Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe
-
Size
455KB
-
MD5
9d75713c8d40be85f1f8cc12c6b78f65
-
SHA1
d98f072887518672676202a40293fabd29c095c1
-
SHA256
96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac
-
SHA512
58a4b20db43cfabfa96bb651130d81edf9fe9375622fd920d2ec1e5dbfcb55c767bedc886bafa239490f2a41484d8ab2e5ca59c46d1f932d384fde2378136459
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbek:q7Tc2NYHUrAwfMp3CDk
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 40 IoCs
resource yara_rule behavioral1/memory/1064-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2316-17-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2992-35-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2976-45-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2916-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3056-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-62-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2688-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/684-85-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2988-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/812-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-174-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2196-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-181-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2440-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-234-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-305-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2276-304-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2696-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-361-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1780-363-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-382-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1660-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-403-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2336-463-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2140-484-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-491-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-533-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-610-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2600-636-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-689-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2496-698-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 jdvfvvn.exe 2720 bxrttvb.exe 2992 hndffv.exe 2976 pfnnpdx.exe 2916 pvvrxp.exe 2636 fhnxh.exe 3056 rljxh.exe 684 nlbtxr.exe 2688 hhnllb.exe 2988 pvtvfxn.exe 552 bfdjnx.exe 1776 lbbnblj.exe 2680 tjhhdn.exe 832 tfhrd.exe 2136 jtxxb.exe 812 hrnrpff.exe 2212 rhrxbbf.exe 2344 ppvtxl.exe 2196 nhdtvbn.exe 2356 hbppj.exe 2440 tvpndr.exe 980 prnth.exe 1136 dhnnjn.exe 280 rvtvbvb.exe 2324 pfbdnvx.exe 1804 bltnrh.exe 1504 vdddj.exe 2524 npdxrvh.exe 2364 jdnfndl.exe 848 nvxvbvp.exe 1556 nbxjbxt.exe 2276 ldplxp.exe 2260 bhlff.exe 2448 nhrxhvv.exe 1756 jvnllxt.exe 2696 vrvvfx.exe 2864 pbbtjxl.exe 2112 vvxpvj.exe 2856 tlvhdl.exe 2808 tvhdfht.exe 1780 fnvlffd.exe 2604 xtvdhrp.exe 3064 xpppdh.exe 908 fjlbpdf.exe 1660 fjlffrd.exe 1296 phnjhfl.exe 2652 ndrvp.exe 2660 bphhdr.exe 552 vxxrb.exe 2952 xrvnj.exe 1796 xdfhxp.exe 3036 pdxfhvr.exe 340 ffpdd.exe 2136 vjdbpbf.exe 2336 vvbvt.exe 1216 ldjnx.exe 1384 lfbbtn.exe 1928 vdnvh.exe 2140 tlpxt.exe 1516 hjhrnp.exe 2476 flvtf.exe 236 jdlfrn.exe 1536 rrrnj.exe 1724 vxnvfnl.exe -
resource yara_rule behavioral1/memory/1064-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2316-17-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-45-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2916-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3056-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2988-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/812-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-234-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2276-305-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-354-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2808-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1780-363-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-484-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-491-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-526-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-533-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-596-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-636-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2992-644-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