Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 18:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe
-
Size
454KB
-
MD5
e7db2d39f386cf4a37d76eecb8776111
-
SHA1
31fb88d1592a801c3bdbd096f32d2ed87e6df706
-
SHA256
92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c
-
SHA512
c7bc6890c992f7dfd75c34517c076b0fbaa717c6a54b93ef35acb58a38c2244a40f53026b30fe363438560859a6d69896483f7f45055e33d5d454b83f89e75a1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeo:q7Tc2NYHUrAwfMp3CDo
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/1728-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2296-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2784-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-54-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2560-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/480-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2904-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-182-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-201-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/904-217-0x00000000002C0000-0x00000000002EA000-memory.dmp family_blackmoon behavioral1/memory/1248-231-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1984-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1628-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-334-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/632-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-361-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-413-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-421-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-494-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2208-545-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1692-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-561-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-598-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2868-694-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/396-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2168-755-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 ffflrxr.exe 2792 ntthbn.exe 2784 xrxflrl.exe 2296 jjdvp.exe 2720 rxrxrrl.exe 2560 thhbbn.exe 3016 3xxfrxl.exe 1828 5vvjj.exe 348 lxfrrrl.exe 1632 bbbthn.exe 480 xflxlxl.exe 2952 vvvvv.exe 2896 llxlxxx.exe 2904 vvpvv.exe 2084 rxlxrrx.exe 1672 3bnthh.exe 396 flfxfrf.exe 2172 vvdjv.exe 2184 xrlrxfx.exe 1976 bhntht.exe 2052 pjdpd.exe 988 1rllrrf.exe 904 pjvdj.exe 1448 fxrxfrx.exe 1248 vvpdd.exe 1984 lfxlflx.exe 1628 pvpvj.exe 2056 1btbbn.exe 2228 rfllfll.exe 704 tbtnnh.exe 896 vvjdp.exe 884 1xrrxxf.exe 1948 bthnbb.exe 2880 dvjpd.exe 1524 1rxxfxx.exe 2800 tnhhnn.exe 2940 5tntbh.exe 2708 pvvvj.exe 2568 3xrfxfl.exe 632 7bhbnb.exe 2540 7vjvd.exe 1228 djjdj.exe 324 tnhnth.exe 1012 dpdvv.exe 2848 rlfrxfx.exe 1020 tnnbnb.exe 300 tbbbnn.exe 2964 1vjpj.exe 2724 llflrfl.exe 2852 bbntht.exe 2924 vvpdd.exe 2748 1xrrxxf.exe 2324 rlflxfl.exe 588 vpdjj.exe 1768 jjvvd.exe 1960 ffxlrxr.exe 2080 bbhbbt.exe 2212 jjdvj.exe 1944 rlfllxl.exe 1312 3nhhnt.exe 1924 hhbnhn.exe 2516 9jvdp.exe 1200 1xxrflr.exe 968 hnnthn.exe -
resource yara_rule behavioral1/memory/1728-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2784-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2560-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/480-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2904-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-221-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-231-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1628-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/632-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-361-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-413-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-456-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-545-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1692-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-561-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-606-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2604-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-694-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/396-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-755-0x00000000003D0000-0x00000000003FA000-memory.dmp