Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 02:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
150 seconds
General
-
Target
77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe
-
Size
454KB
-
MD5
114e100b2c654b36c590d8ce7c024311
-
SHA1
ff2061252792bb59729fd0ac1b1c4fd63cf04842
-
SHA256
77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46
-
SHA512
789affbea2bb088847b8a189fad3cf6f54bc46f704bdee9fd9671422f19142d7203c9ffb934fbbe891f1a049fadf02d78a3f0fe337fb7a77dfc077a98b84cc6e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeq:q7Tc2NYHUrAwfMp3CDq
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2308-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1648-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-72-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/956-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1312-135-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-163-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-175-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-205-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-240-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2456-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2844-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2452-347-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2700-371-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2532-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2920-621-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-679-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2032-708-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/804-730-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-770-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2808-912-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2728-961-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1648 dvvpp.exe 2800 jjppp.exe 2892 1nbhtn.exe 3064 5tbhnb.exe 2872 lrrlrlr.exe 2712 9nttbh.exe 2804 rrxxxxf.exe 2732 tthntb.exe 2740 9fxxxxl.exe 956 bhttth.exe 2388 lfllrrx.exe 320 ffrlxlr.exe 1620 7thntb.exe 1312 rxlfrfr.exe 2752 dvvjj.exe 2780 3rffrxf.exe 592 vvdpv.exe 2128 5tnnhh.exe 2348 jjpvv.exe 1720 fflxlrx.exe 2108 dvvpp.exe 2132 ffrxflr.exe 936 9bhhhb.exe 2120 xxfrrxl.exe 876 7bhbbb.exe 1988 9vjdv.exe 2300 bbnnbh.exe 2584 tthnhh.exe 1680 1btnhn.exe 2456 3hhtbn.exe 1416 frlfxrl.exe 2592 bbhttt.exe 768 7lxfrfl.exe 2652 1hbhtb.exe 2380 dpvvd.exe 1600 1fxxfrf.exe 2796 rxrrrrr.exe 2896 tthhnb.exe 2892 vvdvv.exe 2844 9xlrxxf.exe 2452 fflflxx.exe 2792 1htttt.exe 2736 jjvdd.exe 2720 7frflxl.exe 2700 3nhntb.exe 2332 pjdjp.exe 2056 pjppp.exe 2176 7frrxxl.exe 2388 nnbhnh.exe 2284 9jvjv.exe 2032 ddpvd.exe 816 lxxrfxx.exe 2676 bbnntt.exe 2532 jjvvd.exe 1472 vvddd.exe 2664 9rfxlfr.exe 836 9httbh.exe 2088 vvjvj.exe 2228 ffxlrxl.exe 2348 7htttb.exe 1224 hhnntt.exe 2216 pppvd.exe 916 lfxfrrf.exe 2576 hntttt.exe -
resource yara_rule behavioral1/memory/2308-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1648-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-72-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/956-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1312-135-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-163-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-175-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-205-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2456-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2844-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-346-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2700-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/916-489-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/936-500-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1816-538-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2920-621-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-679-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-699-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-708-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/804-730-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-994-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-1037-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-1191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-1196-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2308 