Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27/12/2024, 22:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe
-
Size
453KB
-
MD5
5790ef9b1f4c0efd0647dea58b516a69
-
SHA1
10e81b9544b2506fc018a958447b3c67e7ec1d34
-
SHA256
63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43
-
SHA512
af68257b5a99dbf6528390bf8d1caeb98ee1eb3a1b015136288f2e37d70a17f063c5f502931b591848a8c8d13c2a0c23450847a84fe1e25ce1d4d8eb4d80131e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeN3:q7Tc2NYHUrAwfMp3CDN3
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2368-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2964-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2304-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-65-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-92-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1316-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2908-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2792-139-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3036-143-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-180-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2124-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-214-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-230-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1828-295-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1740-306-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1128-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-346-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2304-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-386-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1028-463-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1540-532-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2056-551-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1236-604-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2512-644-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1408-735-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2232-769-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1812-808-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/2616-871-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2224-872-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 fvnrvf.exe 2184 dxttv.exe 2912 jdjdxf.exe 2964 nbhfdv.exe 2304 lbrtd.exe 2836 tjjdt.exe 2016 rllhf.exe 2516 rdvrhh.exe 2540 rlllv.exe 1316 hbppdn.exe 2360 vvtjbdr.exe 2908 thfvb.exe 2276 rrxljx.exe 2792 xvhdf.exe 3036 brxvr.exe 2088 tlvvt.exe 1548 xjbrn.exe 764 fxflb.exe 2508 vvtrjxf.exe 2124 thhdtb.exe 2404 vrnnj.exe 2408 ffxht.exe 856 ftftj.exe 2776 btvlhhv.exe 1320 rldrvd.exe 1004 bfjfxhh.exe 2264 tbtbt.exe 1744 dhrjth.exe 2388 vlrvjrl.exe 1544 tnjbtf.exe 1828 xhbhdp.exe 2112 tfbpt.exe 1740 hbvpp.exe 1128 vtjdlj.exe 2900 rxnxvln.exe 2936 xnjhx.exe 2004 dxnlblr.exe 2020 hllhpl.exe 2180 tnpldt.exe 2304 ljbvtv.exe 2896 fvxbbh.exe 2812 pnxtd.exe 2872 nrjjpn.exe 2548 bdlrd.exe 1552 njnjt.exe 940 txdhlxf.exe 1988 hljtvr.exe 2996 hvlxhl.exe 1460 jlbht.exe 2908 bdlhn.exe 2860 bbvtjfb.exe 1108 pbltb.exe 608 npfld.exe 1632 rpvrf.exe 2088 vvblb.exe 1028 xfxltbh.exe 2504 ttvljlp.exe 2052 rrhhvbn.exe 2476 dxdxln.exe 2384 xdhdr.exe 2472 vbjlbh.exe 2064 rfhnln.exe 912 hvpvhv.exe 756 ntxpvth.exe -
resource yara_rule behavioral1/memory/1736-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2368-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2184-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2964-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2016-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-95-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-92-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1316-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2908-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2792-139-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3036-143-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-180-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2124-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-214-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-230-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2264-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1828-295-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-306-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1128-