Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 01:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe
-
Size
454KB
-
MD5
9391c98765adc62ca676a2e7b6d4ff00
-
SHA1
82574b6a3cc12f63cde3ef92210c2557f7eeeb65
-
SHA256
cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47
-
SHA512
943256e6f619b0cb849e1c730126b3acd50288321b117d8b9631d2674da48c671dfb819d4cb24a52b53756dd1d61db73203e015cf9b739850c42d1f86c79a79a
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbez:q7Tc2NYHUrAwfMp3CDz
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2716-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-93-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-91-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2360-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2876-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2760-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1720-187-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/444-204-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1348-221-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2964-243-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/712-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2388-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2796-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-336-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-383-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1724-397-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1580-404-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/588-443-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1076-476-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-502-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-586-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1204-613-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-653-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-818-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2120 3bttbb.exe 2824 3ppvv.exe 2752 jjjvp.exe 2052 rlfrxxx.exe 2716 htbbhb.exe 2564 3pdvd.exe 3000 1flllrr.exe 1280 5tnhnh.exe 3016 xlrlrlr.exe 2360 3tntbt.exe 2876 dvdvv.exe 2312 lxrrxrx.exe 2868 pdppd.exe 1732 llffrrx.exe 2760 jppjv.exe 2004 rlrlrff.exe 264 tnbbbt.exe 2032 9xllflf.exe 1720 1tnhnn.exe 2444 fxlfffr.exe 444 3bhbbb.exe 1952 dvvjj.exe 1348 xxrxllf.exe 2512 jdvjv.exe 712 bbtthn.exe 2964 dvjpp.exe 2388 rfxrxlr.exe 2372 jvvvd.exe 1940 xlflrrx.exe 2980 9dppd.exe 2380 rfxrffl.exe 1584 bnbtbb.exe 2796 pjvjp.exe 2804 rxrrxfl.exe 2684 ntntbb.exe 2752 ppvvj.exe 3036 xrrfrxr.exe 2544 5tnntb.exe 2612 pjvvd.exe 2020 vpdjp.exe 3000 xllffxx.exe 2588 bthbhn.exe 2396 9vjjp.exe 2356 llffrxl.exe 236 rlxxxrx.exe 1724 hbbhhn.exe 1580 7pvpp.exe 1628 lxllllr.exe 2764 7hbbbb.exe 2888 7htnhh.exe 1688 dvjdd.exe 1932 5fffrxf.exe 588 nnhhtt.exe 3060 pjjvd.exe 2184 pjvvd.exe 1444 rlxfffr.exe 1720 bnbbhh.exe 1076 pjdjp.exe 1712 jdppp.exe 2152 frrrffr.exe 1092 htbbbb.exe 2436 jvjdj.exe 908 vvjdj.exe 1804 7thhhb.exe -
resource yara_rule behavioral1/memory/2644-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2716-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3000-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-93-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2876-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-114-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1720-187-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/444-204-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1348-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-243-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/712-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2388-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-322-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-336-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-404-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