Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 14:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe
-
Size
454KB
-
MD5
4e08766b377bed8897d4deecfc658a8d
-
SHA1
7fce2db831fc81f669885f59d942542dca05297a
-
SHA256
d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7
-
SHA512
5fd3c2970d3f29dbc692f8d7910720a39cad52ff14eaa1b1521b1f48e9e42114704592d46bf3ecdfb89be20bc7d9f4d3ea8366ace54b94e98f67408531c737c1
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-58-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-66-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-85-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2792-87-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1156-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-126-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1792-147-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2024-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1132-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-192-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-271-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1672-308-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2656-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-398-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-419-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2768-433-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2760-434-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1248-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-624-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2800-637-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-693-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2600-744-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2684-745-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1772-759-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2032-772-0x0000000000530000-0x000000000055A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2184 jvjpd.exe 2640 9hbnbh.exe 2816 3jddp.exe 2616 rlrrffr.exe 2680 dvjjv.exe 2612 1jddd.exe 2532 xlxxlrf.exe 2792 nhnnbb.exe 1788 djjjd.exe 1156 tthnbt.exe 1496 llrrxfl.exe 2852 tnbbhn.exe 2972 dvvdv.exe 2024 tnbhbh.exe 1792 1dvvp.exe 1132 xlffxxf.exe 1976 vpdjv.exe 2684 3pddp.exe 2596 9hbbnh.exe 2000 bbbnth.exe 2112 fxlxflr.exe 1036 tnhntb.exe 2948 rlffxxl.exe 468 5tntbb.exe 1696 dvjpv.exe 1520 9lxxffr.exe 1940 pdpvj.exe 2956 3rrxflr.exe 772 1thhnt.exe 1032 vpjjp.exe 1512 fffxrfx.exe 1672 ttnnnh.exe 1576 5pvdj.exe 2656 fxrxlfx.exe 2928 9btbbb.exe 2816 vvjjv.exe 2508 jddpj.exe 2688 rlxxllr.exe 1532 9tttbh.exe 2520 vvddv.exe 2552 llrfllf.exe 2516 dpvvj.exe 2464 xlfrxfr.exe 992 5rlrrrr.exe 320 btttnn.exe 868 dvdjp.exe 2864 flrlrlx.exe 2880 hnhtnn.exe 3036 ppvpp.exe 2768 3dpjp.exe 2760 fxlrffr.exe 1740 3nhnhh.exe 1248 hhnntn.exe 2784 dvddj.exe 2264 1flrxll.exe 852 btnbhh.exe 1396 7jdjp.exe 1984 5dppd.exe 2336 lxrxflr.exe 2112 tnbhnt.exe 2388 7pdjp.exe 2252 xlllrxl.exe 2948 bnhntb.exe 960 tthnbb.exe -
resource yara_rule behavioral1/memory/1672-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-58-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2532-69-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-87-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1156-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-126-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1792-147-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2024-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1132-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-192-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1696-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-271-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1672-308-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2656-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-337-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2464