 dvjjv.exe 1672 fxllxrx.exe 2044 nbbhtn.exe 1132 htbhnn.exe 2252 vjjjd.exe 1956 vdppv.exe 2224 1rllfff.exe 2216 tnbhhb.exe 1820 vpjjp.exe 920 dpjjd.exe 1144 7xfffxx.exe 2088 xrflfrl.exe -
resource yara_rule behavioral1/memory/2888-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/604-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2044-160-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1544-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3052-229-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1536-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2332-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-281-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-325-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-339-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/528-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2100-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1072-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-423-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-430-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/920-495-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1144-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1752-551-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2668-602-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2664-642-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2940-693-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-706-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1440-755-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-784-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/548-814-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xlfrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2772 2888 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 30 PID 2888 wrote to memory of 2772 2888 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 30 PID 2888 wrote to memory of 2772 2888 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 30 PID 2888 wrote to memory of 2772 2888 810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe 30 PID 2772 wrote to memory of 2904 2772 lfxfrfr.exe 31 PID 2772 wrote to memory of 2904 2772 lfxfrfr.exe 31 PID 2772 wrote to memory of 2904 2772 lfxfrfr.exe 31 PID 2772 wrote to memory of 2904 2772 lfxfrfr.exe 31 PID 2904 wrote to memory of 1808 2904 pjpjj.exe 32 PID 2904 wrote to memory of 1808 2904 pjpjj.exe 32 PID 2904 wrote to memory of 1808 2904 pjpjj.exe 32 PID 2904 wrote to memory of 1808 2904 pjpjj.exe 32 PID 1808 wrote to memory of 2636 1808 ffrxllr.exe 33 PID 1808 wrote to memory of 2636 1808 ffrxllr.exe 33 PID 1808 wrote to memory of 2636 1808 ffrxllr.exe 33 PID 1808 wrote to memory of 2636 1808 ffrxllr.exe 33 PID 2636 wrote to memory of 2196 2636 thhtht.exe 34 PID 2636 wrote to memory of 2196 2636 thhtht.exe 34 PID 2636 wrote to memory of 2196 2636 thhtht.exe 34 PID 2636 wrote to memory of 2196 2636 thhtht.exe 34 PID 2196 wrote to memory of 604 2196 jdvvd.exe 35 PID 2196 wrote to memory of 604 2196 jdvvd.exe 35 PID 2196 wrote to memory of 604 2196 jdvvd.exe 35 PID 2196 wrote to memory of 604 2196 jdvvd.exe 