Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 01:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe
-
Size
456KB
-
MD5
7c5ae6140ef8bdf10df5bff29e5eaa3d
-
SHA1
5e67f88f4c47fd7f230a393a5ede8bbbdc0b5e6a
-
SHA256
84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683
-
SHA512
d9c85c3aa5bf2c03b0eda75ef9fb2cf1449304c6023b9e24c1e77b1afcc95c7786136ad92a1ece457c855da0accf1a5a093efc4bccfd52a7396f90154f75e27e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbe1:q7Tc2NYHUrAwfMp3CD1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2808-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-36-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3012-44-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2700-54-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/432-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2720-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1952-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-105-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2212-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-122-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/264-165-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-197-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-195-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-204-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1940-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1060-231-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1800-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2272-233-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/864-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2808-309-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-330-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2112-355-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2404-362-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-370-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1184-389-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2628-424-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1484-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/700-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2360-476-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1600-489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1960-516-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1808-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-571-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2864-600-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2176-712-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2752-818-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2856 bvphfhl.exe 3052 vljbjlb.exe 2936 jbbpxvh.exe 3012 bxffr.exe 2700 xnjrff.exe 2720 vlrxjdl.exe 432 htxrtnb.exe 1952 tlxxlph.exe 1932 xjbddt.exe 2212 phxxvp.exe 2196 lrxrjjp.exe 2424 jvjpv.exe 2956 rbfnr.exe 2396 xhjfvvn.exe 1928 pbnfj.exe 2376 bptnnl.exe 264 fxvtnxv.exe 2064 hbbpr.exe 2360 prxfrr.exe 1980 hrhbrh.exe 1060 hhhhdl.exe 828 vffnjnl.exe 1940 lrndjj.exe 2272 ffbjfdt.exe 1800 dlptxbt.exe 736 nrntvv.exe 1736 ndrtd.exe 1956 tfblhd.exe 1664 drnvn.exe 340 rhrrtn.exe 1704 rjrplpd.exe 864 fbdftd.exe 2808 vvtpx.exe 2816 nhnlt.exe 2792 ntxxjpn.exe 3048 nfrhv.exe 2704 vjpvx.exe 2364 bbdbnv.exe 2732 fhfrlth.exe 2112 dlhbtl.exe 2404 vdtrt.exe 2980 jbntld.exe 432 tbhrd.exe 2004 prhvlxr.exe 1184 jjbhxjj.exe 2852 lvdbxv.exe 1936 xbhdrtf.exe 2996 xvbxxx.exe 2736 bnrnrf.exe 2524 tnplr.exe 2628 xnfxj.exe 1484 fdtnlx.exe 2988 dfbjxjx.exe 700 fbnvt.exe 2136 bhjbfbv.exe 2164 phnhxdj.exe 2248 xphdvbj.exe 2356 vbvvbdb.exe 2360 xdtxx.exe 2748 jrffvb.exe 1600 pfnvhr.exe 952 ddvbnl.exe 828 hvfvtnf.exe 1960 dlhllhp.exe -
