Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 14:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe
-
Size
453KB
-
MD5
1e403071c2eff357e098a7f46a91e7f0
-
SHA1
70ac0d6363bd3c2cac84d21911c88d8201fc03b8
-
SHA256
cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363
-
SHA512
ef410aef1bc9a2aa37e803ad25cdbd7775a422c5380ea625bda7aa52a0cc38f39b50222b17b385b9c816eee359a4fa355464e454e34fe54908cd52dfee1e3b90
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe/:q7Tc2NYHUrAwfMp3CD/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2892-0-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2268-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-63-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2652-72-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/776-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/776-87-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2220-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2896-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1776-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/624-196-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2172-209-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-281-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1040-282-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1508-291-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2064-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2744-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1976-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-385-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1264-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2488-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-445-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2300-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-666-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1576-668-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1412-681-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/624-771-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2160-812-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2192-810-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2268 xffxxrl.exe 2820 bbtbnh.exe 2148 tnbntt.exe 2740 vvjpd.exe 2600 ttbhnt.exe 2692 rfrrllr.exe 2652 tnbtbb.exe 2388 vpddj.exe 776 tthhtb.exe 2220 vjvdp.exe 2488 btbntt.exe 2960 vvppd.exe 2896 9thnbh.exe 2564 jdpjj.exe 2904 5hbbhn.exe 3068 vjvdj.exe 2396 hnbntb.exe 1776 jdvvd.exe 1160 nnhnbt.exe 2152 7dvvj.exe 624 3bhhnh.exe 2172 jdddp.exe 1324 nhbbbb.exe 1624 pjvpv.exe 1556 nbnntt.exe 1124 ppjpv.exe 2360 9bbhtt.exe 2372 pdjpp.exe 1804 hhnnbh.exe 1040 5jjpp.exe 1508 xlxxxfr.exe 3052 5dvpd.exe 2308 bthhnt.exe 2064 vddpv.exe 3008 jdvjp.exe 2856 5xrlrrx.exe 2832 ttnhnb.exe 2852 dvppd.exe 2744 pjvdv.exe 2572 xlxxxrx.exe 1976 tntnbh.exe 2076 vvpdj.exe 2796 3xlfffl.exe 2068 rlfrffl.exe 2124 htnntt.exe 1264 jdvdv.exe 2488 lfllrlx.exe 2768 rlfxllr.exe 1656 9bhhhn.exe 2332 3jppv.exe 1208 5fxxfxl.exe 2256 nbhntb.exe 1612 hhbhnb.exe 680 dvdjp.exe 1488 7lllllx.exe 604 hbthnn.exe 2156 3ddjv.exe 1048 vvppd.exe 444 9xfflll.exe 2276 bthhbh.exe 2404 9dpjj.exe 2060 fxxfflr.exe 1324 fxrrxfl.exe 1372 hthbhh.exe -
resource yara_rule behavioral1/memory/2892-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2268-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-25-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2740-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-63-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2652-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/776-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2220-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-111-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2896-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1776-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2152-184-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/624-196-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