/272-675-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-689-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-698-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjnvh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxprbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpjfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnfbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lnbllfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnbxpfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvhdfht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdfhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdjnf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnjdxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vfdnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrjpf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thphvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhlrtvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lhxpl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlttxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvtfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lbnjfbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tjhhdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvrbp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brjflht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbrdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxvxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxfrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xdtpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhtv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxtnnrt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhphnbj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtvjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfthl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvprphj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxhfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fttjlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hvtpfbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrfph.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtljnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thntv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hblhf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xbxhbtx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhrxhvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdltvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hxfnvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bprvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 2316 1064 96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe 30 PID 1064 wrote to memory of 2316 1064 96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe 30 PID 1064 wrote to memory of 2316 1064 96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe 30 PID 1064 wrote to memory of 2316 1064 96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe 30 PID 2316 wrote to memory of 2720 2316 jdvfvvn.exe 31 PID 2316 wrote to memory of 2720 2316 jdvfvvn.exe 31 PID 2316 wrote to memory of 2720 2316 jdvfvvn.exe 31 PID 2316 wrote to memory of 2720 2316 jdvfvvn.exe 31 PID 2720 wrote to memory of 2992 2720 bxrttvb.exe 32 PID 2720 wrote to memory of 2992 2720 bxrttvb.exe 32 PID 2720 wrote to memory of 2992 2720 bxrttvb.exe 32 PID 2720 wrote to memory of 2992 2720 bxrttvb.exe 32 PID 2992 wrote to memory of 2976 2992 hndffv.exe 33 PID 2992 wrote to memory of 2976 2992 hndffv.exe 33 PID 2992 wrote to memory of 2976 2992 hndffv.exe 33 PID 2992 wrote to memory of 2976 2992 hndffv.exe 33 PID 2976 wrote to memory of 2916 2976 pfnnpdx.exe 34 PID 2976 wrote to memory of 2916 2976 pfnnpdx.exe 34 PID 2976 wrote to memory of 2916 2976 pfnnpdx.exe 34 PID 2976 wrote to memory of 2916 2976 pfnnpdx.exe 34 PID 2916 wrote to memory of 2636 2916 pvvrxp.exe 35 PID 2916 wrote to memory of 2636 2916 pvvrxp.exe 35 PID 2916 wrote to memory of 2636 2916 pvvrxp.exe 35 PID 2916 wrote to memory of 2636 2916 pvvrxp.exe 35 PID 2636 wrote to memory of 3056 2636 fhnxh.exe 36 PID 2636 wrote to memory of 3056 2636 fhnxh.exe 36 PID 2636 wrote to memory of 3056 2636 fhnxh.exe 36 PID 2636 wrote to memory of 3056 2636 fhnxh.exe 36 PID 3056 wrote to memory of 684 3056 rljxh.exe 37 PID 3056 wrote to memory of 684 3056 rljxh.exe 37 PID 3056 wrote to memory of 684 3056 rljxh.exe 37 PID 3056 wrote to memory of 684 3056 rljxh.exe 37 PID 684 wrote to memory of 2688 684 nlbtxr.exe 38 PID 684 wrote to memory of 2688 684 