Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 15:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
General
-
Target
1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe
-
Size
454KB
-
MD5
6ad08210bd73ebbb76ba2e38ec7edfd0
-
SHA1
4fdb547b55f79484a8d1878ba5dfe3122af1cabf
-
SHA256
1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a
-
SHA512
73b55df5f917a0931c4bce4f1e5538150783dc87173ed2bbc320bf5b0a7fe260ec1075576b6e377a63c6113b093ad420a35de3a928ec717f55994e1b6274497f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeqg:q7Tc2NYHUrAwfMp3CDf
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 37 IoCs
resource yara_rule behavioral1/memory/1524-515-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-495-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-449-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2344-431-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-385-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-379-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/2628-353-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-332-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1584-324-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2756-311-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1048-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-260-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2380-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-238-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/356-219-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1668-182-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1756-166-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/380-163-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2136-153-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/572-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-523-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/640-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1660-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1624-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2612-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1268-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2364-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/764-571-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2620-632-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2564-643-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2236 9fxlrfr.exe 2780 nhtbnn.exe 1268 ttbbbb.exe 2580 9nhntt.exe 2668 lfrrlrr.exe 2596 hntnbh.exe 2612 fffrlxl.exe 1624 3rlfrxr.exe 2008 dvpvj.exe 1660 nnhnbh.exe 2072 vpvpd.exe 640 lfrxflx.exe 3048 7vpdv.exe 572 llxrxlr.exe 2136 1vddd.exe 380 xxrxfrx.exe 1756 5dvvj.exe 1668 7dvjp.exe 2988 1hbhtt.exe 2896 pdjvd.exe 1620 bbtthn.exe 356 ppvdj.exe 1848 hnhnhn.exe 1648 bhbtbn.exe 2016 rlxxffl.exe 2380 3pjdj.exe 2116 lrllrxl.exe 2312 bbtbnt.exe 1000 ffrrrlr.exe 1048 5nhnth.exe 1676 5ddjd.exe 2756 7nbhhn.exe 2752 ddvdp.exe 1584 rlxxxrf.exe 2788 tnbbhb.exe 2576 3nhtbb.exe 2728 dvjjp.exe 2792 xfxxffr.exe 2628 xfxrxrx.exe 3008 tnhnbh.exe 1484 jdvpv.exe 1772 rlllfrx.exe 2836 rlflxrf.exe 2076 5bntbn.exe 744 5pjpv.exe 1528 dvddp.exe 2540 xxlrxxf.exe 1940 3hbnbh.exe 2616 hnnbtb.exe 2344 vpdjj.exe 2840 xxxxxfr.exe 2188 5fflrrx.exe 1748 bbnbtb.exe 2020 jjvdd.exe 2124 vjppv.exe 3060 rrffllr.exe 2968 9hbhhh.exe 2996 ttthtb.exe 2508 dvdvd.exe 1980 rfffflr.exe 1620 xrlllrf.exe 2084 hbnntt.exe 1524 nnnnbn.exe 3000 ddvvd.exe -
