Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe
-
Size
456KB
-
MD5
6a9e548c3217770b05f5f9c5103ec070
-
SHA1
39951175ae2b79e108fd1195baa71faf0dca385a
-
SHA256
9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5
-
SHA512
da050184b29667dbaf43fd23cb13ac1fac7e3456f26b0b8867ef6a1dc42eff6aee4043894539a4cc5a8bd9254700f8e1e20994ef965ec5344e6e530f54418ed5
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRT:q7Tc2NYHUrAwfMp3CDRT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2076-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2104-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/368-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/584-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-91-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-99-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2800-111-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-107-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2284-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1496-130-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1964-132-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-177-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/3020-186-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-190-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1492-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/112-207-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/940-237-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/940-236-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/580-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-323-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1708-327-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-358-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/516-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2332-438-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-486-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1088-552-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1100-559-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1620-569-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1768-566-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2688-686-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-711-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1560 dlrjvhb.exe 2076 vltdl.exe 2104 rbrbpl.exe 368 ddhdflv.exe 584 vbfbjn.exe 2804 ffxptbr.exe 2952 lxdxjf.exe 2700 fddbpd.exe 2732 rjftbxf.exe 2800 hbrfnxn.exe 2284 nvhbxjj.exe 1496 ftvdnrj.exe 1964 xfrnbl.exe 1644 trtppll.exe 1080 vdvtd.exe 1488 hlnddjf.exe 2776 tlpfb.exe 3020 tjprp.exe 2268 vvrfrt.exe 112 ntnfvln.exe 1492 rljnhvf.exe 2124 dvnlhfv.exe 940 fjnvrrf.exe 968 btjxjhr.exe 2088 pftdtnv.exe 296 dtdjl.exe 580 pfxxf.exe 2272 drffrb.exe 1896 dllhvd.exe 2172 nvrbt.exe 2444 xpbbld.exe 2616 hdnnxrp.exe 2580 fjthf.exe 1708 vnvpbpl.exe 536 pbbtvfl.exe 2964 pvlhfp.exe 2532 xbjvtr.exe 2808 fdddbv.exe 516 jvjbtj.exe 2796 tbpbvhl.exe 3036 pvltrnl.exe 2896 hvnnt.exe 2700 dddvdbj.exe 2688 tvlvx.exe 2192 hfvxp.exe 1832 bpjnn.exe 1200 ttjxxx.exe 2644 ndbnp.exe 1496 vplpxp.exe 2332 vhppf.exe 1956 jbflb.exe 2020 lpbnt.exe 2988 nhnvth.exe 2288 trppnb.exe 3012 rfbjbvd.exe 2420 njtrt.exe 2252 nfbfhbj.exe 2268 bpxnfvb.exe 1652 nrdrtth.exe 108 hlnhvhf.exe 1492 hbtbfl.exe 1788 tfdbxx.exe 1616 htnjr.exe 1324 vhbdnxr.exe -
