Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
28/12/2024, 21:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe
Resource
win7-20240729-en
7 signatures
150 seconds
General
-
Target
324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe
-
Size
456KB
-
MD5
54228cbbc3980dffb6e84088304dcb71
-
SHA1
a685aee5b17f9b104ce5ae05e7ce48e919ae7c0e
-
SHA256
324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7
-
SHA512
dc2180444b8f0bbe729439294a544b26845c40727785c8bf32e03b114396fdaacbc737062dc98230c0b531832cfe8236100f8aff1cfc33a0e31a7314248add77
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeRV:q7Tc2NYHUrAwfMp3CDRV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 39 IoCs
resource yara_rule behavioral1/memory/2792-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2680-9-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2580-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1800-104-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-113-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/284-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-131-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-144-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2052-188-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1540-200-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2888-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1504-227-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/904-236-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2152-288-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2568-357-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/276-365-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/276-364-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-372-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2168-373-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1688-425-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2872-439-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1960-497-0x0000000000260000-0x000000000028A000-memory.dmp family_blackmoon behavioral1/memory/1216-520-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1748-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-574-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-582-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2580-595-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-660-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2792 hbhnhn.exe 2580 vdvdp.exe 2360 1vppd.exe 2712 9pjjv.exe 2576 nhhhnn.exe 1732 5vjjp.exe 3024 9hbhhh.exe 2948 ffllllr.exe 2040 ththnh.exe 1800 xxlrrrl.exe 2216 5thhth.exe 284 xflxflr.exe 2644 5bntht.exe 2384 llrxflr.exe 2280 7nhthb.exe 1420 frfrxlr.exe 784 ddpvj.exe 604 jvjdd.exe 2052 hhtbnb.exe 1540 xlrxllr.exe 1720 jjjpv.exe 2888 vddpj.exe 1504 djvjp.exe 904 ddvdv.exe 2476 pjpdd.exe 2344 flrrxxl.exe 2412 ppdjj.exe 1880 pjvvd.exe 1016 3nbbhh.exe 2152 9vppv.exe 3044 bbntbn.exe 1556 3ppvd.exe 2724 tnnttn.exe 2700 vvjpp.exe 2900 jpddj.exe 2360 3lxxxrx.exe 2688 7httbb.exe 2604 pppvd.exe 2576 rrxxxfl.exe 2568 tnttbt.exe 276 vppvd.exe 1904 rrffrrr.exe 2168 bhtnbh.exe 2364 7thhhn.exe 640 jpvpd.exe 2288 rxflxxf.exe 1592 ttbtnn.exe 284 ddpjp.exe 2872 ddvvd.exe 1688 xlxxffl.exe 2136 tttnhh.exe 1416 jpdvp.exe 484 flflrfr.exe 1084 btttnt.exe 696 dvddd.exe 2316 vvvdd.exe 2292 fxfxxrx.exe 1304 7nbtbb.exe 1568 1djjp.exe 2260 jjvvv.exe 1960 5xfxfll.exe 1500 1nntbb.exe 1668 jvdvd.exe 1216 fxfxffl.exe -
