Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 03:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe
-
Size
454KB
-
MD5
645068246f0bee687d3773642ae64440
-
SHA1
e437431f06e05b494ad52bb2c2c3e4f1583dcd34
-
SHA256
0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3
-
SHA512
c6f53b52caff482a07f9b937351d52a7d90599562b881dbba5fbb173253632508dd91437bf8bb7b7795f97dfd5c23b3411dbc9eb05b0a954b8bbff999be24ef0
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeTq:q7Tc2NYHUrAwfMp3CD+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-37-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2708-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/640-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-59-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1416-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1924-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3004-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/484-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1880-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-172-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2092-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-215-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2120-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-256-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-303-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2660-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-319-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2588-318-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/1052-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-347-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-346-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1872-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2352-389-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-416-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-513-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-512-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-528-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-566-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2572-584-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-649-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2748 3rxxfll.exe 2668 tnbbbt.exe 2788 7jvjj.exe 2708 9pvpp.exe 2528 pjppv.exe 592 1xllllr.exe 640 thnhhb.exe 1416 btbbbt.exe 3004 rlxflff.exe 1924 hnthbt.exe 1792 5dvpd.exe 484 dvddd.exe 1508 nhthhb.exe 2764 pddjj.exe 1880 lxxxllr.exe 1108 nbtbhn.exe 2116 dvjpd.exe 2168 1pdvp.exe 2212 rlxxllr.exe 2092 bthhht.exe 2120 ddpvd.exe 1328 bbhhhb.exe 1168 7dvjd.exe 1916 rxxlxfl.exe 2216 3tbbtt.exe 2964 ddjjp.exe 1556 lfxflrf.exe 904 hnbbhb.exe 1336 1vddd.exe 2736 nbhhhb.exe 2540 1pddd.exe 2992 hbnnbb.exe 2588 hnnbnb.exe 2660 rlrxlrf.exe 2532 frffllx.exe 3016 bnhhbb.exe 592 7pddd.exe 1052 5flrxlr.exe 1872 fxlrxxx.exe 1876 thnnnh.exe 3000 9dvdd.exe 2052 xxlrrxl.exe 2352 lfrrxfr.exe 1884 hbhhtn.exe 2004 djvpd.exe 2256 jjddj.exe 2792 7rlrlrr.exe 1252 7nbtnt.exe 2804 3jdvv.exe 1108 ffrxxxf.exe 2844 rlflrxf.exe 1892 bnbbhh.exe 2332 pjppv.exe 2744 1frlrlx.exe 1616 rlxflll.exe 1832 btbhhh.exe 688 jjdjp.exe 956 jvdpj.exe 864 7xfxrxf.exe 1596 btbnnh.exe 352 htnntt.exe 2908 jjpvd.exe 2436 ffrrrrr.exe 2284 rlfxxxx.exe -