resource yara_rule behavioral1/memory/2240-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1560-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2076-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2104-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/368-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/584-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-91-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1496-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1964-132-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-186-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-190-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1492-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/112-207-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/940-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-249-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-296-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1708-327-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-351-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/516-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-421-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2332-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-486-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1088-552-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-569-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-686-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jbflb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lphnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjdlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfvthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntjrlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nvjfldv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvvbnpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhvxv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btjxjhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nlrpn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdldfvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdbhln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbrfvn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bxbbfd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrtp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnptb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrddbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drjbr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jhjnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dltnnjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rhflhv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bphnllh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbfhnnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dhxfrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntjbx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhbjbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htdhjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnbdxvl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trppnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pbrvvnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvlbpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfjrfnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ftrlt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrdrvfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fvlrvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfnxnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjnvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fddbpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrjf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfbfpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxvnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvfjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jxddpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpnlxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvprl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1560 2240 9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe 30 PID 2240 wrote to memory of 1560 2240 9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe 30 PID 2240 wrote to memory of 1560 2240 9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe 30 PID 2240 wrote to memory of 1560 2240 9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe 30 PID 1560 wrote to memory of 2076 1560 dlrjvhb.exe 31 PID 1560 wrote to memory of 2076 1560 dlrjvhb.exe 31 PID 1560 wrote to memory of 2076 1560 dlrjvhb.exe 31 PID 1560 wrote to memory of 2076 1560 dlrjvhb.exe 31 PID 2076 wrote to memory of 2104 2076 vltdl.exe 32 PID 2076 wrote to memory of 2104 2076 vltdl.exe 32 PID 2076 wrote to memory of 2104 2076 vltdl.exe 32 PID 2076 wrote to memory of 2104 2076 vltdl.exe 32 PID 2104 wrote to memory of 368 2104 rbrbpl.exe 33 PID 2104 wrote to memory of 368 2104 rbrbpl.exe 33 PID 2104 wrote to memory of 368 2104 rbrbpl.exe 33 PID 2104 wrote to memory of 368 2104 rbrbpl.exe 33 PID 368 wrote to memory of 584 368 ddhdflv.exe 34 PID 368 wrote to memory of 584 368 ddhdflv.exe 34 PID 368 wrote to memory of 584 368 ddhdflv.exe 34 PID 368 wrote to memory of 584 368 ddhdflv.exe 34 PID 584 wrote to memory of 2804 584 vbfbjn.exe 35 PID 584 wrote to memory of 2804 584 vbfbjn.exe 35 PID 584 wrote to memory of 2804 584 vbfbjn.exe 35 PID 584 wrote to memory of 2804 584 vbfbjn.exe 35 PID 2804 wrote to memory of 2952 2804 ffxptbr.exe 36 PID 2804 wrote to memory of 2952 2804 ffxptbr.exe 36 PID 2804 wrote to memory of 2952 2804 ffxptbr.exe 36 PID 2804 wrote to memory of 2952 2804 ffxptbr.exe 36 PID 2952 wrote to memory of 2700 2952 lxdxjf.exe 37 PID 2952 wrote to memory of 2700 2952 lxdxjf.exe 37 PID 2952 wrote to memory of 2700 2952 lxdxjf.exe 37 PID 2952 wrote to memory of 2700 2952 lxdxjf.exe 37 PID 2700 wrote to memory of 2732 2700 fddbpd.exe 38 PID 2700 wrote to memory of 2732 2700 fddbpd.exe 38 PID 2700 wrote to memory of 2732 2700 fddbpd.exe 38 PID 2700 wrote to memory of 2732 2700 fddbpd.exe 38 PID 2732 wrote to memory of 2800 2732 rjftbxf.exe 39 PID 2732 wrote to memory of 2800 2732 rjftbxf.exe 39 PID 2732 wrote to memory of 2800 2732 rjftbxf.exe 39 PID 2732 wrote to memory of 2800 2732 rjftbxf.exe 39 PID 2800 wrote to memory of 2284 2800 hbrfnxn.exe 40 PID 2800 wrote to memory of 2284 2800 hbrfnxn.exe 40 PID 2800 wrote to memory of 2284 2800 hbrfnxn.exe 40 PID 2800 wrote to memory of 2284 2800 hbrfnxn.exe 40 PID 2284 wrote to memory of 1496 2284 nvhbxjj.exe 41 PID 2284 wrote to memory of 1496 2284 nvhbxjj.exe 41 PID 2284 wrote to memory of 1496 2284 nvhbxjj.exe 41 PID 2284 wrote to memory of 1496 2284 nvhbxjj.exe 41 PID 1496 wrote to memory of 1964 1496 ftvdnrj.exe 42 PID 1496 wrote to memory of 1964 1496 ftvdnrj.exe 42 PID 1496 wrote to memory of 1964 1496 ftvdnrj.exe 42 PID 1496 wrote to memory of 1964 1496 ftvdnrj.exe 42 PID 1964 wrote to memory of 1644 1964 xfrnbl.exe 43 PID 1964 wrote to memory of 1644 1964 xfrnbl.exe 43 PID 1964 wrote to memory of 1644 1964 xfrnbl.exe 43 PID 1964 wrote to memory of 1644 1964 xfrnbl.exe 43 PID 1644 wrote to memory of 1080 1644 trtppll.exe 44 PID 1644 wrote to memory of 1080 1644 trtppll.exe 44 PID 1644 wrote to memory of 1080 1644 trtppll.exe 44 PID 1644 wrote to memory of 1080 1644 trtppll.exe 44 PID 1080 wrote to memory of 1488 1080 vdvtd.exe 45 PID 1080 wrote to memory of 1488 1080 vdvtd.exe 45 PID 1080 wrote to memory of 1488 1080 vdvtd.exe 45 PID 1080 wrote to memory of 1488 1080 vdvtd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe"C:\Users\Admin\AppData\Local\Temp\9794268a109c37dc44b5603470b0cc03d539c62a49b0a25497382ec972231ca5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\dlrjvhb.exec:\dlrjvhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\vltdl.exec:\vltdl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\rbrbpl.exec:\rbrbpl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\ddhdflv.exec:\ddhdflv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\vbfbjn.exec:\vbfbjn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