nlbtxr.exe 38 PID 684 wrote to memory of 2688 684 nlbtxr.exe 38 PID 684 wrote to memory of 2688 684 nlbtxr.exe 38 PID 2688 wrote to memory of 2988 2688 hhnllb.exe 39 PID 2688 wrote to memory of 2988 2688 hhnllb.exe 39 PID 2688 wrote to memory of 2988 2688 hhnllb.exe 39 PID 2688 wrote to memory of 2988 2688 hhnllb.exe 39 PID 2988 wrote to memory of 552 2988 pvtvfxn.exe 40 PID 2988 wrote to memory of 552 2988 pvtvfxn.exe 40 PID 2988 wrote to memory of 552 2988 pvtvfxn.exe 40 PID 2988 wrote to memory of 552 2988 pvtvfxn.exe 40 PID 552 wrote to memory of 1776 552 bfdjnx.exe 41 PID 552 wrote to memory of 1776 552 bfdjnx.exe 41 PID 552 wrote to memory of 1776 552 bfdjnx.exe 41 PID 552 wrote to memory of 1776 552 bfdjnx.exe 41 PID 1776 wrote to memory of 2680 1776 lbbnblj.exe 42 PID 1776 wrote to memory of 2680 1776 lbbnblj.exe 42 PID 1776 wrote to memory of 2680 1776 lbbnblj.exe 42 PID 1776 wrote to memory of 2680 1776 lbbnblj.exe 42 PID 2680 wrote to memory of 832 2680 tjhhdn.exe 43 PID 2680 wrote to memory of 832 2680 tjhhdn.exe 43 PID 2680 wrote to memory of 832 2680 tjhhdn.exe 43 PID 2680 wrote to memory of 832 2680 tjhhdn.exe 43 PID 832 wrote to memory of 2136 832 tfhrd.exe 44 PID 832 wrote to memory of 2136 832 tfhrd.exe 44 PID 832 wrote to memory of 2136 832 tfhrd.exe 44 PID 832 wrote to memory of 2136 832 tfhrd.exe 44 PID 2136 wrote to memory of 812 2136 jtxxb.exe 45 PID 2136 wrote to memory of 812 2136 jtxxb.exe 45 PID 2136 wrote to memory of 812 2136 jtxxb.exe 45 PID 2136 wrote to memory of 812 2136 jtxxb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe"C:\Users\Admin\AppData\Local\Temp\96e20f0268a351477f7c3cc07b945a2d54aad06f3fdf7207eca22ab88d2b27ac.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\jdvfvvn.exec:\jdvfvvn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\bxrttvb.exec:\bxrttvb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\hndffv.exec:\hndffv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\pfnnpdx.exec:\pfnnpdx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\pvvrxp.exec:\pvvrxp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\fhnxh.exec:\fhnxh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rljxh.exec:\rljxh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\nlbtxr.exec:\nlbtxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\hhnllb.exec:\hhnllb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\pvtvfxn.exec:\pvtvfxn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\bfdjnx.exec:\bfdjnx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\lbbnblj.exec:\lbbnblj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\tjhhdn.exec:\tjhhdn.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\tfhrd.exec:\tfhrd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\jtxxb.exec:\jtxxb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hrnrpff.exec:\hrnrpff.exe17⤵
- Executes dropped EXE
PID:812 -
\??\c:\rhrxbbf.exec:\rhrxbbf.exe18⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ppvtxl.exec:\ppvtxl.exe19⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nhdtvbn.exec:\nhdtvbn.exe20⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbppj.exec:\hbppj.exe21⤵
- Executes dropped EXE
PID:2356 -
\??\c:\tvpndr.exec:\tvpndr.exe22⤵
- Executes dropped EXE
PID:2440 -
\??\c:\prnth.exec:\prnth.exe23⤵
- Executes dropped EXE
PID:980 -
\??\c:\dhnnjn.exec:\dhnnjn.exe24⤵
- Executes dropped EXE
PID:1136 -
\??\c:\rvtvbvb.exec:\rvtvbvb.exe25⤵
- Executes dropped EXE
PID:280 -
\??\c:\pfbdnvx.exec:\pfbdnvx.exe26⤵
- Executes dropped EXE
PID:2324 -
\??\c:\bltnrh.exec:\bltnrh.exe27⤵
- Executes dropped EXE
PID:1804 -
\??\c:\vdddj.exec:\vdddj.exe28⤵
- Executes dropped EXE
PID:1504 -
\??\c:\npdxrvh.exec:\npdxrvh.exe29⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jdnfndl.exec:\jdnfndl.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nvxvbvp.exec:\nvxvbvp.exe31⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbxjbxt.exec:\nbxjbxt.exe32⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ldplxp.exec:\ldplxp.exe33⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bhlff.exec:\bhlff.exe34⤵
- Executes dropped EXE
PID:2260 -
\??\c:\nhrxhvv.exec:\nhrxhvv.exe35⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2448 -
\??\c:\jvnllxt.exec:\jvnllxt.exe36⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vrvvfx.exec:\vrvvfx.exe37⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pbbtjxl.exec:\pbbtjxl.exe38⤵
- Executes dropped EXE
PID:2864 -
\??\c:\vvxpvj.exec:\vvxpvj.exe39⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tlvhdl.exec:\tlvhdl.exe40⤵