resource yara_rule behavioral1/memory/1524-515-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1524-508-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2344-431-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-385-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-353-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-332-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1584-324-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2756-311-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1048-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-260-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-219-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/356-211-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-182-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1756-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/380-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-153-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/572-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/640-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1660-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2612-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1268-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2364-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/764-571-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-746-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-813-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hbntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rlfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1frrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2236 2364 1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe 30 PID 2364 wrote to memory of 2236 2364 1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe 30 PID 2364 wrote to memory of 2236 2364 1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe 30 PID 2364 wrote to memory of 2236 2364 1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe 30 PID 2236 wrote to memory of 2780 2236 9fxlrfr.exe 31 PID 2236 wrote to memory of 2780 2236 9fxlrfr.exe 31 PID 2236 wrote to memory of 2780 2236 9fxlrfr.exe 31 PID 2236 wrote to memory of 2780 2236 9fxlrfr.exe 31 PID 2780 wrote to memory of 1268 2780 nhtbnn.exe 32 PID 2780 wrote to memory of 1268 2780 nhtbnn.exe 32 PID 2780 wrote to memory of 1268 2780 nhtbnn.exe 32 PID 2780 wrote to memory of 1268 2780 nhtbnn.exe 32 PID 1268 wrote to memory of 2580 1268 ttbbbb.exe 33 PID 1268 wrote to memory of 2580 1268 ttbbbb.exe 33 PID 1268 wrote to memory of 2580 1268 ttbbbb.exe 33 PID 1268 wrote to memory of 2580 1268 ttbbbb.exe 33 PID 2580 wrote to memory of 2668 2580 9nhntt.exe 34 PID 2580 wrote to memory of 2668 2580 9nhntt.exe 34 PID 2580 wrote to memory of 2668 2580 9nhntt.exe 34 PID 2580 wrote to memory of 2668 2580 9nhntt.exe 34 PID 2668 wrote to memory of 2596 2668 lfrrlrr.exe 35 PID 2668 wrote to memory of 2596 2668 lfrrlrr.exe 35 PID 2668 wrote to memory of 2596 2668 lfrrlrr.exe 35 PID 2668 wrote to memory of 2596 2668 lfrrlrr.exe 35 PID 2596 wrote to memory of 2612 2596 hntnbh.exe 36 PID 2596 wrote to memory of 2612 2596 hntnbh.exe 36 PID 2596 wrote to memory of 2612 2596 hntnbh.exe 36 PID 2596 wrote to memory of 2612 2596 hntnbh.exe 36 PID 2612 wrote to memory of 1624 2612 fffrlxl.exe 37 PID 2612 wrote to memory of 1624 2612 fffrlxl.exe 37 PID 2612 wrote to memory of 1624 2612 fffrlxl.exe 37 PID 2612 wrote to memory of 1624 2612 fffrlxl.exe 37 PID 1624 wrote to memory of 2008 1624 3rlfrxr.exe 38 PID 1624 wrote to memory of 2008 1624 3rlfrxr.exe 38 PID 1624 wrote to memory of 2008 1624 3rlfrxr.exe 38 PID 1624 wrote to memory of 2008 1624 3rlfrxr.exe 38 PID 2008 wrote to memory of 1660 2008 dvpvj.exe 39 PID 2008 wrote to memory of 1660 2008 dvpvj.exe 39 PID 2008 wrote to memory of 1660 2008 dvpvj.exe 39 PID 2008 wrote to memory of 1660 2008 dvpvj.exe 39 PID 1660 wrote to memory of 2072 1660 nnhnbh.exe 40 PID 1660 wrote to memory of 2072 1660 nnhnbh.exe 40 PID 1660 wrote to memory of 2072 1660 nnhnbh.exe 40 PID 1660 wrote to memory of 2072 1660 nnhnbh.exe 40 PID 2072 wrote to memory of 640 2072 vpvpd.exe 41 PID 2072 wrote to memory of 640 2072 vpvpd.exe 41 PID 2072 wrote to memory of 640 2072 vpvpd.exe 41 PID 2072 wrote to memory of 640 2072 vpvpd.exe 41 PID 640 wrote to memory of 3048 640 lfrxflx.exe 42 PID 640 wrote to memory of 3048 640 lfrxflx.exe 42 PID 640 wrote to memory of 3048 640 lfrxflx.exe 42 PID 640 wrote to memory of 3048 640 lfrxflx.exe 42 PID 3048 wrote to memory of 572 3048 