resource yara_rule behavioral1/memory/2792-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-104-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-113-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/284-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-131-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-144-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2280-152-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1420-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1540-200-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2888-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1504-227-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/904-236-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-357-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/276-364-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2168-373-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-425-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1668-505-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-520-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-574-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2580-595-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-652-0x00000000002A0000-0x00000000002CA000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffflrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2792 2680 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 2680 wrote to memory of 2792 2680 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 2680 wrote to memory of 2792 2680 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 2680 wrote to memory of 2792 2680 324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe 30 PID 2792 wrote to memory of 2580 2792 hbhnhn.exe 31 PID 2792 wrote to memory of 2580 2792 hbhnhn.exe 31 PID 2792 wrote to memory of 2580 2792 hbhnhn.exe 31 PID 2792 wrote to memory of 2580 2792 hbhnhn.exe 31 PID 2580 wrote to memory of 2360 2580 vdvdp.exe 32 PID 2580 wrote to memory of 2360 2580 vdvdp.exe 32 PID 2580 wrote to memory of 2360 2580 vdvdp.exe 32 PID 2580 wrote to memory of 2360 2580 vdvdp.exe 32 PID 2360 wrote to memory of 2712 2360 1vppd.exe 33 PID 2360 wrote to memory of 2712 2360 1vppd.exe 33 PID 2360 wrote to memory of 2712 2360 1vppd.exe 33 PID 2360 wrote to memory of 2712 2360 1vppd.exe 33 PID 2712 wrote to memory of 2576 2712 9pjjv.exe 34 PID 2712 wrote to memory of 2576 2712 9pjjv.exe 34 PID 2712 wrote to memory of 2576 2712 9pjjv.exe 34 PID 2712 wrote to memory of 2576 2712 9pjjv.exe 34 PID 2576 wrote to memory of 1732 2576 nhhhnn.exe 35 PID 2576 wrote to memory of 1732 2576 nhhhnn.exe 35 PID 2576 wrote to memory of 1732 2576 nhhhnn.exe 35 PID 2576 wrote to memory of 1732 2576 nhhhnn.exe 35 PID 1732 wrote to memory of 3024 1732 5vjjp.exe 36 PID 1732 wrote to memory of 3024 1732 5vjjp.exe 36 PID 1732 wrote to memory of 3024 1732 5vjjp.exe 36 PID 1732 wrote to memory of 3024 1732 5vjjp.exe 36 PID 3024 wrote to memory of 2948 3024 9hbhhh.exe 37 PID 3024 wrote to memory of 2948 3024 9hbhhh.exe 37 PID 3024 wrote to memory of 2948 3024 9hbhhh.exe 37 PID 3024 wrote to memory of 2948 3024 9hbhhh.exe 37 PID 2948 wrote to memory of 2040 2948 ffllllr.exe 38 PID 2948 wrote to memory of 2040 2948 ffllllr.exe 38 PID 2948 wrote to memory of 2040 2948 ffllllr.exe 38 PID 2948 wrote to memory of 2040 2948 ffllllr.exe 38 PID 2040 wrote to memory of 1800 2040 ththnh.exe 39 PID 2040 wrote to memory of 1800 2040 ththnh.exe 39 PID 2040 wrote to memory of 1800 2040 ththnh.exe 39 PID 2040 wrote to memory of 1800 2040 ththnh.exe 39 PID 1800 wrote to memory of 2216 1800 xxlrrrl.exe 40 PID 1800 wrote to memory of 2216 1800 xxlrrrl.exe 40 PID 1800 wrote to memory of 2216 1800 xxlrrrl.exe 40 PID 1800 wrote to memory of 2216 1800 xxlrrrl.exe 40 PID 2216 wrote to memory of 284 2216 5thhth.exe 41 PID 2216 wrote to memory of 284 2216 5thhth.exe 41 PID 2216 wrote to memory of 284 2216 5thhth.exe 41 PID 2216 wrote to memory of 284 2216 5thhth.exe 41 PID 284 wrote to memory of 2644 284 xflxflr.exe 42 PID 284 wrote to memory of 2644 284 xflxflr.exe 42 PID 284 wrote to memory of 2644 284 xflxflr.exe 42 PID 284 wrote to memory of 2644 284 xflxflr.exe 42 PID 2644 wrote to memory of 2384 2644 5bntht.exe 43 PID 2644 wrote to memory of 2384 2644 5bntht.exe 43 PID 2644 wrote to memory of 2384 2644 5bntht.exe 43 PID 2644 wrote to memory of 2384 2644 5bntht.exe 43 PID 2384 wrote to memory of 2280 2384 llrxflr.exe 44 PID 2384 wrote to memory of 2280 2384 llrxflr.exe 44 PID 2384 wrote to memory of 2280 2384 llrxflr.exe 44 PID 2384 wrote to memory of 2280 2384 llrxflr.exe 44 PID 2280 wrote to memory of 1420 2280 7nhthb.exe 45 PID 2280 wrote to memory of 1420 2280 7nhthb.exe 45 PID 2280 wrote to memory of 1420 2280 7nhthb.exe 45 PID 2280 wrote to memory of 1420 2280 7nhthb.