Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 20:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe
-
Size
454KB
-
MD5
cb541ec2a28989289fef87d3782263b0
-
SHA1
c28992dd0262ac4a09a79e47b309018a76a84fb8
-
SHA256
46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dcca
-
SHA512
abd16473ae59adfc9387c53f1f9a8a9005e29ca0f9b41a5bc16dc090c45be84355b92ae36cc68ac961499e88ba3f68f2281f3c9e7f19afdf6340affaac32897b
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeT:q7Tc2NYHUrAwfMp3CDT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2684-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2840-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-112-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1448-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-129-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1996-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/348-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1352-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2448-205-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1648-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1436-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3020-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-289-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2660-299-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-378-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-392-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-401-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1948-439-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-454-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2924-453-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/884-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3060-562-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1260-597-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/2892-638-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2772-676-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-787-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1460-789-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2984-879-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 9vpjd.exe 2124 fffrrfx.exe 2840 dvvjj.exe 2532 pvvjd.exe 796 lxxlrlr.exe 3000 htbnnh.exe 2440 bbttnb.exe 1772 vdpjj.exe 2568 bbtbnt.exe 2424 rrrxllf.exe 2792 1hhthn.exe 1448 rxfrxxf.exe 2300 hnbthh.exe 1996 ffrfrfr.exe 2728 3nhhhn.exe 1924 5xxlxlx.exe 1932 hhtbnn.exe 348 rrxlxfr.exe 1352 bnbhhb.exe 1616 ffrrffl.exe 2448 tnbntb.exe 736 5jjvd.exe 1540 bttthh.exe 1456 bbbnbh.exe 1648 djvdd.exe 1436 5fxrlrl.exe 328 dpjjp.exe 3020 7thhhn.exe 3036 1tnbnn.exe 1428 lflxlxl.exe 2104 9nbhnn.exe 2660 lfrlflx.exe 1640 3bhnbt.exe 1632 3jjpd.exe 1260 lfxfrfx.exe 2592 hbthnt.exe 2604 1djjp.exe 2648 1rflxlf.exe 1740 fxlrxfl.exe 992 bnhnhn.exe 628 ddpvd.exe 2616 xrflrxl.exe 1748 hbbnbh.exe 2172 ppjjv.exe 2180 dvvdp.exe 2320 ffrfrrl.exe 1564 5hbbnt.exe 1256 vppvd.exe 1104 vpjvd.exe 1996 lfxxllx.exe 2416 1hhhbb.exe 2728 jjvdp.exe 1948 1xxlxlf.exe 2928 btnthn.exe 2924 jjdpd.exe 1960 pjvdj.exe 1352 lfxrlxx.exe 2860 tbntbb.exe 444 5vpvp.exe 876 xrlxrrx.exe 736 nbnbhn.exe 1208 hnbnnn.exe 1636 9jppv.exe 884 5lfllfl.exe -