35 PID 604 wrote to memory of 696 604 lxlllrx.exe 36 PID 604 wrote to memory of 696 604 lxlllrx.exe 36 PID 604 wrote to memory of 696 604 lxlllrx.exe 36 PID 604 wrote to memory of 696 604 lxlllrx.exe 36 PID 696 wrote to memory of 1992 696 dvdvd.exe 37 PID 696 wrote to memory of 1992 696 dvdvd.exe 37 PID 696 wrote to memory of 1992 696 dvdvd.exe 37 PID 696 wrote to memory of 1992 696 dvdvd.exe 37 PID 1992 wrote to memory of 1748 1992 lfrrxfl.exe 38 PID 1992 wrote to memory of 1748 1992 lfrrxfl.exe 38 PID 1992 wrote to memory of 1748 1992 lfrrxfl.exe 38 PID 1992 wrote to memory of 1748 1992 lfrrxfl.exe 38 PID 1748 wrote to memory of 2100 1748 thttbt.exe 39 PID 1748 wrote to memory of 2100 1748 thttbt.exe 39 PID 1748 wrote to memory of 2100 1748 thttbt.exe 39 PID 1748 wrote to memory of 2100 1748 thttbt.exe 39 PID 2100 wrote to memory of 3056 2100 dpvdv.exe 40 PID 2100 wrote to memory of 3056 2100 dpvdv.exe 40 PID 2100 wrote to memory of 3056 2100 dpvdv.exe 40 PID 2100 wrote to memory of 3056 2100 dpvdv.exe 40 PID 3056 wrote to memory of 2688 3056 rflrxfr.exe 41 PID 3056 wrote to memory of 2688 3056 rflrxfr.exe 41 PID 3056 wrote to memory of 2688 3056 rflrxfr.exe 41 PID 3056 wrote to memory of 2688 3056 rflrxfr.exe 41 PID 2688 wrote to memory of 2964 2688 nbhhtn.exe 42 PID 2688 wrote to memory of 2964 2688 nbhhtn.exe 42 PID 2688 wrote to memory of 2964 2688 nbhhtn.exe 42 PID 2688 wrote to memory of 2964 2688 nbhhtn.exe 42 PID 2964 wrote to memory of 1764 2964 pjdjv.exe 43 PID 2964 wrote to memory of 1764 2964 pjdjv.exe 43 PID 2964 wrote to memory of 1764 2964 pjdjv.exe 43 PID 2964 wrote to memory of 1764 2964 pjdjv.exe 43 PID 1764 wrote to memory of 2516 1764 fxfrrll.exe 44 PID 1764 wrote to memory of 2516 1764 fxfrrll.exe 44 PID 1764 wrote to memory of 2516 1764 fxfrrll.exe 44 PID 1764 wrote to memory of 2516 1764 fxfrrll.exe 44 PID 2516 wrote to memory of 2044 2516 bntttt.exe 45 PID 2516 wrote to memory of 2044 2516 bntttt.exe 45 PID 2516 wrote to memory of 2044 2516 bntttt.exe 45 PID 2516 wrote to memory of 2044 2516 bntttt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe"C:\Users\Admin\AppData\Local\Temp\810e7049d04d18ceda1bef9f140f3946b94e955aff396055f9ac44c598090e42.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\lfxfrfr.exec:\lfxfrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pjpjj.exec:\pjpjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ffrxllr.exec:\ffrxllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\thhtht.exec:\thhtht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\jdvvd.exec:\jdvvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\lxlllrx.exec:\lxlllrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:604 -
\??\c:\dvdvd.exec:\dvdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\lfrrxfl.exec:\lfrrxfl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\thttbt.exec:\thttbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\dpvdv.exec:\dpvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\rflrxfr.exec:\rflrxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nbhhtn.exec:\nbhhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pjdjv.exec:\pjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\fxfrrll.exec:\fxfrrll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\bntttt.exec:\bntttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\lxlxlfl.exec:\lxlxlfl.exe17⤵