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe"C:\Users\Admin\AppData\Local\Temp\324697037607e6c701b58fbac53f1cd4bb58b9325a4f0b49e2e7b95d324a9bb7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hbhnhn.exec:\hbhnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\vdvdp.exec:\vdvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1vppd.exec:\1vppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\9pjjv.exec:\9pjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nhhhnn.exec:\nhhhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5vjjp.exec:\5vjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\9hbhhh.exec:\9hbhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\ffllllr.exec:\ffllllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\ththnh.exec:\ththnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\xxlrrrl.exec:\xxlrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\5thhth.exec:\5thhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\xflxflr.exec:\xflxflr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:284 -
\??\c:\5bntht.exec:\5bntht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\llrxflr.exec:\llrxflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7nhthb.exec:\7nhthb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\frfrxlr.exec:\frfrxlr.exe17⤵
- Executes dropped EXE
PID:1420 -
\??\c:\ddpvj.exec:\ddpvj.exe18⤵
- Executes dropped EXE
PID:784 -
\??\c:\jvjdd.exec:\jvjdd.exe19⤵
- Executes dropped EXE
PID:604 -
\??\c:\hhtbnb.exec:\hhtbnb.exe20⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xlrxllr.exec:\xlrxllr.exe21⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jjjpv.exec:\jjjpv.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\vddpj.exec:\vddpj.exe23⤵
- Executes dropped EXE
PID:2888 -
\??\c:\djvjp.exec:\djvjp.exe24⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ddvdv.exec:\ddvdv.exe25⤵
- Executes dropped EXE
PID:904 -
\??\c:\pjpdd.exec:\pjpdd.exe26⤵
- Executes dropped EXE
PID:2476 -
\??\c:\flrrxxl.exec:\flrrxxl.exe27⤵
- Executes dropped EXE
PID:2344 -
\??\c:\ppdjj.exec:\ppdjj.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pjvvd.exec:\pjvvd.exe29⤵
- Executes dropped EXE
PID:1880 -
\??\c:\3nbbhh.exec:\3nbbhh.exe30⤵
- Executes dropped EXE
PID:1016 -
\??\c:\9vppv.exec:\9vppv.exe31⤵
- Executes dropped EXE
PID:2152 -
\??\c:\bbntbn.exec:\bbntbn.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\3ppvd.exec:\3ppvd.exe33⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tnnttn.exec:\tnnttn.exe34⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vvjpp.exec:\vvjpp.exe35⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jpddj.exec:\jpddj.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3lxxxrx.exec:\3lxxxrx.exe37⤵
- Executes dropped EXE
PID:2360 -
\??\c:\7httbb.exec:\7httbb.exe38⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pppvd.exec:\pppvd.exe39⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe40⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tnttbt.exec:\tnttbt.exe41⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vppvd.exec:\vppvd.exe42⤵
- Executes dropped EXE
PID:276 -
\??\c:\rrffrrr.exec:\rrffrrr.exe43⤵
- Executes dropped EXE
PID:1904 -
\??\c:\bhtnbh.exec:\bhtnbh.exe44⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7thhhn.exec:\7thhhn.exe45⤵
- Executes dropped EXE
PID:2364 -