resource yara_rule behavioral1/memory/2684-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2840-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-112-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/348-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2448-203-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/1648-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1436-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-299-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/628-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-392-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-401-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1948-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-454-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1460-789-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2984-879-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxllxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2684 2824 46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe 30 PID 2824 wrote to memory of 2684 2824 46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe 30 PID 2824 wrote to memory of 2684 2824 46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe 30 PID 2824 wrote to memory of 2684 2824 46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe 30 PID 2684 wrote to memory of 2124 2684 9vpjd.exe 31 PID 2684 wrote to memory of 2124 2684 9vpjd.exe 31 PID 2684 wrote to memory of 2124 2684 9vpjd.exe 31 PID 2684 wrote to memory of 2124 2684 9vpjd.exe 31 PID 2124 wrote to memory of 2840 2124 fffrrfx.exe 32 PID 2124 wrote to memory of 2840 2124 fffrrfx.exe 32 PID 2124 wrote to memory of 2840 2124 fffrrfx.exe 32 PID 2124 wrote to memory of 2840 2124 fffrrfx.exe 32 PID 2840 wrote to memory of 2532 2840 dvvjj.exe 33 PID 2840 wrote to memory of 2532 2840 dvvjj.exe 33 PID 2840 wrote to memory of 2532 2840 dvvjj.exe 33 PID 2840 wrote to memory of 2532 2840 dvvjj.exe 33 PID 2532 wrote to memory of 796 2532 pvvjd.exe 34 PID 2532 wrote to memory of 796 2532 pvvjd.exe 34 PID 2532 wrote to memory of 796 2532 pvvjd.exe 34 PID 2532 wrote to memory of 796 2532 pvvjd.exe 34 PID 796 wrote to memory of 3000 796 lxxlrlr.exe 35 PID 796 wrote to memory of 3000 796 lxxlrlr.exe 35 PID 796 wrote to memory of 3000 796 lxxlrlr.exe 35 PID 796 wrote to memory of 3000 796 lxxlrlr.exe 35 PID 3000 wrote to memory of 2440 3000 htbnnh.exe 36 PID 3000 wrote to memory of 2440 3000 htbnnh.exe 36 PID 3000 wrote to memory of 2440 3000 htbnnh.exe 36 PID 3000 wrote to memory of 2440 3000 htbnnh.exe 36 PID 2440 wrote to memory of 1772 2440 bbttnb.exe 37 PID 2440 wrote to memory of 1772 2440 bbttnb.exe 37 PID 2440 wrote to memory of 1772 2440 bbttnb.exe 37 PID 2440 wrote to memory of 1772 2440 bbttnb.exe 37 PID 1772 wrote to memory of 2568 1772 vdpjj.exe 38 PID 1772 wrote to memory of 2568 1772 vdpjj.exe 38 PID 1772 wrote to memory of 2568 1772 vdpjj.exe 38 PID 1772 wrote to memory of 2568 1772 vdpjj.exe 38 PID 2568 wrote to memory of 2424 2568 bbtbnt.exe 39 PID 2568 wrote to memory of 2424 2568 bbtbnt.exe 39 PID 2568 wrote to memory of 2424 2568 bbtbnt.exe 39 PID 2568 wrote to memory of 2424 2568 bbtbnt.exe 39 PID 2424 wrote to memory of 2792 2424 rrrxllf.exe 40 PID 2424 wrote to memory of 2792 2424 rrrxllf.exe 40 PID 2424 wrote to memory of 2792 2424 rrrxllf.exe 40 PID 2424 wrote to memory of 2792 2424 rrrxllf.exe 40 PID 2792 wrote to memory of 1448 2792 1hhthn.exe 41 PID 2792 wrote to memory of 1448 2792 1hhthn.exe 41 PID 2792 wrote to memory of 1448 2792 1hhthn.exe 41 PID 2792 wrote to memory of 1448 2792 1hhthn.exe 41 PID 1448 wrote to memory of 2300 1448 rxfrxxf.exe 42 PID 1448 wrote to memory of 2300 1448 rxfrxxf.exe 42 PID 1448 wrote to memory of 2300 1448 rxfrxxf.exe 42 PID 1448 wrote to memory of 2300 1448 rxfrxxf.exe 42 PID 2300 wrote to memory of 1996 2300 hnbthh.exe 43 PID 2300 wrote to memory of 1996 2300 hnbthh.exe 43 PID 2300 wrote to memory of 1996 2300 hnbthh.exe 43 PID 2300 wrote to memory of 1996 2300 hnbthh.exe 43 PID 1996 wrote to memory of 2728 1996 ffrfrfr.exe 44 PID 1996 wrote to memory of 2728 1996 ffrfrfr.exe 44 PID 1996 wrote to memory of 2728 1996 ffrfrfr.exe 44 PID 1996 wrote to memory of 2728 1996 ffrfrfr.exe 44 PID 