Analysis
-
max time kernel
120s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-12-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe
-
Size
79KB
-
MD5
c7f3544c6cb49e9b7e6290069813b5b0
-
SHA1
984448f3a738ed2d811de5f4addfe0e77c813f9c
-
SHA256
93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01
-
SHA512
de3f47d691d41493493ed986cc67a0ec84749541a7934efb909bd7aa9e7c0504fa07000e3f3ee2dc366ac61b0728a429f0636e3cf08a7c507fcf69a3992bdf02
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5bx7DUQeDac7Akc:0cdpeeBSHHMHLf9Rybx7DYec7Fc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 54 IoCs
resource yara_rule behavioral1/memory/1760-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-13-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2788-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2932-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-47-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/3032-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-80-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2752-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-85-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2224-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2492-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2028-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2116-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-191-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2056-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/492-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1908-215-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/716-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/716-230-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1912-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2512-295-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2956-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-338-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2948-346-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2948-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-359-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2264-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2032-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/568-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-431-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2452-438-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2056-472-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2248-484-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/944-497-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1676-510-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2336-535-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/344-654-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2456-688-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1368-750-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2620-765-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2336-804-0x00000000002C0000-0x00000000002E9000-memory.dmp family_blackmoon behavioral1/memory/2940-838-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1904-901-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/564-909-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2224-917-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2680-920-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2024-993-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2300-1001-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3052 3bnbnh.exe 2788 vdjdd.exe 2932 vvppp.exe 2820 lrlxlfl.exe 2948 3bnbhh.exe 3032 ddpvj.exe 2752 3flrrrx.exe 2744 bhtbtt.exe 2224 hhhtth.exe 2492 lfflflx.exe 2028 btbnnn.exe 2116 vpdvv.exe 2128 vvjdp.exe 2384 1frxxfl.exe 2684 bhbtbn.exe 636 3bhnbh.exe 2348 vdppd.exe 1096 flxfllr.exe 1504 lrlfxfl.exe 2056 tthnbn.exe 492 djjvp.exe 1908 xxxxlrf.exe 2408 