Analysis
-
max time kernel
120s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 20:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe
-
Size
456KB
-
MD5
2f99ff2bda33f6fcdc1c80951a9ce520
-
SHA1
3cfc9bfca7f3050ca0213b6e74805486cb7041fb
-
SHA256
1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407e
-
SHA512
112c1e64a2dabf9fbef9c55078e83f4ee6d2769db5c53e68d1bc9e0adb4f327c978eff92199a17c9dce057fc8c9278e386218ffb423710a87378adc7ddfb4686
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRL:q7Tc2NYHUrAwfMp3CDRL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2724-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-35-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1532-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2696-66-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2748-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-82-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-100-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1148-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-145-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/852-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-172-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2960-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2088-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2440-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1860-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/876-244-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/876-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2224-251-0x0000000000430000-0x000000000045A000-memory.dmp family_blackmoon behavioral1/memory/1448-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-285-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-365-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1264-419-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1940-446-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2456-460-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2452-474-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1200-506-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1276-509-0x00000000002A0000-0x00000000002CA000-memory.dmp family_blackmoon behavioral1/memory/1520-575-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-689-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1964-717-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-736-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-819-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1604-821-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/352-833-0x00000000003D0000-0x00000000003FA000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2724 hbbthh.exe 2728 vvjvd.exe 2852 rlflfrf.exe 3036 jdpvd.exe 1532 thbnbh.exe 2696 9rlxrrl.exe 2748 7vjpp.exe 592 xrlfrxr.exe 1220 jddjp.exe 2460 5llrllf.exe 2148 7tnnnt.exe 1608 dvjjv.exe 1036 nhtttb.exe 1148 3dvdp.exe 1980 hhhthh.exe 852 jdvjv.exe 2472 bnbhnn.exe 1740 pjvpd.exe 2960 hnbhtb.exe 2232 5dpdp.exe 2088 7rlxrff.exe 2440 nhttnn.exe 1508 jdvdp.exe 2168 tnhbnt.exe 1860 vpddv.exe 876 hntntn.exe 2224 frflxrr.exe 1448 dvppj.exe 2944 lfrxxfr.exe 1676 bthbnt.exe 2680 rfflfxl.exe 1632 nbhhtb.exe 2724 xrfrxfx.exe 2808 ntnbbh.exe 2732 btnttt.exe 2852 dpjjp.exe 2620 9lxxllr.exe 2568 1bnthn.exe 2824 3vddp.exe 1660 7frxrrr.exe 696 1rffrxf.exe 1108 hhthtt.exe 568 7vpvd.exe 1216 rfrflfl.exe 2540 tnbhtb.exe 2104 5jvpj.exe 2148 rlxxrrl.exe 1748 rlxxlfr.exe 1752 hbnnbb.exe 1264 djddv.exe 1044 lxlxrrf.exe 2912 hbhnhh.exe 2908 bnbbnn.exe 1940 jdvdp.exe 1696 9rlxlrl.exe 2456 nbnhhb.exe 2228 vpjjj.exe 2336 pjdjj.exe 2452 3ffrlrf.exe 2276 1bntbh.exe 2440 7pddv.exe 2424 xrlrrxl.exe 1200 7rffffl.exe 1276 hhnhtb.exe -