/588-443-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-476-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-502-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/992-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-586-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1204-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-639-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-653-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-692-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1864-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1992-793-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-818-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2732-927-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llflxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 2120 2644 cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe 30 PID 2644 wrote to memory of 2120 2644 cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe 30 PID 2644 wrote to memory of 2120 2644 cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe 30 PID 2644 wrote to memory of 2120 2644 cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe 30 PID 2120 wrote to memory of 2824 2120 3bttbb.exe 31 PID 2120 wrote to memory of 2824 2120 3bttbb.exe 31 PID 2120 wrote to memory of 2824 2120 3bttbb.exe 31 PID 2120 wrote to memory of 2824 2120 3bttbb.exe 31 PID 2824 wrote to memory of 2752 2824 3ppvv.exe 32 PID 2824 wrote to memory of 2752 2824 3ppvv.exe 32 PID 2824 wrote to memory of 2752 2824 3ppvv.exe 32 PID 2824 wrote to memory of 2752 2824 3ppvv.exe 32 PID 2752 wrote to memory of 2052 2752 jjjvp.exe 33 PID 2752 wrote to memory of 2052 2752 jjjvp.exe 33 PID 2752 wrote to memory of 2052 2752 jjjvp.exe 33 PID 2752 wrote to memory of 2052 2752 jjjvp.exe 33 PID 2052 wrote to memory of 2716 2052 rlfrxxx.exe 34 PID 2052 wrote to memory of 2716 2052 rlfrxxx.exe 34 PID 2052 wrote to memory of 2716 2052 rlfrxxx.exe 34 PID 2052 wrote to memory of 2716 2052 rlfrxxx.exe 34 PID 2716 wrote to memory of 2564 2716 htbbhb.exe 35 PID 2716 wrote to memory of 2564 2716 htbbhb.exe 35 PID 2716 wrote to memory of 2564 2716 htbbhb.exe 35 PID 2716 wrote to memory of 2564 2716 htbbhb.exe 35 PID 2564 wrote to memory of 3000 2564 3pdvd.exe 36 PID 2564 wrote to memory of 3000 2564 3pdvd.exe 36 PID 2564 wrote to memory of 3000 2564 3pdvd.exe 36 PID 2564 wrote to memory of 3000 2564 3pdvd.exe 36 PID 3000 wrote to memory of 1280 3000 1flllrr.exe 37 PID 3000 wrote to memory of 1280 3000 1flllrr.exe 37 PID 3000 wrote to memory of 1280 3000 1flllrr.exe 37 PID 3000 wrote to memory of 1280 3000 1flllrr.exe 37 PID 1280 wrote to memory of 3016 1280 5tnhnh.exe 38 PID 1280 wrote to memory of 3016 1280 5tnhnh.exe 38 PID 1280 wrote to memory of 3016 1280 5tnhnh.exe 38 PID 1280 wrote to memory of 3016 1280 5tnhnh.exe 38 PID 3016 wrote to memory of 2360 3016 xlrlrlr.exe 39 PID 3016 wrote to memory of 2360 3016 xlrlrlr.exe 39 PID 3016 wrote to memory of 2360 3016 xlrlrlr.exe 39 PID 3016 wrote to memory of 2360 3016 xlrlrlr.exe 39 PID 2360 wrote to memory of 2876 2360 3tntbt.exe 40 PID 2360 wrote to memory of 2876 2360 3tntbt.exe 40 PID 2360 wrote to memory of 2876 2360 3tntbt.exe 40 PID 2360 wrote to memory of 2876 2360 3tntbt.exe 40 PID 2876 wrote to memory of 2312 2876 dvdvv.exe 41 PID 2876 wrote to memory of 2312 2876 dvdvv.exe 41 PID 2876 wrote to memory of 2312 2876 dvdvv.exe 41 PID 2876 wrote to memory of 2312 2876 dvdvv.exe 41 PID 2312 wrote to memory of 2868 2312 lxrrxrx.exe 42 PID 2312 wrote to memory of 2868 2312 lxrrxrx.exe 42 PID 2312 wrote to memory of 2868 2312 lxrrxrx.exe 42 PID 2312 wrote to memory of 2868 2312 lxrrxrx.exe 42 PID 2868 wrote to memory of 1732 2868 pdppd.exe 43 PID 2868 wrote to memory of 1732 2868 pdppd.exe 43 PID 2868 wrote to memory of 1732 2868 pdppd.exe 43 PID 2868 wrote to memory of 1732 2868 pdppd.exe 43 PID 1732 wrote to