wrote to memory of 1648 2308 77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe 30 PID 2308 wrote to memory of 1648 2308 77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe 30 PID 2308 wrote to memory of 1648 2308 77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe 30 PID 2308 wrote to memory of 1648 2308 77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe 30 PID 1648 wrote to memory of 2800 1648 dvvpp.exe 31 PID 1648 wrote to memory of 2800 1648 dvvpp.exe 31 PID 1648 wrote to memory of 2800 1648 dvvpp.exe 31 PID 1648 wrote to memory of 2800 1648 dvvpp.exe 31 PID 2800 wrote to memory of 2892 2800 jjppp.exe 32 PID 2800 wrote to memory of 2892 2800 jjppp.exe 32 PID 2800 wrote to memory of 2892 2800 jjppp.exe 32 PID 2800 wrote to memory of 2892 2800 jjppp.exe 32 PID 2892 wrote to memory of 3064 2892 1nbhtn.exe 33 PID 2892 wrote to memory of 3064 2892 1nbhtn.exe 33 PID 2892 wrote to memory of 3064 2892 1nbhtn.exe 33 PID 2892 wrote to memory of 3064 2892 1nbhtn.exe 33 PID 3064 wrote to memory of 2872 3064 5tbhnb.exe 34 PID 3064 wrote to memory of 2872 3064 5tbhnb.exe 34 PID 3064 wrote to memory of 2872 3064 5tbhnb.exe 34 PID 3064 wrote to memory of 2872 3064 5tbhnb.exe 34 PID 2872 wrote to memory of 2712 2872 lrrlrlr.exe 35 PID 2872 wrote to memory of 2712 2872 lrrlrlr.exe 35 PID 2872 wrote to memory of 2712 2872 lrrlrlr.exe 35 PID 2872 wrote to memory of 2712 2872 lrrlrlr.exe 35 PID 2712 wrote to memory of 2804 2712 9nttbh.exe 36 PID 2712 wrote to memory of 2804 2712 9nttbh.exe 36 PID 2712 wrote to memory of 2804 2712 9nttbh.exe 36 PID 2712 wrote to memory of 2804 2712 9nttbh.exe 36 PID 2804 wrote to memory of 2732 2804 rrxxxxf.exe 37 PID 2804 wrote to memory of 2732 2804 rrxxxxf.exe 37 PID 2804 wrote to memory of 2732 2804 rrxxxxf.exe 37 PID 2804 wrote to memory of 2732 2804 rrxxxxf.exe 37 PID 2732 wrote to memory of 2740 2732 tthntb.exe 38 PID 2732 wrote to memory of 2740 2732 tthntb.exe 38 PID 2732 wrote to memory of 2740 2732 tthntb.exe 38 PID 2732 wrote to memory of 2740 2732 tthntb.exe 38 PID 2740 wrote to memory of 956 2740 9fxxxxl.exe 39 PID 2740 wrote to memory of 956 2740 9fxxxxl.exe 39 PID 2740 wrote to memory of 956 2740 9fxxxxl.exe 39 PID 2740 wrote to memory of 956 2740 9fxxxxl.exe 39 PID 956 wrote to memory of 2388 956 bhttth.exe 40 PID 956 wrote to memory of 2388 956 bhttth.exe 40 PID 956 wrote to memory of 2388 956 bhttth.exe 40 PID 956 wrote to memory of 2388 956 bhttth.exe 40 PID 2388 wrote to memory of 320 2388 lfllrrx.exe 41 PID 2388 wrote to memory of 320 2388 lfllrrx.exe 41 PID 2388 wrote to memory of 320 2388 lfllrrx.exe 41 PID 2388 wrote to memory of 320 2388 lfllrrx.exe 41 PID 320 wrote to memory of 1620 320 ffrlxlr.exe 42 PID 320 wrote to memory of 1620 320 ffrlxlr.exe 42 PID 320 wrote to memory of 1620 320 ffrlxlr.exe 42 PID 320 wrote to memory of 1620 320 ffrlxlr.exe 42 PID 1620 wrote to memory of 1312 1620 7thntb.exe 43 PID 1620 wrote to memory of 1312 1620 7thntb.exe 43 PID 1620 wrote to memory of 1312 1620 7thntb.exe 43 PID 1620 wrote to memory of 1312 1620 7thntb.exe 43 PID 1312 wrote to memory of 2752 1312 rxlfrfr.exe 44 PID 1312 wrote to memory of 2752 1312 rxlfrfr.exe 44 PID 1312 wrote to memory of 2752 1312 rxlfrfr.exe 44 PID 1312 wrote to memory of 2752 1312 rxlfrfr.exe 44 PID 2752 wrote to memory of 2780 2752 dvvjj.exe 45 PID 2752 wrote to memory of 2780 2752 dvvjj.exe 45 PID 2752 wrote to memory of 2780 2752 dvvjj.exe 45 PID 2752 wrote to memory of 2780 2752 dvvjj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe"C:\Users\Admin\AppData\Local\Temp\77a0fdc436dbbcb0d46afb213872950557685968064a87e8de8d001704876c46.