Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe
-
Size
454KB
-
MD5
da27a22e9d021dc88eb035827cb25c00
-
SHA1
6b5dcf10afd9190bcaacacd7c32943d65dc5e716
-
SHA256
4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850a
-
SHA512
0558ec6eed5817b289b717c119460deade101512d593bee1ceb740ae4fe08d2ed1eaa6183de867b27f55ff82b4466a8deb26ad48ae2556ca39750ee0cdb33623
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR:q7Tc2NYHUrAwfMp3CDR
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2776-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2724-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-184-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1320-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1400-226-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1820-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2160-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1944-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-116-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-81-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2524-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-38-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1516-289-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-296-0x0000000077930000-0x0000000077A4F000-memory.dmp family_blackmoon behavioral1/memory/2972-297-0x0000000077830000-0x000000007792A000-memory.dmp family_blackmoon behavioral1/memory/2360-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2848-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-498-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-546-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1308-560-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1884-696-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/2312-775-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2356-794-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-984-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2776 1vddd.exe 2724 fxlxflf.exe 2936 jjdjj.exe 2892 pjvdp.exe 2524 frlrrlf.exe 2600 hbntth.exe 3012 jjppv.exe 2056 xrlrflr.exe 1508 htnbbt.exe 2948 dppdp.exe 2508 1xrrrrr.exe 852 5thnnt.exe 1100 5nhbnn.exe 2380 ppdjv.exe 1944 fxlfrxl.exe 2160 nththb.exe 1304 7vdvp.exe 2060 fxllxxx.exe 2236 hbnnnt.exe 2264 jvppv.exe 2396 3lxflrx.exe 1412 3bbbhh.exe 1320 1pdvj.exe 956 9frxffr.exe 892 vvvdp.exe 1400 ffxflxf.exe 1260 7bntht.exe 1820 nhbhnt.exe 2324 ddvvd.exe 1056 9fxfrrx.exe 2140 thntbh.exe 1040 ddjpj.exe 1920 9lffxxx.exe 1516 bttthh.exe 2972 bnbhtb.exe 2832 vpjjj.exe 2360 lrrlfxx.exe 2848 hbbtnh.exe 2804 rrflxfr.exe 2612 bnhhnn.exe 2644 9jdjd.exe 2876 fxxrlrf.exe 2492 3thntb.exe 876 5tnnbh.exe 2164 rlflfrl.exe 2564 9frxxlx.exe 2608 fxllxxr.exe 1964 lrrrxxl.exe 2036 bthhtb.exe 1932 pjvvd.exe 2252 hhtthh.exe 2664 hbtbhn.exe 2160 pjvjv.exe 1500 fxrrxxf.exe 644 9hhhnn.exe 1752 jjdpp.exe 2528 lrlxfrf.exe 2004 1flllrr.exe 2340 nhbhnh.exe 2384 djdpd.exe 1768 5xlxrfr.exe 2756 1frlrrf.exe 1236 thtbbh.exe 2356 3vddj.exe -
resource yara_rule behavioral1/memory/2776-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1320-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1400-226-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1820-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1944-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1100-116-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-81-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2524-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1516-289-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2848-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2164-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2160-421-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/644-436-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1236-498-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-547-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-