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-347-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2304-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1988-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2860-426-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1028-463-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-532-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2056-551-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2288-579-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2512-644-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2136-696-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1408-735-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2232-769-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1564-817-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2224-872-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trtpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfxrrnj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xjbrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nxfrjfb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fpjvf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnvljh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pplfnrp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnpnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxhlh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vprjdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvhxjn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjhhhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjfnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvxbpx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hpxjfdb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpttjdh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxdjvlj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxjpbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltjxddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrdvfhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnfxnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xntffjb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvllfpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dbptp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdbf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpnhtj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2368 1736 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 1736 wrote to memory of 2368 1736 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 1736 wrote to memory of 2368 1736 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 1736 wrote to memory of 2368 1736 63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe 30 PID 2368 wrote to memory of 2184 2368 fvnrvf.exe 31 PID 2368 wrote to memory of 2184 2368 fvnrvf.exe 31 PID 2368 wrote to memory of 2184 2368 fvnrvf.exe 31 PID 2368 wrote to memory of 2184 2368 fvnrvf.exe 31 PID 2184 wrote to memory of 2912 2184 dxttv.exe 32 PID 2184 wrote to memory of 2912 2184 dxttv.exe 32 PID 2184 wrote to memory of 2912 2184 dxttv.exe 32 PID 2184 wrote to memory of 2912 2184 dxttv.exe 32 PID 2912 wrote to memory of 2964 2912 jdjdxf.exe 33 PID 2912 wrote to memory of 2964 2912 jdjdxf.exe 33 PID 2912 wrote to memory of 2964 2912 jdjdxf.exe 33 PID 2912 wrote to memory of 2964 2912 jdjdxf.exe 33 PID 2964 wrote to memory of 2304 2964 nbhfdv.exe 34 PID 2964 wrote to memory of 2304 2964 nbhfdv.exe 34 PID 2964 wrote to memory of 2304 2964 nbhfdv.exe 34 PID 2964 wrote to memory of 2304 2964 nbhfdv.exe 34 PID 2304 wrote to memory of 2836 2304 lbrtd.exe 35 PID 2304 wrote to memory of 2836 2304 lbrtd.exe 35 PID 2304 wrote to memory of 2836 2304 lbrtd.exe 35 PID 2304 wrote to memory of 2836 2304 lbrtd.exe 35 PID 2836 wrote to memory of 2016 2836 tjjdt.exe 36 PID 2836 wrote to memory of 2016 2836 tjjdt.exe 36 PID 2836 wrote to memory of 2016 2836 tjjdt.exe 36 PID 2836 wrote to memory of 2016 2836 tjjdt.exe 36 PID 2016 wrote to memory of 2516 2016 rllhf.exe 37 PID 2016 wrote to memory of 2516 2016 rllhf.exe 37 PID 2016 wrote to memory of 2516 2016 rllhf.exe 37 PID 2016 wrote to memory of 2516 2016 rllhf.exe 37 PID 2516 wrote to memory of 2540 2516 rdvrhh.exe 38 PID 2516 wrote to memory of 2540 2516 rdvrhh.exe 38 PID 2516 wrote to memory of 2540 2516 rdvrhh.exe 38 PID 2516 wrote to memory of 2540 2516 rdvrhh.exe 38 PID 2540 wrote to memory of 1316 2540 