-209-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1040-282-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1508-291-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2064-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2744-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2796-369-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-385-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1264-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2488-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-438-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-445-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-591-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2300-597-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2600-626-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-668-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-798-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2192-810-0x0000000000220000-0x000000000024A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2892 wrote to memory of 2268 2892 cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe 30 PID 2892 wrote to memory of 2268 2892 cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe 30 PID 2892 wrote to memory of 2268 2892 cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe 30 PID 2892 wrote to memory of 2268 2892 cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe 30 PID 2268 wrote to memory of 2820 2268 xffxxrl.exe 31 PID 2268 wrote to memory of 2820 2268 xffxxrl.exe 31 PID 2268 wrote to memory of 2820 2268 xffxxrl.exe 31 PID 2268 wrote to memory of 2820 2268 xffxxrl.exe 31 PID 2820 wrote to memory of 2148 2820 bbtbnh.exe 32 PID 2820 wrote to memory of 2148 2820 bbtbnh.exe 32 PID 2820 wrote to memory of 2148 2820 bbtbnh.exe 32 PID 2820 wrote to memory of 2148 2820 bbtbnh.exe 32 PID 2148 wrote to memory of 2740 2148 tnbntt.exe 33 PID 2148 wrote to memory of 2740 2148 tnbntt.exe 33 PID 2148 wrote to memory of 2740 2148 tnbntt.exe 33 PID 2148 wrote to memory of 2740 2148 tnbntt.exe 33 PID 2740 wrote to memory of 2600 2740 vvjpd.exe 34 PID 2740 wrote to memory of 2600 2740 vvjpd.exe 34 PID 2740 wrote to memory of 2600 2740 vvjpd.exe 34 PID 2740 wrote to memory of 2600 2740 vvjpd.exe 34 PID 2600 wrote to memory of 2692 2600 ttbhnt.exe 35 PID 2600 wrote to memory of 2692 2600 ttbhnt.exe 35 PID 2600 wrote to memory of 2692 2600 ttbhnt.exe 35 PID 2600 wrote to memory of 2692 2600 ttbhnt.exe 35 PID 2692 wrote to memory of 2652 2692 rfrrllr.exe 36 PID 2692 wrote to memory of 2652 2692 rfrrllr.exe 36 PID 2692 wrote to memory of 2652 2692 rfrrllr.exe 36 PID 2692 wrote to memory of 2652 2692 rfrrllr.exe 36 PID 2652 wrote to memory of 2388 2652 tnbtbb.exe 37 PID 2652 wrote to memory of 2388 2652 tnbtbb.exe 37 PID 2652 wrote to memory of 2388 2652 tnbtbb.exe 37 PID 2652 wrote to memory of 2388 2652 tnbtbb.exe 37 PID 2388 wrote to memory of 776 2388 vpddj.exe 38 PID 2388 wrote to memory of 776 2388 vpddj.exe 38 PID 2388 wrote to memory of 776 2388 vpddj.exe 38 PID 2388 wrote to memory of 776 2388 vpddj.exe 38 PID 776 wrote to memory of 2220 776 tthhtb.exe 39 PID 776 wrote to memory of 2220 776 tthhtb.exe 39 PID 776 wrote to memory of 2220 776 tthhtb.exe 39 PID 776 wrote to memory of 2220 776 tthhtb.exe 39 PID 2220 wrote to memory of 2488 2220 vjvdp.exe 40 PID 2220 wrote to memory of 2488 2220 vjvdp.exe 40 PID 2220 wrote to memory of 2488 2220 vjvdp.exe 40 PID 2220 wrote to memory of 2488 2220 vjvdp.exe 40 PID 2488 wrote to memory of 2960 2488 btbntt.exe 41 PID 2488 wrote to memory of 2960 2488 btbntt.exe 41 PID 2488 wrote to memory of 2960 2488 btbntt.exe 41 PID 2488 wrote to memory of 2960 2488 btbntt.exe 41 PID 2960 wrote to memory of 2896 2960 vvppd.exe 42 PID 2960 wrote to memory of 2896 2960 vvppd.exe 42 PID 2960 wrote to memory of 2896 2960 vvppd.exe 42 PID 2960 wrote to memory of 2896 2960 vvppd.exe 42 PID 2896 wrote to memory of 2564 2896 9thnbh.exe 43 PID 2896 wrote to memory of 2564 2896 9thnbh.exe 43 PID 2896 wrote to memory of 2564 2896 9thnbh.exe 43 PID 2896 wrote to memory of 2564 2896 9thnbh.exe 43 PID 2564 wrote to memory of 2904 2564 jdpjj.exe 44 PID 2564 wrote to memory of 2904 2564 jdpjj.exe 44 PID 2564 wrote to memory of 2904 2564 jdpjj.exe 44 PID 2564 wrote to memory of 2904 2564 jdpjj.exe 44 PID 2904 wrote to memory of 3068 2904 5hbbhn.exe 45 PID 2904 wrote to memory of 3068 2904 5hbbhn.exe 45 PID 2904 wrote to memory of 3068 2904 5hbbhn.exe 45 PID 2904 wrote to memory of 3068 2904 5hbbhn.