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\dvvpp.exec:\dvvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jjppp.exec:\jjppp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1nbhtn.exec:\1nbhtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\5tbhnb.exec:\5tbhnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\lrrlrlr.exec:\lrrlrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\9nttbh.exec:\9nttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\tthntb.exec:\tthntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\9fxxxxl.exec:\9fxxxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bhttth.exec:\bhttth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\lfllrrx.exec:\lfllrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\ffrlxlr.exec:\ffrlxlr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\7thntb.exec:\7thntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\rxlfrfr.exec:\rxlfrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\dvvjj.exec:\dvvjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\3rffrxf.exec:\3rffrxf.exe17⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vvdpv.exec:\vvdpv.exe18⤵
- Executes dropped EXE
PID:592 -
\??\c:\5tnnhh.exec:\5tnnhh.exe19⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jjpvv.exec:\jjpvv.exe20⤵
- Executes dropped EXE
PID:2348 -
\??\c:\fflxlrx.exec:\fflxlrx.exe21⤵
- Executes dropped EXE
PID:1720 -
\??\c:\dvvpp.exec:\dvvpp.exe22⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ffrxflr.exec:\ffrxflr.exe23⤵
- Executes dropped EXE
PID:2132 -
\??\c:\9bhhhb.exec:\9bhhhb.exe24⤵
- Executes dropped EXE
PID:936 -
\??\c:\xxfrrxl.exec:\xxfrrxl.exe25⤵
- Executes dropped EXE
PID:2120 -
\??\c:\7bhbbb.exec:\7bhbbb.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\9vjdv.exec:\9vjdv.exe27⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bbnnbh.exec:\bbnnbh.exe28⤵
- Executes dropped EXE
PID:2300 -
\??\c:\tthnhh.exec:\tthnhh.exe29⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1btnhn.exec:\1btnhn.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\3hhtbn.exec:\3hhtbn.exe31⤵
- Executes dropped EXE
PID:2456 -
\??\c:\frlfxrl.exec:\frlfxrl.exe32⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bbhttt.exec:\bbhttt.exe33⤵
- Executes dropped EXE
PID:2592 -
\??\c:\7lxfrfl.exec:\7lxfrfl.exe34⤵
- Executes dropped EXE
PID:768 -
\??\c:\1hbhtb.exec:\1hbhtb.exe35⤵
- Executes dropped EXE
PID:2652 -
\??\c:\dpvvd.exec:\dpvvd.exe36⤵
- Executes dropped EXE
PID:2380 -
\??\c:\1fxxfrf.exec:\1fxxfrf.exe37⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rxrrrrr.exec:\rxrrrrr.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tthhnb.exec:\tthhnb.exe39⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vvdvv.exec:\vvdvv.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\9xlrxxf.exec:\9xlrxxf.exe41⤵
- Executes dropped EXE
PID:2844 -
\??\c:\fflflxx.exec:\fflflxx.exe42⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1htttt.exec:\1htttt.exe43⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jjvdd.exec:\jjvdd.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7frflxl.exec:\7frflxl.exe45⤵
- Executes dropped EXE
PID:2720 -
\??\c:\3nhntb.exec:\3nhntb.exe46⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pjdjp.exec:\pjdjp.exe47⤵
- Executes dropped EXE
PID:2332 -
\??\c:\pjppp.exec:\pjppp.exe48⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7frrxxl.exec:\7frrxxl.exe49⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nnbhnh.exec:\nnbhnh.exe50⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9jvjv.exec:\9jvjv.exe51⤵