upx behavioral1/memory/1884-847-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frlxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2676 1728 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 30 PID 1728 wrote to memory of 2676 1728 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 30 PID 1728 wrote to memory of 2676 1728 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 30 PID 1728 wrote to memory of 2676 1728 92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe 30 PID 2676 wrote to memory of 2792 2676 ffflrxr.exe 31 PID 2676 wrote to memory of 2792 2676 ffflrxr.exe 31 PID 2676 wrote to memory of 2792 2676 ffflrxr.exe 31 PID 2676 wrote to memory of 2792 2676 ffflrxr.exe 31 PID 2792 wrote to memory of 2784 2792 ntthbn.exe 32 PID 2792 wrote to memory of 2784 2792 ntthbn.exe 32 PID 2792 wrote to memory of 2784 2792 ntthbn.exe 32 PID 2792 wrote to memory of 2784 2792 ntthbn.exe 32 PID 2784 wrote to memory of 2296 2784 xrxflrl.exe 33 PID 2784 wrote to memory of 2296 2784 xrxflrl.exe 33 PID 2784 wrote to memory of 2296 2784 xrxflrl.exe 33 PID 2784 wrote to memory of 2296 2784 xrxflrl.exe 33 PID 2296 wrote to memory of 2720 2296 jjdvp.exe 34 PID 2296 wrote to memory of 2720 2296 jjdvp.exe 34 PID 2296 wrote to memory of 2720 2296 jjdvp.exe 34 PID 2296 wrote to memory of 2720 2296 jjdvp.exe 34 PID 2720 wrote to memory of 2560 2720 rxrxrrl.exe 35 PID 2720 wrote to memory of 2560 2720 rxrxrrl.exe 35 PID 2720 wrote to memory of 2560 2720 rxrxrrl.exe 35 PID 2720 wrote to memory of 2560 2720 rxrxrrl.exe 35 PID 2560 wrote to memory of 3016 2560 thhbbn.exe 36 PID 2560 wrote to memory of 3016 2560 thhbbn.exe 36 PID 2560 wrote to memory of 3016 2560 thhbbn.exe 36 PID 2560 wrote to memory of 3016 2560 thhbbn.exe 36 PID 3016 wrote to memory of 1828 3016 3xxfrxl.exe 37 PID 3016 wrote to memory of 1828 3016 3xxfrxl.exe 37 PID 3016 wrote to memory of 1828 3016 3xxfrxl.exe 37 PID 3016 wrote to memory of 1828 3016 3xxfrxl.exe 37 PID 1828 wrote to memory of 348 1828 5vvjj.exe 38 PID 1828 wrote to memory of 348 1828 5vvjj.exe 38 PID 1828 wrote to memory of 348 1828 5vvjj.exe 38 PID 1828 wrote to memory of 348 1828 5vvjj.exe 38 PID 348 wrote to memory of 1632 348 lxfrrrl.exe 39 PID 348 wrote to memory of 1632 348 lxfrrrl.exe 39 PID 348 wrote to memory of 1632 348 lxfrrrl.exe 39 PID 348 wrote to memory of 1632 348 lxfrrrl.exe 39 PID 1632 wrote to memory of 480 1632 bbbthn.exe 40 PID 1632 wrote to memory of 480 1632 bbbthn.exe 40 PID 1632 wrote to memory of 480 1632 bbbthn.exe 40 PID 1632 wrote to memory of 480 1632 bbbthn.exe 40 PID 480 wrote to memory of 2952 480 xflxlxl.exe 41 PID 480 wrote to memory of 2952 480 xflxlxl.exe 41 PID 480 wrote to memory of 2952 480 xflxlxl.exe 41 PID 480 wrote to memory of 2952 480 xflxlxl.exe 41 PID 2952 wrote to memory of 2896 2952 vvvvv.exe 42 PID 2952 wrote to memory of 2896 2952 vvvvv.exe 42 PID 2952 wrote to memory of 2896 2952 vvvvv.exe 42 PID 2952 wrote to memory of 2896 2952 vvvvv.exe 42 PID 2896 wrote to memory of 2904 2896 llxlxxx.exe 43 PID 2896 wrote to memory of 2904 2896 llxlxxx.exe 43 PID 2896 wrote to memory of 2904 2896 llxlxxx.exe 43 PID 2896 wrote to memory of 2904 2896 llxlxxx.exe 43 PID 2904 wrote to memory of 2084 2904 vvpvv.exe 44 PID 2904 wrote to memory of 2084 2904 vvpvv.exe 44 PID 2904 wrote to memory of 2084 2904 vvpvv.exe 44 PID 2904 wrote to memory of 2084 2904 vvpvv.exe 44 PID 2084 wrote to memory of 1672 2084 rxlxrrx.exe 45 PID 2084 wrote to memory of 1672 2084 rxlxrrx.exe 45 PID 2084 wrote to memory of 1672 2084 rxlxrrx.exe 45 PID 2084 wrote to memory of 1672 2084 rxlxrrx.