\??\c:\ffxptbr.exec:\ffxptbr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lxdxjf.exec:\lxdxjf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\fddbpd.exec:\fddbpd.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rjftbxf.exec:\rjftbxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\hbrfnxn.exec:\hbrfnxn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nvhbxjj.exec:\nvhbxjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\ftvdnrj.exec:\ftvdnrj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\xfrnbl.exec:\xfrnbl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\trtppll.exec:\trtppll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\vdvtd.exec:\vdvtd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\hlnddjf.exec:\hlnddjf.exe17⤵
- Executes dropped EXE
PID:1488 -
\??\c:\tlpfb.exec:\tlpfb.exe18⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tjprp.exec:\tjprp.exe19⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvrfrt.exec:\vvrfrt.exe20⤵
- Executes dropped EXE
PID:2268 -
\??\c:\ntnfvln.exec:\ntnfvln.exe21⤵
- Executes dropped EXE
PID:112 -
\??\c:\rljnhvf.exec:\rljnhvf.exe22⤵
- Executes dropped EXE
PID:1492 -
\??\c:\dvnlhfv.exec:\dvnlhfv.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fjnvrrf.exec:\fjnvrrf.exe24⤵
- Executes dropped EXE
PID:940 -
\??\c:\btjxjhr.exec:\btjxjhr.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968 -
\??\c:\pftdtnv.exec:\pftdtnv.exe26⤵
- Executes dropped EXE
PID:2088 -
\??\c:\dtdjl.exec:\dtdjl.exe27⤵
- Executes dropped EXE
PID:296 -
\??\c:\pfxxf.exec:\pfxxf.exe28⤵
- Executes dropped EXE
PID:580 -
\??\c:\drffrb.exec:\drffrb.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dllhvd.exec:\dllhvd.exe30⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nvrbt.exec:\nvrbt.exe31⤵
- Executes dropped EXE
PID:2172 -
\??\c:\xpbbld.exec:\xpbbld.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hdnnxrp.exec:\hdnnxrp.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\fjthf.exec:\fjthf.exe34⤵
- Executes dropped EXE
PID:2580 -
\??\c:\vnvpbpl.exec:\vnvpbpl.exe35⤵
- Executes dropped EXE
PID:1708 -
\??\c:\pbbtvfl.exec:\pbbtvfl.exe36⤵
- Executes dropped EXE
PID:536 -
\??\c:\pvlhfp.exec:\pvlhfp.exe37⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xbjvtr.exec:\xbjvtr.exe38⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fdddbv.exec:\fdddbv.exe39⤵
- Executes dropped EXE
PID:2808 -
\??\c:\jvjbtj.exec:\jvjbtj.exe40⤵
- Executes dropped EXE
PID:516 -
\??\c:\tbpbvhl.exec:\tbpbvhl.exe41⤵
- Executes dropped EXE
PID:2796 -
\??\c:\pvltrnl.exec:\pvltrnl.exe42⤵
- Executes dropped EXE
PID:3036 -
\??\c:\hvnnt.exec:\hvnnt.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dddvdbj.exec:\dddvdbj.exe44⤵
- Executes dropped EXE
PID:2700 -
\??\c:\tvlvx.exec:\tvlvx.exe45⤵
- Executes dropped EXE
PID:2688 -
\??\c:\hfvxp.exec:\hfvxp.exe46⤵
- Executes dropped EXE
PID:2192 -
\??\c:\bpjnn.exec:\bpjnn.exe47⤵
- Executes dropped EXE
PID:1832 -
\??\c:\ttjxxx.exec:\ttjxxx.exe48⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ndbnp.exec:\ndbnp.exe49⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vplpxp.exec:\vplpxp.exe50⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vhppf.exec:\vhppf.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\jbflb.exec:\jbflb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1956 -