resource yara_rule behavioral1/memory/2724-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2852-35-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1532-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2696-66-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-82-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-100-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1148-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-145-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/852-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-172-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2960-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2088-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1860-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/876-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1448-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-285-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-365-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-398-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1264-419-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-474-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2440-487-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1200-506-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1520-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-602-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1756-701-0x00000000002C0000-0x00000000002EA000-memory.dmp upx behavioral1/memory/1964-717-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-736-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-821-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7frrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrxlrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2724 2400 1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe 30 PID 2400 wrote to memory of 2724 2400 1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe 30 PID 2400 wrote to memory of 2724 2400 1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe 30 PID 2400 wrote to memory of 2724 2400 1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe 30 PID 2724 wrote to memory of 2728 2724 hbbthh.exe 31 PID 2724 wrote to memory of 2728 2724 hbbthh.exe 31 PID 2724 wrote to memory of 2728 2724 hbbthh.exe 31 PID 2724 wrote to memory of 2728 2724 hbbthh.exe 31 PID 2728 wrote to memory of 2852 2728 vvjvd.exe 32 PID 2728 wrote to memory of 2852 2728 vvjvd.exe 32 PID 2728 wrote to memory of 2852 2728 vvjvd.exe 32 PID 2728 wrote to memory of 2852 2728 vvjvd.exe 32 PID 2852 wrote to memory of 3036 2852 rlflfrf.exe 33 PID 2852 wrote to memory of 3036 2852 rlflfrf.exe 33 PID 2852 wrote to memory of 3036 2852 rlflfrf.exe 33 PID 2852 wrote to memory of 3036 2852 rlflfrf.exe 33 PID 3036 wrote to memory of 1532 3036 jdpvd.exe 34 PID 3036 wrote to memory of 1532 