Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 07:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe
-
Size
54KB
-
MD5
c45df4ea0a871798ae849a406b09a740
-
SHA1
251f7c076c33504ba80f0f4d10cb97388a89f1e1
-
SHA256
801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492b
-
SHA512
89979745d22016cafa244dcd62d18d471c4413f3daf9375769f2db0bc817ebb94ac99ae581612d00a7ea264da3f74d8cc6a6b81715b842d439023ccddac7f22c
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJVC:0cdpeeBSHHMHLf9RyIETC
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 57 IoCs
resource yara_rule behavioral1/memory/1680-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2292-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1280-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2340-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2332-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2188-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2988-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2896-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2632-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2788-90-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2948-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1260-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2928-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2204-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2436-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2348-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-295-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2084-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2128-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2848-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2764-344-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2804-351-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2872-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1180-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/440-485-0x00000000003A0000-0x00000000003C9000-memory.dmp family_blackmoon behavioral1/memory/888-533-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2256-550-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2860-589-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-621-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1172-647-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2756-648-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1880-655-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/1880-676-0x00000000003C0000-0x00000000003E9000-memory.dmp family_blackmoon behavioral1/memory/900-682-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/900-684-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-838-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2980-864-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1960-936-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2168-992-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2168-995-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/704-1025-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1828-1044-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2892-1121-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2808-1144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2944-1181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2720-1209-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/2020-1224-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2136-1231-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1012-1278-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2292 jddvd.exe 1280 ffrxrll.exe 2408 nbnhhh.exe 2340 bttnbb.exe 2332 5djjd.exe 2988 vpppj.exe 2188 lxxllff.exe 2896 lflrrff.exe 2788 3thbbb.exe 2632 vjpjj.exe 3056 pjpdp.exe 2688 3rlffrr.exe 2948 1hthbt.exe 1260 7jpjj.exe 2872 1ddvp.exe 2928 xlxllff.exe 1752 fxxxrff.exe 