Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26/12/2024, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe
-
Size
453KB
-
MD5
84c842440c7a4c2d36db43bc1d018005
-
SHA1
f81db179b3401747130914396e96966fd3235fdd
-
SHA256
a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2
-
SHA512
8e7e999fcb24497c17eab0f1ad808121aebb76fe770deba48599df81b15de91e0741ebe8ddafcd32ca28ea52e6c06e1694e27cef73a0dde2d818246b44dfd2c4
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeP:q7Tc2NYHUrAwfMp3CDP
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 32 IoCs
resource yara_rule behavioral1/memory/2772-8-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1652-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2512-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2132-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2012-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-158-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1600-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/732-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1388-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1228-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/924-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1564-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-331-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2648-366-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2968-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-479-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1292-514-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2536-530-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2484-714-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-964-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2872 hfdrbn.exe 2800 djbdt.exe 2900 xbldlnd.exe 2708 xfdjlhr.exe 2740 jtlpbx.exe 2380 dnrnt.exe 2980 dvvhd.exe 1276 ljfbv.exe 1184 fjhfx.exe 1652 ltrrtnt.exe 1936 tbvnxbt.exe 2512 hfdtr.exe 2960 frxxhjx.exe 2132 hnpfj.exe 2012 hlrhxrr.exe 760 bnlntx.exe 2136 njvpndd.exe 2388 jhrlxh.exe 2148 pbbpndx.exe 2532 nvbhbj.exe 956 nntfff.exe 1600 jbdhp.exe 732 rpvpdh.exe 2272 trntlbf.exe 1388 nrftvbh.exe 1228 dtxxv.exe 2752 xpppxxd.exe 612 fftjf.exe 2636 xrdnd.exe 924 pjtjld.exe 932 hpdxxrx.exe 1704 xdllr.exe 2600 xdhft.exe 2924 pdhlrvb.exe 1564 xtntltt.exe 2828 nvpxjr.exe 2800 drhbdh.exe 3028 rxtdfvh.exe 2716 lxdnrjb.exe 2264 vbfjvv.exe 2288 jhlbxj.exe 2648 tbbnv.exe 1888 vjdxv.exe 2976 npvhnn.exe 1932 rbxrpl.exe 2072 vrblxfb.exe 2412 jthvx.exe 2196 bvjxb.exe 2736 ffrrfvh.exe 2968 xxlnppf.exe 3024 tjrjrfb.exe 2628 dhdfbbd.exe 2084 dpvblh.exe 1084 brjvtn.exe 264 hphhpdl.exe 2144 vnbnnf.exe 1748 xxbnh.exe 2384 phvplrl.exe 2540 hjxnpnv.exe 1144 nrnhv.exe 1292 rpffb.exe 1616 djnvr.exe 828 dbbrhfp.exe 1712 vlrtlbp.exe -
resource yara_rule behavioral1/memory/2772-8-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1276-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1652-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2132-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2012-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-185-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/732-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1388-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1228-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/924-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2648-366-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2968-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-479-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-494-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/828-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2536-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2772-588-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2484-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-747-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-820-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1984-834-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2924-875-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-964-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1372-971-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnnfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxfppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlndd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hlvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbhxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxxrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddnnfnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntjbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rljnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvpxjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbphdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxfhxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrjjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rpbvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntrpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxpxdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldbjr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xvdht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnrnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldnlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhblblt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhdjxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language prtnd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvhlfpb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llbvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xtxjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjpxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjnbhl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbdhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftfjndn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvxxfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrldlb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttdxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhftbfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlphdbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrvrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdhxhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhfhjn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2872 2772 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 2772 wrote to memory of 2872 2772 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 2772 wrote to memory of 2872 2772 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 2772 wrote to memory of 2872 2772 a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe 30 PID 2872 wrote to memory of 2800 2872 hfdrbn.exe 31 PID 2872 wrote to memory of 2800 2872 hfdrbn.exe 31 PID 2872 wrote to memory of 2800 2872 hfdrbn.exe 31 PID 2872 wrote to memory of 2800 2872 hfdrbn.exe 31 PID 2800 wrote to memory of 2900 2800 djbdt.exe 32 PID 2800 wrote to memory of 2900 2800 djbdt.exe 32 PID 2800 wrote to memory of 2900 2800 djbdt.exe 32 PID 2800 wrote to memory of 2900 2800 djbdt.exe 32 PID 2900 wrote to memory of 2708 2900 xbldlnd.exe 33 PID 2900 wrote to memory of 2708 2900 xbldlnd.exe 33 PID 2900 wrote to memory of 2708 2900 xbldlnd.exe 33 PID 2900 wrote to memory of 2708 2900 xbldlnd.exe 33 PID 2708 wrote to memory of 2740 2708 xfdjlhr.exe 34 PID 2708 wrote to memory of 2740 2708 xfdjlhr.exe 34 PID 2708 wrote to memory of 2740 2708 xfdjlhr.exe 34 PID 2708 wrote to memory of 2740 2708 xfdjlhr.exe 34 PID 2740 wrote to memory of 2380 2740 jtlpbx.exe 35 PID 2740 wrote to memory of 2380 2740 jtlpbx.exe 35 PID 2740 wrote to memory of 2380 2740 jtlpbx.exe 35 PID 2740 wrote to memory of 2380 2740 jtlpbx.exe 35 PID 2380 wrote to memory of 2980 2380 dnrnt.exe 36 PID 2380 wrote to memory of 2980 2380 dnrnt.exe 36 PID 2380 wrote to memory of 2980 2380 dnrnt.exe 36 PID 2380 wrote to memory of 2980 2380 dnrnt.exe 36 PID 2980 wrote to memory of 1276 2980 dvvhd.exe 37 PID 2980 wrote to memory of 1276 2980 dvvhd.exe 37 PID 2980 wrote to memory of 1276 2980 dvvhd.exe 37 PID 2980 wrote to memory of 1276 2980 dvvhd.exe 37 PID 1276 wrote to memory of 1184 1276 ljfbv.exe 38 PID 1276 wrote to memory of 1184 1276 ljfbv.exe 38 PID 1276 wrote to memory of 1184 1276 ljfbv.exe 38 PID 1276 wrote to memory of 1184 1276 ljfbv.exe 38 PID 1184 wrote to memory of 1652 1184 fjhfx.exe 39 PID 1184 wrote to memory of 1652 1184 fjhfx.exe 39 PID 1184 wrote to memory of 1652 1184 fjhfx.exe 39 PID 1184 wrote to memory of 1652 1184 fjhfx.exe 39 PID 1652 wrote to memory of 1936 1652 ltrrtnt.exe 