3036 jdpvd.exe 34 PID 3036 wrote to memory of 1532 3036 jdpvd.exe 34 PID 3036 wrote to memory of 1532 3036 jdpvd.exe 34 PID 1532 wrote to memory of 2696 1532 thbnbh.exe 35 PID 1532 wrote to memory of 2696 1532 thbnbh.exe 35 PID 1532 wrote to memory of 2696 1532 thbnbh.exe 35 PID 1532 wrote to memory of 2696 1532 thbnbh.exe 35 PID 2696 wrote to memory of 2748 2696 9rlxrrl.exe 36 PID 2696 wrote to memory of 2748 2696 9rlxrrl.exe 36 PID 2696 wrote to memory of 2748 2696 9rlxrrl.exe 36 PID 2696 wrote to memory of 2748 2696 9rlxrrl.exe 36 PID 2748 wrote to memory of 592 2748 7vjpp.exe 37 PID 2748 wrote to memory of 592 2748 7vjpp.exe 37 PID 2748 wrote to memory of 592 2748 7vjpp.exe 37 PID 2748 wrote to memory of 592 2748 7vjpp.exe 37 PID 592 wrote to memory of 1220 592 xrlfrxr.exe 38 PID 592 wrote to memory of 1220 592 xrlfrxr.exe 38 PID 592 wrote to memory of 1220 592 xrlfrxr.exe 38 PID 592 wrote to memory of 1220 592 xrlfrxr.exe 38 PID 1220 wrote to memory of 2460 1220 jddjp.exe 39 PID 1220 wrote to memory of 2460 1220 jddjp.exe 39 PID 1220 wrote to memory of 2460 1220 jddjp.exe 39 PID 1220 wrote to memory of 2460 1220 jddjp.exe 39 PID 2460 wrote to memory of 2148 2460 5llrllf.exe 40 PID 2460 wrote to memory of 2148 2460 5llrllf.exe 40 PID 2460 wrote to memory of 2148 2460 5llrllf.exe 40 PID 2460 wrote to memory of 2148 2460 5llrllf.exe 40 PID 2148 wrote to memory of 1608 2148 7tnnnt.exe 41 PID 2148 wrote to memory of 1608 2148 7tnnnt.exe 41 PID 2148 wrote to memory of 1608 2148 7tnnnt.exe 41 PID 2148 wrote to memory of 1608 2148 7tnnnt.exe 41 PID 1608 wrote to memory of 1036 1608 dvjjv.exe 42 PID 1608 wrote to memory of 1036 1608 dvjjv.exe 42 PID 1608 wrote to memory of 1036 1608 dvjjv.exe 42 PID 1608 wrote to memory of 1036 1608 dvjjv.exe 42 PID 1036 wrote to memory of 1148 1036 nhtttb.exe 43 PID 1036 wrote to memory of 1148 1036 nhtttb.exe 43 PID 1036 wrote to memory of 1148 1036 nhtttb.exe 43 PID 1036 wrote to memory of 1148 1036 nhtttb.exe 43 PID 1148 wrote to memory of 1980 1148 3dvdp.exe 44 PID 1148 wrote to memory of 1980 1148 3dvdp.exe 44 PID 1148 wrote to memory of 1980 1148 3dvdp.exe 44 PID 1148 wrote to memory of 1980 1148 3dvdp.exe 44 PID 1980 wrote to memory of 852 1980 hhhthh.exe 45 PID 1980 wrote to memory of 852 1980 hhhthh.exe 45 PID 1980 wrote to memory of 852 1980 hhhthh.exe 45 PID 1980 wrote to memory of 852 1980 hhhthh.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe"C:\Users\Admin\AppData\Local\Temp\1e9c546bdb6966ee08b4d9ab969fa1ae39c419566d7b670c6891a0a58be9407eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hbbthh.exec:\hbbthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vvjvd.exec:\vvjvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rlflfrf.exec:\rlflfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\jdpvd.exec:\jdpvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\thbnbh.exec:\thbnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\9rlxrrl.exec:\9rlxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\7vjpp.exec:\7vjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\xrlfrxr.exec:\xrlfrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:592 -