resource yara_rule behavioral1/memory/2748-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1416-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1924-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3004-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2092-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-215-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-240-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-256-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-303-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2660-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2588-319-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-513-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/352-512-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-528-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-562-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-584-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-649-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2748 2112 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 31 PID 2112 wrote to memory of 2748 2112 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 31 PID 2112 wrote to memory of 2748 2112 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 31 PID 2112 wrote to memory of 2748 2112 0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe 31 PID 2748 wrote to memory of 2668 2748 3rxxfll.exe 32 PID 2748 wrote to memory of 2668 2748 3rxxfll.exe 32 PID 2748 wrote to memory of 2668 2748 3rxxfll.exe 32 PID 2748 wrote to memory of 2668 2748 3rxxfll.exe 32 PID 2668 wrote to memory of 2788 2668 tnbbbt.exe 33 PID 2668 wrote to memory of 2788 2668 tnbbbt.exe 33 PID 2668 wrote to memory of 2788 2668 tnbbbt.exe 33 PID 2668 wrote to memory of 2788 2668 tnbbbt.exe 33 PID 2788 wrote to memory of 2708 2788 7jvjj.exe 34 PID 2788 wrote to memory of 2708 2788 7jvjj.exe 34 PID 2788 wrote to memory of 2708 2788 7jvjj.exe 34 PID 2788 wrote to memory of 2708 2788 7jvjj.exe 34 PID 2708 wrote to memory of 2528 2708 9pvpp.exe 35 PID 2708 wrote to memory of 2528 2708 9pvpp.exe 35 PID 2708 wrote to memory of 2528 2708 9pvpp.exe 35 PID 2708 wrote to memory of 2528 2708 9pvpp.exe 35 PID 2528 wrote to memory of 592 2528 pjppv.exe 36 PID 2528 wrote to memory of 592 2528 pjppv.exe 36 PID 2528 wrote to memory of 592 2528 pjppv.exe 36 PID 2528 wrote to memory of 592 2528 pjppv.exe 36 PID 592 wrote to memory of 640 592 1xllllr.exe 37 PID 592 wrote to memory of 640 592 1xllllr.exe 37 PID 592 wrote to memory of 640 592 1xllllr.exe 37 PID 592 wrote to memory of 640 592 1xllllr.exe 37 PID 640 wrote to memory of 1416 640 thnhhb.exe 38 PID 640 wrote to memory of 1416 640 thnhhb.exe 38 PID 640 wrote to memory of 1416 640 thnhhb.exe 38 PID 640 wrote to memory of 1416 640 thnhhb.exe 38 PID 1416 wrote to memory of 3004 1416 btbbbt.exe 39 PID 1416 wrote to memory of 3004 1416 btbbbt.exe 39 PID 1416 wrote to memory of 3004 1416 btbbbt.exe 39 PID 1416 wrote to memory of 3004 1416 btbbbt.exe 39 PID 3004 wrote to memory of 1924 3004 rlxflff.exe 40 PID 3004 wrote to memory of 1924 3004 rlxflff.exe 40 PID 3004 wrote to memory of 1924 3004 rlxflff.exe 40 PID 3004 wrote to memory of 1924 3004 rlxflff.exe 40 PID 1924 wrote to memory of 1792 1924 hnthbt.exe 41 PID 1924 wrote to memory of 1792 1924 hnthbt.exe 41 PID 1924 wrote to memory of 1792 1924 hnthbt.exe 41 PID 1924 wrote to memory of 1792 1924 hnthbt.exe 41 PID 1792 wrote to memory of 484 1792 5dvpd.exe 42 PID 1792 wrote to memory of 484 1792 5dvpd.exe 42 PID 1792 wrote to memory of 484 1792 5dvpd.exe 42 PID 1792 wrote to memory of 484 1792 5dvpd.exe 42 PID 484 wrote to memory of 1508 484 dvddd.exe 43 PID 484 wrote to memory of 1508 484 dvddd.exe 43 PID 484 wrote to memory of 1508 484 dvddd.exe 43 PID 484 wrote to memory of 1508 484 dvddd.exe 43 PID 1508 wrote to memory of 2764 1508 nhthhb.exe 44 PID 1508 wrote to memory of 2764 1508 nhthhb.exe 44 PID 1508 wrote to memory of 2764 1508 nhthhb.exe 44 PID 1508 wrote to memory of 2764 1508 nhthhb.exe 44 PID 2764 wrote to memory of 1880 2764 pddjj.exe 45 PID 2764 wrote to memory of 1880 2764 pddjj.exe 45 PID 2764 wrote to memory of 1880 2764 pddjj.exe 45 PID 2764 wrote to memory of 1880 2764 pddjj.exe 45 PID 1880 wrote to memory of 1108 1880 lxxxllr.exe 46 PID 1880 wrote to memory of 1108 1880 lxxxllr.exe 46 PID 1880 wrote to memory of 1108 1880 lxxxllr.exe 46 PID 1880 wrote to memory of 1108 1880 lxxxllr.