rlllv.exe 39 PID 2540 wrote to memory of 1316 2540 rlllv.exe 39 PID 2540 wrote to memory of 1316 2540 rlllv.exe 39 PID 2540 wrote to memory of 1316 2540 rlllv.exe 39 PID 1316 wrote to memory of 2360 1316 hbppdn.exe 40 PID 1316 wrote to memory of 2360 1316 hbppdn.exe 40 PID 1316 wrote to memory of 2360 1316 hbppdn.exe 40 PID 1316 wrote to memory of 2360 1316 hbppdn.exe 40 PID 2360 wrote to memory of 2908 2360 vvtjbdr.exe 41 PID 2360 wrote to memory of 2908 2360 vvtjbdr.exe 41 PID 2360 wrote to memory of 2908 2360 vvtjbdr.exe 41 PID 2360 wrote to memory of 2908 2360 vvtjbdr.exe 41 PID 2908 wrote to memory of 2276 2908 thfvb.exe 42 PID 2908 wrote to memory of 2276 2908 thfvb.exe 42 PID 2908 wrote to memory of 2276 2908 thfvb.exe 42 PID 2908 wrote to memory of 2276 2908 thfvb.exe 42 PID 2276 wrote to memory of 2792 2276 rrxljx.exe 43 PID 2276 wrote to memory of 2792 2276 rrxljx.exe 43 PID 2276 wrote to memory of 2792 2276 rrxljx.exe 43 PID 2276 wrote to memory of 2792 2276 rrxljx.exe 43 PID 2792 wrote to memory of 3036 2792 xvhdf.exe 44 PID 2792 wrote to memory of 3036 2792 xvhdf.exe 44 PID 2792 wrote to memory of 3036 2792 xvhdf.exe 44 PID 2792 wrote to memory of 3036 2792 xvhdf.exe 44 PID 3036 wrote to memory of 2088 3036 brxvr.exe 45 PID 3036 wrote to memory of 2088 3036 brxvr.exe 45 PID 3036 wrote to memory of 2088 3036 brxvr.exe 45 PID 3036 wrote to memory of 2088 3036 brxvr.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe"C:\Users\Admin\AppData\Local\Temp\63127448c68f9ab92928fd560e4670cb893bc1b05a922b016abeb14ad6fc9f43.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\fvnrvf.exec:\fvnrvf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\dxttv.exec:\dxttv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\jdjdxf.exec:\jdjdxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nbhfdv.exec:\nbhfdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\lbrtd.exec:\lbrtd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\tjjdt.exec:\tjjdt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\rllhf.exec:\rllhf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\rdvrhh.exec:\rdvrhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rlllv.exec:\rlllv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\hbppdn.exec:\hbppdn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\vvtjbdr.exec:\vvtjbdr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\thfvb.exec:\thfvb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\rrxljx.exec:\rrxljx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xvhdf.exec:\xvhdf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\brxvr.exec:\brxvr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tlvvt.exec:\tlvvt.exe17⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xjbrn.exec:\xjbrn.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1548 -
\??\c:\fxflb.exec:\fxflb.exe19⤵
- Executes dropped EXE
PID:764 -
\??\c:\vvtrjxf.exec:\vvtrjxf.exe20⤵
- Executes dropped EXE
PID:2508 -
\??\c:\thhdtb.exec:\thhdtb.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\vrnnj.exec:\vrnnj.exe22⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ffxht.exec:\ffxht.exe23⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ftftj.exec:\ftftj.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\btvlhhv.exec:\btvlhhv.exe25⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rldrvd.exec:\rldrvd.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\bfjfxhh.exec:\bfjfxhh.exe27⤵
- Executes dropped EXE
PID:1004 -
\??\c:\tbtbt.exec:\tbtbt.exe28⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dhrjth.exec:\dhrjth.exe29⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vlrvjrl.exec:\vlrvjrl.exe30⤵
- Executes dropped EXE
PID:2388 -
\??\c:\tnjbtf.exec:\tnjbtf.exe31⤵
- Executes dropped EXE
PID:1544 -
\??\c:\xhbhdp.exec:\xhbhdp.exe32⤵
- Executes dropped EXE
PID:1828 -
\??\c:\tfbpt.exec:\tfbpt.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\hbvpp.exec:\hbvpp.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vtjdlj.exec:\vtjdlj.exe35⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rxnxvln.exec:\rxnxvln.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\xnjhx.exec:\xnjhx.exe37⤵
- Executes dropped EXE
PID:2936 -
\??\c:\dxnlblr.exec:\dxnlblr.exe38⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hllhpl.exec:\hllhpl.exe39⤵
- Executes dropped EXE
PID:2020 -