\??\c:\jddjp.exec:\jddjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\5llrllf.exec:\5llrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\7tnnnt.exec:\7tnnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dvjjv.exec:\dvjjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nhtttb.exec:\nhtttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\3dvdp.exec:\3dvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\hhhthh.exec:\hhhthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\jdvjv.exec:\jdvjv.exe17⤵
- Executes dropped EXE
PID:852 -
\??\c:\bnbhnn.exec:\bnbhnn.exe18⤵
- Executes dropped EXE
PID:2472 -
\??\c:\pjvpd.exec:\pjvpd.exe19⤵
- Executes dropped EXE
PID:1740 -
\??\c:\hnbhtb.exec:\hnbhtb.exe20⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5dpdp.exec:\5dpdp.exe21⤵
- Executes dropped EXE
PID:2232 -
\??\c:\7rlxrff.exec:\7rlxrff.exe22⤵
- Executes dropped EXE
PID:2088 -
\??\c:\nhttnn.exec:\nhttnn.exe23⤵
- Executes dropped EXE
PID:2440 -
\??\c:\jdvdp.exec:\jdvdp.exe24⤵
- Executes dropped EXE
PID:1508 -
\??\c:\tnhbnt.exec:\tnhbnt.exe25⤵
- Executes dropped EXE
PID:2168 -
\??\c:\vpddv.exec:\vpddv.exe26⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hntntn.exec:\hntntn.exe27⤵
- Executes dropped EXE
PID:876 -
\??\c:\frflxrr.exec:\frflxrr.exe28⤵
- Executes dropped EXE
PID:2224 -
\??\c:\dvppj.exec:\dvppj.exe29⤵
- Executes dropped EXE
PID:1448 -
\??\c:\lfrxxfr.exec:\lfrxxfr.exe30⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bthbnt.exec:\bthbnt.exe31⤵
- Executes dropped EXE
PID:1676 -
\??\c:\rfflfxl.exec:\rfflfxl.exe32⤵
- Executes dropped EXE
PID:2680 -
\??\c:\nbhhtb.exec:\nbhhtb.exe33⤵
- Executes dropped EXE
PID:1632 -
\??\c:\xrfrxfx.exec:\xrfrxfx.exe34⤵
- Executes dropped EXE
PID:2724 -
\??\c:\ntnbbh.exec:\ntnbbh.exe35⤵
- Executes dropped EXE
PID:2808 -
\??\c:\btnttt.exec:\btnttt.exe36⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dpjjp.exec:\dpjjp.exe37⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9lxxllr.exec:\9lxxllr.exe38⤵
- Executes dropped EXE
PID:2620 -
\??\c:\1bnthn.exec:\1bnthn.exe39⤵
- Executes dropped EXE
PID:2568 -
\??\c:\3vddp.exec:\3vddp.exe40⤵
- Executes dropped EXE
PID:2824 -
\??\c:\7frxrrr.exec:\7frxrrr.exe41⤵
- Executes dropped EXE
PID:1660 -
\??\c:\1rffrxf.exec:\1rffrxf.exe42⤵
- Executes dropped EXE
PID:696 -
\??\c:\hhthtt.exec:\hhthtt.exe43⤵
- Executes dropped EXE
PID:1108 -
\??\c:\7vpvd.exec:\7vpvd.exe44⤵
- Executes dropped EXE
PID:568 -
\??\c:\rfrflfl.exec:\rfrflfl.exe45⤵
- Executes dropped EXE
PID:1216 -
\??\c:\tnbhtb.exec:\tnbhtb.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5jvpj.exec:\5jvpj.exe47⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rlxxrrl.exec:\rlxxrrl.exe48⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlxxlfr.exec:\rlxxlfr.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\hbnnbb.exec:\hbnnbb.exe50⤵
- Executes dropped EXE
PID:1752 -
\??\c:\djddv.exec:\djddv.exe51⤵
- Executes dropped EXE
PID:1264 -
\??\c:\lxlxrrf.exec:\lxlxrrf.exe52⤵
- Executes dropped EXE
PID:1044 -
\??\c:\hbhnhh.exec:\hbhnhh.exe53⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bnbbnn.exec:\bnbbnn.exe54⤵
- Executes dropped EXE
PID:2908 -
\??\c:\jdvdp.exec:\jdvdp.exe55⤵
- Executes dropped EXE
PID:1940 -