resource yara_rule behavioral1/memory/2808-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-36-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3012-44-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2700-54-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/432-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2720-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1952-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-105-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2212-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-122-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/264-165-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2360-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1060-197-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-195-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1940-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2272-233-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-294-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2808-309-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-330-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2112-355-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2404-362-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2980-370-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1184-389-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-409-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-424-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1484-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/700-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-489-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/952-495-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-516-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1808-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-600-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/868-714-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-818-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1708-850-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2432-853-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvjrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fnjhxj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xnxbjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffjndp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tlvvxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdrtjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhhffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ltvht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjnfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tpblrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lpnvbl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hphtjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbtvbhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rjxjdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jrphdjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlxfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rnltfjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bfhfhdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frthlft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vltnfv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pxtdxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnpll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dlhllhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vxjhlnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhrrxjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language npvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dnntnv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbrdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxrlrb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xhlfpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njphhd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vtfnhj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jtrnhxh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfhtfl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 2856 2808 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 30 PID 2808 wrote to memory of 2856 2808 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 30 PID 2808 wrote to memory of 2856 2808 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 30 PID 2808 wrote to memory of 2856 2808 84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe 30 PID 2856 wrote to memory of 3052 2856 bvphfhl.exe 31 PID 2856 wrote to memory of 3052 2856 bvphfhl.exe 31 PID 2856 wrote to memory of 3052 2856 bvphfhl.exe 31 PID 2856 wrote to memory of 3052 2856 bvphfhl.exe 31 PID 3052 wrote to memory of 2936 3052 vljbjlb.exe 32 PID 3052 wrote to memory of 2936 3052 vljbjlb.exe 32 PID 3052 wrote to memory of 2936 3052 vljbjlb.exe 32 PID 3052 wrote to memory of 2936 3052 vljbjlb.exe 32 PID 2936 wrote to memory of 3012 2936 jbbpxvh.exe 33 PID 2936 wrote to memory of 3012 2936 jbbpxvh.exe 33 PID 2936 wrote to memory of 3012 2936 jbbpxvh.exe 33 PID 2936 wrote to memory of 3012 2936 jbbpxvh.exe 33 PID 3012 wrote to memory of 2700 3012 bxffr.exe 34 PID 3012 wrote to memory of 2700 3012 bxffr.exe 34 PID 3012 wrote to memory of 2700 3012 bxffr.exe 34 PID 3012 wrote to memory of 2700 3012 bxffr.exe 34 PID 2700 wrote to memory of 2720 2700 xnjrff.exe 35 PID 2700 wrote to memory of 2720 2700 xnjrff.exe 35 PID 2700 wrote to memory of 2720 2700 xnjrff.exe 35 PID 2700 wrote to memory of 2720 2700 xnjrff.exe 35 PID 2720 wrote to memory of 432 2720 vlrxjdl.exe 36 PID 2720 wrote to memory of 432 2720 vlrxjdl.exe 36 PID 2720 wrote to memory of 432 2720 vlrxjdl.exe 36 PID 2720 wrote to memory of 432 2720 vlrxjdl.exe 36 PID 432 wrote to memory of 1952 432 htxrtnb.exe 37 PID 432 wrote to memory of 1952 432 htxrtnb.exe 37 PID 432 wrote to memory of 1952 432 htxrtnb.exe 37 PID 432 wrote to memory of 1952 432 htxrtnb.exe 37 PID 1952 wrote to memory of 1932 1952 tlxxlph.exe 38 PID 1952 wrote to memory of 1932 1952 tlxxlph.exe 38 PID 1952 wrote to memory of 1932 1952 tlxxlph.exe 38 PID 1952 wrote to memory of 1932 1952 tlxxlph.exe 38 PID 1932 wrote to memory of 2212 1932 xjbddt.exe 39 PID 1932 wrote to memory of 2212 1932 xjbddt.exe 39 PID 1932 wrote to memory of 2212 1932 xjbddt.exe 39 PID 1932 wrote to memory of 2212 1932 xjbddt.exe 39 PID 2212 wrote to memory of 2196 2212 phxxvp.exe 40 PID 2212 wrote to memory of 2196 2212 phxxvp.exe 40 PID 2212 wrote to memory of 2196 2212 phxxvp.exe 40 PID 2212 wrote to memory of 2196 2212 phxxvp.exe 40 PID 2196 wrote to memory of 2424 2196 lrxrjjp.exe 41 PID 2196 wrote to memory of 2424 2196 lrxrjjp.exe 41 PID 2196 wrote to memory of 2424 2196 lrxrjjp.exe 41 PID 2196 wrote to memory of 2424 2196 lrxrjjp.exe 41 PID 2424 wrote to memory of 2956 2424 jvjpv.exe 42 PID 2424 wrote to memory of 2956 2424 jvjpv.exe 42 PID 2424 wrote to memory of 2956 2424 jvjpv.exe 42 PID 2424 wrote to memory of 2956 2424 jvjpv.exe 42 PID 2956 wrote to memory of 2396 2956 rbfnr.exe 43 PID 2956 wrote to memory of 2396 2956 rbfnr.exe 43 PID 2956 wrote to memory of 2396 2956 rbfnr.exe 43 PID 2956 wrote to memory of 2396 2956 rbfnr.exe 43 PID 2396 wrote to memory of 1928 2396 xhjfvvn.exe 44 PID 2396 wrote to memory of 1928 2396 xhjfvvn.exe 44 PID 2396 wrote to memory of 1928 2396 xhjfvvn.exe 44 PID 2396 wrote to memory of 1928 2396 xhjfvvn.exe 44 PID 1928 wrote to memory of 2376 1928 pbnfj.exe 45 PID 1928 wrote to memory of 2376 1928 pbnfj.exe 45 PID 1928 wrote to memory of 2376 1928 pbnfj.exe 45 PID 1928 wrote to memory of 2376 1928 pbnfj.