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe"C:\Users\Admin\AppData\Local\Temp\92c646d11accd76eb68083395d87df6e4282b96d399fd8baf3aab511024a722c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ffflrxr.exec:\ffflrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\ntthbn.exec:\ntthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\xrxflrl.exec:\xrxflrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\jjdvp.exec:\jjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rxrxrrl.exec:\rxrxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\thhbbn.exec:\thhbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\3xxfrxl.exec:\3xxfrxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\5vvjj.exec:\5vvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\lxfrrrl.exec:\lxfrrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\bbbthn.exec:\bbbthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\xflxlxl.exec:\xflxlxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:480 -
\??\c:\vvvvv.exec:\vvvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\llxlxxx.exec:\llxlxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\vvpvv.exec:\vvpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\rxlxrrx.exec:\rxlxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\3bnthh.exec:\3bnthh.exe17⤵
- Executes dropped EXE
PID:1672 -
\??\c:\flfxfrf.exec:\flfxfrf.exe18⤵
- Executes dropped EXE
PID:396 -
\??\c:\vvdjv.exec:\vvdjv.exe19⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xrlrxfx.exec:\xrlrxfx.exe20⤵
- Executes dropped EXE
PID:2184 -
\??\c:\bhntht.exec:\bhntht.exe21⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjdpd.exec:\pjdpd.exe22⤵
- Executes dropped EXE
PID:2052 -
\??\c:\1rllrrf.exec:\1rllrrf.exe23⤵
- Executes dropped EXE
PID:988 -
\??\c:\pjvdj.exec:\pjvdj.exe24⤵
- Executes dropped EXE
PID:904 -
\??\c:\fxrxfrx.exec:\fxrxfrx.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1448 -
\??\c:\vvpdd.exec:\vvpdd.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\lfxlflx.exec:\lfxlflx.exe27⤵
- Executes dropped EXE
PID:1984 -
\??\c:\pvpvj.exec:\pvpvj.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1btbbn.exec:\1btbbn.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rfllfll.exec:\rfllfll.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tbtnnh.exec:\tbtnnh.exe31⤵
- Executes dropped EXE
PID:704 -
\??\c:\vvjdp.exec:\vvjdp.exe32⤵
- Executes dropped EXE
PID:896 -
\??\c:\1xrrxxf.exec:\1xrrxxf.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\bthnbb.exec:\bthnbb.exe34⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dvjpd.exec:\dvjpd.exe35⤵
- Executes dropped EXE
PID:2880 -
\??\c:\1rxxfxx.exec:\1rxxfxx.exe36⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tnhhnn.exec:\tnhhnn.exe37⤵
- Executes dropped EXE
PID:2800 -
\??\c:\5tntbh.exec:\5tntbh.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pvvvj.exec:\pvvvj.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\3xrfxfl.exec:\3xrfxfl.exe40⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7bhbnb.exec:\7bhbnb.exe41⤵
- Executes dropped EXE
PID:632 -
\??\c:\7vjvd.exec:\7vjvd.exe42⤵
- Executes dropped EXE
PID:2540 -
\??\c:\djjdj.exec:\djjdj.exe43⤵
- Executes dropped EXE
PID:1228 -
\??\c:\tnhnth.exec:\tnhnth.exe44⤵
- Executes dropped EXE
PID:324 -
\??\c:\dpdvv.exec:\dpdvv.exe45⤵
- Executes dropped EXE
PID:1012 -
\??\c:\rlfrxfx.exec:\rlfrxfx.exe46⤵
- Executes dropped EXE
PID:2848 -
\??\c:\tnnbnb.exec:\tnnbnb.exe47⤵
- Executes dropped EXE
PID:1020 -
\??\c:\tbbbnn.exec:\tbbbnn.exe48⤵
- Executes dropped EXE
PID:300 -
\??\c:\1vjpj.exec:\1vjpj.exe49⤵
- Executes dropped EXE
PID:2964 -
\??\c:\llflrfl.exec:\llflrfl.exe50⤵
- Executes dropped EXE