\??\c:\9rlxlrl.exec:\9rlxlrl.exe56⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbnhhb.exec:\nbnhhb.exe57⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vpjjj.exec:\vpjjj.exe58⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pjdjj.exec:\pjdjj.exe59⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3ffrlrf.exec:\3ffrlrf.exe60⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1bntbh.exec:\1bntbh.exe61⤵
- Executes dropped EXE
PID:2276 -
\??\c:\7pddv.exec:\7pddv.exe62⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrlrrxl.exec:\xrlrrxl.exe63⤵
- Executes dropped EXE
PID:2424 -
\??\c:\7rffffl.exec:\7rffffl.exe64⤵
- Executes dropped EXE
PID:1200 -
\??\c:\hhnhtb.exec:\hhnhtb.exe65⤵
- Executes dropped EXE
PID:1276 -
\??\c:\jvpvd.exec:\jvpvd.exe66⤵PID:292
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe67⤵PID:1936
-
\??\c:\bthhbt.exec:\bthhbt.exe68⤵PID:1712
-
\??\c:\nhbhhn.exec:\nhbhhn.exe69⤵PID:1604
-
\??\c:\vvppv.exec:\vvppv.exe70⤵PID:1160
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe71⤵PID:872
-
\??\c:\nhthnt.exec:\nhthnt.exe72⤵PID:1556
-
\??\c:\bththb.exec:\bththb.exe73⤵PID:3052
-
\??\c:\pjvpd.exec:\pjvpd.exe74⤵PID:1520
-
\??\c:\rlfrlrl.exec:\rlfrlrl.exe75⤵PID:2704
-
\??\c:\tbbhbh.exec:\tbbhbh.exe76⤵PID:2932
-
\??\c:\pddvj.exec:\pddvj.exe77⤵PID:2832
-
\??\c:\lxxflrx.exec:\lxxflrx.exe78⤵PID:2836
-
\??\c:\btnbnt.exec:\btnbnt.exe79⤵PID:1012
-
\??\c:\3pvdp.exec:\3pvdp.exe80⤵PID:2652
-
\??\c:\1vpvv.exec:\1vpvv.exe81⤵PID:2256
-
\??\c:\rlxxffr.exec:\rlxxffr.exe82⤵PID:3016
-
\??\c:\5tntth.exec:\5tntth.exe83⤵PID:988
-
\??\c:\djdvp.exec:\djdvp.exe84⤵PID:2468
-
\??\c:\5xrxlrx.exec:\5xrxlrx.exe85⤵
- System Location Discovery: System Language Discovery
PID:596 -
\??\c:\xlxfxxf.exec:\xlxfxxf.exe86⤵PID:2464
-
\??\c:\nnbntb.exec:\nnbntb.exe87⤵PID:2540
-
\??\c:\1dvdp.exec:\1dvdp.exe88⤵PID:1584
-
\??\c:\lfrrllx.exec:\lfrrllx.exe89⤵PID:2148
-
\??\c:\rrlxxlx.exec:\rrlxxlx.exe90⤵PID:1232
-
\??\c:\5nbbtb.exec:\5nbbtb.exe91⤵PID:1452
-
\??\c:\dvpdv.exec:\dvpdv.exe92⤵PID:2040
-
\??\c:\rxlxrrr.exec:\rxlxrrr.exe93⤵
- System Location Discovery: System Language Discovery
PID:1756 -
\??\c:\bnbhhh.exec:\bnbhhh.exe94⤵PID:1572
-
\??\c:\bbnnnt.exec:\bbnnnt.exe95⤵PID:1964
-
\??\c:\vjpvd.exec:\vjpvd.exe96⤵PID:1976
-
\??\c:\rlrffff.exec:\rlrffff.exe97⤵PID:2144
-
\??\c:\bbntbb.exec:\bbntbb.exe98⤵PID:2260
-
\??\c:\hnhbtt.exec:\hnhbtt.exe99⤵PID:2136
-
\??\c:\1dppp.exec:\1dppp.exe100⤵PID:2200
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe101⤵PID:2240
-
\??\c:\bthtnh.exec:\bthtnh.exe102⤵PID:1796
-
\??\c:\7jjpj.exec:\7jjpj.exe103⤵PID:2964
-
\??\c:\dpjjv.exec:\dpjjv.exe104⤵PID:2412
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe105⤵PID:372
-
\??\c:\bthhtb.exec:\bthhtb.exe106⤵PID:1364
-
\??\c:\5dvpd.exec:\5dvpd.exe107⤵PID:2368
-
\??\c:\dpjjd.exec:\dpjjd.exe108⤵PID:2536
-
\??\c:\5frrlll.exec:\5frrlll.exe109⤵PID:1808
-
\??\c:\vpjjd.exec:\vpjjd.exe110⤵PID:572
-
\??\c:\3rfrrxl.exec:\3rfrrxl.exe111⤵PID:1604
-
\??\c:\1tbhnt.exec:\1tbhnt.exe112⤵PID:868
-
\??\c:\3dpjp.exec:\3dpjp.exe113⤵PID:352
-
\??\c:\frffrlr.exec:\frffrlr.exe114⤵PID:1992
-
\??\c:\3hnttn.exec:\3hnttn.exe115⤵PID:2776
-
\??\c:\pjvdj.exec:\pjvdj.exe116⤵PID:2844
-
\??\c:\9rlfrlr.exec:\9rlfrlr.exe117⤵PID:2700
-
\??\c:\9rrrlrf.exec:\9rrrlrf.exe118⤵PID:2728
-
\??\c:\1bnntb.exec:\1bnntb.exe119⤵PID:2688
-
\??\c:\jdddj.exec:\jdddj.exe120⤵PID:2628
-
\??\c:\3vvvj.exec:\3vvvj.exe121⤵PID:1012
-
\??\c:\rrlrffr.exec:\rrlrffr.exe122⤵PID:1532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-