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"C:\Users\Admin\AppData\Local\Temp\84655e5521931ea7a3fa77304ff757d282a6abf8db02f246da0807af8744a683.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bvphfhl.exec:\bvphfhl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\vljbjlb.exec:\vljbjlb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\jbbpxvh.exec:\jbbpxvh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\bxffr.exec:\bxffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xnjrff.exec:\xnjrff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\vlrxjdl.exec:\vlrxjdl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\htxrtnb.exec:\htxrtnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\tlxxlph.exec:\tlxxlph.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\xjbddt.exec:\xjbddt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\phxxvp.exec:\phxxvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\lrxrjjp.exec:\lrxrjjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\jvjpv.exec:\jvjpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rbfnr.exec:\rbfnr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\xhjfvvn.exec:\xhjfvvn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pbnfj.exec:\pbnfj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\bptnnl.exec:\bptnnl.exe17⤵
- Executes dropped EXE
PID:2376 -
\??\c:\fxvtnxv.exec:\fxvtnxv.exe18⤵
- Executes dropped EXE
PID:264 -
\??\c:\hbbpr.exec:\hbbpr.exe19⤵
- Executes dropped EXE
PID:2064 -
\??\c:\prxfrr.exec:\prxfrr.exe20⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hrhbrh.exec:\hrhbrh.exe21⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hhhhdl.exec:\hhhhdl.exe22⤵
- Executes dropped EXE
PID:1060 -
\??\c:\vffnjnl.exec:\vffnjnl.exe23⤵
- Executes dropped EXE
PID:828 -
\??\c:\lrndjj.exec:\lrndjj.exe24⤵
- Executes dropped EXE
PID:1940 -
\??\c:\ffbjfdt.exec:\ffbjfdt.exe25⤵
- Executes dropped EXE
PID:2272 -
\??\c:\dlptxbt.exec:\dlptxbt.exe26⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nrntvv.exec:\nrntvv.exe27⤵
- Executes dropped EXE
PID:736 -
\??\c:\ndrtd.exec:\ndrtd.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\tfblhd.exec:\tfblhd.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\drnvn.exec:\drnvn.exe30⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rhrrtn.exec:\rhrrtn.exe31⤵
- Executes dropped EXE
PID:340 -
\??\c:\rjrplpd.exec:\rjrplpd.exe32⤵
- Executes dropped EXE
PID:1704 -
\??\c:\fbdftd.exec:\fbdftd.exe33⤵
- Executes dropped EXE
PID:864 -
\??\c:\vvtpx.exec:\vvtpx.exe34⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nhnlt.exec:\nhnlt.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\ntxxjpn.exec:\ntxxjpn.exe36⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nfrhv.exec:\nfrhv.exe37⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vjpvx.exec:\vjpvx.exe38⤵
- Executes dropped EXE
PID:2704 -
\??\c:\bbdbnv.exec:\bbdbnv.exe39⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fhfrlth.exec:\fhfrlth.exe40⤵
- Executes dropped EXE
PID:2732 -
\??\c:\dlhbtl.exec:\dlhbtl.exe41⤵
- Executes dropped EXE
PID:2112 -
\??\c:\vdtrt.exec:\vdtrt.exe42⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jbntld.exec:\jbntld.exe43⤵
- Executes dropped EXE
PID:2980 -
\??\c:\tbhrd.exec:\tbhrd.exe44⤵
- Executes dropped EXE
PID:432 -
\??\c:\prhvlxr.exec:\prhvlxr.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jjbhxjj.exec:\jjbhxjj.exe46⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lvdbxv.exec:\lvdbxv.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xbhdrtf.exec:\xbhdrtf.exe48⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xvbxxx.exec:\xvbxxx.exe49⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bnrnrf.exec:\bnrnrf.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\tnplr.exec:\tnplr.exe51⤵
- Executes dropped EXE
PID:2524 -