40 PID 1652 wrote to memory of 1936 1652 ltrrtnt.exe 40 PID 1652 wrote to memory of 1936 1652 ltrrtnt.exe 40 PID 1652 wrote to memory of 1936 1652 ltrrtnt.exe 40 PID 1936 wrote to memory of 2512 1936 tbvnxbt.exe 41 PID 1936 wrote to memory of 2512 1936 tbvnxbt.exe 41 PID 1936 wrote to memory of 2512 1936 tbvnxbt.exe 41 PID 1936 wrote to memory of 2512 1936 tbvnxbt.exe 41 PID 2512 wrote to memory of 2960 2512 hfdtr.exe 42 PID 2512 wrote to memory of 2960 2512 hfdtr.exe 42 PID 2512 wrote to memory of 2960 2512 hfdtr.exe 42 PID 2512 wrote to memory of 2960 2512 hfdtr.exe 42 PID 2960 wrote to memory of 2132 2960 frxxhjx.exe 43 PID 2960 wrote to memory of 2132 2960 frxxhjx.exe 43 PID 2960 wrote to memory of 2132 2960 frxxhjx.exe 43 PID 2960 wrote to memory of 2132 2960 frxxhjx.exe 43 PID 2132 wrote to memory of 2012 2132 hnpfj.exe 44 PID 2132 wrote to memory of 2012 2132 hnpfj.exe 44 PID 2132 wrote to memory of 2012 2132 hnpfj.exe 44 PID 2132 wrote to memory of 2012 2132 hnpfj.exe 44 PID 2012 wrote to memory of 760 2012 hlrhxrr.exe 45 PID 2012 wrote to memory of 760 2012 hlrhxrr.exe 45 PID 2012 wrote to memory of 760 2012 hlrhxrr.exe 45 PID 2012 wrote to memory of 760 2012 hlrhxrr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe"C:\Users\Admin\AppData\Local\Temp\a7224fb2f175128346d36be98edaf2bec8a866f863126223155a1dfc3f1fe6c2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\hfdrbn.exec:\hfdrbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\djbdt.exec:\djbdt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\xbldlnd.exec:\xbldlnd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\xfdjlhr.exec:\xfdjlhr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jtlpbx.exec:\jtlpbx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\dnrnt.exec:\dnrnt.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\dvvhd.exec:\dvvhd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\ljfbv.exec:\ljfbv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\fjhfx.exec:\fjhfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ltrrtnt.exec:\ltrrtnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\tbvnxbt.exec:\tbvnxbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\hfdtr.exec:\hfdtr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\frxxhjx.exec:\frxxhjx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\hnpfj.exec:\hnpfj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\hlrhxrr.exec:\hlrhxrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\bnlntx.exec:\bnlntx.exe17⤵
- Executes dropped EXE
PID:760 -
\??\c:\njvpndd.exec:\njvpndd.exe18⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jhrlxh.exec:\jhrlxh.exe19⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pbbpndx.exec:\pbbpndx.exe20⤵
- Executes dropped EXE
PID:2148 -
\??\c:\nvbhbj.exec:\nvbhbj.exe21⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nntfff.exec:\nntfff.exe22⤵
- Executes dropped EXE
PID:956 -
\??\c:\jbdhp.exec:\jbdhp.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\rpvpdh.exec:\rpvpdh.exe24⤵
- Executes dropped EXE
PID:732 -
\??\c:\trntlbf.exec:\trntlbf.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\nrftvbh.exec:\nrftvbh.exe26⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dtxxv.exec:\dtxxv.exe27⤵
- Executes dropped EXE
PID:1228 -
\??\c:\xpppxxd.exec:\xpppxxd.exe28⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fftjf.exec:\fftjf.exe29⤵
- Executes dropped EXE
PID:612 -
\??\c:\xrdnd.exec:\xrdnd.exe30⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjtjld.exec:\pjtjld.exe31⤵
- Executes dropped EXE
PID:924 -
\??\c:\hpdxxrx.exec:\hpdxxrx.exe32⤵
- Executes dropped EXE
PID:932 -
\??\c:\xdllr.exec:\xdllr.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\xdhft.exec:\xdhft.exe34⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pdhlrvb.exec:\pdhlrvb.exe35⤵
- Executes dropped EXE
PID:2924 -
\??\c:\xtntltt.exec:\xtntltt.exe36⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nvpxjr.exec:\nvpxjr.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2828 -
\??\c:\drhbdh.exec:\drhbdh.exe38⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rxtdfvh.exec:\rxtdfvh.exe39⤵
- Executes dropped EXE
PID:3028 -
\??\c:\lxdnrjb.exec:\lxdnrjb.exe40⤵
- Executes dropped EXE
PID:2716 -
\??\c:\vbfjvv.exec:\vbfjvv.exe41⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jhlbxj.exec:\jhlbxj.exe42⤵