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe"C:\Users\Admin\AppData\Local\Temp\0220327ca0f61d48ae96c5467cf830f9e77a26d4d6ffc8fedf858c415a60bca3N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\3rxxfll.exec:\3rxxfll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\tnbbbt.exec:\tnbbbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7jvjj.exec:\7jvjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\9pvpp.exec:\9pvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\pjppv.exec:\pjppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\1xllllr.exec:\1xllllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\thnhhb.exec:\thnhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\btbbbt.exec:\btbbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\rlxflff.exec:\rlxflff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\hnthbt.exec:\hnthbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\5dvpd.exec:\5dvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\dvddd.exec:\dvddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:484 -
\??\c:\nhthhb.exec:\nhthhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\pddjj.exec:\pddjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lxxxllr.exec:\lxxxllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\nbtbhn.exec:\nbtbhn.exe17⤵
- Executes dropped EXE
PID:1108 -
\??\c:\dvjpd.exec:\dvjpd.exe18⤵
- Executes dropped EXE
PID:2116 -
\??\c:\1pdvp.exec:\1pdvp.exe19⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rlxxllr.exec:\rlxxllr.exe20⤵
- Executes dropped EXE
PID:2212 -
\??\c:\bthhht.exec:\bthhht.exe21⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ddpvd.exec:\ddpvd.exe22⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bbhhhb.exec:\bbhhhb.exe23⤵
- Executes dropped EXE
PID:1328 -
\??\c:\7dvjd.exec:\7dvjd.exe24⤵
- Executes dropped EXE
PID:1168 -
\??\c:\rxxlxfl.exec:\rxxlxfl.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3tbbtt.exec:\3tbbtt.exe26⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ddjjp.exec:\ddjjp.exe27⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lfxflrf.exec:\lfxflrf.exe28⤵
- Executes dropped EXE
PID:1556 -
\??\c:\hnbbhb.exec:\hnbbhb.exe29⤵
- Executes dropped EXE
PID:904 -
\??\c:\1vddd.exec:\1vddd.exe30⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nbhhhb.exec:\nbhhhb.exe31⤵
- Executes dropped EXE
PID:2736 -
\??\c:\1pddd.exec:\1pddd.exe32⤵
- Executes dropped EXE
PID:2540 -
\??\c:\hbnnbb.exec:\hbnnbb.exe33⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hnnbnb.exec:\hnnbnb.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe35⤵
- Executes dropped EXE
PID:2660 -
\??\c:\frffllx.exec:\frffllx.exe36⤵
- Executes dropped EXE
PID:2532 -
\??\c:\bnhhbb.exec:\bnhhbb.exe37⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7pddd.exec:\7pddd.exe38⤵
- Executes dropped EXE
PID:592 -
\??\c:\5flrxlr.exec:\5flrxlr.exe39⤵
- Executes dropped EXE
PID:1052 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe40⤵
- Executes dropped EXE
PID:1872 -
\??\c:\thnnnh.exec:\thnnnh.exe41⤵
- Executes dropped EXE
PID:1876 -
\??\c:\9dvdd.exec:\9dvdd.exe42⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xxlrrxl.exec:\xxlrrxl.exe43⤵
- Executes dropped EXE
PID:2052 -
\??\c:\lfrrxfr.exec:\lfrrxfr.exe44⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hbhhtn.exec:\hbhhtn.exe45⤵
- Executes dropped EXE
PID:1884 -
\??\c:\djvpd.exec:\djvpd.exe46⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jjddj.exec:\jjddj.exe47⤵
- Executes dropped EXE
PID:2256 -
\??\c:\7rlrlrr.exec:\7rlrlrr.exe48⤵
- Executes dropped EXE
PID:2792 -