7vpdv.exe 43 PID 3048 wrote to memory of 572 3048 7vpdv.exe 43 PID 3048 wrote to memory of 572 3048 7vpdv.exe 43 PID 3048 wrote to memory of 572 3048 7vpdv.exe 43 PID 572 wrote to memory of 2136 572 llxrxlr.exe 44 PID 572 wrote to memory of 2136 572 llxrxlr.exe 44 PID 572 wrote to memory of 2136 572 llxrxlr.exe 44 PID 572 wrote to memory of 2136 572 llxrxlr.exe 44 PID 2136 wrote to memory of 380 2136 1vddd.exe 45 PID 2136 wrote to memory of 380 2136 1vddd.exe 45 PID 2136 wrote to memory of 380 2136 1vddd.exe 45 PID 2136 wrote to memory of 380 2136 1vddd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe"C:\Users\Admin\AppData\Local\Temp\1b63982db861259c66a362dcafab9373e0dd0408d0c1e7a26c39a134457b7a7a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\9fxlrfr.exec:\9fxlrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\nhtbnn.exec:\nhtbnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ttbbbb.exec:\ttbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\9nhntt.exec:\9nhntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lfrrlrr.exec:\lfrrlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hntnbh.exec:\hntnbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\fffrlxl.exec:\fffrlxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\3rlfrxr.exec:\3rlfrxr.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\dvpvj.exec:\dvpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\nnhnbh.exec:\nnhnbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\vpvpd.exec:\vpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\lfrxflx.exec:\lfrxflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\7vpdv.exec:\7vpdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\llxrxlr.exec:\llxrxlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:572 -
\??\c:\1vddd.exec:\1vddd.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\xxrxfrx.exec:\xxrxfrx.exe17⤵
- Executes dropped EXE
PID:380 -
\??\c:\5dvvj.exec:\5dvvj.exe18⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7dvjp.exec:\7dvjp.exe19⤵
- Executes dropped EXE
PID:1668 -
\??\c:\1hbhtt.exec:\1hbhtt.exe20⤵
- Executes dropped EXE
PID:2988 -
\??\c:\pdjvd.exec:\pdjvd.exe21⤵
- Executes dropped EXE
PID:2896 -
\??\c:\bbtthn.exec:\bbtthn.exe22⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ppvdj.exec:\ppvdj.exe23⤵
- Executes dropped EXE
PID:356 -
\??\c:\hnhnhn.exec:\hnhnhn.exe24⤵
- Executes dropped EXE
PID:1848 -
\??\c:\bhbtbn.exec:\bhbtbn.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rlxxffl.exec:\rlxxffl.exe26⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3pjdj.exec:\3pjdj.exe27⤵
- Executes dropped EXE
PID:2380 -
\??\c:\lrllrxl.exec:\lrllrxl.exe28⤵
- Executes dropped EXE
PID:2116 -
\??\c:\bbtbnt.exec:\bbtbnt.exe29⤵
- Executes dropped EXE
PID:2312 -
\??\c:\ffrrrlr.exec:\ffrrrlr.exe30⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5nhnth.exec:\5nhnth.exe31⤵
- Executes dropped EXE
PID:1048 -
\??\c:\5ddjd.exec:\5ddjd.exe32⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7nbhhn.exec:\7nbhhn.exe33⤵
- Executes dropped EXE
PID:2756 -
\??\c:\ddvdp.exec:\ddvdp.exe34⤵
- Executes dropped EXE
PID:2752 -
\??\c:\rlxxxrf.exec:\rlxxxrf.exe35⤵
- Executes dropped EXE
PID:1584 -
\??\c:\tnbbhb.exec:\tnbbhb.exe36⤵
- Executes dropped EXE
PID:2788 -
\??\c:\3nhtbb.exec:\3nhtbb.exe37⤵
- Executes dropped EXE
PID:2576 -
\??\c:\dvjjp.exec:\dvjjp.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\xfxxffr.exec:\xfxxffr.exe39⤵
- Executes dropped EXE
PID:2792 -
\??\c:\xfxrxrx.exec:\xfxrxrx.exe40⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnhnbh.exec:\tnhnbh.exe41⤵
- Executes dropped EXE
PID:3008 -
\??\c:\jdvpv.exec:\jdvpv.exe42⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rlllfrx.exec:\rlllfrx.exe43⤵
- Executes dropped EXE
PID:1772 -
\??\c:\rlflxrf.exec:\rlflxrf.exe44⤵
- Executes dropped EXE
PID:2836 -
\??\c:\5bntbn.exec:\5bntbn.exe45⤵
- Executes dropped EXE
PID:2076 -
\??\c:\5pjpv.exec:\5pjpv.exe46⤵
- Executes dropped EXE
PID:744 -
\??\c:\dvddp.exec:\dvddp.exe47⤵
- Executes dropped EXE