- Executes dropped EXE
PID:2288 -
\??\c:\tbbnv.exec:\tbbnv.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vjdxv.exec:\vjdxv.exe44⤵
- Executes dropped EXE
PID:1888 -
\??\c:\npvhnn.exec:\npvhnn.exe45⤵
- Executes dropped EXE
PID:2976 -
\??\c:\rbxrpl.exec:\rbxrpl.exe46⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vrblxfb.exec:\vrblxfb.exe47⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jthvx.exec:\jthvx.exe48⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bvjxb.exec:\bvjxb.exe49⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ffrrfvh.exec:\ffrrfvh.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xxlnppf.exec:\xxlnppf.exe51⤵
- Executes dropped EXE
PID:2968 -
\??\c:\tjrjrfb.exec:\tjrjrfb.exe52⤵
- Executes dropped EXE
PID:3024 -
\??\c:\dhdfbbd.exec:\dhdfbbd.exe53⤵
- Executes dropped EXE
PID:2628 -
\??\c:\dpvblh.exec:\dpvblh.exe54⤵
- Executes dropped EXE
PID:2084 -
\??\c:\brjvtn.exec:\brjvtn.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hphhpdl.exec:\hphhpdl.exe56⤵
- Executes dropped EXE
PID:264 -
\??\c:\vnbnnf.exec:\vnbnnf.exe57⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xxbnh.exec:\xxbnh.exe58⤵
- Executes dropped EXE
PID:1748 -
\??\c:\phvplrl.exec:\phvplrl.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hjxnpnv.exec:\hjxnpnv.exe60⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nrnhv.exec:\nrnhv.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\rpffb.exec:\rpffb.exe62⤵
- Executes dropped EXE
PID:1292 -
\??\c:\djnvr.exec:\djnvr.exe63⤵
- Executes dropped EXE
PID:1616 -
\??\c:\dbbrhfp.exec:\dbbrhfp.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\vlrtlbp.exec:\vlrtlbp.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lfbnvfr.exec:\lfbnvfr.exe66⤵PID:1624
-
\??\c:\dxrfbhb.exec:\dxrfbhb.exe67⤵PID:364
-
\??\c:\jxrjt.exec:\jxrjt.exe68⤵PID:2536
-
\??\c:\rxrrv.exec:\rxrrv.exe69⤵PID:3032
-
\??\c:\jfjrfvr.exec:\jfjrfvr.exe70⤵PID:2752
-
\??\c:\bbvnp.exec:\bbvnp.exe71⤵PID:1580
-
\??\c:\hvrdht.exec:\hvrdht.exe72⤵PID:2636
-
\??\c:\hvjvh.exec:\hvjvh.exe73⤵PID:1004
-
\??\c:\rhnvl.exec:\rhnvl.exe74⤵PID:284
-
\??\c:\xpbrlxb.exec:\xpbrlxb.exe75⤵PID:864
-
\??\c:\jrplrd.exec:\jrplrd.exe76⤵PID:2596
-
\??\c:\rvfvxl.exec:\rvfvxl.exe77⤵PID:2772
-
\??\c:\jrjnxt.exec:\jrjnxt.exe78⤵PID:3040
-
\??\c:\fbjtfh.exec:\fbjtfh.exe79⤵PID:2492
-
\??\c:\xtpjjx.exec:\xtpjjx.exe80⤵PID:2812
-
\??\c:\fllrr.exec:\fllrr.exe81⤵PID:2948
-
\??\c:\xfdfpj.exec:\xfdfpj.exe82⤵PID:2912
-
\??\c:\fptffrn.exec:\fptffrn.exe83⤵PID:2884
-
\??\c:\fvtbbrn.exec:\fvtbbrn.exe84⤵PID:2716
-
\??\c:\jtpjp.exec:\jtpjp.exe85⤵PID:2172
-
\??\c:\pppxnj.exec:\pppxnj.exe86⤵PID:316
-
\??\c:\vbtxl.exec:\vbtxl.exe87⤵PID:1196
-
\??\c:\lnbnn.exec:\lnbnn.exe88⤵PID:2000
-
\??\c:\ntrpt.exec:\ntrpt.exe89⤵
- System Location Discovery: System Language Discovery
PID:1880 -
\??\c:\rjrtxx.exec:\rjrtxx.exe90⤵PID:2188
-
\??\c:\rllvfr.exec:\rllvfr.exe91⤵PID:3004
-
\??\c:\jblnlvn.exec:\jblnlvn.exe92⤵PID:1372
-
\??\c:\rdntx.exec:\rdntx.exe93⤵PID:2196
-
\??\c:\hjhfrdr.exec:\hjhfrdr.exe94⤵PID:3008
-
\??\c:\txnnl.exec:\txnnl.exe95⤵PID:2396
-
\??\c:\fljfjlp.exec:\fljfjlp.exe96⤵PID:2484
-
\??\c:\lvxxt.exec:\lvxxt.exe97⤵PID:868
-
\??\c:\nhdht.exec:\nhdht.exe98⤵PID:676
-
\??\c:\xlddbx.exec:\xlddbx.exe99⤵PID:2376
-
\??\c:\jvrfpv.exec:\jvrfpv.exe100⤵PID:2368
-
\??\c:\tjplrn.exec:\tjplrn.exe101⤵PID:2008
-
\??\c:\btrvvpf.exec:\btrvvpf.exe102⤵PID:3056
-
\??\c:\djtbfj.exec:\djtbfj.exe103⤵PID:2148
-
\??\c:\nhbvxhn.exec:\nhbvxhn.exe104⤵PID:2460
-
\??\c:\bjnrth.exec:\bjnrth.exe105⤵PID:952
-
\??\c:\ttvhl.exec:\ttvhl.exe106⤵PID:2128
-
\??\c:\fbtrh.exec:\fbtrh.exe107⤵PID:2400
-
\??\c:\hbtxp.exec:\hbtxp.exe108⤵PID:788
-
\??\c:\lhlhrt.exec:\lhlhrt.exe109⤵PID:804
-
\??\c:\nbpbtvp.exec:\nbpbtvp.exe110⤵PID:1712
-
\??\c:\fbnbtt.exec:\fbnbtt.exe111⤵PID:1976
-
\??\c:\xtrhll.exec:\xtrhll.exe112⤵PID:324
-
\??\c:\jrpjj.exec:\jrpjj.exe113⤵PID:2344
-
\??\c:\dpxxxfh.exec:\dpxxxfh.exe114⤵PID:2432
-
\??\c:\xfvpplr.exec:\xfvpplr.exe115⤵PID:1984
-
\??\c:\prxdpdh.exec:\prxdpdh.exe116⤵PID:1008
-
\??\c:\hhltll.exec:\hhltll.exe117⤵PID:1768
-
\??\c:\rnftnx.exec:\rnftnx.exe118⤵PID:1068
-
\??\c:\brrtnbr.exec:\brrtnbr.exe119⤵PID:852
-
\??\c:\lxnblt.exec:\lxnblt.exe120⤵PID:1988
-
\??\c:\pdpvhhr.exec:\pdpvhhr.exe121⤵PID:1556
-
\??\c:\pfprbbr.exec:\pfprbbr.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-