546-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1308-560-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-612-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1412-756-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2312-775-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2356-794-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/900-846-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-866-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2724-880-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-913-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-984-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2340-1032-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlrflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrrrf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2776 2076 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 30 PID 2076 wrote to memory of 2776 2076 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 30 PID 2076 wrote to memory of 2776 2076 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 30 PID 2076 wrote to memory of 2776 2076 4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe 30 PID 2776 wrote to memory of 2724 2776 1vddd.exe 31 PID 2776 wrote to memory of 2724 2776 1vddd.exe 31 PID 2776 wrote to memory of 2724 2776 1vddd.exe 31 PID 2776 wrote to memory of 2724 2776 1vddd.exe 31 PID 2724 wrote to memory of 2936 2724 fxlxflf.exe 32 PID 2724 wrote to memory of 2936 2724 fxlxflf.exe 32 PID 2724 wrote to memory of 2936 2724 fxlxflf.exe 32 PID 2724 wrote to memory of 2936 2724 fxlxflf.exe 32 PID 2936 wrote to memory of 2892 2936 jjdjj.exe 33 PID 2936 wrote to memory of 2892 2936 jjdjj.exe 33 PID 2936 wrote to memory of 2892 2936 jjdjj.exe 33 PID 2936 wrote to memory of 2892 2936 jjdjj.exe 33 PID 2892 wrote to memory of 2524 2892 pjvdp.exe 34 PID 2892 wrote to memory of 2524 2892 pjvdp.exe 34 PID 2892 wrote to memory of 2524 2892 pjvdp.exe 34 PID 2892 wrote to memory of 2524 2892 pjvdp.exe 34 PID 2524 wrote to memory of 2600 2524 frlrrlf.exe 35 PID 2524 wrote to memory of 2600 2524 frlrrlf.exe 35 PID 2524 wrote to memory of 2600 2524 frlrrlf.exe 35 PID 2524 wrote to memory of 2600 2524 frlrrlf.exe 35 PID 2600 wrote to memory of 3012 2600 hbntth.exe 36 PID 2600 wrote to memory of 3012 2600 hbntth.exe 36 PID 2600 wrote to memory of 3012 2600 hbntth.exe 36 PID 2600 wrote to memory of 3012 2600 hbntth.exe 36 PID 3012 wrote to memory of 2056 3012 jjppv.exe 37 PID 3012 wrote to memory of 2056 3012 jjppv.exe 37 PID 3012 wrote to memory of 2056 3012 jjppv.exe 37 PID 3012 wrote to memory of 2056 3012 jjppv.exe 37 PID 2056 wrote to memory of 1508 2056 xrlrflr.exe 38 PID 2056 wrote to memory of 1508 2056 xrlrflr.exe 38 PID 2056 wrote to memory of 1508 2056 xrlrflr.exe 38 PID 2056 wrote to memory of 1508 2056 xrlrflr.exe 38 PID 1508 wrote to memory of 2948 1508 htnbbt.exe 39 PID 1508 wrote to memory of 2948 1508 htnbbt.exe 39 PID 1508 wrote to memory of 2948 1508 htnbbt.exe 39 PID 1508 wrote to memory of 2948 1508 htnbbt.exe 39 PID 2948 wrote to memory of 2508 2948 dppdp.exe 40 PID 2948 wrote to memory of 2508 2948 dppdp.exe 40 PID 2948 wrote to memory of 2508 2948 dppdp.exe 40 PID 2948 wrote to memory of 2508 2948 dppdp.exe 40 PID 2508 wrote to memory of 852 2508 1xrrrrr.exe 41 PID 2508 wrote to memory of 852 2508 1xrrrrr.exe 41 PID 2508 wrote to memory of 852 2508 1xrrrrr.exe 41 PID 2508 wrote to memory of 852 2508 1xrrrrr.exe 41 PID 852 wrote to memory of 1100 852 5thnnt.exe 42 PID 852 wrote to memory of 1100 852 5thnnt.exe 42 PID 852 wrote to memory of 1100 852 5thnnt.exe 42 PID 852 wrote to memory of 1100 852 5thnnt.exe 42 PID 1100 wrote to memory of 2380 1100 5nhbnn.exe 43 PID 1100 wrote to memory of 2380 1100 5nhbnn.exe 43 PID 1100 wrote to memory of 2380 1100 5nhbnn.exe 43 PID 1100 wrote to memory of 2380 1100 5nhbnn.exe 43 PID 2380 wrote to memory of 1944 2380 ppdjv.exe 