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe"C:\Users\Admin\AppData\Local\Temp\cc7983bda85e28918b7a6e4cc7a876f3a1537cc5fa6078027ac53ad0623ad363N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\xffxxrl.exec:\xffxxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\bbtbnh.exec:\bbtbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\tnbntt.exec:\tnbntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vvjpd.exec:\vvjpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ttbhnt.exec:\ttbhnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\rfrrllr.exec:\rfrrllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\tnbtbb.exec:\tnbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\vpddj.exec:\vpddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\tthhtb.exec:\tthhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\vjvdp.exec:\vjvdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\btbntt.exec:\btbntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\vvppd.exec:\vvppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\9thnbh.exec:\9thnbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\jdpjj.exec:\jdpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\5hbbhn.exec:\5hbbhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\vjvdj.exec:\vjvdj.exe17⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hnbntb.exec:\hnbntb.exe18⤵
- Executes dropped EXE
PID:2396 -
\??\c:\jdvvd.exec:\jdvvd.exe19⤵
- Executes dropped EXE
PID:1776 -
\??\c:\nnhnbt.exec:\nnhnbt.exe20⤵
- Executes dropped EXE
PID:1160 -
\??\c:\7dvvj.exec:\7dvvj.exe21⤵
- Executes dropped EXE
PID:2152 -
\??\c:\3bhhnh.exec:\3bhhnh.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:624 -
\??\c:\jdddp.exec:\jdddp.exe23⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nhbbbb.exec:\nhbbbb.exe24⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjvpv.exec:\pjvpv.exe25⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nbnntt.exec:\nbnntt.exe26⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ppjpv.exec:\ppjpv.exe27⤵
- Executes dropped EXE
PID:1124 -
\??\c:\9bbhtt.exec:\9bbhtt.exe28⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pdjpp.exec:\pdjpp.exe29⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hhnnbh.exec:\hhnnbh.exe30⤵
- Executes dropped EXE
PID:1804 -
\??\c:\5jjpp.exec:\5jjpp.exe31⤵
- Executes dropped EXE
PID:1040 -
\??\c:\xlxxxfr.exec:\xlxxxfr.exe32⤵
- Executes dropped EXE
PID:1508 -
\??\c:\5dvpd.exec:\5dvpd.exe33⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bthhnt.exec:\bthhnt.exe34⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vddpv.exec:\vddpv.exe35⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdvjp.exec:\jdvjp.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\5xrlrrx.exec:\5xrlrrx.exe37⤵
- Executes dropped EXE
PID:2856 -
\??\c:\ttnhnb.exec:\ttnhnb.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvppd.exec:\dvppd.exe39⤵
- Executes dropped EXE
PID:2852 -
\??\c:\pjvdv.exec:\pjvdv.exe40⤵
- Executes dropped EXE
PID:2744 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe41⤵
- Executes dropped EXE
PID:2572 -
\??\c:\tntnbh.exec:\tntnbh.exe42⤵
- Executes dropped EXE
PID:1976 -
\??\c:\vvpdj.exec:\vvpdj.exe43⤵
- Executes dropped EXE
PID:2076 -
\??\c:\3xlfffl.exec:\3xlfffl.exe44⤵
- Executes dropped EXE
PID:2796 -
\??\c:\rlfrffl.exec:\rlfrffl.exe45⤵
- Executes dropped EXE
PID:2068 -
\??\c:\htnntt.exec:\htnntt.exe46⤵
- Executes dropped EXE
PID:2124 -