1732 tntbbh.exe 2204 3nthtn.exe 2436 7vdpv.exe 2176 3rxxrrx.exe 2516 lfrrrrr.exe 1032 nhhbhb.exe 840 bnhbtn.exe 1328 jpppp.exe 2352 rrxrxxr.exe 2060 1nhhhb.exe 2368 9thbbn.exe 2672 ppvvv.exe 2416 9pdvd.exe 2348 flxlxrr.exe 2388 xlfxxrl.exe 2084 bnhhtn.exe 1940 9ntnbt.exe 2128 jddvd.exe 2816 jjjdd.exe 2552 7jpjj.exe 2848 9rlxfxr.exe 2764 rllxlff.exe 2804 5hnnnh.exe 2648 hbbtnh.exe 2812 pddvd.exe 2616 fxfrrfl.exe 2740 nttthb.exe 3064 nnttth.exe 2884 vjvvv.exe 1656 jdjjd.exe 2132 frfxxxx.exe 1960 3rlflll.exe 900 fxflfxx.exe 2872 hthhhb.exe 2920 thnbtn.exe 1664 hhbnnh.exe 1752 1vpvp.exe 2496 1ddpp.exe 1164 dvjjp.exe 1412 rlllxxf.exe 2172 rlxllxf.exe 2216 3bhhnh.exe 2548 nbnhht.exe 1180 hbnhhb.exe 440 vjpjj.exe 2228 vpppj.exe 2140 rxrlffx.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffrfrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2292 1680 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 30 PID 1680 wrote to memory of 2292 1680 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 30 PID 1680 wrote to memory of 2292 1680 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 30 PID 1680 wrote to memory of 2292 1680 801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe 30 PID 2292 wrote to memory of 1280 2292 jddvd.exe 31 PID 2292 wrote to memory of 1280 2292 jddvd.exe 31 PID 2292 wrote to memory of 1280 2292 jddvd.exe 31 PID 2292 wrote to memory of 1280 2292 jddvd.exe 31 PID 1280 wrote to memory of 2408 1280 ffrxrll.exe 32 PID 1280 wrote to memory of 2408 1280 ffrxrll.exe 32 PID 1280 wrote to memory of 2408 1280 ffrxrll.exe 32 PID 1280 wrote to memory of 2408 1280 ffrxrll.exe 32 PID 2408 wrote to memory of 2340 2408 nbnhhh.exe 33 PID 2408 wrote to memory of 2340 2408 nbnhhh.exe 33 PID 2408 wrote to memory of 2340 2408 nbnhhh.exe 33 PID 2408 wrote to memory of 2340 2408 nbnhhh.exe 33 PID 2340 wrote to memory of 2332 2340 bttnbb.exe 34 PID 2340 wrote to memory of 2332 2340 bttnbb.exe 34 PID 2340 wrote to memory of 2332 2340 bttnbb.exe 34 PID 2340 wrote to memory of 2332 2340 bttnbb.exe 34 PID 2332 wrote to memory of 2988 2332 5djjd.exe 35 PID 2332 wrote to memory of 2988 2332 5djjd.exe 35 PID 2332 wrote to memory of 2988 2332 5djjd.exe 35 PID 2332 wrote to memory of 2988 2332 5djjd.exe 35 PID 2988 wrote to memory of 2188 2988 vpppj.exe 36 PID 2988 wrote to memory of 2188 2988 vpppj.exe 36 PID 2988 wrote to memory of 2188 2988 vpppj.exe 36 PID 2988 wrote to memory of 2188 2988 vpppj.exe 36 PID 2188 wrote to memory of 2896 2188 lxxllff.exe 37 PID 2188 wrote to memory of 2896 2188 lxxllff.exe 37 PID 2188 wrote to memory of 2896 2188 lxxllff.exe 37 PID 2188 wrote to memory of 2896 2188 lxxllff.exe 37 PID 2896 wrote to memory of 2788 2896 lflrrff.exe 38 PID 2896 wrote to memory of 2788 2896 lflrrff.exe 38 PID 2896 wrote to memory of 2788 2896 lflrrff.exe 38 PID 2896 wrote to memory of 2788 2896 lflrrff.exe 38 PID 2788 wrote to memory of 2632 2788 3thbbb.exe 39 PID 2788 wrote to memory of 2632 2788 3thbbb.exe 39 PID 2788 wrote to memory of 2632 2788 3thbbb.exe 39 PID 2788 wrote to memory of 2632 2788 3thbbb.exe 39 PID 2632 wrote to memory of 3056 2632 vjpjj.exe 40 PID 2632 wrote to memory of 3056 2632 vjpjj.exe 40 PID 2632 wrote to memory of 3056 2632 vjpjj.exe 40 PID 2632 wrote to memory of 3056 2632 vjpjj.exe 40 PID 3056 wrote to memory of 2688 3056 pjpdp.exe 41 PID 3056 wrote to memory of 2688 3056 pjpdp.exe 41 PID 3056 wrote to memory of 2688 3056 pjpdp.exe 41 PID 3056 wrote to memory of 2688 3056 pjpdp.exe 41 PID 2688 wrote to memory of 2948 2688 3rlffrr.exe 42 PID 2688 wrote to memory of 2948 2688 3rlffrr.exe 42 PID 2688 wrote to memory of 2948 2688 3rlffrr.exe 42 PID 2688 wrote to memory of 2948 2688 3rlffrr.exe 42 PID 2948 wrote to memory of 1260 2948 1hthbt.exe 43 PID 2948 wrote to memory of 1260 2948 1hthbt.exe 43 PID 2948 wrote to memory of 1260 2948 1hthbt.exe 43 PID 2948 wrote to memory of 1260 2948 1hthbt.exe 43 PID 1260 wrote to memory of 2872 1260 7jpjj.exe 44 PID 1260 wrote to memory of 2872 1260 7jpjj.exe 44 PID 1260 wrote to memory of 2872 1260 7jpjj.exe 44 PID 1260 wrote to memory of 2872 1260 7jpjj.exe 44 PID 2872 wrote to memory of 2928 2872 1ddvp.exe 45 PID 2872 wrote to memory of 2928 2872 1ddvp.exe 45 PID 2872 wrote to memory of 2928 2872 1ddvp.exe 45 PID 2872 wrote to memory of 2928 2872 1ddvp.