lxllrfr.exe 716 bthhnt.exe 1912 3vjpv.exe 1604 pjpvd.exe 2664 5fxfrxx.exe 264 bthhtt.exe 1092 pjpdj.exe 1448 xflrflr.exe 2512 rrfrfrx.exe 2836 ttnnbh.exe 2932 tbtbnt.exe 2956 vvjpp.exe 2928 5pvvd.exe 1960 1xfllrx.exe 2856 tbtbht.exe 2948 bthnnb.exe 2860 jpjjp.exe 2752 rrxfrxx.exe 2088 3xrrflf.exe 2264 bbnnbh.exe 2448 nntbtb.exe 1340 1vdjv.exe 1172 1vpvd.exe 2032 fffxrrx.exe 568 rrffrxl.exe 3040 1thnbb.exe 2456 hhttnh.exe 1532 jdppv.exe 1224 1jddp.exe 2452 lrxfxrl.exe 2372 3nttth.exe 676 9tbhbb.exe 1616 vvddv.exe 1972 dddjp.exe 2480 xxxflfl.exe 2056 rrlfxfr.exe 2248 bhnnnn.exe 2380 1jvpd.exe 944 vppvd.exe 2356 xxrrflr.exe 1676 btbbhb.exe 1928 7bnhnn.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfflflx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1760 wrote to memory of 3052 1760 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 30 PID 1760 wrote to memory of 3052 1760 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 30 PID 1760 wrote to memory of 3052 1760 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 30 PID 1760 wrote to memory of 3052 1760 93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe 30 PID 3052 wrote to memory of 2788 3052 3bnbnh.exe 31 PID 3052 wrote to memory of 2788 3052 3bnbnh.exe 31 PID 3052 wrote to memory of 2788 3052 3bnbnh.exe 31 PID 3052 wrote to memory of 2788 3052 3bnbnh.exe 31 PID 2788 wrote to memory of 2932 2788 vdjdd.exe 32 PID 2788 wrote to memory of 2932 2788 vdjdd.exe 32 PID 2788 wrote to memory of 2932 2788 vdjdd.exe 32 PID 2788 wrote to memory of 2932 2788 vdjdd.exe 32 PID 2932 wrote to memory of 2820 2932 vvppp.exe 33 PID 2932 wrote to memory of 2820 2932 vvppp.exe 33 PID 2932 wrote to memory of 2820 2932 vvppp.exe 33 PID 2932 wrote to memory of 2820 2932 vvppp.exe 33 PID 2820 wrote to memory of 2948 2820 lrlxlfl.exe 34 PID 2820 wrote to memory of 2948 2820 lrlxlfl.exe 34 PID 2820 wrote to memory of 2948 2820 lrlxlfl.exe 34 PID 2820 wrote to memory of 2948 2820 lrlxlfl.exe 34 PID 2948 wrote to memory of 3032 2948 3bnbhh.exe 35 PID 2948 wrote to memory of 3032 2948 3bnbhh.exe 35 PID 2948 wrote to memory of 3032 2948 3bnbhh.exe 35 PID 2948 wrote to memory of 3032 2948 3bnbhh.exe 35 PID 3032 wrote to memory of 2752 3032 ddpvj.exe 36 PID 3032 wrote to memory of 2752 3032 ddpvj.exe 36 PID 3032 wrote to memory of 2752 3032 ddpvj.exe 36 PID 3032 wrote to memory of 2752 3032 ddpvj.exe 36 PID 2752 wrote to memory of 2744 2752 3flrrrx.exe 37 PID 2752 wrote to memory of 2744 2752 3flrrrx.exe 37 PID 2752 wrote to memory of 2744 2752 3flrrrx.exe 37 PID 2752 wrote to memory of 2744 2752 3flrrrx.exe 37 PID 2744 wrote to memory of 2224 2744 bhtbtt.exe 38 PID 2744 wrote to memory of 2224 2744 bhtbtt.exe 38 PID 2744 wrote to memory of 2224 2744 bhtbtt.exe 38 PID 2744 wrote to memory of 2224 2744 bhtbtt.exe 38 PID 2224 wrote to memory of 2492 2224 hhhtth.exe 39 PID 2224 wrote to memory of 2492 2224 hhhtth.exe 39 PID 2224 wrote to memory of 2492 2224 hhhtth.exe 39 PID 2224 wrote to memory of 2492 2224 hhhtth.exe 39 PID 2492 wrote to memory of 2028 2492 lfflflx.exe 40 PID 2492 wrote to memory of 2028 2492 lfflflx.exe 40 PID 2492 wrote to memory of 2028 2492 lfflflx.exe 40 PID 2492 wrote to memory of 2028 2492 lfflflx.exe 40 PID 2028 wrote to memory of 2116 2028 btbnnn.exe 41 PID 2028 wrote to memory of 2116 2028 btbnnn.exe 41 PID 2028 wrote to memory of 2116 2028 btbnnn.exe 41 PID 2028 wrote to memory of 2116 2028 btbnnn.exe 41 PID 2116 wrote to memory of 2128 2116 vpdvv.exe 42 PID 2116 wrote to memory of 2128 2116 vpdvv.exe 42 PID 2116 wrote to memory of 2128 2116 vpdvv.exe 42 PID 2116 wrote to memory of 2128 2116 vpdvv.exe 42 PID 2128 wrote to memory of 2384 2128 vvjdp.exe 43 PID 2128 wrote to memory of 2384 2128 vvjdp.exe 43 PID 2128 wrote to memory of 2384 2128 vvjdp.exe 43 PID 2128 wrote to memory of 2384 2128 vvjdp.exe 43 PID 2384 wrote to memory of 2684 2384 1frxxfl.exe 44 PID 