\??\c:\jdvdv.exec:\jdvdv.exe47⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lfllrlx.exec:\lfllrlx.exe48⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rlfxllr.exec:\rlfxllr.exe49⤵
- Executes dropped EXE
PID:2768 -
\??\c:\9bhhhn.exec:\9bhhhn.exe50⤵
- Executes dropped EXE
PID:1656 -
\??\c:\3jppv.exec:\3jppv.exe51⤵
- Executes dropped EXE
PID:2332 -
\??\c:\5fxxfxl.exec:\5fxxfxl.exe52⤵
- Executes dropped EXE
PID:1208 -
\??\c:\nbhntb.exec:\nbhntb.exe53⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hhbhnb.exec:\hhbhnb.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\dvdjp.exec:\dvdjp.exe55⤵
- Executes dropped EXE
PID:680 -
\??\c:\7lllllx.exec:\7lllllx.exe56⤵
- Executes dropped EXE
PID:1488 -
\??\c:\hbthnn.exec:\hbthnn.exe57⤵
- Executes dropped EXE
PID:604 -
\??\c:\3ddjv.exec:\3ddjv.exe58⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvppd.exec:\vvppd.exe59⤵
- Executes dropped EXE
PID:1048 -
\??\c:\9xfflll.exec:\9xfflll.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\bthhbh.exec:\bthhbh.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\9dpjj.exec:\9dpjj.exe62⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fxxfflr.exec:\fxxfflr.exe63⤵
- Executes dropped EXE
PID:2060 -
\??\c:\fxrrxfl.exec:\fxrrxfl.exe64⤵
- Executes dropped EXE
PID:1324 -
\??\c:\hthbhh.exec:\hthbhh.exe65⤵
- Executes dropped EXE
PID:1372 -
\??\c:\pdvdj.exec:\pdvdj.exe66⤵PID:1288
-
\??\c:\3lxfffl.exec:\3lxfffl.exe67⤵PID:2364
-
\??\c:\9frxrrx.exec:\9frxrrx.exe68⤵PID:532
-
\??\c:\tnhnnb.exec:\tnhnnb.exe69⤵PID:2320
-
\??\c:\pppvd.exec:\pppvd.exe70⤵PID:576
-
\??\c:\vpjpv.exec:\vpjpv.exe71⤵PID:1848
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe72⤵PID:1688
-
\??\c:\7nhntt.exec:\7nhntt.exe73⤵PID:1512
-
\??\c:\3vjpj.exec:\3vjpj.exe74⤵PID:1508
-
\??\c:\jjdpv.exec:\jjdpv.exe75⤵PID:2724
-
\??\c:\fxffrlr.exec:\fxffrlr.exe76⤵PID:2880
-
\??\c:\hhbtht.exec:\hhbtht.exe77⤵PID:2300
-
\??\c:\jjjjd.exec:\jjjjd.exe78⤵PID:2840
-
\??\c:\ddddp.exec:\ddddp.exe79⤵PID:2712
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe80⤵PID:2888
-
\??\c:\9hbthb.exec:\9hbthb.exe81⤵PID:2716
-
\??\c:\ppjvj.exec:\ppjvj.exe82⤵PID:2600
-
\??\c:\vpdjp.exec:\vpdjp.exe83⤵PID:2656
-
\??\c:\fxffllf.exec:\fxffllf.exe84⤵PID:2628
-
\??\c:\bttntn.exec:\bttntn.exe85⤵PID:1212
-
\??\c:\bnbbnn.exec:\bnbbnn.exe86⤵PID:2236
-
\??\c:\jjvdj.exec:\jjvdj.exe87⤵PID:1844
-
\??\c:\5fllllx.exec:\5fllllx.exe88⤵PID:1576
-
\??\c:\5xlrrxx.exec:\5xlrrxx.exe89⤵PID:1412
-
\??\c:\nhbhtt.exec:\nhbhtt.exe90⤵PID:1336
-
\??\c:\dvjjv.exec:\dvjjv.exe91⤵PID:2916
-
\??\c:\lflrlxf.exec:\lflrlxf.exe92⤵PID:2900
-
\??\c:\3rllllx.exec:\3rllllx.exe93⤵PID:1656
-
\??\c:\tthnnb.exec:\tthnnb.exe94⤵PID:2128
-
\??\c:\jjpjp.exec:\jjpjp.exe95⤵PID:2920
-
\??\c:\rlxfrxf.exec:\rlxfrxf.exe96⤵PID:1756
-
\??\c:\xlxfrrx.exec:\xlxfrrx.exe97⤵PID:1524
-
\??\c:\nbbbhn.exec:\nbbbhn.exe98⤵PID:680
-
\??\c:\jppjp.exec:\jppjp.exe99⤵PID:1356
-
\??\c:\3rllxrx.exec:\3rllxrx.exe100⤵PID:1344
-
\??\c:\lffxlrf.exec:\lffxlrf.exe101⤵PID:2156
-
\??\c:\7bhttb.exec:\7bhttb.exe102⤵PID:2296
-
\??\c:\7dppd.exec:\7dppd.exe103⤵PID:624
-
\??\c:\ppjjv.exec:\ppjjv.exe104⤵PID:1884
-
\??\c:\rlxfxrf.exec:\rlxfxrf.exe105⤵PID:1852
-
\??\c:\hbtbhh.exec:\hbtbhh.exe106⤵PID:2160
-
\??\c:\ddvjj.exec:\ddvjj.exe107⤵PID:1624
-
\??\c:\7xrfxlf.exec:\7xrfxlf.exe108⤵PID:1180
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe109⤵PID:2192
-
\??\c:\9nnntt.exec:\9nnntt.exe110⤵PID:3044
-
\??\c:\vjdjp.exec:\vjdjp.exe111⤵PID:1748
-
\??\c:\pvpjv.exec:\pvpjv.exe112⤵PID:2372
-
\??\c:\fxrflrx.exec:\fxrflrx.exe113⤵PID:2292
-
\??\c:\ttnnbh.exec:\ttnnbh.exe114⤵PID:2340
-
\??\c:\xlxxllx.exec:\xlxxllx.exe115⤵PID:2504
-
\??\c:\3rrrffl.exec:\3rrrffl.exe116⤵PID:2892
-
\??\c:\7bnhhn.exec:\7bnhhn.exe117⤵PID:2804
-
\??\c:\7pjjj.exec:\7pjjj.exe118⤵PID:2664
-
\??\c:\dpjjd.exec:\dpjjd.exe119⤵PID:2736
-
\??\c:\fxrrffl.exec:\fxrrffl.exe120⤵PID:2300
-
\??\c:\7ntnht.exec:\7ntnht.exe121⤵PID:1224
-
\??\c:\ppjdp.exec:\ppjdp.exe122⤵PID:2828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-