PID:1528 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe48⤵
- Executes dropped EXE
PID:2540 -
\??\c:\3hbnbh.exec:\3hbnbh.exe49⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hnnbtb.exec:\hnnbtb.exe50⤵
- Executes dropped EXE
PID:2616 -
\??\c:\vpdjj.exec:\vpdjj.exe51⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xxxxxfr.exec:\xxxxxfr.exe52⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5fflrrx.exec:\5fflrrx.exe53⤵
- Executes dropped EXE
PID:2188 -
\??\c:\bbnbtb.exec:\bbnbtb.exe54⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jjvdd.exec:\jjvdd.exe55⤵
- Executes dropped EXE
PID:2020 -
\??\c:\vjppv.exec:\vjppv.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\rrffllr.exec:\rrffllr.exe57⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9hbhhh.exec:\9hbhhh.exe58⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ttthtb.exec:\ttthtb.exe59⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dvdvd.exec:\dvdvd.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\rfffflr.exec:\rfffflr.exe61⤵
- Executes dropped EXE
PID:1980 -
\??\c:\xrlllrf.exec:\xrlllrf.exe62⤵
- Executes dropped EXE
PID:1620 -
\??\c:\hbnntt.exec:\hbnntt.exe63⤵
- Executes dropped EXE
PID:2084 -
\??\c:\nnnnbn.exec:\nnnnbn.exe64⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ddvvd.exec:\ddvvd.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\7fxxxfl.exec:\7fxxxfl.exe66⤵PID:2164
-
\??\c:\3bntth.exec:\3bntth.exe67⤵PID:2096
-
\??\c:\hhbhtb.exec:\hhbhtb.exe68⤵PID:2212
-
\??\c:\vjdjd.exec:\vjdjd.exe69⤵PID:2368
-
\??\c:\1thntb.exec:\1thntb.exe70⤵PID:2920
-
\??\c:\ppjpj.exec:\ppjpj.exe71⤵PID:2312
-
\??\c:\thbbhn.exec:\thbbhn.exe72⤵
- System Location Discovery: System Language Discovery
PID:764 -
\??\c:\dpdvp.exec:\dpdvp.exe73⤵PID:2332
-
\??\c:\ffrrxlr.exec:\ffrrxlr.exe74⤵PID:2160
-
\??\c:\5ppvd.exec:\5ppvd.exe75⤵PID:2700
-
\??\c:\llxxlrf.exec:\llxxlrf.exe76⤵PID:1576
-
\??\c:\1rlrfxr.exec:\1rlrfxr.exe77⤵PID:2688
-
\??\c:\bhbnth.exec:\bhbnth.exe78⤵PID:1584
-
\??\c:\9pddp.exec:\9pddp.exe79⤵PID:1268
-
\??\c:\3rrxxfr.exec:\3rrxxfr.exe80⤵PID:2692
-
\??\c:\bbhnnt.exec:\bbhnnt.exe81⤵PID:2552
-
\??\c:\7pppd.exec:\7pppd.exe82⤵PID:2620
-
\??\c:\ffxxrxf.exec:\ffxxrxf.exe83⤵PID:2564
-
\??\c:\lxllxrf.exec:\lxllxrf.exe84⤵PID:1272
-
\??\c:\rlrxllx.exec:\rlrxllx.exe85⤵PID:2196
-
\??\c:\jddjv.exec:\jddjv.exe86⤵PID:2204
-
\??\c:\lfllrxf.exec:\lfllrxf.exe87⤵PID:2400
-
\??\c:\pvjvv.exec:\pvjvv.exe88⤵PID:2280
-
\??\c:\3ddvv.exec:\3ddvv.exe89⤵PID:1332
-
\??\c:\rxrxllx.exec:\rxrxllx.exe90⤵PID:1276
-
\??\c:\bnbhhn.exec:\bnbhhn.exe91⤵PID:2072
-
\??\c:\5lffllf.exec:\5lffllf.exe92⤵PID:2432
-
\??\c:\7hbhtb.exec:\7hbhtb.exe93⤵PID:2272
-
\??\c:\7pjpv.exec:\7pjpv.exe94⤵PID:2140
-
\??\c:\vdvjv.exec:\vdvjv.exe95⤵PID:2024
-
\??\c:\xfxfrrx.exec:\xfxfrrx.exe96⤵PID:768
-
\??\c:\5tnthn.exec:\5tnthn.exe97⤵PID:2044
-
\??\c:\hbbbbb.exec:\hbbbbb.exe98⤵PID:1964
-
\??\c:\vvjpv.exec:\vvjpv.exe99⤵PID:2964
-
\??\c:\3frlllr.exec:\3frlllr.exe100⤵PID:1668
-
\??\c:\9nnhht.exec:\9nnhht.exe101⤵PID:1404
-
\??\c:\bbhntb.exec:\bbhntb.exe102⤵PID:824
-
\??\c:\jdvjp.exec:\jdvjp.exe103⤵PID:896
-
\??\c:\3xrxlrl.exec:\3xrxlrl.exe104⤵PID:1080
-
\??\c:\hnbbhh.exec:\hnbbhh.exe105⤵PID:1620
-
\??\c:\tbnnbn.exec:\tbnnbn.exe106⤵PID:2084
-
\??\c:\vvdjv.exec:\vvdjv.exe107⤵PID:1092
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe108⤵PID:2352
-
\??\c:\5vpjj.exec:\5vpjj.exe109⤵PID:1264
-
\??\c:\3lfflrf.exec:\3lfflrf.exe110⤵PID:1960
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe111⤵PID:2824
-
\??\c:\hntttt.exec:\hntttt.exe112⤵PID:2500
-
\??\c:\jdvdp.exec:\jdvdp.exe113⤵PID:908
-
\??\c:\fxrxxxl.exec:\fxrxxxl.exe114⤵PID:328
-
\??\c:\7xxfrxl.exec:\7xxfrxl.exe115⤵PID:1656
-
\??\c:\3thhhb.exec:\3thhhb.exe116⤵PID:2004
-
\??\c:\7jvvv.exec:\7jvvv.exe117⤵PID:1300
-
\??\c:\vdvjd.exec:\vdvjd.exe118⤵PID:2664
-
\??\c:\7fxfrxf.exec:\7fxfrxf.exe119⤵PID:1608
-
\??\c:\hhbbth.exec:\hhbbth.exe120⤵PID:2752
-
\??\c:\hbtbnb.exec:\hbtbnb.exe121⤵PID:2688
-
\??\c:\7jvpp.exec:\7jvpp.exe122⤵PID:2788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-