memory of 2760 1732 llffrrx.exe 44 PID 1732 wrote to memory of 2760 1732 llffrrx.exe 44 PID 1732 wrote to memory of 2760 1732 llffrrx.exe 44 PID 1732 wrote to memory of 2760 1732 llffrrx.exe 44 PID 2760 wrote to memory of 2004 2760 jppjv.exe 45 PID 2760 wrote to memory of 2004 2760 jppjv.exe 45 PID 2760 wrote to memory of 2004 2760 jppjv.exe 45 PID 2760 wrote to memory of 2004 2760 jppjv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe"C:\Users\Admin\AppData\Local\Temp\cad1ec4c0c8075493281c4022d4e56d1ae36574c4df2785c9e02c2fb68aa2c47N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\3bttbb.exec:\3bttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\3ppvv.exec:\3ppvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jjjvp.exec:\jjjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rlfrxxx.exec:\rlfrxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\htbbhb.exec:\htbbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\3pdvd.exec:\3pdvd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\1flllrr.exec:\1flllrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\5tnhnh.exec:\5tnhnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\3tntbt.exec:\3tntbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\dvdvv.exec:\dvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\lxrrxrx.exec:\lxrrxrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\pdppd.exec:\pdppd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\llffrrx.exec:\llffrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\jppjv.exec:\jppjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\rlrlrff.exec:\rlrlrff.exe17⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tnbbbt.exec:\tnbbbt.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\9xllflf.exec:\9xllflf.exe19⤵
- Executes dropped EXE
PID:2032 -
\??\c:\1tnhnn.exec:\1tnhnn.exe20⤵
- Executes dropped EXE
PID:1720 -
\??\c:\fxlfffr.exec:\fxlfffr.exe21⤵
- Executes dropped EXE
PID:2444 -
\??\c:\3bhbbb.exec:\3bhbbb.exe22⤵
- Executes dropped EXE
PID:444 -
\??\c:\dvvjj.exec:\dvvjj.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\xxrxllf.exec:\xxrxllf.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1348 -
\??\c:\jdvjv.exec:\jdvjv.exe25⤵
- Executes dropped EXE
PID:2512 -
\??\c:\bbtthn.exec:\bbtthn.exe26⤵
- Executes dropped EXE
PID:712 -
\??\c:\dvjpp.exec:\dvjpp.exe27⤵
- Executes dropped EXE
PID:2964 -
\??\c:\rfxrxlr.exec:\rfxrxlr.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvvvd.exec:\jvvvd.exe29⤵
- Executes dropped EXE
PID:2372 -
\??\c:\xlflrrx.exec:\xlflrrx.exe30⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9dppd.exec:\9dppd.exe31⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rfxrffl.exec:\rfxrffl.exe32⤵
- Executes dropped EXE
PID:2380 -
\??\c:\bnbtbb.exec:\bnbtbb.exe33⤵
- Executes dropped EXE
PID:1584 -
\??\c:\pjvjp.exec:\pjvjp.exe34⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rxrrxfl.exec:\rxrrxfl.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ntntbb.exec:\ntntbb.exe36⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ppvvj.exec:\ppvvj.exe37⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrrfrxr.exec:\xrrfrxr.exe38⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5tnntb.exec:\5tnntb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544 -
\??\c:\pjvvd.exec:\pjvvd.exe40⤵
- Executes dropped EXE
PID:2612 -
\??\c:\vpdjp.exec:\vpdjp.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2020 -
\??\c:\xllffxx.exec:\xllffxx.exe42⤵
- Executes dropped EXE
PID:3000 -
\??\c:\bthbhn.exec:\bthbhn.exe43⤵
- Executes dropped EXE
PID:2588 -
\??\c:\9vjjp.exec:\9vjjp.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\llffrxl.exec:\llffrxl.exe45⤵
- Executes dropped EXE
PID:2356 -
\??\c:\rlxxxrx.exec:\rlxxxrx.exe46⤵
- Executes dropped EXE
PID:236 -
\??\c:\hbbhhn.exec:\hbbhhn.exe47⤵
- Executes dropped EXE
PID:1724 -
