Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe
-
Size
456KB
-
MD5
f8e7ad411fa002796f165e4482761939
-
SHA1
382003c45784eb416fda1bad39ca125a135fa287
-
SHA256
120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df
-
SHA512
c6337175cd7c808ef729205ffa98546f62c8ddafe03e9ef4ccfc17c70998e05d56837c6911bd02d66eefb97400858ebbc69874f6a7d3ac6f904d4483cdc67904
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRA:q7Tc2NYHUrAwfMp3CDRA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2788-1-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2812-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-42-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2528-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2572-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-78-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-83-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-89-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-98-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1824-118-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1664-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/848-181-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-190-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2304-211-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/788-220-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2444-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-247-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2320-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1744-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-329-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2528-343-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-351-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/844-359-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1328-388-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1328-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/616-396-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2340-441-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/780-451-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1732-536-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/836-664-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2812 lfxrfxf.exe 2888 jppjd.exe 2872 llflrxf.exe 2528 lxxfxxl.exe 2572 nhhhht.exe 2996 xxffrrf.exe 984 bbbbnt.exe 1940 xxfllrx.exe 2736 5hbnnt.exe 1284 xlrrfff.exe 1824 nbttnt.exe 296 vjvvj.exe 1664 nbnntt.exe 2072 9rfxxxx.exe 532 rlflrxf.exe 1256 vpvdv.exe 3060 lfxfllr.exe 848 djvvv.exe 1132 rlffflx.exe 1676 dvpvp.exe 2304 xxlrfll.exe 788 ddjdj.exe 2444 lffxflx.exe 1688 jdddj.exe 1624 lxllxff.exe 2084 vjvvj.exe 2320 rlfffxl.exe 2148 vdjjj.exe 1744 lrrxrlf.exe 3028 djvpd.exe 2788 xrrrrxf.exe 2108 5vdvp.exe 2564 nhttbb.exe 2688 5vdjp.exe 2324 xxllxxx.exe 2668 hthbhh.exe 2528 vvjpv.exe 3044 3vdvd.exe 844 ffxlrfl.exe 2328 hhbhnt.exe 2764 jdvdv.exe 2972 rfxfrlx.exe 1328 nnhnbh.exe 616 ddppd.exe 1700 7lffffl.exe 1820 nntbnh.exe 2064 pjdjp.exe 544 xlllxrf.exe 1140 nhbnnt.exe 780 1htbbn.exe 2340 pppjp.exe 2212 fxrlrrx.exe 2344 3bhnbn.exe 2248 jddvv.exe 848 lxrlrrf.exe 2376 nbnttt.exe 1980 jjvvj.exe 1076 xrllrrx.exe 2304 btnnbh.exe 2516 dvjjj.exe 1532 5jjvv.exe 1708 5xffrll.exe 1688 ttnntt.exe 2160 5vdvv.exe -
resource yara_rule behavioral1/memory/2788-1-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2812-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-59-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2572-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-79-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-78-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-89-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-99-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-98-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1284-108-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1824-118-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1664-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-181-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/788-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