\??\c:\jpvpd.exec:\jpvpd.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\rxflxxf.exec:\rxflxxf.exe47⤵
- Executes dropped EXE
PID:2288 -
\??\c:\ttbtnn.exec:\ttbtnn.exe48⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ddpjp.exec:\ddpjp.exe49⤵
- Executes dropped EXE
PID:284 -
\??\c:\ddvvd.exec:\ddvvd.exe50⤵
- Executes dropped EXE
PID:2872 -
\??\c:\xlxxffl.exec:\xlxxffl.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\tttnhh.exec:\tttnhh.exe52⤵
- Executes dropped EXE
PID:2136 -
\??\c:\jpdvp.exec:\jpdvp.exe53⤵
- Executes dropped EXE
PID:1416 -
\??\c:\flflrfr.exec:\flflrfr.exe54⤵
- Executes dropped EXE
PID:484 -
\??\c:\btttnt.exec:\btttnt.exe55⤵
- Executes dropped EXE
PID:1084 -
\??\c:\dvddd.exec:\dvddd.exe56⤵
- Executes dropped EXE
PID:696 -
\??\c:\vvvdd.exec:\vvvdd.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe58⤵
- Executes dropped EXE
PID:2292 -
\??\c:\7nbtbb.exec:\7nbtbb.exe59⤵
- Executes dropped EXE
PID:1304 -
\??\c:\1djjp.exec:\1djjp.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjvvv.exec:\jjvvv.exe61⤵
- Executes dropped EXE
PID:2260 -
\??\c:\5xfxfll.exec:\5xfxfll.exe62⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1nntbb.exec:\1nntbb.exe63⤵
- Executes dropped EXE
PID:1500 -
\??\c:\jvdvd.exec:\jvdvd.exe64⤵
- Executes dropped EXE
PID:1668 -
\??\c:\fxfxffl.exec:\fxfxffl.exe65⤵
- Executes dropped EXE
PID:1216 -
\??\c:\nnbbbb.exec:\nnbbbb.exe66⤵PID:1748
-
\??\c:\1dpvj.exec:\1dpvj.exe67⤵PID:2488
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe68⤵PID:3040
-
\??\c:\ffxrxxx.exec:\ffxrxxx.exe69⤵PID:568
-
\??\c:\hbhhnn.exec:\hbhhnn.exe70⤵PID:2848
-
\??\c:\dddjj.exec:\dddjj.exe71⤵PID:1016
-
\??\c:\flrrrxf.exec:\flrrrxf.exe72⤵PID:912
-
\??\c:\hhthnn.exec:\hhthnn.exe73⤵PID:2732
-
\??\c:\vvpjj.exec:\vvpjj.exe74⤵PID:2808
-
\??\c:\3djjj.exec:\3djjj.exe75⤵PID:2836
-
\??\c:\lfffffl.exec:\lfffffl.exe76⤵PID:2580
-
\??\c:\7nbbnt.exec:\7nbbnt.exe77⤵PID:2600
-
\??\c:\ppvvj.exec:\ppvvj.exe78⤵PID:3036
-
\??\c:\7jddp.exec:\7jddp.exe79⤵PID:2624
-
\??\c:\flxxrxl.exec:\flxxrxl.exe80⤵PID:3052
-
\??\c:\9tnntt.exec:\9tnntt.exe81⤵PID:580
-
\??\c:\pvpjj.exec:\pvpjj.exe82⤵PID:592
-
\??\c:\djvdj.exec:\djvdj.exe83⤵PID:2020
-
\??\c:\xxfrrll.exec:\xxfrrll.exe84⤵PID:2948
-
\??\c:\tnbttb.exec:\tnbttb.exe85⤵PID:2264
-
\??\c:\7pjjv.exec:\7pjjv.exe86⤵PID:2208
-
\??\c:\5jdjv.exec:\5jdjv.exe87⤵PID:620
-
\??\c:\1xfrfxf.exec:\1xfrfxf.exe88⤵PID:1796
-
\??\c:\1htbht.exec:\1htbht.exe89⤵PID:1592
-
\??\c:\tbhhtn.exec:\tbhhtn.exe90⤵PID:2460
-
\??\c:\1pjjp.exec:\1pjjp.exe91⤵PID:1884
-
\??\c:\lrlrlfr.exec:\lrlrlfr.exe92⤵PID:2524
-
\??\c:\bthhtt.exec:\bthhtt.exe93⤵PID:1856
-
\??\c:\nnnttt.exec:\nnnttt.exe94⤵PID:1124
-
\??\c:\ddppv.exec:\ddppv.exe95⤵PID:1708
-
\??\c:\xfrrxxx.exec:\xfrrxxx.exe96⤵PID:2236
-
\??\c:\xfffflr.exec:\xfffflr.exe97⤵PID:604
-
\??\c:\hntbbb.exec:\hntbbb.exe98⤵PID:2316
-
\??\c:\djpvd.exec:\djpvd.exe99⤵PID:1808
-
\??\c:\1dppv.exec:\1dppv.exe100⤵PID:2464
-
\??\c:\lrxxffl.exec:\lrxxffl.exe101⤵PID:324
-
\??\c:\thhhnn.exec:\thhhnn.exe102⤵PID:588
-
\??\c:\bbtbnb.exec:\bbtbnb.exe103⤵PID:1988
-
\??\c:\1ppvd.exec:\1ppvd.exe104⤵PID:1672
-
\??\c:\xrxflxr.exec:\xrxflxr.exe105⤵PID:2976
-
\??\c:\tbnntt.exec:\tbnntt.exe106⤵PID:824
-
\??\c:\nntbhh.exec:\nntbhh.exe107⤵PID:2476
-
\??\c:\3vpvd.exec:\3vpvd.exe108⤵PID:1852
-
\??\c:\rrxflrr.exec:\rrxflrr.exe109⤵PID:2312
-
\??\c:\bttnnh.exec:\bttnnh.exe110⤵PID:964
-
\??\c:\1dpvd.exec:\1dpvd.exe111⤵PID:2256
-
\??\c:\lrxxffr.exec:\lrxxffr.exe112⤵PID:1016
-
\??\c:\thnbht.exec:\thnbht.exe113⤵PID:1548
-
\??\c:\7vddp.exec:\7vddp.exe114⤵PID:2732
-
\??\c:\jdpjj.exec:\jdpjj.exe115⤵PID:1556
-
\??\c:\xxllrxl.exec:\xxllrxl.exe116⤵PID:2608
-
\??\c:\3tnnbb.exec:\3tnnbb.exe117⤵PID:2880
-
\??\c:\tnbhnt.exec:\tnbhnt.exe118⤵PID:2744
-
\??\c:\vvvvp.exec:\vvvvp.exe119⤵PID:2588
-
\??\c:\xxrxlrx.exec:\xxrxlrx.exe120⤵PID:2404
-
\??\c:\bhbbbb.exec:\bhbbbb.exe121⤵PID:2604
-
\??\c:\1vvvj.exec:\1vvvj.exe122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-