\??\c:\tnpldt.exec:\tnpldt.exe40⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ljbvtv.exec:\ljbvtv.exe41⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fvxbbh.exec:\fvxbbh.exe42⤵
- Executes dropped EXE
PID:2896 -
\??\c:\pnxtd.exec:\pnxtd.exe43⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nrjjpn.exec:\nrjjpn.exe44⤵
- Executes dropped EXE
PID:2872 -
\??\c:\bdlrd.exec:\bdlrd.exe45⤵
- Executes dropped EXE
PID:2548 -
\??\c:\njnjt.exec:\njnjt.exe46⤵
- Executes dropped EXE
PID:1552 -
\??\c:\txdhlxf.exec:\txdhlxf.exe47⤵
- Executes dropped EXE
PID:940 -
\??\c:\hljtvr.exec:\hljtvr.exe48⤵
- Executes dropped EXE
PID:1988 -
\??\c:\hvlxhl.exec:\hvlxhl.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jlbht.exec:\jlbht.exe50⤵
- Executes dropped EXE
PID:1460 -
\??\c:\bdlhn.exec:\bdlhn.exe51⤵
- Executes dropped EXE
PID:2908 -
\??\c:\bbvtjfb.exec:\bbvtjfb.exe52⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pbltb.exec:\pbltb.exe53⤵
- Executes dropped EXE
PID:1108 -
\??\c:\npfld.exec:\npfld.exe54⤵
- Executes dropped EXE
PID:608 -
\??\c:\rpvrf.exec:\rpvrf.exe55⤵
- Executes dropped EXE
PID:1632 -
\??\c:\vvblb.exec:\vvblb.exe56⤵
- Executes dropped EXE
PID:2088 -
\??\c:\xfxltbh.exec:\xfxltbh.exe57⤵
- Executes dropped EXE
PID:1028 -
\??\c:\ttvljlp.exec:\ttvljlp.exe58⤵
- Executes dropped EXE
PID:2504 -
\??\c:\rrhhvbn.exec:\rrhhvbn.exe59⤵
- Executes dropped EXE
PID:2052 -
\??\c:\dxdxln.exec:\dxdxln.exe60⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xdhdr.exec:\xdhdr.exe61⤵
- Executes dropped EXE
PID:2384 -
\??\c:\vbjlbh.exec:\vbjlbh.exe62⤵
- Executes dropped EXE
PID:2472 -
\??\c:\rfhnln.exec:\rfhnln.exe63⤵
- Executes dropped EXE
PID:2064 -
\??\c:\hvpvhv.exec:\hvpvhv.exe64⤵
- Executes dropped EXE
PID:912 -
\??\c:\ntxpvth.exec:\ntxpvth.exe65⤵
- Executes dropped EXE
PID:756 -
\??\c:\jdxjxnd.exec:\jdxjxnd.exe66⤵PID:1812
-
\??\c:\dtdxvjp.exec:\dtdxvjp.exe67⤵PID:2776
-
\??\c:\nnvvbhh.exec:\nnvvbhh.exe68⤵PID:1540
-
\??\c:\pvfdv.exec:\pvfdv.exe69⤵PID:2532
-
\??\c:\fttdpd.exec:\fttdpd.exe70⤵PID:1308
-
\??\c:\bplxvfr.exec:\bplxvfr.exe71⤵PID:632
-
\??\c:\pxfll.exec:\pxfll.exe72⤵PID:2056
-
\??\c:\lvdhjff.exec:\lvdhjff.exe73⤵PID:2892
-
\??\c:\bnfxnnn.exec:\bnfxnnn.exe74⤵
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\vtttxb.exec:\vtttxb.exe75⤵PID:2616
-
\??\c:\tvbpvfv.exec:\tvbpvfv.exe76⤵PID:2288
-
\??\c:\lrvnbn.exec:\lrvnbn.exe77⤵PID:888
-
\??\c:\bdlvjj.exec:\bdlvjj.exe78⤵PID:2156
-
\??\c:\jrbxhjt.exec:\jrbxhjt.exe79⤵PID:1236
-
\??\c:\rpljpb.exec:\rpljpb.exe80⤵PID:2916
-
\??\c:\brlnv.exec:\brlnv.exe81⤵PID:2036
-
\??\c:\nfljbr.exec:\nfljbr.exe82⤵PID:3060
-
\??\c:\nddfvp.exec:\nddfvp.exe83⤵PID:2636
-
\??\c:\ddhhdtj.exec:\ddhhdtj.exe84⤵PID:2844
-
\??\c:\rhflx.exec:\rhflx.exe85⤵PID:2512
-
\??\c:\pxdjdf.exec:\pxdjdf.exe86⤵PID:2836
-
\??\c:\jvltnl.exec:\jvltnl.exe87⤵PID:2884
-
\??\c:\tlrvr.exec:\tlrvr.exe88⤵PID:2444
-
\??\c:\dtthblj.exec:\dtthblj.exe89⤵PID:2272
-
\??\c:\rfvnhv.exec:\rfvnhv.exe90⤵PID:3004
-
\??\c:\xpxpb.exec:\xpxpb.exe91⤵PID:944
-
\??\c:\rtjhn.exec:\rtjhn.exe92⤵PID:1192
-
\??\c:\njhlxtf.exec:\njhlxtf.exe93⤵PID:3020
-
\??\c:\jhxfv.exec:\jhxfv.exe94⤵PID:2136
-
\??\c:\nbbjd.exec:\nbbjd.exe95⤵PID:2740
-
\??\c:\fpxffnt.exec:\fpxffnt.exe96⤵PID:2344
-
\??\c:\nvfpn.exec:\nvfpn.exe97⤵PID:2792
-
\??\c:\hdfdbfj.exec:\hdfdbfj.exe98⤵PID:3036
-
\??\c:\bbvxdft.exec:\bbvxdft.exe99⤵PID:1408
-
\??\c:\lldjbl.exec:\lldjbl.exe100⤵PID:1348
-
\??\c:\ftfrvr.exec:\ftfrvr.exe101⤵PID:1760
-
\??\c:\pvjjtrf.exec:\pvjjtrf.exe102⤵PID:2268
-
\??\c:\bxfnl.exec:\bxfnl.exe103⤵PID:1532
-
\??\c:\jbxvh.exec:\jbxvh.exe104⤵PID:2232
-
\??\c:\nthpd.exec:\nthpd.exe105⤵PID:1644
-
\??\c:\fhxhjx.exec:\fhxhjx.exe106⤵PID:2280
-
\??\c:\fntpnjl.exec:\fntpnjl.exe107⤵PID:2064
-
\??\c:\ntnhxn.exec:\ntnhxn.exe108⤵PID:820
-
\??\c:\nxlnlrh.exec:\nxlnlrh.exe109⤵PID:756
-
\??\c:\tppnrfh.exec:\tppnrfh.exe110⤵PID:1812
-
\??\c:\flltbbb.exec:\flltbbb.exe111⤵PID:1996
-
\??\c:\nbvbppb.exec:\nbvbppb.exe112⤵PID:1564
-
\??\c:\tvfnldl.exec:\tvfnldl.exe113⤵PID:1656
-
\??\c:\tptpx.exec:\tptpx.exe114⤵PID:2604
-
\??\c:\rjvdhj.exec:\rjvdhj.exe115⤵PID:1768
-
\??\c:\hrjnlv.exec:\hrjnlv.exe116⤵PID:1820
-
\??\c:\vndbdpb.exec:\vndbdpb.exe117⤵PID:2892
-
\??\c:\dbpphh.exec:\dbpphh.exe118⤵PID:536
-
\??\c:\jdhrpd.exec:\jdhrpd.exe119⤵PID:2616
-
\??\c:\ntfhdjh.exec:\ntfhdjh.exe120⤵PID:2224
-
\??\c:\npndvdf.exec:\npndvdf.exe121⤵PID:1704
-
\??\c:\dbhjvvb.exec:\dbhjvvb.exe122⤵PID:1984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-