44 PID 2380 wrote to memory of 1944 2380 ppdjv.exe 44 PID 2380 wrote to memory of 1944 2380 ppdjv.exe 44 PID 2380 wrote to memory of 1944 2380 ppdjv.exe 44 PID 1944 wrote to memory of 2160 1944 fxlfrxl.exe 45 PID 1944 wrote to memory of 2160 1944 fxlfrxl.exe 45 PID 1944 wrote to memory of 2160 1944 fxlfrxl.exe 45 PID 1944 wrote to memory of 2160 1944 fxlfrxl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe"C:\Users\Admin\AppData\Local\Temp\4928c2353f29b55db5278b93d9565466155251df2be820385cb36f9ba494850aN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\1vddd.exec:\1vddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\fxlxflf.exec:\fxlxflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jjdjj.exec:\jjdjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\pjvdp.exec:\pjvdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\frlrrlf.exec:\frlrrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hbntth.exec:\hbntth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\jjppv.exec:\jjppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xrlrflr.exec:\xrlrflr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\htnbbt.exec:\htnbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\dppdp.exec:\dppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\1xrrrrr.exec:\1xrrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\5thnnt.exec:\5thnnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\5nhbnn.exec:\5nhbnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\ppdjv.exec:\ppdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\fxlfrxl.exec:\fxlfrxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nththb.exec:\nththb.exe17⤵
- Executes dropped EXE
PID:2160 -
\??\c:\7vdvp.exec:\7vdvp.exe18⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxllxxx.exec:\fxllxxx.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\hbnnnt.exec:\hbnnnt.exe20⤵
- Executes dropped EXE
PID:2236 -
\??\c:\jvppv.exec:\jvppv.exe21⤵
- Executes dropped EXE
PID:2264 -
\??\c:\3lxflrx.exec:\3lxflrx.exe22⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3bbbhh.exec:\3bbbhh.exe23⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1pdvj.exec:\1pdvj.exe24⤵
- Executes dropped EXE
PID:1320 -
\??\c:\9frxffr.exec:\9frxffr.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\vvvdp.exec:\vvvdp.exe26⤵
- Executes dropped EXE
PID:892 -
\??\c:\ffxflxf.exec:\ffxflxf.exe27⤵
- Executes dropped EXE
PID:1400 -
\??\c:\7bntht.exec:\7bntht.exe28⤵
- Executes dropped EXE
PID:1260 -
\??\c:\nhbhnt.exec:\nhbhnt.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\ddvvd.exec:\ddvvd.exe30⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9fxfrrx.exec:\9fxfrrx.exe31⤵
- Executes dropped EXE
PID:1056 -
\??\c:\thntbh.exec:\thntbh.exe32⤵
- Executes dropped EXE
PID:2140 -
\??\c:\ddjpj.exec:\ddjpj.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9lffxxx.exec:\9lffxxx.exe34⤵
- Executes dropped EXE
PID:1920 -
\??\c:\bttthh.exec:\bttthh.exe35⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bnbhtb.exec:\bnbhtb.exe36⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tnhnbb.exec:\tnhnbb.exe37⤵PID:2784
-
\??\c:\vpjjj.exec:\vpjjj.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\lrrlfxx.exec:\lrrlfxx.exe39⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hbbtnh.exec:\hbbtnh.exe40⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rrflxfr.exec:\rrflxfr.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bnhhnn.exec:\bnhhnn.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\9jdjd.exec:\9jdjd.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe44⤵
- Executes dropped EXE
PID:2876 -
\??\c:\3thntb.exec:\3thntb.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5tnnbh.exec:\5tnnbh.exe46⤵
- Executes dropped EXE
PID:876 -