\??\c:\7pvpp.exec:\7pvpp.exe48⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lxllllr.exec:\lxllllr.exe49⤵
- Executes dropped EXE
PID:1628 -
\??\c:\7hbbbb.exec:\7hbbbb.exe50⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7htnhh.exec:\7htnhh.exe51⤵
- Executes dropped EXE
PID:2888 -
\??\c:\dvjdd.exec:\dvjdd.exe52⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5fffrxf.exec:\5fffrxf.exe53⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnhhtt.exec:\nnhhtt.exe54⤵
- Executes dropped EXE
PID:588 -
\??\c:\pjjvd.exec:\pjjvd.exe55⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjvvd.exec:\pjvvd.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rlxfffr.exec:\rlxfffr.exe57⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bnbbhh.exec:\bnbbhh.exe58⤵
- Executes dropped EXE
PID:1720 -
\??\c:\pjdjp.exec:\pjdjp.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdppp.exec:\jdppp.exe60⤵
- Executes dropped EXE
PID:1712 -
\??\c:\frrrffr.exec:\frrrffr.exe61⤵
- Executes dropped EXE
PID:2152 -
\??\c:\htbbbb.exec:\htbbbb.exe62⤵
- Executes dropped EXE
PID:1092 -
\??\c:\jvjdj.exec:\jvjdj.exe63⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vvjdj.exec:\vvjdj.exe64⤵
- Executes dropped EXE
PID:908 -
\??\c:\7thhhb.exec:\7thhhb.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\1tbbbh.exec:\1tbbbh.exe66⤵PID:1784
-
\??\c:\vpddj.exec:\vpddj.exe67⤵PID:2428
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe68⤵PID:2072
-
\??\c:\9lfrxfr.exec:\9lfrxfr.exe69⤵PID:992
-
\??\c:\nbtntt.exec:\nbtntt.exe70⤵PID:1948
-
\??\c:\3pdjp.exec:\3pdjp.exe71⤵PID:1008
-
\??\c:\xrrxffl.exec:\xrrxffl.exe72⤵PID:1000
-
\??\c:\ffrrxrx.exec:\ffrrxrx.exe73⤵PID:2700
-
\??\c:\btnhtt.exec:\btnhtt.exe74⤵PID:1692
-
\??\c:\7jpvv.exec:\7jpvv.exe75⤵PID:2680
-
\??\c:\3xxxlrr.exec:\3xxxlrr.exe76⤵PID:2792
-
\??\c:\1fxflrf.exec:\1fxflrf.exe77⤵PID:2136
-
\??\c:\nnbhtb.exec:\nnbhtb.exe78⤵PID:2884
-
\??\c:\jddvd.exec:\jddvd.exe79⤵PID:2668
-
\??\c:\pdjdd.exec:\pdjdd.exe80⤵PID:1204
-
\??\c:\lrlllrl.exec:\lrlllrl.exe81⤵PID:2548
-
\??\c:\tthntt.exec:\tthntt.exe82⤵PID:2612
-
\??\c:\7pvdj.exec:\7pvdj.exe83⤵PID:2988
-
\??\c:\vjdpv.exec:\vjdpv.exe84⤵PID:2204
-
\??\c:\fxlrxff.exec:\fxlrxff.exe85⤵PID:1996
-
\??\c:\hnhntt.exec:\hnhntt.exe86⤵PID:2360
-
\??\c:\jjddv.exec:\jjddv.exe87⤵PID:2096
-
\??\c:\flxxxfl.exec:\flxxxfl.exe88⤵PID:620
-
\??\c:\3btttt.exec:\3btttt.exe89⤵PID:2060
-
\??\c:\7thbhh.exec:\7thbhh.exe90⤵PID:2440
-
\??\c:\7pvvv.exec:\7pvvv.exe91⤵PID:1704
-
\??\c:\fxrrllr.exec:\fxrrllr.exe92⤵PID:2652
-
\??\c:\hbnhtt.exec:\hbnhtt.exe93⤵PID:2768
-
\??\c:\3nhbbh.exec:\3nhbbh.exe94⤵PID:1688
-
\??\c:\3vjpv.exec:\3vjpv.exe95⤵PID:540
-
\??\c:\lxxxfxf.exec:\lxxxfxf.exe96⤵PID:3064
-
\??\c:\nhbtbh.exec:\nhbtbh.exe97⤵PID:1800
-
\??\c:\hthbhh.exec:\hthbhh.exe98⤵PID:2068
-
\??\c:\3vjpp.exec:\3vjpp.exe99⤵PID:1264
-
\??\c:\lfxllrx.exec:\lfxllrx.exe100⤵PID:2316
-
\??\c:\hhhtbt.exec:\hhhtbt.exe101⤵PID:408
-
\??\c:\htbbbt.exec:\htbbbt.exe102⤵PID:2364
-
\??\c:\dvjpv.exec:\dvjpv.exe103⤵PID:2152
-
\??\c:\rxrlrlx.exec:\rxrlrlx.exe104⤵PID:1348
-
\??\c:\7htbhh.exec:\7htbhh.exe105⤵PID:1864
-
\??\c:\bnbhhh.exec:\bnbhhh.exe106⤵PID:908
-
\??\c:\vpddp.exec:\vpddp.exe107⤵PID:1048
-
\??\c:\7rxrxrr.exec:\7rxrxrr.exe108⤵PID:1992
-
\??\c:\hbtthh.exec:\hbtthh.exe109⤵PID:2240
-
\??\c:\5ntnhn.exec:\5ntnhn.exe110⤵PID:2372
-
\??\c:\7jvdv.exec:\7jvdv.exe111⤵PID:1964
-
\??\c:\vdddp.exec:\vdddp.exe112⤵PID:2636
-
\??\c:\rflfrrr.exec:\rflfrrr.exe113⤵
- System Location Discovery: System Language Discovery
PID:3032 -
\??\c:\7btbbh.exec:\7btbbh.exe114⤵PID:1848
-
\??\c:\pjvdj.exec:\pjvdj.exe115⤵PID:2700
-
\??\c:\vjppj.exec:\vjppj.exe116⤵PID:1560
-
\??\c:\rrxxffl.exec:\rrxxffl.exe117⤵PID:2680
-
\??\c:\tnttbt.exec:\tnttbt.exe118⤵PID:2792
-
\??\c:\bnbhhh.exec:\bnbhhh.exe119⤵PID:2136
-
\??\c:\vjjdd.exec:\vjjdd.exe120⤵PID:1312
-
\??\c:\3lrrfll.exec:\3lrrfll.exe121⤵PID:2580
-
\??\c:\tnbbnn.exec:\tnbbnn.exe122⤵PID:800
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-