- Executes dropped EXE
PID:2044 -
\??\c:\thbhnn.exec:\thbhnn.exe18⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vdjjj.exec:\vdjjj.exe19⤵
- Executes dropped EXE
PID:2460 -
\??\c:\llrxlrr.exec:\llrxlrr.exe20⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nhhtbt.exec:\nhhtbt.exe21⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3pvpj.exec:\3pvpj.exe22⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3rffrrx.exec:\3rffrrx.exe23⤵
- Executes dropped EXE
PID:2456 -
\??\c:\5bhbbt.exec:\5bhbbt.exe24⤵
- Executes dropped EXE
PID:2588 -
\??\c:\jjvvd.exec:\jjvvd.exe25⤵
- Executes dropped EXE
PID:3052 -
\??\c:\xlffllx.exec:\xlffllx.exe26⤵
- Executes dropped EXE
PID:1536 -
\??\c:\hbnbhn.exec:\hbnbhn.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\btbtnn.exec:\btbtnn.exe29⤵
- Executes dropped EXE
PID:1752 -
\??\c:\7xlllll.exec:\7xlllll.exe30⤵
- Executes dropped EXE
PID:2332 -
\??\c:\lxffxll.exec:\lxffxll.exe31⤵
- Executes dropped EXE
PID:2064 -
\??\c:\3vddv.exec:\3vddv.exe32⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rrflxrl.exec:\rrflxrl.exe33⤵
- Executes dropped EXE
PID:396 -
\??\c:\1thbhn.exec:\1thbhn.exe34⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vjpdd.exec:\vjpdd.exe35⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9lfxxxl.exec:\9lfxxxl.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\hhtttt.exec:\hhtttt.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1pppv.exec:\1pppv.exe38⤵
- Executes dropped EXE
PID:2632 -
\??\c:\dvdvv.exec:\dvdvv.exe39⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rlllrfl.exec:\rlllrfl.exe40⤵
- Executes dropped EXE
PID:2344 -
\??\c:\thtbbb.exec:\thtbbb.exe41⤵
- Executes dropped EXE
PID:320 -
\??\c:\dvjpd.exec:\dvjpd.exe42⤵
- Executes dropped EXE
PID:2664 -
\??\c:\dvpvj.exec:\dvpvj.exe43⤵
- Executes dropped EXE
PID:1500 -
\??\c:\fxrxfff.exec:\fxrxfff.exe44⤵
- Executes dropped EXE
PID:528 -
\??\c:\nbtbnn.exec:\nbtbnn.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\dpvvj.exec:\dpvvj.exe46⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rrffllf.exec:\rrffllf.exe47⤵
- Executes dropped EXE
PID:2600 -
\??\c:\ththnh.exec:\ththnh.exe48⤵
- Executes dropped EXE
PID:2100 -
\??\c:\7hhhhb.exec:\7hhhhb.exe49⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1vpvv.exec:\1vpvv.exe50⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lflrxxf.exec:\lflrxxf.exe51⤵
- Executes dropped EXE
PID:1072 -
\??\c:\hbnntb.exec:\hbnntb.exe52⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tnhbhh.exec:\tnhbhh.exe53⤵
- Executes dropped EXE
PID:2280 -
\??\c:\dvjjv.exec:\dvjjv.exe54⤵
- Executes dropped EXE
PID:2236 -
\??\c:\fxllxrx.exec:\fxllxrx.exe55⤵
- Executes dropped EXE
PID:1672 -
\??\c:\nbbhtn.exec:\nbbhtn.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\htbhnn.exec:\htbhnn.exe57⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vjjjd.exec:\vjjjd.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\vdppv.exec:\vdppv.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\1rllfff.exec:\1rllfff.exe60⤵