\??\c:\lpbnt.exec:\lpbnt.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nhnvth.exec:\nhnvth.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\trppnb.exec:\trppnb.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2288 -
\??\c:\rfbjbvd.exec:\rfbjbvd.exe56⤵
- Executes dropped EXE
PID:3012 -
\??\c:\njtrt.exec:\njtrt.exe57⤵
- Executes dropped EXE
PID:2420 -
\??\c:\nfbfhbj.exec:\nfbfhbj.exe58⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bpxnfvb.exec:\bpxnfvb.exe59⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nrdrtth.exec:\nrdrtth.exe60⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hlnhvhf.exec:\hlnhvhf.exe61⤵
- Executes dropped EXE
PID:108 -
\??\c:\hbtbfl.exec:\hbtbfl.exe62⤵
- Executes dropped EXE
PID:1492 -
\??\c:\tfdbxx.exec:\tfdbxx.exe63⤵
- Executes dropped EXE
PID:1788 -
\??\c:\htnjr.exec:\htnjr.exe64⤵
- Executes dropped EXE
PID:1616 -
\??\c:\vhbdnxr.exec:\vhbdnxr.exe65⤵
- Executes dropped EXE
PID:1324 -
\??\c:\nhlpt.exec:\nhlpt.exe66⤵PID:1828
-
\??\c:\lffvhfv.exec:\lffvhfv.exe67⤵PID:908
-
\??\c:\dlrrvj.exec:\dlrrvj.exe68⤵PID:1088
-
\??\c:\ttbvptd.exec:\ttbvptd.exe69⤵PID:1100
-
\??\c:\pnlnd.exec:\pnlnd.exe70⤵PID:1768
-
\??\c:\djlfj.exec:\djlfj.exe71⤵PID:1620
-
\??\c:\drhjt.exec:\drhjt.exe72⤵PID:1016
-
\??\c:\vhjpj.exec:\vhjpj.exe73⤵PID:2172
-
\??\c:\fltrdhx.exec:\fltrdhx.exe74⤵PID:2612
-
\??\c:\nblht.exec:\nblht.exe75⤵PID:2308
-
\??\c:\lxnvjh.exec:\lxnvjh.exe76⤵PID:1560
-
\??\c:\vxdtx.exec:\vxdtx.exe77⤵PID:2372
-
\??\c:\bhpftjx.exec:\bhpftjx.exe78⤵PID:2104
-
\??\c:\blphfr.exec:\blphfr.exe79⤵PID:536
-
\??\c:\nptjfbn.exec:\nptjfbn.exe80⤵PID:2964
-
\??\c:\nblbr.exec:\nblbr.exe81⤵PID:2880
-
\??\c:\lfddljt.exec:\lfddljt.exe82⤵PID:2812
-
\??\c:\llrntv.exec:\llrntv.exe83⤵PID:516
-
\??\c:\bbtjf.exec:\bbtjf.exe84⤵PID:2796
-
\??\c:\nvhhfhp.exec:\nvhhfhp.exe85⤵PID:3036
-
\??\c:\thfxdv.exec:\thfxdv.exe86⤵PID:2856
-
\??\c:\phlbnpv.exec:\phlbnpv.exe87⤵PID:2792
-
\??\c:\dnhjx.exec:\dnhjx.exe88⤵PID:2688
-
\??\c:\drpxbv.exec:\drpxbv.exe89⤵PID:524
-
\??\c:\rdhdjbv.exec:\rdhdjbv.exe90⤵PID:3016
-
\??\c:\jhxntd.exec:\jhxntd.exe91⤵PID:2972
-
\??\c:\fxbfr.exec:\fxbfr.exe92⤵PID:2980
-
\??\c:\txhpvpv.exec:\txhpvpv.exe93⤵PID:1948
-
\??\c:\ldntjrr.exec:\ldntjrr.exe94⤵PID:2576
-
\??\c:\tdhhfvj.exec:\tdhhfvj.exe95⤵PID:1636
-
\??\c:\xdrnr.exec:\xdrnr.exe96⤵PID:2008
-
\??\c:\vtxjx.exec:\vtxjx.exe97⤵PID:1972
-
\??\c:\bnbrjv.exec:\bnbrjv.exe98⤵PID:3028
-
\??\c:\vlvfpf.exec:\vlvfpf.exe99⤵PID:2052
-
\??\c:\vpbbfl.exec:\vpbbfl.exe100⤵PID:2420
-
\??\c:\jlvnjhd.exec:\jlvnjhd.exe101⤵PID:676
-
\??\c:\jvrrrf.exec:\jvrrrf.exe102⤵PID:1380
-
\??\c:\hphxtx.exec:\hphxtx.exe103⤵PID:1796
-
\??\c:\vdfbpt.exec:\vdfbpt.exe104⤵PID:2772
-
\??\c:\nvbrfr.exec:\nvbrfr.exe105⤵PID:960
-
\??\c:\lphnp.exec:\lphnp.exe106⤵
- System Location Discovery: System Language Discovery
PID:1552 -
\??\c:\jtlbpjd.exec:\jtlbpjd.exe107⤵PID:744
-
\??\c:\rfbxbbd.exec:\rfbxbbd.exe108⤵PID:1732
-
\??\c:\rxbbnj.exec:\rxbbnj.exe109⤵PID:1148
-
\??\c:\bdrlxlh.exec:\bdrlxlh.exe110⤵PID:2088
-
\??\c:\jhfdr.exec:\jhfdr.exe111⤵PID:296
-
\??\c:\fvlrvj.exec:\fvlrvj.exe112⤵
- System Location Discovery: System Language Discovery
PID:2540 -
\??\c:\nftdpvp.exec:\nftdpvp.exe113⤵PID:3060
-
\??\c:\dvftfhr.exec:\dvftfhr.exe114⤵PID:2508
-
\??\c:\bjhdjx.exec:\bjhdjx.exe115⤵PID:1720
-
\??\c:\hhtnjhl.exec:\hhtnjhl.exe116⤵PID:2240
-
\??\c:\xpbdbvp.exec:\xpbdbvp.exe117⤵PID:2188
-
\??\c:\bbbjxb.exec:\bbbjxb.exe118⤵PID:2404
-
\??\c:\hflxxr.exec:\hflxxr.exe119⤵PID:1688
-
\??\c:\dddrv.exec:\dddrv.exe120⤵PID:2580
-
\??\c:\vnphnr.exec:\vnphnr.exe121⤵PID:2600
-
\??\c:\hplvfb.exec:\hplvfb.exe122⤵PID:2108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-