2728 wrote to memory of 1924 2728 3nhhhn.exe 45 PID 2728 wrote to memory of 1924 2728 3nhhhn.exe 45 PID 2728 wrote to memory of 1924 2728 3nhhhn.exe 45 PID 2728 wrote to memory of 1924 2728 3nhhhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe"C:\Users\Admin\AppData\Local\Temp\46f370f3213bba71920902e4de5b4391392cd1f6187d1daee70d27c53736dccaN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\9vpjd.exec:\9vpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\fffrrfx.exec:\fffrrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\dvvjj.exec:\dvvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\pvvjd.exec:\pvvjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\lxxlrlr.exec:\lxxlrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\htbnnh.exec:\htbnnh.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\bbttnb.exec:\bbttnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vdpjj.exec:\vdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\bbtbnt.exec:\bbtbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rrrxllf.exec:\rrrxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\1hhthn.exec:\1hhthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\rxfrxxf.exec:\rxfrxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\hnbthh.exec:\hnbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\3nhhhn.exec:\3nhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5xxlxlx.exec:\5xxlxlx.exe17⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hhtbnn.exec:\hhtbnn.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe19⤵
- Executes dropped EXE
PID:348 -
\??\c:\bnbhhb.exec:\bnbhhb.exe20⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ffrrffl.exec:\ffrrffl.exe21⤵
- Executes dropped EXE
PID:1616 -
\??\c:\tnbntb.exec:\tnbntb.exe22⤵
- Executes dropped EXE
PID:2448 -
\??\c:\5jjvd.exec:\5jjvd.exe23⤵
- Executes dropped EXE
PID:736 -
\??\c:\bttthh.exec:\bttthh.exe24⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bbbnbh.exec:\bbbnbh.exe25⤵
- Executes dropped EXE
PID:1456 -
\??\c:\djvdd.exec:\djvdd.exe26⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5fxrlrl.exec:\5fxrlrl.exe27⤵
- Executes dropped EXE
PID:1436 -
\??\c:\dpjjp.exec:\dpjjp.exe28⤵
- Executes dropped EXE
PID:328 -
\??\c:\7thhhn.exec:\7thhhn.exe29⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1tnbnn.exec:\1tnbnn.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3036 -
\??\c:\lflxlxl.exec:\lflxlxl.exe31⤵
- Executes dropped EXE
PID:1428 -
\??\c:\9nbhnn.exec:\9nbhnn.exe32⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lfrlflx.exec:\lfrlflx.exe33⤵
- Executes dropped EXE
PID:2660 -
\??\c:\3bhnbt.exec:\3bhnbt.exe34⤵
- Executes dropped EXE
PID:1640 -
\??\c:\3jjpd.exec:\3jjpd.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lfxfrfx.exec:\lfxfrfx.exe36⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hbthnt.exec:\hbthnt.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\1djjp.exec:\1djjp.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1rflxlf.exec:\1rflxlf.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe40⤵
- Executes dropped EXE
PID:1740 -
\??\c:\bnhnhn.exec:\bnhnhn.exe41⤵
- Executes dropped EXE
PID:992 -
\??\c:\ddpvd.exec:\ddpvd.exe42⤵
- Executes dropped EXE
PID:628 -
\??\c:\xrflrxl.exec:\xrflrxl.exe43⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hbbnbh.exec:\hbbnbh.exe44⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ppjjv.exec:\ppjjv.exe45⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvvdp.exec:\dvvdp.exe46⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ffrfrrl.exec:\ffrfrrl.exe47⤵
- Executes dropped EXE
PID:2320 -
\??\c:\5hbbnt.exec:\5hbbnt.exe48⤵
- Executes dropped EXE
PID:1564 -
\??\c:\vppvd.exec:\vppvd.exe49⤵
- Executes dropped EXE