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe"C:\Users\Admin\AppData\Local\Temp\801bd9c3360c28c3bcd12653bfcd4776582de4a4e1f78678610cc41998bf492bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\jddvd.exec:\jddvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\ffrxrll.exec:\ffrxrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\nbnhhh.exec:\nbnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bttnbb.exec:\bttnbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\5djjd.exec:\5djjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\vpppj.exec:\vpppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\lxxllff.exec:\lxxllff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\lflrrff.exec:\lflrrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\3thbbb.exec:\3thbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vjpjj.exec:\vjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pjpdp.exec:\pjpdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\3rlffrr.exec:\3rlffrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\1hthbt.exec:\1hthbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\7jpjj.exec:\7jpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\1ddvp.exec:\1ddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\xlxllff.exec:\xlxllff.exe17⤵
- Executes dropped EXE
PID:2928 -
\??\c:\fxxxrff.exec:\fxxxrff.exe18⤵
- Executes dropped EXE
PID:1752 -
\??\c:\tntbbh.exec:\tntbbh.exe19⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3nthtn.exec:\3nthtn.exe20⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7vdpv.exec:\7vdpv.exe21⤵
- Executes dropped EXE
PID:2436 -
\??\c:\3rxxrrx.exec:\3rxxrrx.exe22⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\nhhbhb.exec:\nhhbhb.exe24⤵
- Executes dropped EXE
PID:1032 -
\??\c:\bnhbtn.exec:\bnhbtn.exe25⤵
- Executes dropped EXE
PID:840 -
\??\c:\jpppp.exec:\jpppp.exe26⤵
- Executes dropped EXE
PID:1328 -
\??\c:\rrxrxxr.exec:\rrxrxxr.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1nhhhb.exec:\1nhhhb.exe28⤵
- Executes dropped EXE
PID:2060 -
\??\c:\9thbbn.exec:\9thbbn.exe29⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ppvvv.exec:\ppvvv.exe30⤵
- Executes dropped EXE
PID:2672 -
\??\c:\9pdvd.exec:\9pdvd.exe31⤵
- Executes dropped EXE
PID:2416 -
\??\c:\flxlxrr.exec:\flxlxrr.exe32⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xlfxxrl.exec:\xlfxxrl.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388 -
\??\c:\bnhhtn.exec:\bnhhtn.exe34⤵
- Executes dropped EXE
PID:2084 -
\??\c:\9ntnbt.exec:\9ntnbt.exe35⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jddvd.exec:\jddvd.exe36⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jjjdd.exec:\jjjdd.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\7jpjj.exec:\7jpjj.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\9rlxfxr.exec:\9rlxfxr.exe39⤵
- Executes dropped EXE
PID:2848 -
\??\c:\rllxlff.exec:\rllxlff.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\5hnnnh.exec:\5hnnnh.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbbtnh.exec:\hbbtnh.exe42⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pddvd.exec:\pddvd.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\fxfrrfl.exec:\fxfrrfl.exe44⤵
- Executes dropped EXE
PID:2616 -
\??\c:\nttthb.exec:\nttthb.exe45⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nnttth.exec:\nnttth.exe46⤵
- Executes dropped EXE
PID:3064 -
\??\c:\vjvvv.exec:\vjvvv.exe47⤵
- Executes dropped EXE
PID:2884 -