\??\c:\rlflfrl.exec:\rlflfrl.exe47⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9frxxlx.exec:\9frxxlx.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\fxllxxr.exec:\fxllxxr.exe49⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lrrrxxl.exec:\lrrrxxl.exe50⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bthhtb.exec:\bthhtb.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\pjvvd.exec:\pjvvd.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hhtthh.exec:\hhtthh.exe53⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hbtbhn.exec:\hbtbhn.exe54⤵
- Executes dropped EXE
PID:2664 -
\??\c:\pjvjv.exec:\pjvjv.exe55⤵
- Executes dropped EXE
PID:2160 -
\??\c:\fxrrxxf.exec:\fxrrxxf.exe56⤵
- Executes dropped EXE
PID:1500 -
\??\c:\9hhhnn.exec:\9hhhnn.exe57⤵
- Executes dropped EXE
PID:644 -
\??\c:\jjdpp.exec:\jjdpp.exe58⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lrlxfrf.exec:\lrlxfrf.exe59⤵
- Executes dropped EXE
PID:2528 -
\??\c:\1flllrr.exec:\1flllrr.exe60⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nhbhnh.exec:\nhbhnh.exe61⤵
- Executes dropped EXE
PID:2340 -
\??\c:\djdpd.exec:\djdpd.exe62⤵
- Executes dropped EXE
PID:2384 -
\??\c:\5xlxrfr.exec:\5xlxrfr.exe63⤵
- Executes dropped EXE
PID:1768 -
\??\c:\1frlrrf.exec:\1frlrrf.exe64⤵
- Executes dropped EXE
PID:2756 -
\??\c:\thtbbh.exec:\thtbbh.exe65⤵
- Executes dropped EXE
PID:1236 -
\??\c:\3vddj.exec:\3vddj.exe66⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ffrxflr.exec:\ffrxflr.exe67⤵PID:1564
-
\??\c:\nbtnnt.exec:\nbtnnt.exe68⤵PID:1904
-
\??\c:\tnhhnh.exec:\tnhhnh.exe69⤵PID:2112
-
\??\c:\pdpdj.exec:\pdpdj.exe70⤵PID:860
-
\??\c:\9rffffl.exec:\9rffffl.exe71⤵PID:328
-
\??\c:\tntbhh.exec:\tntbhh.exe72⤵PID:2364
-
\??\c:\ppdjv.exec:\ppdjv.exe73⤵PID:1548
-
\??\c:\dvvdp.exec:\dvvdp.exe74⤵PID:1308
-
\??\c:\rlxfllf.exec:\rlxfllf.exe75⤵PID:1628
-
\??\c:\tbttbb.exec:\tbttbb.exe76⤵PID:1068
-
\??\c:\7pddj.exec:\7pddj.exe77⤵PID:2932
-
\??\c:\dddvp.exec:\dddvp.exe78⤵PID:2076
-
\??\c:\1rrfffl.exec:\1rrfffl.exe79⤵PID:2784
-
\??\c:\nnntbh.exec:\nnntbh.exe80⤵PID:2940
-
\??\c:\jdpvd.exec:\jdpvd.exe81⤵PID:2684
-
\??\c:\5jdjj.exec:\5jdjj.exe82⤵PID:2484
-
\??\c:\xrllrxl.exec:\xrllrxl.exe83⤵PID:2720
-
\??\c:\thtbhn.exec:\thtbhn.exe84⤵PID:2620
-
\??\c:\vpjpd.exec:\vpjpd.exe85⤵PID:2616
-
\??\c:\dpjdj.exec:\dpjdj.exe86⤵
- System Location Discovery: System Language Discovery
PID:1976 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe87⤵PID:444
-
\??\c:\7nbbhn.exec:\7nbbhn.exe88⤵PID:2016
-
\??\c:\3pjvd.exec:\3pjvd.exe89⤵PID:3052
-
\??\c:\jjvpp.exec:\jjvpp.exe90⤵PID:2748
-
\??\c:\lflllrf.exec:\lflllrf.exe91⤵PID:2500
-
\??\c:\bttbhn.exec:\bttbhn.exe92⤵PID:536
-
\??\c:\vpvvd.exec:\vpvvd.exe93⤵PID:1956
-
\??\c:\dvjvv.exec:\dvjvv.exe94⤵PID:1020
-
\??\c:\frrrfff.exec:\frrrfff.exe95⤵PID:1884
-
\??\c:\9hhnbn.exec:\9hhnbn.exe96⤵PID:2252
-
\??\c:\vpdpd.exec:\vpdpd.exe97⤵PID:2012
-
\??\c:\lxrrxfr.exec:\lxrrxfr.exe98⤵PID:1304
-
\??\c:\lllxllx.exec:\lllxllx.exe99⤵PID:1692
-
\??\c:\tnbhnt.exec:\tnbhnt.exe100⤵PID:1284
-
\??\c:\1jppj.exec:\1jppj.exe101⤵PID:1684
-
\??\c:\7fxrrrr.exec:\7fxrrrr.exe102⤵PID:2264
-
\??\c:\lflxlrf.exec:\lflxlrf.exe103⤵
- System Location Discovery: System Language Discovery
PID:852 -
\??\c:\btbhtb.exec:\btbhtb.exe104⤵PID:2000
-
\??\c:\9pvpp.exec:\9pvpp.exe105⤵PID:1412
-
\??\c:\vpjpv.exec:\vpjpv.exe106⤵PID:1484
-
\??\c:\rlfrxxr.exec:\rlfrxxr.exe107⤵PID:2312
-
\??\c:\ttnttn.exec:\ttnttn.exe108⤵PID:892
-
\??\c:\pjdjv.exec:\pjdjv.exe109⤵PID:1812
-
\??\c:\frllxxr.exec:\frllxxr.exe110⤵PID:2356
-
\??\c:\7lfxxff.exec:\7lfxxff.exe111⤵PID:1888
-
\??\c:\bbthht.exec:\bbthht.exe112⤵PID:340
-
\??\c:\pvpjv.exec:\pvpjv.exe113⤵PID:2112
-
\??\c:\dvjjp.exec:\dvjjp.exe114⤵PID:2912
-
\??\c:\frlffff.exec:\frlffff.exe115⤵PID:328
-
\??\c:\nhtbht.exec:\nhtbht.exe116⤵PID:2984
-
\??\c:\jdvvp.exec:\jdvvp.exe117⤵PID:2920
-
\??\c:\vpdjp.exec:\vpdjp.exe118⤵PID:1360
-
\??\c:\7fxxflr.exec:\7fxxflr.exe119⤵PID:900
-
\??\c:\nnttbh.exec:\nnttbh.exe120⤵PID:2696
-
\??\c:\jdddp.exec:\jdddp.exe121⤵PID:2796
-
\??\c:\vpjpd.exec:\vpjpd.exe122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-