2444-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-247-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2320-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1744-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-329-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2528-343-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/844-359-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-374-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1328-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/544-416-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/848-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2376-472-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1076-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-536-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-537-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-613-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/836-664-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ffxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llffllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1dvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2788 wrote to memory of 2812 2788 120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe 31 PID 2788 wrote to memory of 2812 2788 120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe 31 PID 2788 wrote to memory of 2812 2788 120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe 31 PID 2788 wrote to memory of 2812 2788 120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe 31 PID 2812 wrote to memory of 2888 2812 lfxrfxf.exe 32 PID 2812 wrote to memory of 2888 2812 lfxrfxf.exe 32 PID 2812 wrote to memory of 2888 2812 lfxrfxf.exe 32 PID 2812 wrote to memory of 2888 2812 lfxrfxf.exe 32 PID 2888 wrote to memory of 2872 2888 jppjd.exe 33 PID 2888 wrote to memory of 2872 2888 jppjd.exe 33 PID 2888 wrote to memory of 2872 2888 jppjd.exe 33 PID 2888 wrote to memory of 2872 2888 jppjd.exe 33 PID 2872 wrote to memory of 2528 2872 llflrxf.exe 34 PID 2872 wrote to memory of 2528 2872 llflrxf.exe 34 PID 2872 wrote to memory of 2528 2872 llflrxf.exe 34 PID 2872 wrote to memory of 2528 2872 llflrxf.exe 34 PID 2528 wrote to memory of 2572 2528 lxxfxxl.exe 35 PID 2528 wrote to memory of 2572 2528 lxxfxxl.exe 35 PID 2528 wrote to memory of 2572 2528 lxxfxxl.exe 35 PID 2528 wrote to memory of 2572 2528 lxxfxxl.exe 35 PID 2572 wrote to memory of 2996 2572 nhhhht.exe 36 PID 2572 wrote to memory of 2996 2572 nhhhht.exe 36 PID 2572 wrote to memory of 2996 2572 nhhhht.exe 36 PID 2572 wrote to memory of 2996 2572 nhhhht.exe 36 PID 2996 wrote to memory of 984 2996 xxffrrf.exe 37 PID 2996 wrote to memory of 984 2996 xxffrrf.exe 37 PID 2996 wrote to memory of 984 2996 xxffrrf.exe 37 PID 2996 wrote to memory of 984 2996 xxffrrf.exe 37 PID 984 wrote to memory of 1940 984 bbbbnt.exe 38 PID 984 wrote to memory of 1940 984 bbbbnt.exe 38 PID 984 wrote to memory of 1940 984 bbbbnt.exe 38 PID 984 wrote to memory of 1940 984 bbbbnt.exe 38 PID 1940 wrote to memory of 2736 1940 xxfllrx.exe 39 PID 1940 wrote to memory of 2736 1940 xxfllrx.exe 39 PID 1940 wrote to memory of 2736 1940 xxfllrx.exe 39 PID 1940 wrote to memory of 2736 1940 xxfllrx.exe 39 PID 2736 wrote to memory of 1284 2736 5hbnnt.exe 40 PID 2736 wrote to memory of 1284 2736 5hbnnt.exe 40 PID 2736 wrote to memory of 1284 2736 5hbnnt.exe 40 PID 2736 wrote to memory of 1284 2736 5hbnnt.exe 40 PID 1284 wrote to memory of 1824 1284 xlrrfff.exe 41 PID 1284 wrote to memory of 1824 1284 xlrrfff.exe 41 PID 1284 wrote to memory of 1824 1284 xlrrfff.exe 41 PID 1284 wrote to memory of 1824 1284 xlrrfff.exe 41 PID 1824 wrote to memory of 296 1824 nbttnt.exe 42 PID 1824 wrote to memory of 296 1824 nbttnt.exe 42 PID 1824 wrote to memory of 296 1824 nbttnt.exe 42 PID 1824 wrote to memory of 296 1824 nbttnt.exe 42 PID 296 wrote to memory of 1664 296 vjvvj.exe 43 PID 296 wrote to memory of 1664 296 vjvvj.exe 43 PID 296 wrote to memory of 1664 296 vjvvj.exe 43 PID 296 wrote to memory of 1664 296 vjvvj.exe 43 PID 1664 wrote to memory of 2072 1664 nbnntt.exe 44 PID 1664 wrote to memory of 2072 1664 nbnntt.exe 44 PID 1664 wrote to memory of 2072 1664 nbnntt.exe 44 PID 1664 wrote to memory of 2072 1664 nbnntt.exe 44 PID 2072 wrote to memory of 532 2072 9rfxxxx.exe 45 PID 2072 wrote to memory of 532 2072 9rfxxxx.exe 45 PID 2072 wrote to memory of 532 2072 9rfxxxx.exe 45 PID 2072 wrote to memory of 532 2072 9rfxxxx.exe 45 PID 532 wrote to memory of 1256 532 rlflrxf.exe 46 PID 532 wrote to memory of 1256 532 rlflrxf.exe 46 PID 532 wrote to memory of 1256 532 rlflrxf.exe 46 PID 532 wrote to memory of 1256 532 rlflrxf.