- Executes dropped EXE
PID:2224 -
\??\c:\tnbhhb.exec:\tnbhhb.exe61⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vpjjp.exec:\vpjjp.exe62⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dpjjd.exec:\dpjjd.exe63⤵
- Executes dropped EXE
PID:920 -
\??\c:\7xfffxx.exec:\7xfffxx.exe64⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xrflfrl.exec:\xrflfrl.exe65⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5bnbbt.exec:\5bnbbt.exe66⤵PID:1360
-
\??\c:\vjddp.exec:\vjddp.exe67⤵PID:1536
-
\??\c:\9fllfrr.exec:\9fllfrr.exe68⤵PID:712
-
\??\c:\xflflll.exec:\xflflll.exe69⤵PID:2180
-
\??\c:\5tbnnt.exec:\5tbnnt.exe70⤵PID:2416
-
\??\c:\jvppv.exec:\jvppv.exe71⤵PID:1752
-
\??\c:\9jpvd.exec:\9jpvd.exe72⤵PID:2172
-
\??\c:\lrlxxff.exec:\lrlxxff.exe73⤵PID:1528
-
\??\c:\xrffffl.exec:\xrffffl.exe74⤵PID:1848
-
\??\c:\bnbbhh.exec:\bnbbhh.exe75⤵PID:2712
-
\??\c:\jpvdp.exec:\jpvdp.exe76⤵PID:1724
-
\??\c:\dpjjp.exec:\dpjjp.exe77⤵PID:1612
-
\??\c:\lfrxfxf.exec:\lfrxfxf.exe78⤵PID:2464
-
\??\c:\3lxxfxf.exec:\3lxxfxf.exe79⤵PID:2668
-
\??\c:\thhbhn.exec:\thhbhn.exe80⤵PID:2756
-
\??\c:\jjvjp.exec:\jjvjp.exe81⤵PID:2632
-
\??\c:\fxxfxlx.exec:\fxxfxlx.exe82⤵PID:2620
-
\??\c:\ffflrxf.exec:\ffflrxf.exe83⤵PID:500
-
\??\c:\hbthtb.exec:\hbthtb.exe84⤵PID:952
-
\??\c:\9htntt.exec:\9htntt.exe85⤵PID:2664
-
\??\c:\dvdpp.exec:\dvdpp.exe86⤵PID:1504
-
\??\c:\9rllfrr.exec:\9rllfrr.exe87⤵PID:2876
-
\??\c:\ffxxlfx.exec:\ffxxlfx.exe88⤵PID:2068
-
\??\c:\thttbh.exec:\thttbh.exe89⤵PID:2132
-
\??\c:\7vjdp.exec:\7vjdp.exe90⤵PID:2108
-
\??\c:\3pdjj.exec:\3pdjj.exe91⤵PID:2100
-
\??\c:\rlxfllx.exec:\rlxfllx.exe92⤵PID:2960
-
\??\c:\tntntt.exec:\tntntt.exe93⤵PID:2940
-
\??\c:\bbnbbt.exec:\bbnbbt.exe94⤵PID:2092
-
\??\c:\jdpjp.exec:\jdpjp.exe95⤵PID:2504
-
\??\c:\9vjdj.exec:\9vjdj.exe96⤵PID:688
-
\??\c:\1rfffxf.exec:\1rfffxf.exe97⤵PID:1288
-
\??\c:\9xlrfrf.exec:\9xlrfrf.exe98⤵PID:884
-
\??\c:\5bnnbh.exec:\5bnnbh.exe99⤵
- System Location Discovery: System Language Discovery
PID:1924 -
\??\c:\dpvjp.exec:\dpvjp.exe100⤵PID:1440
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe101⤵PID:1996
-
\??\c:\hhthnn.exec:\hhthnn.exe102⤵PID:1932
-
\??\c:\htbhtt.exec:\htbhtt.exe103⤵PID:1496
-
\??\c:\5djjv.exec:\5djjv.exe104⤵PID:2008
-
\??\c:\frxllll.exec:\frxllll.exe105⤵PID:1820
-
\??\c:\tnbbbb.exec:\tnbbbb.exe106⤵PID:488
-
\??\c:\3nnbbh.exec:\3nnbbh.exe107⤵PID:1144
-
\??\c:\dpjdd.exec:\dpjdd.exe108⤵PID:3052
-
\??\c:\rflrxxl.exec:\rflrxxl.exe109⤵PID:936
-
\??\c:\xrxxlff.exec:\xrxxlff.exe110⤵PID:2156
-
\??\c:\tbhbbt.exec:\tbhbbt.exe111⤵PID:1396
-
\??\c:\jdpjp.exec:\jdpjp.exe112⤵PID:548
-
\??\c:\lxllffl.exec:\lxllffl.exe113⤵PID:2416
-
\??\c:\nhtthb.exec:\nhtthb.exe114⤵PID:2544
-
\??\c:\hthnnh.exec:\hthnnh.exe115⤵PID:1668
-
\??\c:\pdjjd.exec:\pdjjd.exe116⤵PID:1528
-
\??\c:\llxxxfr.exec:\llxxxfr.exe117⤵PID:2404
-
\??\c:\nnnnhb.exec:\nnnnhb.exe118⤵PID:1620
-
\??\c:\3hhnnn.exec:\3hhnnn.exe119⤵PID:1824
-
\??\c:\1vjpp.exec:\1vjpp.exe120⤵PID:2768
-
\??\c:\pjvjp.exec:\pjvjp.exe121⤵PID:2780
-
\??\c:\lfffxxx.exec:\lfffxxx.exe122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-