\??\c:\jdjjd.exec:\jdjjd.exe48⤵
- Executes dropped EXE
PID:1656 -
\??\c:\frfxxxx.exec:\frfxxxx.exe49⤵
- Executes dropped EXE
PID:2132 -
\??\c:\3rlflll.exec:\3rlflll.exe50⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fxflfxx.exec:\fxflfxx.exe51⤵
- Executes dropped EXE
PID:900 -
\??\c:\hthhhb.exec:\hthhhb.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\thnbtn.exec:\thnbtn.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\hhbnnh.exec:\hhbnnh.exe54⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1vpvp.exec:\1vpvp.exe55⤵
- Executes dropped EXE
PID:1752 -
\??\c:\1ddpp.exec:\1ddpp.exe56⤵
- Executes dropped EXE
PID:2496 -
\??\c:\dvjjp.exec:\dvjjp.exe57⤵
- Executes dropped EXE
PID:1164 -
\??\c:\rlllxxf.exec:\rlllxxf.exe58⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rlxllxf.exec:\rlxllxf.exe59⤵
- Executes dropped EXE
PID:2172 -
\??\c:\3bhhnh.exec:\3bhhnh.exe60⤵
- Executes dropped EXE
PID:2216 -
\??\c:\nbnhht.exec:\nbnhht.exe61⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hbnhhb.exec:\hbnhhb.exe62⤵
- Executes dropped EXE
PID:1180 -
\??\c:\vjpjj.exec:\vjpjj.exe63⤵
- Executes dropped EXE
PID:440 -
\??\c:\vpppj.exec:\vpppj.exe64⤵
- Executes dropped EXE
PID:2228 -
\??\c:\rxrlffx.exec:\rxrlffx.exe65⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fxfxrll.exec:\fxfxrll.exe66⤵PID:1328
-
\??\c:\nnbbbt.exec:\nnbbbt.exe67⤵PID:2072
-
\??\c:\htttbt.exec:\htttbt.exe68⤵PID:2060
-
\??\c:\jdjjp.exec:\jdjjp.exe69⤵PID:2196
-
\??\c:\jdjjj.exec:\jdjjj.exe70⤵PID:888
-
\??\c:\vpvjj.exec:\vpvjj.exe71⤵PID:3044
-
\??\c:\xrlffxx.exec:\xrlffxx.exe72⤵PID:896
-
\??\c:\rfffxxx.exec:\rfffxxx.exe73⤵PID:1728
-
\??\c:\fxrllll.exec:\fxrllll.exe74⤵PID:2256
-
\??\c:\3thbtt.exec:\3thbtt.exe75⤵PID:2540
-
\??\c:\tnnbbt.exec:\tnnbbt.exe76⤵PID:1532
-
\??\c:\nhnhhb.exec:\nhnhhb.exe77⤵PID:1940
-
\??\c:\3pvjv.exec:\3pvjv.exe78⤵PID:856
-
\??\c:\jjppj.exec:\jjppj.exe79⤵PID:2860
-
\??\c:\9rfxrrr.exec:\9rfxrrr.exe80⤵PID:2724
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe81⤵PID:2748
-
\??\c:\7nbbbb.exec:\7nbbbb.exe82⤵PID:2708
-
\??\c:\hthtnn.exec:\hthtnn.exe83⤵PID:2220
-
\??\c:\thhnhh.exec:\thhnhh.exe84⤵PID:2888
-
\??\c:\vjvpj.exec:\vjvpj.exe85⤵PID:2756
-
\??\c:\1jvjd.exec:\1jvjd.exe86⤵PID:2680
-
\??\c:\5xlxrrl.exec:\5xlxrrl.exe87⤵PID:2624
-
\??\c:\lflfffr.exec:\lflfffr.exe88⤵PID:1172
-
\??\c:\nnbhtt.exec:\nnbhtt.exe89⤵PID:1880
-
\??\c:\nttbtb.exec:\nttbtb.exe90⤵PID:2932
-
\??\c:\dvddv.exec:\dvddv.exe91⤵PID:1452
-
\??\c:\5dvpj.exec:\5dvpj.exe92⤵PID:1896
-
\??\c:\rfffxxr.exec:\rfffxxr.exe93⤵PID:900
-
\??\c:\lxxxrff.exec:\lxxxrff.exe94⤵PID:2872
-
\??\c:\ntnhbt.exec:\ntnhbt.exe95⤵PID:636
-
\??\c:\dvpdv.exec:\dvpdv.exe96⤵PID:1448
-
\??\c:\dpppp.exec:\dpppp.exe97⤵PID:2208
-
\??\c:\rlrlllf.exec:\rlrlllf.exe98⤵PID:1756
-
\??\c:\fflllff.exec:\fflllff.exe99⤵PID:2112
-
\??\c:\7hhhhb.exec:\7hhhhb.exe100⤵PID:2168
-
\??\c:\bnbhhb.exec:\bnbhhb.exe101⤵PID:404
-
\??\c:\pjppd.exec:\pjppd.exe102⤵PID:2504
-
\??\c:\dpvdp.exec:\dpvdp.exe103⤵PID:2276
-
\??\c:\rflxxrx.exec:\rflxxrx.exe104⤵PID:2036
-
\??\c:\7frllff.exec:\7frllff.exe105⤵PID:840
-
\??\c:\thnhht.exec:\thnhht.exe106⤵PID:2228
-
\??\c:\hbtnnb.exec:\hbtnnb.exe107⤵PID:676
-
\??\c:\dppjd.exec:\dppjd.exe108⤵PID:1492
-
\??\c:\jvvjp.exec:\jvvjp.exe109⤵PID:2072
-
\??\c:\rlrlfrx.exec:\rlrlfrx.exe110⤵PID:2368
-
\??\c:\5lrrrxr.exec:\5lrrrxr.exe111⤵PID:1644
-
\??\c:\1nhhbn.exec:\1nhhbn.exe112⤵PID:1932
-
\??\c:\bttnhh.exec:\bttnhh.exe113⤵PID:2252
-
\??\c:\dvddv.exec:\dvddv.exe114⤵PID:1600
-
\??\c:\pdjdv.exec:\pdjdv.exe115⤵PID:2108
-
\??\c:\vjjpp.exec:\vjjpp.exe116⤵PID:1336
-
\??\c:\5xlrfff.exec:\5xlrfff.exe117⤵PID:2540
-
\??\c:\fxfxfrr.exec:\fxfxfrr.exe118⤵PID:1712
-
\??\c:\tnbttn.exec:\tnbttn.exe119⤵PID:576
-
\??\c:\btbnnb.exec:\btbnnb.exe120⤵PID:2128
-
\??\c:\pjpdv.exec:\pjpdv.exe121⤵PID:2816
-
\??\c:\5pppv.exec:\5pppv.exe122⤵PID:2980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-