- Executes dropped EXE
PID:2856 -
\??\c:\tvhdfht.exec:\tvhdfht.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\fnvlffd.exec:\fnvlffd.exe42⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xtvdhrp.exec:\xtvdhrp.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xpppdh.exec:\xpppdh.exe44⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fjlbpdf.exec:\fjlbpdf.exe45⤵
- Executes dropped EXE
PID:908 -
\??\c:\fjlffrd.exec:\fjlffrd.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\phnjhfl.exec:\phnjhfl.exe47⤵
- Executes dropped EXE
PID:1296 -
\??\c:\ndrvp.exec:\ndrvp.exe48⤵
- Executes dropped EXE
PID:2652 -
\??\c:\bphhdr.exec:\bphhdr.exe49⤵
- Executes dropped EXE
PID:2660 -
\??\c:\vxxrb.exec:\vxxrb.exe50⤵
- Executes dropped EXE
PID:552 -
\??\c:\xrvnj.exec:\xrvnj.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xdfhxp.exec:\xdfhxp.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1796 -
\??\c:\pdxfhvr.exec:\pdxfhvr.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\ffpdd.exec:\ffpdd.exe54⤵
- Executes dropped EXE
PID:340 -
\??\c:\vjdbpbf.exec:\vjdbpbf.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\vvbvt.exec:\vvbvt.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ldjnx.exec:\ldjnx.exe57⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lfbbtn.exec:\lfbbtn.exe58⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vdnvh.exec:\vdnvh.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\tlpxt.exec:\tlpxt.exe60⤵
- Executes dropped EXE
PID:2140 -
\??\c:\hjhrnp.exec:\hjhrnp.exe61⤵
- Executes dropped EXE
PID:1516 -
\??\c:\flvtf.exec:\flvtf.exe62⤵
- Executes dropped EXE
PID:2476 -
\??\c:\jdlfrn.exec:\jdlfrn.exe63⤵
- Executes dropped EXE
PID:236 -
\??\c:\rrrnj.exec:\rrrnj.exe64⤵
- Executes dropped EXE
PID:1536 -
\??\c:\vxnvfnl.exec:\vxnvfnl.exe65⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jtdhhj.exec:\jtdhhj.exe66⤵PID:1828
-
\??\c:\pdbxx.exec:\pdbxx.exe67⤵PID:1716
-
\??\c:\btnbr.exec:\btnbr.exe68⤵PID:536
-
\??\c:\hddxdlv.exec:\hddxdlv.exe69⤵PID:1372
-
\??\c:\dxdfbt.exec:\dxdfbt.exe70⤵PID:2080
-
\??\c:\lldbjf.exec:\lldbjf.exe71⤵PID:2524
-
\??\c:\jhlbrjn.exec:\jhlbrjn.exe72⤵PID:2676
-
\??\c:\rhbhb.exec:\rhbhb.exe73⤵PID:2060
-
\??\c:\vbjpvv.exec:\vbjpvv.exe74⤵PID:1664
-
\??\c:\pdlhvlp.exec:\pdlhvlp.exe75⤵PID:2008
-
\??\c:\tvnhfvl.exec:\tvnhfvl.exe76⤵PID:1980
-
\??\c:\xnbvp.exec:\xnbvp.exe77⤵PID:1584
-
\??\c:\xnbnjlr.exec:\xnbnjlr.exe78⤵PID:2444
-
\??\c:\hhtdlf.exec:\hhtdlf.exe79⤵PID:2684
-
\??\c:\tnnbdf.exec:\tnnbdf.exe80⤵PID:2804
-
\??\c:\dpdxvh.exec:\dpdxvh.exe81⤵PID:2600
-
\??\c:\dvbfp.exec:\dvbfp.exe82⤵PID:2992
-
\??\c:\tjtnx.exec:\tjtnx.exe83⤵PID:2976
-
\??\c:\xvnrfj.exec:\xvnrfj.exe84⤵PID:2828
-
\??\c:\bfbpjh.exec:\bfbpjh.exe85⤵PID:2592
-
\??\c:\xfrjpf.exec:\xfrjpf.exe86⤵
- System Location Discovery: System Language Discovery
PID:2640 -
\??\c:\bxrpxfx.exec:\bxrpxfx.exe87⤵PID:1072
-
\??\c:\jhfthpn.exec:\jhfthpn.exe88⤵PID:272
-
\??\c:\pnbbl.exec:\pnbbl.exe89⤵PID:580
-
\??\c:\pdfjfh.exec:\pdfjfh.exe90⤵PID:2496
-
\??\c:\jvlvxn.exec:\jvlvxn.exe91⤵PID:2580
-
\??\c:\hdrltf.exec:\hdrltf.exe92⤵PID:2844
-
\??\c:\jnbrd.exec:\jnbrd.exe93⤵PID:1956
-
\??\c:\pnvvnj.exec:\pnvvnj.exe94⤵PID:1924
-
\??\c:\rhbhhf.exec:\rhbhhf.exe95⤵PID:1436
-
\??\c:\fbtttvh.exec:\fbtttvh.exe96⤵PID:3036
-
\??\c:\rbltnf.exec:\rbltnf.exe97⤵PID:340
-
\??\c:\hfnjhp.exec:\hfnjhp.exe98⤵PID:592
-
\??\c:\dnrvjht.exec:\dnrvjht.exe99⤵PID:2212
-
\??\c:\xrvrdlj.exec:\xrvrdlj.exe100⤵PID:684
-
\??\c:\rdpxppj.exec:\rdpxppj.exe101⤵PID:2192
-
\??\c:\jttpxr.exec:\jttpxr.exe102⤵PID:1360
-
\??\c:\xvtbtx.exec:\xvtbtx.exe103⤵PID:1808
-
\??\c:\pjrvr.exec:\pjrvr.exe104⤵PID:388
-
\??\c:\bhbnd.exec:\bhbnd.exe105⤵PID:708
-
\??\c:\lhfttrj.exec:\lhfttrj.exe106⤵PID:980
-
\??\c:\rdxltfd.exec:\rdxltfd.exe107⤵PID:112
-
\??\c:\pjhhh.exec:\pjhhh.exe108⤵PID:1496
-
\??\c:\hdhbl.exec:\hdhbl.exe109⤵PID:1468
-
\??\c:\hxfnvp.exec:\hxfnvp.exe110⤵
- System Location Discovery: System Language Discovery
PID:2324 -
\??\c:\phtlpdv.exec:\phtlpdv.exe111⤵PID:1720
-
\??\c:\ndbjtd.exec:\ndbjtd.exe112⤵PID:1228
-
\??\c:\fdltvn.exec:\fdltvn.exe113⤵
- System Location Discovery: System Language Discovery
PID:2064 -
\??\c:\xhjljh.exec:\xhjljh.exe114⤵PID:2984
-
\??\c:\dhtbn.exec:\dhtbn.exe115⤵PID:2368
-
\??\c:\pbvdv.exec:\pbvdv.exe116⤵PID:1188
-
\??\c:\vlhrt.exec:\vlhrt.exe117⤵PID:2012
-
\??\c:\prlxhx.exec:\prlxhx.exe118⤵PID:1556
-
\??\c:\rtfrx.exec:\rtfrx.exe119⤵PID:2008
-
\??\c:\pflxr.exec:\pflxr.exe120⤵PID:1980
-
\??\c:\jtpnxhn.exec:\jtpnxhn.exe121⤵PID:1584
-
\??\c:\vbltdhl.exec:\vbltdhl.exe122⤵PID:2444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-