\??\c:\7nbtnt.exec:\7nbtnt.exe49⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3jdvv.exec:\3jdvv.exe50⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ffrxxxf.exec:\ffrxxxf.exe51⤵
- Executes dropped EXE
PID:1108 -
\??\c:\rlflrxf.exec:\rlflrxf.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnbbhh.exec:\bnbbhh.exe53⤵
- Executes dropped EXE
PID:1892 -
\??\c:\pjppv.exec:\pjppv.exe54⤵
- Executes dropped EXE
PID:2332 -
\??\c:\1frlrlx.exec:\1frlrlx.exe55⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rlxflll.exec:\rlxflll.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\btbhhh.exec:\btbhhh.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\jjdjp.exec:\jjdjp.exe58⤵
- Executes dropped EXE
PID:688 -
\??\c:\jvdpj.exec:\jvdpj.exe59⤵
- Executes dropped EXE
PID:956 -
\??\c:\7xfxrxf.exec:\7xfxrxf.exe60⤵
- Executes dropped EXE
PID:864 -
\??\c:\btbnnh.exec:\btbnnh.exe61⤵
- Executes dropped EXE
PID:1596 -
\??\c:\htnntt.exec:\htnntt.exe62⤵
- Executes dropped EXE
PID:352 -
\??\c:\jjpvd.exec:\jjpvd.exe63⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe64⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rlfxxxx.exec:\rlfxxxx.exe65⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tnnnbb.exec:\tnnnbb.exe66⤵PID:1224
-
\??\c:\dpjpv.exec:\dpjpv.exe67⤵PID:2112
-
\??\c:\jpdvd.exec:\jpdvd.exe68⤵PID:1336
-
\??\c:\1rrrffr.exec:\1rrrffr.exe69⤵PID:2736
-
\??\c:\thtthh.exec:\thtthh.exe70⤵PID:2748
-
\??\c:\nhnnnh.exec:\nhnnnh.exe71⤵PID:2820
-
\??\c:\3pjdd.exec:\3pjdd.exe72⤵PID:2572
-
\??\c:\5lxrllr.exec:\5lxrllr.exe73⤵PID:2588
-
\??\c:\nnhthh.exec:\nnhthh.exe74⤵PID:2716
-
\??\c:\vjdjj.exec:\vjdjj.exe75⤵PID:1504
-
\??\c:\3dpjd.exec:\3dpjd.exe76⤵
- System Location Discovery: System Language Discovery
PID:576 -
\??\c:\3xfxrlr.exec:\3xfxrlr.exe77⤵PID:640
-
\??\c:\hbhnnh.exec:\hbhnnh.exe78⤵PID:3008
-
\??\c:\nhtntn.exec:\nhtntn.exe79⤵PID:3028
-
\??\c:\vpvvj.exec:\vpvvj.exe80⤵PID:2472
-
\??\c:\frfxfxl.exec:\frfxfxl.exe81⤵PID:600
-
\??\c:\lxfffff.exec:\lxfffff.exe82⤵PID:2376
-
\??\c:\bthnbb.exec:\bthnbb.exe83⤵PID:2520
-
\??\c:\3jddp.exec:\3jddp.exe84⤵PID:1732
-
\??\c:\jvdvp.exec:\jvdvp.exe85⤵PID:2600
-
\??\c:\fxffllr.exec:\fxffllr.exe86⤵PID:1928
-
\??\c:\hthbbb.exec:\hthbbb.exe87⤵PID:2872
-
\??\c:\jvjjp.exec:\jvjjp.exe88⤵PID:2764
-
\??\c:\3vpjp.exec:\3vpjp.exe89⤵PID:1968
-
\??\c:\xxlrrfl.exec:\xxlrrfl.exe90⤵PID:1688
-
\??\c:\rfxffff.exec:\rfxffff.exe91⤵PID:2936
-
\??\c:\nbhhnh.exec:\nbhhnh.exe92⤵PID:2360
-
\??\c:\vjvdp.exec:\vjvdp.exe93⤵PID:1940
-
\??\c:\vjvjp.exec:\vjvjp.exe94⤵PID:1908
-
\??\c:\rfrllff.exec:\rfrllff.exe95⤵PID:1180
-
\??\c:\xrflllr.exec:\xrflllr.exe96⤵PID:1952
-
\??\c:\7bhnhb.exec:\7bhnhb.exe97⤵PID:1304
-
\??\c:\dvjjv.exec:\dvjjv.exe98⤵PID:268
-
\??\c:\5vddv.exec:\5vddv.exe99⤵PID:1700
-
\??\c:\fxllxrx.exec:\fxllxrx.exe100⤵PID:1936
-
\??\c:\thnhhh.exec:\thnhhh.exe101⤵PID:1612
-
\??\c:\7nhbbt.exec:\7nhbbt.exe102⤵PID:2968
-
\??\c:\jjppv.exec:\jjppv.exe103⤵PID:1020
-
\??\c:\vjddj.exec:\vjddj.exe104⤵PID:1132
-
\??\c:\5rxxxfr.exec:\5rxxxfr.exe105⤵PID:2328
-
\??\c:\btntbb.exec:\btntbb.exe106⤵PID:900
-
\??\c:\9tbbbb.exec:\9tbbbb.exe107⤵PID:2808
-
\??\c:\vpvvd.exec:\vpvvd.exe108⤵PID:2568
-
\??\c:\9flxfxx.exec:\9flxfxx.exe109⤵PID:2068
-
\??\c:\xxrrxxf.exec:\xxrrxxf.exe110⤵PID:2740
-
\??\c:\nbbbbt.exec:\nbbbbt.exe111⤵PID:2560
-
\??\c:\hbnthb.exec:\hbnthb.exe112⤵PID:2824
-
\??\c:\vppvd.exec:\vppvd.exe113⤵PID:2596
-
\??\c:\7lxflrf.exec:\7lxflrf.exe114⤵PID:2532
-
\??\c:\5lrxrrf.exec:\5lrxrrf.exe115⤵PID:2716
-
\??\c:\nbntbb.exec:\nbntbb.exe116⤵PID:2656
-
\??\c:\jvpjj.exec:\jvpjj.exe117⤵PID:1716
-
\??\c:\3vpjj.exec:\3vpjj.exe118⤵PID:640
-
\??\c:\7xlfrrf.exec:\7xlfrrf.exe119⤵PID:2976
-
\??\c:\ttnthn.exec:\ttnthn.exe120⤵PID:1472
-
\??\c:\nhbhnn.exec:\nhbhnn.exe121⤵PID:1876
-
\??\c:\jvdpp.exec:\jvdpp.exe122⤵PID:600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-