- Executes dropped EXE
PID:2284 -
\??\c:\ddpvd.exec:\ddpvd.exe52⤵
- Executes dropped EXE
PID:2032 -
\??\c:\lxxrfxx.exec:\lxxrfxx.exe53⤵
- Executes dropped EXE
PID:816 -
\??\c:\bbnntt.exec:\bbnntt.exe54⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jjvvd.exec:\jjvvd.exe55⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vvddd.exec:\vvddd.exe56⤵
- Executes dropped EXE
PID:1472 -
\??\c:\9rfxlfr.exec:\9rfxlfr.exe57⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9httbh.exec:\9httbh.exe58⤵
- Executes dropped EXE
PID:836 -
\??\c:\vvjvj.exec:\vvjvj.exe59⤵
- Executes dropped EXE
PID:2088 -
\??\c:\ffxlrxl.exec:\ffxlrxl.exe60⤵
- Executes dropped EXE
PID:2228 -
\??\c:\7htttb.exec:\7htttb.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\hhnntt.exec:\hhnntt.exe62⤵
- Executes dropped EXE
PID:1224 -
\??\c:\pppvd.exec:\pppvd.exe63⤵
- Executes dropped EXE
PID:2216 -
\??\c:\lfxfrrf.exec:\lfxfrrf.exe64⤵
- Executes dropped EXE
PID:916 -
\??\c:\hntttt.exec:\hntttt.exe65⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vvdjv.exec:\vvdjv.exe66⤵PID:936
-
\??\c:\dpvpv.exec:\dpvpv.exe67⤵PID:2512
-
\??\c:\1xxfxfr.exec:\1xxfxfr.exe68⤵PID:1816
-
\??\c:\hhnnnn.exec:\hhnnnn.exe69⤵PID:2656
-
\??\c:\7jvdd.exec:\7jvdd.exe70⤵PID:2064
-
\??\c:\1jddj.exec:\1jddj.exe71⤵PID:1676
-
\??\c:\flxfllr.exec:\flxfllr.exe72⤵PID:2584
-
\??\c:\1nhhhh.exec:\1nhhhh.exe73⤵PID:1800
-
\??\c:\bbhtbh.exec:\bbhtbh.exe74⤵PID:3052
-
\??\c:\jvdvv.exec:\jvdvv.exe75⤵PID:1152
-
\??\c:\ffrxrxl.exec:\ffrxrxl.exe76⤵PID:1528
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe77⤵PID:2596
-
\??\c:\3thhnb.exec:\3thhnb.exe78⤵PID:1340
-
\??\c:\jjvvj.exec:\jjvvj.exe79⤵PID:1608
-
\??\c:\ddjpv.exec:\ddjpv.exe80⤵PID:1572
-
\??\c:\llxflrx.exec:\llxflrx.exe81⤵PID:2876
-
\??\c:\3bhtth.exec:\3bhtth.exe82⤵PID:2948
-
\??\c:\9nbbth.exec:\9nbbth.exe83⤵PID:2920
-
\??\c:\ppvpv.exec:\ppvpv.exe84⤵PID:3060
-
\??\c:\lfrxllx.exec:\lfrxllx.exe85⤵PID:3024
-
\??\c:\tthnbh.exec:\tthnbh.exe86⤵PID:1808
-
\??\c:\hbhtbt.exec:\hbhtbt.exe87⤵PID:2684
-
\??\c:\1vvjv.exec:\1vvjv.exe88⤵PID:2812
-
\??\c:\rfrrlrf.exec:\rfrrlrf.exe89⤵PID:2748
-
\??\c:\bbtbbh.exec:\bbtbbh.exe90⤵PID:2700
-
\??\c:\btntbh.exec:\btntbh.exe91⤵PID:2728
-
\??\c:\5vjpp.exec:\5vjpp.exe92⤵PID:1160
-
\??\c:\1fflrrf.exec:\1fflrrf.exe93⤵PID:2176
-
\??\c:\tnbhtt.exec:\tnbhtt.exe94⤵PID:1068
-
\??\c:\hhbnnt.exec:\hhbnnt.exe95⤵PID:1976
-
\??\c:\dpdpd.exec:\dpdpd.exe96⤵PID:2032
-
\??\c:\lrxxfrr.exec:\lrxxfrr.exe97⤵PID:2984
-
\??\c:\bthntt.exec:\bthntt.exe98⤵PID:2264
-
\??\c:\vddpd.exec:\vddpd.exe99⤵PID:804
-
\??\c:\jvddj.exec:\jvddj.exe100⤵PID:1812
-
\??\c:\1lfflrf.exec:\1lfflrf.exe101⤵PID:2084
-
\??\c:\nhttnt.exec:\nhttnt.exe102⤵PID:2224
-
\??\c:\jpdjd.exec:\jpdjd.exe103⤵PID:2180
-
\??\c:\7dpdp.exec:\7dpdp.exe104⤵PID:2348
-
\??\c:\rrllxfr.exec:\rrllxfr.exe105⤵PID:2148
-
\??\c:\rrflrxl.exec:\rrflrxl.exe106⤵PID:2400
-
\??\c:\ntbhnt.exec:\ntbhnt.exe107⤵PID:2248
-
\??\c:\ddpvd.exec:\ddpvd.exe108⤵
- System Location Discovery: System Language Discovery
PID:2076 -
\??\c:\jjvvj.exec:\jjvvj.exe109⤵PID:2080
-
\??\c:\1xflxfl.exec:\1xflxfl.exe110⤵PID:2512
-
\??\c:\5nhnht.exec:\5nhnht.exe111⤵PID:1692
-
\??\c:\ddpvp.exec:\ddpvp.exe112⤵PID:988
-
\??\c:\pvjpd.exec:\pvjpd.exe113⤵
- System Location Discovery: System Language Discovery
PID:800 -
\??\c:\rxlrrxl.exec:\rxlrrxl.exe114⤵PID:2304
-
\??\c:\hhnnbh.exec:\hhnnbh.exe115⤵PID:2632
-
\??\c:\vpdjp.exec:\vpdjp.exe116⤵PID:2572
-
\??\c:\xfrxlrl.exec:\xfrxlrl.exe117⤵PID:584
-
\??\c:\1hhthn.exec:\1hhthn.exe118⤵PID:1500
-
\??\c:\djvvp.exec:\djvvp.exe119⤵PID:2600
-
\??\c:\jppvj.exec:\jppvj.exe120⤵PID:2784
-
\??\c:\xxllrxr.exec:\xxllrxr.exe121⤵PID:2604
-
\??\c:\5rflllr.exec:\5rflllr.exe122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-