2384 wrote to memory of 2684 2384 1frxxfl.exe 44 PID 2384 wrote to memory of 2684 2384 1frxxfl.exe 44 PID 2384 wrote to memory of 2684 2384 1frxxfl.exe 44 PID 2684 wrote to memory of 636 2684 bhbtbn.exe 45 PID 2684 wrote to memory of 636 2684 bhbtbn.exe 45 PID 2684 wrote to memory of 636 2684 bhbtbn.exe 45 PID 2684 wrote to memory of 636 2684 bhbtbn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe"C:\Users\Admin\AppData\Local\Temp\93c5fb92f541cd2ae9283d378ce174c1c000094484126c80162fe22c08d06f01N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\3bnbnh.exec:\3bnbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\vdjdd.exec:\vdjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vvppp.exec:\vvppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lrlxlfl.exec:\lrlxlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3bnbhh.exec:\3bnbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ddpvj.exec:\ddpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\3flrrrx.exec:\3flrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\bhtbtt.exec:\bhtbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\hhhtth.exec:\hhhtth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\lfflflx.exec:\lfflflx.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\btbnnn.exec:\btbnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\vpdvv.exec:\vpdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vvjdp.exec:\vvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\1frxxfl.exec:\1frxxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\bhbtbn.exec:\bhbtbn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3bhnbh.exec:\3bhnbh.exe17⤵
- Executes dropped EXE
PID:636 -
\??\c:\vdppd.exec:\vdppd.exe18⤵
- Executes dropped EXE
PID:2348 -
\??\c:\flxfllr.exec:\flxfllr.exe19⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lrlfxfl.exec:\lrlfxfl.exe20⤵
- Executes dropped EXE
PID:1504 -
\??\c:\tthnbn.exec:\tthnbn.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\djjvp.exec:\djjvp.exe22⤵
- Executes dropped EXE
PID:492 -
\??\c:\xxxxlrf.exec:\xxxxlrf.exe23⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lxllrfr.exec:\lxllrfr.exe24⤵
- Executes dropped EXE
PID:2408 -
\??\c:\bthhnt.exec:\bthhnt.exe25⤵
- Executes dropped EXE
PID:716 -
\??\c:\3vjpv.exec:\3vjpv.exe26⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pjpvd.exec:\pjpvd.exe27⤵
- Executes dropped EXE
PID:1604 -
\??\c:\5fxfrxx.exec:\5fxfrxx.exe28⤵
- Executes dropped EXE
PID:2664 -
\??\c:\bthhtt.exec:\bthhtt.exe29⤵
- Executes dropped EXE
PID:264 -
\??\c:\pjpdj.exec:\pjpdj.exe30⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xflrflr.exec:\xflrflr.exe31⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rrfrfrx.exec:\rrfrfrx.exe32⤵
- Executes dropped EXE
PID:2512 -
\??\c:\ttnnbh.exec:\ttnnbh.exe33⤵
- Executes dropped EXE
PID:2836 -
\??\c:\tbtbnt.exec:\tbtbnt.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2932 -
\??\c:\vvjpp.exec:\vvjpp.exe35⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5pvvd.exec:\5pvvd.exe36⤵
- Executes dropped EXE
PID:2928 -
\??\c:\1xfllrx.exec:\1xfllrx.exe37⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tbtbht.exec:\tbtbht.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\bthnnb.exec:\bthnnb.exe39⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jpjjp.exec:\jpjjp.exe40⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rrxfrxx.exec:\rrxfrxx.exe41⤵
- Executes dropped EXE
PID:2752 -
\??\c:\3xrrflf.exec:\3xrrflf.exe42⤵
- Executes dropped EXE
PID:2088 -
\??\c:\bbnnbh.exec:\bbnnbh.exe43⤵
- Executes dropped EXE
PID:2264 -
\??\c:\nntbtb.exec:\nntbtb.exe44⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1vdjv.exec:\1vdjv.exe45⤵
- Executes dropped EXE
PID:1340 -
\??\c:\1vpvd.exec:\1vpvd.exe46⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fffxrrx.exec:\fffxrrx.exe47⤵
- Executes dropped EXE
PID:2032 -
\??\c:\rrffrxl.exec:\rrffrxl.exe48⤵