-378-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2760-434-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1248-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-462-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1396-475-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2800-637-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2556-638-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-664-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-745-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1772-752-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2172-788-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rffrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxlll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2184 1672 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 28 PID 1672 wrote to memory of 2184 1672 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 28 PID 1672 wrote to memory of 2184 1672 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 28 PID 1672 wrote to memory of 2184 1672 d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe 28 PID 2184 wrote to memory of 2640 2184 jvjpd.exe 29 PID 2184 wrote to memory of 2640 2184 jvjpd.exe 29 PID 2184 wrote to memory of 2640 2184 jvjpd.exe 29 PID 2184 wrote to memory of 2640 2184 jvjpd.exe 29 PID 2640 wrote to memory of 2816 2640 9hbnbh.exe 30 PID 2640 wrote to memory of 2816 2640 9hbnbh.exe 30 PID 2640 wrote to memory of 2816 2640 9hbnbh.exe 30 PID 2640 wrote to memory of 2816 2640 9hbnbh.exe 30 PID 2816 wrote to memory of 2616 2816 3jddp.exe 31 PID 2816 wrote to memory of 2616 2816 3jddp.exe 31 PID 2816 wrote to memory of 2616 2816 3jddp.exe 31 PID 2816 wrote to memory of 2616 2816 3jddp.exe 31 PID 2616 wrote to memory of 2680 2616 rlrrffr.exe 32 PID 2616 wrote to memory of 2680 2616 rlrrffr.exe 32 PID 2616 wrote to memory of 2680 2616 rlrrffr.exe 32 PID 2616 wrote to memory of 2680 2616 rlrrffr.exe 32 PID 2680 wrote to memory of 2612 2680 dvjjv.exe 33 PID 2680 wrote to memory of 2612 2680 dvjjv.exe 33 PID 2680 wrote to memory of 2612 2680 dvjjv.exe 33 PID 2680 wrote to memory of 2612 2680 dvjjv.exe 33 PID 2612 wrote to memory of 2532 2612 1jddd.exe 34 PID 2612 wrote to memory of 2532 2612 1jddd.exe 34 PID 2612 wrote to memory of 2532 2612 1jddd.exe 34 PID 2612 wrote to memory of 2532 2612 1jddd.exe 34 PID 2532 wrote to memory of 2792 2532 xlxxlrf.exe 35 PID 2532 wrote to memory of 2792 2532 xlxxlrf.exe 35 PID 2532 wrote to memory of 2792 2532 xlxxlrf.exe 35 PID 2532 wrote to memory of 2792 2532 xlxxlrf.exe 35 PID 2792 wrote to memory of 1788 2792 nhnnbb.exe 36 PID 2792 wrote to memory of 1788 2792 nhnnbb.exe 36 PID 2792 wrote to memory of 1788 2792 nhnnbb.exe 36 PID 2792 wrote to memory of 1788 2792 nhnnbb.exe 36 PID 1788 wrote to memory of 1156 1788 djjjd.exe 37 PID 1788 wrote to memory of 1156 1788 djjjd.exe 37 PID 1788 wrote to memory of 1156 1788 djjjd.exe 37 PID 1788 wrote to memory of 1156 1788 djjjd.exe 37 PID 1156 wrote to memory of 1496 1156 tthnbt.exe 38 PID 1156 wrote to memory of 1496 1156 tthnbt.exe 38 PID 1156 wrote to memory of 1496 1156 tthnbt.exe 38 PID 1156 wrote to memory of 1496 1156 tthnbt.exe 38 PID 1496 wrote to memory of 2852 1496 llrrxfl.exe 39 PID 1496 wrote to memory of 2852 1496 llrrxfl.exe 39 PID 1496 wrote to memory of 2852 1496 llrrxfl.exe 39 PID 1496 wrote to memory of 2852 1496 llrrxfl.exe 39 PID 2852 wrote to memory of 2972 2852 tnbbhn.exe 40 PID 2852 wrote to memory of 2972 2852 tnbbhn.exe 40 PID 2852 wrote to memory of 2972 2852 tnbbhn.exe 40 PID 2852 wrote to memory of 2972 2852 tnbbhn.exe 40 PID 2972 wrote to memory of 2024 2972 dvvdv.exe 41 PID 2972 wrote to memory of 2024 2972 dvvdv.exe 41 PID 2972 wrote to memory of 2024 2972 dvvdv.exe 41 PID 2972 wrote to memory of 2024 2972 dvvdv.exe 41 PID 2024 wrote to memory of 1792 2024 tnbhbh.exe 42 PID 2024 wrote to memory of 1792 2024 tnbhbh.exe 42 PID 2024 wrote to memory of 1792 2024 tnbhbh.exe 42 PID 2024 wrote to memory of 1792 2024 tnbhbh.exe 42 PID 1792 wrote to memory of 1132 1792 1dvvp.exe 43 PID 1792 wrote to memory of 1132 1792 1dvvp.exe 43 PID 1792 wrote to memory of 1132 1792 1dvvp.exe 43 PID 1792 wrote to memory of 1132 1792 1dvvp.