PID:1256 -
\??\c:\vpjvd.exec:\vpjvd.exe50⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lfxxllx.exec:\lfxxllx.exe51⤵
- Executes dropped EXE
PID:1996 -
\??\c:\1hhhbb.exec:\1hhhbb.exe52⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jjvdp.exec:\jjvdp.exe53⤵
- Executes dropped EXE
PID:2728 -
\??\c:\1xxlxlf.exec:\1xxlxlf.exe54⤵
- Executes dropped EXE
PID:1948 -
\??\c:\btnthn.exec:\btnthn.exe55⤵
- Executes dropped EXE
PID:2928 -
\??\c:\jjdpd.exec:\jjdpd.exe56⤵
- Executes dropped EXE
PID:2924 -
\??\c:\pjvdj.exec:\pjvdj.exe57⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lfxrlxx.exec:\lfxrlxx.exe58⤵
- Executes dropped EXE
PID:1352 -
\??\c:\tbntbb.exec:\tbntbb.exe59⤵
- Executes dropped EXE
PID:2860 -
\??\c:\5vpvp.exec:\5vpvp.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\xrlxrrx.exec:\xrlxrrx.exe61⤵
- Executes dropped EXE
PID:876 -
\??\c:\nbnbhn.exec:\nbnbhn.exe62⤵
- Executes dropped EXE
PID:736 -
\??\c:\hnbnnn.exec:\hnbnnn.exe63⤵
- Executes dropped EXE
PID:1208 -
\??\c:\9jppv.exec:\9jppv.exe64⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5lfllfl.exec:\5lfllfl.exe65⤵
- Executes dropped EXE
PID:884 -
\??\c:\tnbhbh.exec:\tnbhbh.exe66⤵PID:1968
-
\??\c:\jjdjp.exec:\jjdjp.exe67⤵PID:1912
-
\??\c:\pdpvd.exec:\pdpvd.exe68⤵PID:2744
-
\??\c:\xrfllrf.exec:\xrfllrf.exe69⤵PID:600
-
\??\c:\nnbhnt.exec:\nnbhnt.exe70⤵PID:988
-
\??\c:\1pjvv.exec:\1pjvv.exe71⤵PID:1432
-
\??\c:\9lxlrrx.exec:\9lxlrrx.exe72⤵PID:880
-
\??\c:\1thhhn.exec:\1thhhn.exe73⤵PID:3060
-
\??\c:\ppjvd.exec:\ppjvd.exe74⤵PID:2104
-
\??\c:\3lfrxfr.exec:\3lfrxfr.exe75⤵PID:2848
-
\??\c:\hbnntt.exec:\hbnntt.exe76⤵PID:2836
-
\??\c:\3jdjp.exec:\3jdjp.exe77⤵PID:1396
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe78⤵PID:1260
-
\??\c:\5tthht.exec:\5tthht.exe79⤵PID:2628
-
\??\c:\5htnbb.exec:\5htnbb.exe80⤵PID:796
-
\??\c:\dddjd.exec:\dddjd.exe81⤵PID:2148
-
\??\c:\rlfrxfl.exec:\rlfrxfl.exe82⤵PID:1896
-
\??\c:\3bbhnb.exec:\3bbhnb.exe83⤵PID:1048
-
\??\c:\hnnthn.exec:\hnnthn.exe84⤵PID:2892
-
\??\c:\jjdpd.exec:\jjdpd.exe85⤵PID:1852
-
\??\c:\rlxfffr.exec:\rlxfffr.exe86⤵PID:1840
-
\??\c:\nhttnh.exec:\nhttnh.exe87⤵PID:2436
-
\??\c:\vdddj.exec:\vdddj.exe88⤵PID:1368
-
\??\c:\rrflxrf.exec:\rrflxrf.exe89⤵PID:1544
-
\??\c:\1rllrlf.exec:\1rllrlf.exe90⤵PID:2772
-
\??\c:\1tnthn.exec:\1tnthn.exe91⤵PID:1420
-
\??\c:\jdvvj.exec:\jdvvj.exe92⤵PID:2300
-
\??\c:\7rrxxfl.exec:\7rrxxfl.exe93⤵PID:2024
-
\??\c:\9rlxrrx.exec:\9rlxrrx.exe94⤵PID:2428
-
\??\c:\pjdpj.exec:\pjdpj.exe95⤵PID:1680
-
\??\c:\jjdjp.exec:\jjdjp.exe96⤵PID:2216
-
\??\c:\1rlrxrf.exec:\1rlrxrf.exe97⤵PID:2512
-
\??\c:\nnntnb.exec:\nnntnb.exe98⤵PID:2224
-
\??\c:\pvvjd.exec:\pvvjd.exe99⤵PID:664
-
\??\c:\3flxrlx.exec:\3flxrlx.exe100⤵PID:2940
-
\??\c:\5thhtb.exec:\5thhtb.exe101⤵PID:1964
-
\??\c:\nnnbht.exec:\nnnbht.exe102⤵PID:1284
-
\??\c:\pjdjd.exec:\pjdjd.exe103⤵PID:956
-
\??\c:\1rflrrx.exec:\1rflrrx.exe104⤵PID:744
-
\??\c:\xfrflfr.exec:\xfrflfr.exe105⤵PID:1456
-
\??\c:\5nnttb.exec:\5nnttb.exe106⤵PID:1644
-
\??\c:\7vpvj.exec:\7vpvj.exe107⤵PID:1460
-
\??\c:\rllrxfx.exec:\rllrxfx.exe108⤵PID:1664
-
\??\c:\tbthnt.exec:\tbthnt.exe109⤵PID:1884
-
\??\c:\7jjvd.exec:\7jjvd.exe110⤵PID:2964
-
\??\c:\rlflflr.exec:\rlflflr.exe111⤵PID:1920
-
\??\c:\bhbnbb.exec:\bhbnbb.exe112⤵PID:2896
-
\??\c:\hnbhnn.exec:\hnbhnn.exe113⤵PID:2816
-
\??\c:\5ddjp.exec:\5ddjp.exe114⤵PID:2908
-
\??\c:\1llxflr.exec:\1llxflr.exe115⤵PID:2564
-
\??\c:\9nbhnt.exec:\9nbhnt.exe116⤵PID:2664
-
\??\c:\pjvdd.exec:\pjvdd.exe117⤵PID:2548
-
\??\c:\9ppjv.exec:\9ppjv.exe118⤵PID:2540
-
\??\c:\ffxlrfx.exec:\ffxlrfx.exe119⤵PID:2524
-
\??\c:\tnhnbb.exec:\tnhnbb.exe120⤵PID:2984
-
\??\c:\5tnbnn.exec:\5tnbnn.exe121⤵PID:692
-
\??\c:\jdvjv.exec:\jdvjv.exe122⤵PID:568
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-