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe"C:\Users\Admin\AppData\Local\Temp\120562dc33759c490c2519815324f1404b3aa755dc709607ed9bbae2f44fa6df.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\lfxrfxf.exec:\lfxrfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jppjd.exec:\jppjd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\llflrxf.exec:\llflrxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\lxxfxxl.exec:\lxxfxxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nhhhht.exec:\nhhhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xxffrrf.exec:\xxffrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\bbbbnt.exec:\bbbbnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
\??\c:\xxfllrx.exec:\xxfllrx.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\5hbnnt.exec:\5hbnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\xlrrfff.exec:\xlrrfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\nbttnt.exec:\nbttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\vjvvj.exec:\vjvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\nbnntt.exec:\nbnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\9rfxxxx.exec:\9rfxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\rlflrxf.exec:\rlflrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\vpvdv.exec:\vpvdv.exe17⤵
- Executes dropped EXE
PID:1256 -
\??\c:\lfxfllr.exec:\lfxfllr.exe18⤵
- Executes dropped EXE
PID:3060 -
\??\c:\djvvv.exec:\djvvv.exe19⤵
- Executes dropped EXE
PID:848 -
\??\c:\rlffflx.exec:\rlffflx.exe20⤵
- Executes dropped EXE
PID:1132 -
\??\c:\dvpvp.exec:\dvpvp.exe21⤵
- Executes dropped EXE
PID:1676 -
\??\c:\xxlrfll.exec:\xxlrfll.exe22⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ddjdj.exec:\ddjdj.exe23⤵
- Executes dropped EXE
PID:788 -
\??\c:\lffxflx.exec:\lffxflx.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\jdddj.exec:\jdddj.exe25⤵
- Executes dropped EXE
PID:1688 -
\??\c:\lxllxff.exec:\lxllxff.exe26⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vjvvj.exec:\vjvvj.exe27⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rlfffxl.exec:\rlfffxl.exe28⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vdjjj.exec:\vdjjj.exe29⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lrrxrlf.exec:\lrrxrlf.exe30⤵
- Executes dropped EXE
PID:1744 -
\??\c:\djvpd.exec:\djvpd.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe32⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5vdvp.exec:\5vdvp.exe33⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nhttbb.exec:\nhttbb.exe34⤵
- Executes dropped EXE
PID:2564 -
\??\c:\5vdjp.exec:\5vdjp.exe35⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xxllxxx.exec:\xxllxxx.exe36⤵
- Executes dropped EXE
PID:2324 -
\??\c:\hthbhh.exec:\hthbhh.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\vvjpv.exec:\vvjpv.exe38⤵
- Executes dropped EXE
PID:2528 -
\??\c:\3vdvd.exec:\3vdvd.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\ffxlrfl.exec:\ffxlrfl.exe40⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhbhnt.exec:\hhbhnt.exe41⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jdvdv.exec:\jdvdv.exe42⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rfxfrlx.exec:\rfxfrlx.exe43⤵
- Executes dropped EXE
PID:2972 -
\??\c:\nnhnbh.exec:\nnhnbh.exe44⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ddppd.exec:\ddppd.exe45⤵
- Executes dropped EXE
PID:616 -
\??\c:\7lffffl.exec:\7lffffl.exe46⤵
- Executes dropped EXE
PID:1700 -
\??\c:\nntbnh.exec:\nntbnh.exe47⤵
- Executes dropped EXE
PID:1820 -