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe"C:\Users\Admin\AppData\Local\Temp\d20cfe8954e52ffc998ed6d731615a19ef9b3d81574120096684c9bd80db5cf7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\jvjpd.exec:\jvjpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\9hbnbh.exec:\9hbnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3jddp.exec:\3jddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\rlrrffr.exec:\rlrrffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\dvjjv.exec:\dvjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1jddd.exec:\1jddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\xlxxlrf.exec:\xlxxlrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\nhnnbb.exec:\nhnnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\djjjd.exec:\djjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\tthnbt.exec:\tthnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\llrrxfl.exec:\llrrxfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\tnbbhn.exec:\tnbbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\dvvdv.exec:\dvvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\tnbhbh.exec:\tnbhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1dvvp.exec:\1dvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\xlffxxf.exec:\xlffxxf.exe17⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vpdjv.exec:\vpdjv.exe18⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3pddp.exec:\3pddp.exe19⤵
- Executes dropped EXE
PID:2684 -
\??\c:\9hbbnh.exec:\9hbbnh.exe20⤵
- Executes dropped EXE
PID:2596 -
\??\c:\bbbnth.exec:\bbbnth.exe21⤵
- Executes dropped EXE
PID:2000 -
\??\c:\fxlxflr.exec:\fxlxflr.exe22⤵
- Executes dropped EXE
PID:2112 -
\??\c:\tnhntb.exec:\tnhntb.exe23⤵
- Executes dropped EXE
PID:1036 -
\??\c:\rlffxxl.exec:\rlffxxl.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5tntbb.exec:\5tntbb.exe25⤵
- Executes dropped EXE
PID:468 -
\??\c:\dvjpv.exec:\dvjpv.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\9lxxffr.exec:\9lxxffr.exe27⤵
- Executes dropped EXE
PID:1520 -
\??\c:\pdpvj.exec:\pdpvj.exe28⤵
- Executes dropped EXE
PID:1940 -
\??\c:\3rrxflr.exec:\3rrxflr.exe29⤵
- Executes dropped EXE
PID:2956 -
\??\c:\1thhnt.exec:\1thhnt.exe30⤵
- Executes dropped EXE
PID:772 -
\??\c:\vpjjp.exec:\vpjjp.exe31⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fffxrfx.exec:\fffxrfx.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ttnnnh.exec:\ttnnnh.exe33⤵
- Executes dropped EXE
PID:1672 -
\??\c:\5pvdj.exec:\5pvdj.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxrxlfx.exec:\fxrxlfx.exe35⤵
- Executes dropped EXE
PID:2656 -
\??\c:\9btbbb.exec:\9btbbb.exe36⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vvjjv.exec:\vvjjv.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jddpj.exec:\jddpj.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\rlxxllr.exec:\rlxxllr.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9tttbh.exec:\9tttbh.exe40⤵
- Executes dropped EXE
PID:1532 -
\??\c:\vvddv.exec:\vvddv.exe41⤵
- Executes dropped EXE
PID:2520 -
\??\c:\llrfllf.exec:\llrfllf.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\dpvvj.exec:\dpvvj.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\xlfrxfr.exec:\xlfrxfr.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\5rlrrrr.exec:\5rlrrrr.exe45⤵
- Executes dropped EXE
PID:992 -
\??\c:\btttnn.exec:\btttnn.exe46⤵
- Executes dropped EXE
PID:320 -
\??\c:\dvdjp.exec:\dvdjp.exe47⤵
- Executes dropped EXE
PID:868 -