- Executes dropped EXE
PID:568 -
\??\c:\1thnbb.exec:\1thnbb.exe49⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hhttnh.exec:\hhttnh.exe50⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jdppv.exec:\jdppv.exe51⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1jddp.exec:\1jddp.exe52⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lrxfxrl.exec:\lrxfxrl.exe53⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3nttth.exec:\3nttth.exe54⤵
- Executes dropped EXE
PID:2372 -
\??\c:\9tbhbb.exec:\9tbhbb.exe55⤵
- Executes dropped EXE
PID:676 -
\??\c:\vvddv.exec:\vvddv.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dddjp.exec:\dddjp.exe57⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xxxflfl.exec:\xxxflfl.exe58⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrlfxfr.exec:\rrlfxfr.exe59⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bhnnnn.exec:\bhnnnn.exe60⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1jvpd.exec:\1jvpd.exe61⤵
- Executes dropped EXE
PID:2380 -
\??\c:\vppvd.exec:\vppvd.exe62⤵
- Executes dropped EXE
PID:944 -
\??\c:\xxrrflr.exec:\xxrrflr.exe63⤵
- Executes dropped EXE
PID:2356 -
\??\c:\btbbhb.exec:\btbbhb.exe64⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7bnhnn.exec:\7bnhnn.exe65⤵
- Executes dropped EXE
PID:1928 -
\??\c:\ddpjp.exec:\ddpjp.exe66⤵PID:1632
-
\??\c:\ddjjp.exec:\ddjjp.exe67⤵PID:2196
-
\??\c:\xllfrrf.exec:\xllfrrf.exe68⤵PID:2336
-
\??\c:\flxfrxf.exec:\flxfrxf.exe69⤵PID:2320
-
\??\c:\tnnbhh.exec:\tnnbhh.exe70⤵PID:2432
-
\??\c:\tthtth.exec:\tthtth.exe71⤵PID:1520
-
\??\c:\vppjv.exec:\vppjv.exe72⤵PID:1820
-
\??\c:\dddjp.exec:\dddjp.exe73⤵PID:2212
-
\??\c:\xxrrxxx.exec:\xxrrxxx.exe74⤵PID:1568
-
\??\c:\9lffrfl.exec:\9lffrfl.exe75⤵PID:1700
-
\??\c:\bbbbhh.exec:\bbbbhh.exe76⤵PID:2936
-
\??\c:\vvjpd.exec:\vvjpd.exe77⤵PID:2956
-
\??\c:\djddd.exec:\djddd.exe78⤵PID:2976
-
\??\c:\lllrrfl.exec:\lllrrfl.exe79⤵PID:2912
-
\??\c:\rflflrr.exec:\rflflrr.exe80⤵PID:3064
-
\??\c:\hhntbb.exec:\hhntbb.exe81⤵PID:2740
-
\??\c:\bttbbt.exec:\bttbbt.exe82⤵PID:2808
-
\??\c:\7pdjv.exec:\7pdjv.exe83⤵PID:2768
-
\??\c:\ddddd.exec:\ddddd.exe84⤵PID:2256
-
\??\c:\rxrrxfl.exec:\rxrrxfl.exe85⤵PID:2764
-
\??\c:\1xlllrx.exec:\1xlllrx.exe86⤵PID:2224
-
\??\c:\hnbbnn.exec:\hnbbnn.exe87⤵PID:1428
-
\??\c:\hbhtbb.exec:\hbhtbb.exe88⤵PID:344
-
\??\c:\vpvvp.exec:\vpvvp.exe89⤵PID:764
-
\??\c:\3vpdd.exec:\3vpdd.exe90⤵PID:2116
-
\??\c:\frxfllr.exec:\frxfllr.exe91⤵PID:2796
-
\??\c:\3rxrxxf.exec:\3rxrxxf.exe92⤵PID:1656
-
\??\c:\nnbnbn.exec:\nnbnbn.exe93⤵PID:2456
-
\??\c:\tttthb.exec:\tttthb.exe94⤵PID:2684
-
\??\c:\3pvjv.exec:\3pvjv.exe95⤵PID:2436
-
\??\c:\xfllxrx.exec:\xfllxrx.exe96⤵PID:608
-
\??\c:\rxlxxfl.exec:\rxlxxfl.exe97⤵PID:2372
-
\??\c:\3btbhb.exec:\3btbhb.exe98⤵PID:2388
-
\??\c:\nhnhbh.exec:\nhnhbh.exe99⤵PID:1616
-
\??\c:\vpppp.exec:\vpppp.exe100⤵PID:1972
-
\??\c:\jjvjd.exec:\jjvjd.exe101⤵PID:2428
-
\??\c:\1fffflr.exec:\1fffflr.exe102⤵PID:2244
-
\??\c:\frffllx.exec:\frffllx.exe103⤵PID:1368
-
\??\c:\9lfrxxr.exec:\9lfrxxr.exe104⤵PID:2380
-
\??\c:\tthbhh.exec:\tthbhh.exe105⤵PID:2620
-
\??\c:\vppvv.exec:\vppvv.exe106⤵PID:2108
-
\??\c:\jjppp.exec:\jjppp.exe107⤵PID:1740
-
\??\c:\3rrxlll.exec:\3rrxlll.exe108⤵PID:1628
-
\??\c:\lrffflr.exec:\lrffflr.exe109⤵PID:1796
-
\??\c:\5htbbn.exec:\5htbbn.exe110⤵PID:1020
-
\??\c:\nhhnhb.exec:\nhhnhb.exe111⤵PID:2336
-
\??\c:\ppppd.exec:\ppppd.exe112⤵PID:1780
-
\??\c:\rlxflrx.exec:\rlxflrx.exe113⤵PID:2432
-
\??\c:\lllrllr.exec:\lllrllr.exe114⤵PID:1396
-
\??\c:\tbhhnt.exec:\tbhhnt.exe115⤵PID:2512
-
\??\c:\hhhhtt.exec:\hhhhtt.exe116⤵PID:2940
-
\??\c:\9vppv.exec:\9vppv.exe117⤵PID:2960
-
\??\c:\jjjdj.exec:\jjjdj.exe118⤵PID:2920
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe119⤵PID:2704
-
\??\c:\llrxllr.exec:\llrxllr.exe120⤵PID:1960
-
\??\c:\bbbhbh.exec:\bbbhbh.exe121⤵PID:2804
-
\??\c:\1nbbbt.exec:\1nbbbt.exe122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-