\??\c:\pjdjp.exec:\pjdjp.exe48⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlllxrf.exec:\xlllxrf.exe49⤵
- Executes dropped EXE
PID:544 -
\??\c:\nhbnnt.exec:\nhbnnt.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1140 -
\??\c:\1htbbn.exec:\1htbbn.exe51⤵
- Executes dropped EXE
PID:780 -
\??\c:\pppjp.exec:\pppjp.exe52⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxrlrrx.exec:\fxrlrrx.exe53⤵
- Executes dropped EXE
PID:2212 -
\??\c:\3bhnbn.exec:\3bhnbn.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\jddvv.exec:\jddvv.exe55⤵
- Executes dropped EXE
PID:2248 -
\??\c:\lxrlrrf.exec:\lxrlrrf.exe56⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbnttt.exec:\nbnttt.exe57⤵
- Executes dropped EXE
PID:2376 -
\??\c:\jjvvj.exec:\jjvvj.exe58⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xrllrrx.exec:\xrllrrx.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\btnnbh.exec:\btnnbh.exe60⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvjjj.exec:\dvjjj.exe61⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5jjvv.exec:\5jjvv.exe62⤵
- Executes dropped EXE
PID:1532 -
\??\c:\5xffrll.exec:\5xffrll.exe63⤵
- Executes dropped EXE
PID:1708 -
\??\c:\ttnntt.exec:\ttnntt.exe64⤵
- Executes dropped EXE
PID:1688 -
\??\c:\5vdvv.exec:\5vdvv.exe65⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jdjjv.exec:\jdjjv.exe66⤵PID:1732
-
\??\c:\9ffflll.exec:\9ffflll.exe67⤵PID:1540
-
\??\c:\bnhbhn.exec:\bnhbhn.exe68⤵PID:1920
-
\??\c:\5djjj.exec:\5djjj.exe69⤵PID:2284
-
\??\c:\jdvdp.exec:\jdvdp.exe70⤵PID:860
-
\??\c:\fxrxxrr.exec:\fxrxxrr.exe71⤵PID:3028
-
\??\c:\hbhtnn.exec:\hbhtnn.exe72⤵PID:3032
-
\??\c:\jdvdj.exec:\jdvdj.exe73⤵PID:2844
-
\??\c:\1dvjp.exec:\1dvjp.exe74⤵
- System Location Discovery: System Language Discovery
PID:2848 -
\??\c:\rffxflr.exec:\rffxflr.exe75⤵PID:2584
-
\??\c:\3htttb.exec:\3htttb.exe76⤵PID:2604
-
\??\c:\vjddp.exec:\vjddp.exe77⤵PID:2692
-
\??\c:\rlrlfff.exec:\rlrlfff.exe78⤵PID:2628
-
\??\c:\nhbbbb.exec:\nhbbbb.exe79⤵PID:2840
-
\??\c:\vpvvd.exec:\vpvvd.exe80⤵PID:3044
-
\??\c:\flllxrf.exec:\flllxrf.exe81⤵PID:1800
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe82⤵PID:2776
-
\??\c:\3nbnnt.exec:\3nbnnt.exe83⤵PID:2896
-
\??\c:\vdvjd.exec:\vdvjd.exe84⤵PID:2596
-
\??\c:\xlllxxf.exec:\xlllxxf.exe85⤵PID:836
-
\??\c:\tnnbtt.exec:\tnnbtt.exe86⤵PID:1636
-
\??\c:\5dvdd.exec:\5dvdd.exe87⤵PID:1832
-
\??\c:\lflrxfl.exec:\lflrxfl.exe88⤵PID:1700
-
\??\c:\lxfrrrr.exec:\lxfrrrr.exe89⤵PID:352
-
\??\c:\hbbnbh.exec:\hbbnbh.exe90⤵PID:776
-
\??\c:\vjjjj.exec:\vjjjj.exe91⤵PID:544
-
\??\c:\9llfflx.exec:\9llfflx.exe92⤵
- System Location Discovery: System Language Discovery
PID:2756 -
\??\c:\btnnnh.exec:\btnnnh.exe93⤵PID:532
-
\??\c:\btnntt.exec:\btnntt.exe94⤵PID:2176
-
\??\c:\pjvjv.exec:\pjvjv.exe95⤵PID:2212
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe96⤵PID:1816
-
\??\c:\bbtbnn.exec:\bbtbnn.exe97⤵PID:1436
-
\??\c:\1nntbb.exec:\1nntbb.exe98⤵PID:404
-
\??\c:\ppdjv.exec:\ppdjv.exe99⤵PID:2112
-
\??\c:\3lfxlrx.exec:\3lfxlrx.exe100⤵PID:900
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe101⤵PID:1720
-
\??\c:\nbthnt.exec:\nbthnt.exe102⤵PID:1380
-
\??\c:\pdjjp.exec:\pdjjp.exe103⤵PID:1772
-
\??\c:\5lxfrrx.exec:\5lxfrrx.exe104⤵PID:2448
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe105⤵PID:612
-
\??\c:\bthntt.exec:\bthntt.exe106⤵PID:1624
-
\??\c:\fxrlffl.exec:\fxrlffl.exe107⤵PID:2428
-
\??\c:\5fxfffl.exec:\5fxfffl.exe108⤵PID:2316
-
\??\c:\5tbbhh.exec:\5tbbhh.exe109⤵PID:2148
-
\??\c:\7dppv.exec:\7dppv.exe110⤵PID:876
-
\??\c:\xxrlxxx.exec:\xxrlxxx.exe111⤵PID:2476
-
\??\c:\nnbthh.exec:\nnbthh.exe112⤵PID:2984
-
\??\c:\tthnth.exec:\tthnth.exe113⤵PID:2796
-
\??\c:\5rlxfff.exec:\5rlxfff.exe114⤵PID:1560
-
\??\c:\flfflxr.exec:\flfflxr.exe115⤵
- System Location Discovery: System Language Discovery
PID:2404 -
\??\c:\hhttnn.exec:\hhttnn.exe116⤵PID:2672
-
\??\c:\dvjvd.exec:\dvjvd.exe117⤵PID:2688
-
\??\c:\pjvdj.exec:\pjvdj.exe118⤵PID:2552
-
\??\c:\3rxrrrr.exec:\3rxrrrr.exe119⤵PID:2692
-
\??\c:\nnhnbh.exec:\nnhnbh.exe120⤵PID:2628
-
\??\c:\pjvdj.exec:\pjvdj.exe121⤵PID:3000
-
\??\c:\ppddd.exec:\ppddd.exe122⤵PID:2280
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-