\??\c:\flrlrlx.exec:\flrlrlx.exe48⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hnhtnn.exec:\hnhtnn.exe49⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ppvpp.exec:\ppvpp.exe50⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3dpjp.exec:\3dpjp.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fxlrffr.exec:\fxlrffr.exe52⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3nhnhh.exec:\3nhnhh.exe53⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hhnntn.exec:\hhnntn.exe54⤵
- Executes dropped EXE
PID:1248 -
\??\c:\dvddj.exec:\dvddj.exe55⤵
- Executes dropped EXE
PID:2784 -
\??\c:\1flrxll.exec:\1flrxll.exe56⤵
- Executes dropped EXE
PID:2264 -
\??\c:\btnbhh.exec:\btnbhh.exe57⤵
- Executes dropped EXE
PID:852 -
\??\c:\7jdjp.exec:\7jdjp.exe58⤵
- Executes dropped EXE
PID:1396 -
\??\c:\5dppd.exec:\5dppd.exe59⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lxrxflr.exec:\lxrxflr.exe60⤵
- Executes dropped EXE
PID:2336 -
\??\c:\tnbhnt.exec:\tnbhnt.exe61⤵
- Executes dropped EXE
PID:2112 -
\??\c:\7pdjp.exec:\7pdjp.exe62⤵
- Executes dropped EXE
PID:2388 -
\??\c:\xlllrxl.exec:\xlllrxl.exe63⤵
- Executes dropped EXE
PID:2252 -
\??\c:\bnhntb.exec:\bnhntb.exe64⤵
- Executes dropped EXE
PID:2948 -
\??\c:\tthnbb.exec:\tthnbb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:960 -
\??\c:\vpjjj.exec:\vpjjj.exe66⤵PID:640
-
\??\c:\rrrlfrl.exec:\rrrlfrl.exe67⤵PID:916
-
\??\c:\nhnntt.exec:\nhnntt.exe68⤵PID:1520
-
\??\c:\jvjdj.exec:\jvjdj.exe69⤵PID:2444
-
\??\c:\vpdjv.exec:\vpdjv.exe70⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\lfxxlfl.exec:\lfxxlfl.exe71⤵PID:2980
-
\??\c:\5ntbhn.exec:\5ntbhn.exe72⤵PID:2212
-
\??\c:\dvpdp.exec:\dvpdp.exe73⤵PID:2408
-
\??\c:\xlffllx.exec:\xlffllx.exe74⤵PID:892
-
\??\c:\fxfllrf.exec:\fxfllrf.exe75⤵PID:2840
-
\??\c:\5thhnt.exec:\5thhnt.exe76⤵PID:1672
-
\??\c:\vpdpv.exec:\vpdpv.exe77⤵PID:2716
-
\??\c:\jpdjv.exec:\jpdjv.exe78⤵PID:1272
-
\??\c:\rlxlrxf.exec:\rlxlrxf.exe79⤵PID:2644
-
\??\c:\bbttbb.exec:\bbttbb.exe80⤵PID:2920
-
\??\c:\dddpj.exec:\dddpj.exe81⤵PID:2808
-
\??\c:\lflflrx.exec:\lflflrx.exe82⤵PID:2788
-
\??\c:\9xrfflr.exec:\9xrfflr.exe83⤵PID:2800
-
\??\c:\1htthn.exec:\1htthn.exe84⤵PID:2556
-
\??\c:\pdppv.exec:\pdppv.exe85⤵PID:2520
-
\??\c:\ffxxflx.exec:\ffxxflx.exe86⤵PID:2552
-
\??\c:\3frlllr.exec:\3frlllr.exe87⤵PID:1708
-
\??\c:\hbbhnh.exec:\hbbhnh.exe88⤵PID:2412
-
\??\c:\5jppp.exec:\5jppp.exe89⤵PID:1488
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe90⤵PID:596
-
\??\c:\thnnnn.exec:\thnnnn.exe91⤵PID:868
-
\??\c:\ttbbbb.exec:\ttbbbb.exe92⤵PID:2892
-
\??\c:\vjvjp.exec:\vjvjp.exe93⤵PID:3024
-
\??\c:\xrllxrx.exec:\xrllxrx.exe94⤵PID:3028
-
\??\c:\xlrlflr.exec:\xlrlflr.exe95⤵PID:1640
-
\??\c:\7bttbh.exec:\7bttbh.exe96⤵PID:2024
-
\??\c:\jdppv.exec:\jdppv.exe97⤵PID:1792
-
\??\c:\jdpdv.exec:\jdpdv.exe98⤵PID:1280
-
\??\c:\lxlrlrf.exec:\lxlrlrf.exe99⤵PID:2600
-
\??\c:\thtntn.exec:\thtntn.exe100⤵PID:2684
-
\??\c:\thbthb.exec:\thbthb.exe101⤵PID:1772
-
\??\c:\pjjjp.exec:\pjjjp.exe102⤵PID:1396
-
\??\c:\rfllllr.exec:\rfllllr.exe103⤵PID:2032
-
\??\c:\xrflrrf.exec:\xrflrrf.exe104⤵PID:2164
-
\??\c:\thtthh.exec:\thtthh.exe105⤵PID:1036
-
\??\c:\vdvpj.exec:\vdvpj.exe106⤵PID:2172
-
\??\c:\pddjj.exec:\pddjj.exe107⤵PID:2284
-
\??\c:\lxllrxl.exec:\lxllrxl.exe108⤵PID:1244
-
\??\c:\nthhbn.exec:\nthhbn.exe109⤵
- System Location Discovery: System Language Discovery
PID:1628 -
\??\c:\9hbnbh.exec:\9hbnbh.exe110⤵PID:2356
-
\??\c:\djdjv.exec:\djdjv.exe111⤵PID:1520
-
\??\c:\rffflrf.exec:\rffflrf.exe112⤵PID:2444
-
\??\c:\hbbbnn.exec:\hbbbnn.exe113⤵PID:2396
-
\??\c:\bthnbn.exec:\bthnbn.exe114⤵PID:2980
-
\??\c:\5jpjj.exec:\5jpjj.exe115⤵PID:2436
-
\??\c:\rlffrxl.exec:\rlffrxl.exe116⤵PID:1604
-
\??\c:\1rllrxl.exec:\1rllrxl.exe117⤵PID:3048
-
\??\c:\tnbbbh.exec:\tnbbbh.exe118⤵
- System Location Discovery: System Language Discovery
PID:2840 -
\??\c:\dvvdj.exec:\dvvdj.exe119⤵PID:1672
-
\??\c:\vpvjv.exec:\vpvjv.exe120⤵PID:2716
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe121⤵PID:2624
-
\??\c:\bbhhtt.exec:\bbhhtt.exe122⤵PID:2644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-