PID:2724 -
\??\c:\bbntht.exec:\bbntht.exe51⤵
- Executes dropped EXE
PID:2852 -
\??\c:\vvpdd.exec:\vvpdd.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\1xrrxxf.exec:\1xrrxxf.exe53⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rlflxfl.exec:\rlflxfl.exe54⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpdjj.exec:\vpdjj.exe55⤵
- Executes dropped EXE
PID:588 -
\??\c:\jjvvd.exec:\jjvvd.exe56⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe57⤵
- Executes dropped EXE
PID:1960 -
\??\c:\bbhbbt.exec:\bbhbbt.exe58⤵
- Executes dropped EXE
PID:2080 -
\??\c:\jjdvj.exec:\jjdvj.exe59⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlfllxl.exec:\rlfllxl.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\3nhhnt.exec:\3nhhnt.exe61⤵
- Executes dropped EXE
PID:1312 -
\??\c:\hhbnhn.exec:\hhbnhn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1924 -
\??\c:\9jvdp.exec:\9jvdp.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1xxrflr.exec:\1xxrflr.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hnnthn.exec:\hnnthn.exe65⤵
- Executes dropped EXE
PID:968 -
\??\c:\vpdjv.exec:\vpdjv.exe66⤵PID:1476
-
\??\c:\1jddd.exec:\1jddd.exe67⤵PID:780
-
\??\c:\flrlxlf.exec:\flrlxlf.exe68⤵PID:1940
-
\??\c:\ttnbnt.exec:\ttnbnt.exe69⤵PID:2512
-
\??\c:\3dppd.exec:\3dppd.exe70⤵PID:2208
-
\??\c:\flxlrrf.exec:\flxlrrf.exe71⤵PID:1692
-
\??\c:\7xrxllf.exec:\7xrxllf.exe72⤵PID:1404
-
\??\c:\nbnbhn.exec:\nbnbhn.exe73⤵PID:1748
-
\??\c:\9ppvj.exec:\9ppvj.exe74⤵PID:1420
-
\??\c:\xrlrflf.exec:\xrlrflf.exe75⤵PID:2988
-
\??\c:\rrflxfr.exec:\rrflxfr.exe76⤵PID:2808
-
\??\c:\nnhttb.exec:\nnhttb.exe77⤵
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\vdvdv.exec:\vdvdv.exe78⤵PID:2704
-
\??\c:\fxflflx.exec:\fxflflx.exe79⤵PID:2672
-
\??\c:\5lxflxf.exec:\5lxflxf.exe80⤵PID:2824
-
\??\c:\vvvpv.exec:\vvvpv.exe81⤵PID:2736
-
\??\c:\vjdvp.exec:\vjdvp.exe82⤵PID:2712
-
\??\c:\1lflrxl.exec:\1lflrxl.exe83⤵PID:2544
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵PID:2604
-
\??\c:\jvjpv.exec:\jvjpv.exe85⤵PID:3012
-
\??\c:\vvpvj.exec:\vvpvj.exe86⤵
- System Location Discovery: System Language Discovery
PID:2444 -
\??\c:\rfxlrrx.exec:\rfxlrrx.exe87⤵PID:2900
-
\??\c:\hhhthn.exec:\hhhthn.exe88⤵PID:404
-
\??\c:\vpdpd.exec:\vpdpd.exe89⤵PID:1664
-
\??\c:\vvjpv.exec:\vvjpv.exe90⤵PID:2528
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe91⤵PID:2128
-
\??\c:\7btntb.exec:\7btntb.exe92⤵PID:2972
-
\??\c:\1ddjp.exec:\1ddjp.exe93⤵PID:2868
-
\??\c:\rrflrxl.exec:\rrflrxl.exe94⤵PID:2852
-
\??\c:\1rlrxxx.exec:\1rlrxxx.exe95⤵PID:2828
-
\??\c:\3tbnbt.exec:\3tbnbt.exe96⤵PID:2844
-
\??\c:\vvjjv.exec:\vvjjv.exe97⤵PID:2396
-
\??\c:\pjvdp.exec:\pjvdp.exe98⤵PID:796
-
\??\c:\1xlxxll.exec:\1xlxxll.exe99⤵PID:396
-
\??\c:\btnhtb.exec:\btnhtb.exe100⤵PID:2200
-
\??\c:\3ddjv.exec:\3ddjv.exe101⤵PID:2168
-
\??\c:\vpdpd.exec:\vpdpd.exe102⤵
- System Location Discovery: System Language Discovery
PID:2240 -
\??\c:\flflrxl.exec:\flflrxl.exe103⤵PID:1744
-
\??\c:\btnbnh.exec:\btnbnh.exe104⤵PID:1800
-
\??\c:\9jppp.exec:\9jppp.exe105⤵PID:840
-
\??\c:\lllrlrl.exec:\lllrlrl.exe106⤵PID:1720
-
\??\c:\7lflxfx.exec:\7lflxfx.exe107⤵PID:1932
-
\??\c:\3nhhtb.exec:\3nhhtb.exe108⤵PID:1456
-
\??\c:\ddvjv.exec:\ddvjv.exe109⤵PID:1732
-
\??\c:\jddjv.exec:\jddjv.exe110⤵PID:1192
-
\??\c:\rrlxlrl.exec:\rrlxlrl.exe111⤵PID:2408
-
\??\c:\3nbhnt.exec:\3nbhnt.exe112⤵PID:2300
-
\??\c:\jvjpj.exec:\jvjpj.exe113⤵PID:1628
-
\??\c:\7frlxxf.exec:\7frlxxf.exe114⤵
- System Location Discovery: System Language Discovery
PID:1692 -
\??\c:\7tntht.exec:\7tntht.exe115⤵PID:2272
-
\??\c:\bhttbn.exec:\bhttbn.exe116⤵PID:1884
-
\??\c:\vppvj.exec:\vppvj.exe117⤵PID:2728
-
\??\c:\ffxxffr.exec:\ffxxffr.exe118⤵PID:2796
-
\??\c:\ttnntb.exec:\ttnntb.exe119⤵PID:2808
-
\??\c:\7tnbnb.exec:\7tnbnb.exe120⤵PID:2652
-
\??\c:\vpjvd.exec:\vpjvd.exe121⤵PID:2820
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-