\??\c:\xnfxj.exec:\xnfxj.exe52⤵
- Executes dropped EXE
PID:2628 -
\??\c:\fdtnlx.exec:\fdtnlx.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\dfbjxjx.exec:\dfbjxjx.exe54⤵
- Executes dropped EXE
PID:2988 -
\??\c:\fbnvt.exec:\fbnvt.exe55⤵
- Executes dropped EXE
PID:700 -
\??\c:\bhjbfbv.exec:\bhjbfbv.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\phnhxdj.exec:\phnhxdj.exe57⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xphdvbj.exec:\xphdvbj.exe58⤵
- Executes dropped EXE
PID:2248 -
\??\c:\vbvvbdb.exec:\vbvvbdb.exe59⤵
- Executes dropped EXE
PID:2356 -
\??\c:\xdtxx.exec:\xdtxx.exe60⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jrffvb.exec:\jrffvb.exe61⤵
- Executes dropped EXE
PID:2748 -
\??\c:\pfnvhr.exec:\pfnvhr.exe62⤵
- Executes dropped EXE
PID:1600 -
\??\c:\ddvbnl.exec:\ddvbnl.exe63⤵
- Executes dropped EXE
PID:952 -
\??\c:\hvfvtnf.exec:\hvfvtnf.exe64⤵
- Executes dropped EXE
PID:828 -
\??\c:\dlhllhp.exec:\dlhllhp.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1960 -
\??\c:\jtltfn.exec:\jtltfn.exe66⤵PID:2456
-
\??\c:\jxndxpf.exec:\jxndxpf.exe67⤵PID:1976
-
\??\c:\lpnvbl.exec:\lpnvbl.exe68⤵
- System Location Discovery: System Language Discovery
PID:1800 -
\??\c:\bhndj.exec:\bhndj.exe69⤵PID:784
-
\??\c:\pnjtdvf.exec:\pnjtdvf.exe70⤵PID:3032
-
\??\c:\rjldfnt.exec:\rjldfnt.exe71⤵PID:2324
-
\??\c:\xdrfl.exec:\xdrfl.exe72⤵PID:284
-
\??\c:\fvdtpt.exec:\fvdtpt.exe73⤵PID:1808
-
\??\c:\ljnpppt.exec:\ljnpppt.exe74⤵PID:340
-
\??\c:\jfpxf.exec:\jfpxf.exe75⤵PID:1900
-
\??\c:\btpfxfx.exec:\btpfxfx.exe76⤵PID:2796
-
\??\c:\vlxrhf.exec:\vlxrhf.exe77⤵PID:1536
-
\??\c:\vxbbnt.exec:\vxbbnt.exe78⤵PID:2864
-
\??\c:\jjbrjdx.exec:\jjbrjdx.exe79⤵PID:2492
-
\??\c:\fdpnhnt.exec:\fdpnhnt.exe80⤵PID:2812
-
\??\c:\dhtlhj.exec:\dhtlhj.exe81⤵PID:3028
-
\??\c:\nddpj.exec:\nddpj.exe82⤵PID:2832
-
\??\c:\rvtnbjr.exec:\rvtnbjr.exe83⤵PID:1668
-
\??\c:\djprdv.exec:\djprdv.exe84⤵PID:2712
-
\??\c:\rffdjlf.exec:\rffdjlf.exe85⤵PID:2112
-
\??\c:\fpvbh.exec:\fpvbh.exe86⤵PID:3016
-
\??\c:\lnllb.exec:\lnllb.exe87⤵PID:1804
-
\??\c:\ttnjljp.exec:\ttnjljp.exe88⤵PID:3068
-
\??\c:\rxbnll.exec:\rxbnll.exe89⤵PID:912
-
\??\c:\vtbnbnp.exec:\vtbnbnp.exe90⤵PID:3060
-
\??\c:\nhdxl.exec:\nhdxl.exe91⤵PID:2616
-
\??\c:\bltddtv.exec:\bltddtv.exe92⤵PID:1684
-
\??\c:\nplbxxh.exec:\nplbxxh.exe93⤵PID:2984
-
\??\c:\njphhd.exec:\njphhd.exe94⤵
- System Location Discovery: System Language Discovery
PID:2960 -
\??\c:\rhjhjd.exec:\rhjhjd.exe95⤵PID:2176
-
\??\c:\hjtnnnp.exec:\hjtnnnp.exe96⤵PID:868
-
\??\c:\bvbjvbx.exec:\bvbjvbx.exe97⤵PID:1928
-
\??\c:\dtnvd.exec:\dtnvd.exe98⤵PID:2376
-
\??\c:\tfhtfl.exec:\tfhtfl.exe99⤵
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\rjjhf.exec:\rjjhf.exe100⤵PID:2384
-
\??\c:\pvvvxfj.exec:\pvvvxfj.exe101⤵PID:2528
-
\??\c:\fdjdbrt.exec:\fdjdbrt.exe102⤵PID:2236
-
\??\c:\dfvtll.exec:\dfvtll.exe103⤵PID:2340
-
\??\c:\vdjxl.exec:\vdjxl.exe104⤵PID:1980
-
\??\c:\npfrxlx.exec:\npfrxlx.exe105⤵PID:2640
-
\??\c:\dplpnpd.exec:\dplpnpd.exe106⤵PID:732
-
\??\c:\dxdnnv.exec:\dxdnnv.exe107⤵PID:2560
-
\??\c:\llhxxt.exec:\llhxxt.exe108⤵PID:2612
-
\??\c:\nvdrr.exec:\nvdrr.exe109⤵PID:2272
-
\??\c:\pljhr.exec:\pljhr.exe110⤵PID:740
-
\??\c:\dhxbdf.exec:\dhxbdf.exe111⤵PID:2752
-
\??\c:\jfrdlpv.exec:\jfrdlpv.exe112⤵PID:2208
-
\??\c:\vrhpxnn.exec:\vrhpxnn.exe113⤵PID:1204
-
\??\c:\xxvvv.exec:\xxvvv.exe114⤵PID:2432
-
\??\c:\frthlft.exec:\frthlft.exe115⤵
- System Location Discovery: System Language Discovery
PID:1004 -
\??\c:\hjdjbfh.exec:\hjdjbfh.exe116⤵PID:1876
-
\??\c:\tfnhfrh.exec:\tfnhfrh.exe117⤵PID:1708
-
\??\c:\dnvxh.exec:\dnvxh.exe118⤵PID:1068
-
\??\c:\thlpvxf.exec:\thlpvxf.exe119⤵PID:1568
-
\??\c:\rjxrx.exec:\rjxrx.exe120⤵PID:2872
-
\??\c:\txlbtv.exec:\txlbtv.exe121⤵PID:2944
-
\??\c:\vbdjprp.exec:\vbdjprp.exe122⤵PID:2924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-