Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe
-
Size
454KB
-
MD5
c554cd0dc8d3319eff3860db4819673f
-
SHA1
e6dc25e834a2120651d9998bf65b96f9997be4d2
-
SHA256
bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed
-
SHA512
74c1c194212e5240fe555a05d1eb3eeec1079aa7bb25fffa2551144caca00f847bf7f5dcf6929381c9e944d32af7e43d3446e42ec7c43a9f0407efbd46bd4cea
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeZ:q7Tc2NYHUrAwfMp3CDZ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2788-19-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2608-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2576-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3016-74-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1852-90-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/2900-108-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1152-126-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1152-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1364-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-156-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/596-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2116-171-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2144-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2328-255-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2708-320-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2600-333-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2764-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1216-368-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/592-396-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-429-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-437-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2116-465-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2016-492-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2032-555-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-563-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/984-561-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2892-663-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2636-671-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2412-726-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2684 3pjvd.exe 2788 3xfrlxl.exe 2580 hhhthn.exe 2608 9vpvj.exe 2740 9vdvd.exe 2576 1rrfrxr.exe 2068 jddjd.exe 3016 3nhtbh.exe 1852 vvvdd.exe 2832 llflrxf.exe 2900 vvdpj.exe 1556 tnhntb.exe 1152 bnhbhn.exe 1364 9vjpd.exe 1740 hbhhth.exe 2384 pvddp.exe 596 1hhhtt.exe 2116 jjppj.exe 2144 ffllflf.exe 2948 hbthbh.exe 1136 7xlxfxx.exe 2992 jpvdv.exe 2964 rxxrflr.exe 1644 frlfxxl.exe 1956 lffflrx.exe 2912 vpjjj.exe 2328 rrlrlrx.exe 2200 hhntnn.exe 996 7jvdd.exe 288 hthnth.exe 2020 5ttbnt.exe 2352 fxfllrx.exe 2820 tnhnbb.exe 2840 3jpjj.exe 2796 rflffxx.exe 2708 xrfflrx.exe 2932 5ttbtb.exe 2600 1vjdd.exe 2764 rxllllf.exe 2748 nbtbnn.exe 2568 hbtbnt.exe 2632 vvjjj.exe 1536 9xrrrxx.exe 1216 ttbthn.exe 2644 7thnnh.exe 2560 vjvdv.exe 2040 frxrrrf.exe 592 nbtttt.exe 1680 7ttntt.exe 872 1dpvd.exe 1968 3flllll.exe 1056 htbbbb.exe 320 nhbhhh.exe 668 1vddd.exe 800 1lllrrx.exe 1592 1nhhhh.exe 2116 5jvdj.exe 1928 vpvvv.exe 2300 rlxlrlx.exe 2168 btbbhn.exe 2016 7hhntb.exe 2612 7dppv.exe 1744 rlrxllx.exe 700 hthbbb.exe -
resource yara_rule behavioral1/memory/2112-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2788-19-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2684-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2608-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2740-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2576-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3016-74-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1152-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1364-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-148-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2384-156-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-158-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/596-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-171-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2144-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2948-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2328-255-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2708-320-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-333-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-334-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2764-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1216-368-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/592-396-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/872-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-429-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-465-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2032-555-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/984-563-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-570-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-663-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/2636-671-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2412-726-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2748-912-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tnthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlflxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2684 2112 bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe 30 PID 2112 wrote to memory of 2684 2112 bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe 30 PID 2112 wrote to memory of 2684 2112 bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe 30 PID 2112 wrote to memory of 2684 2112 bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe 30 PID 2684 wrote to memory of 2788 2684 3pjvd.exe 31 PID 2684 wrote to memory of 2788 2684 3pjvd.exe 31 PID 2684 wrote to memory of 2788 2684 3pjvd.exe 31 PID 2684 wrote to memory of 2788 2684 3pjvd.exe 31 PID 2788 wrote to memory of 2580 2788 3xfrlxl.exe 32 PID 2788 wrote to memory of 2580 2788 3xfrlxl.exe 32 PID 2788 wrote to memory of 2580 2788 3xfrlxl.exe 32 PID 2788 wrote to memory of 2580 2788 3xfrlxl.exe 32 PID 2580 wrote to memory of 2608 2580 hhhthn.exe 33 PID 2580 wrote to memory of 2608 2580 hhhthn.exe 33 PID 2580 wrote to memory of 2608 2580 hhhthn.exe 33 PID 2580 wrote to memory of 2608 2580 hhhthn.exe 33 PID 2608 wrote to memory of 2740 2608 9vpvj.exe 34 PID 2608 wrote to memory of 2740 2608 9vpvj.exe 34 PID 2608 wrote to memory of 2740 2608 9vpvj.exe 34 PID 2608 wrote to memory of 2740 2608 9vpvj.exe 34 PID 2740 wrote to memory of 2576 2740 9vdvd.exe 35 PID 2740 wrote to memory of 2576 2740 9vdvd.exe 35 PID 2740 wrote to memory of 2576 2740 9vdvd.exe 35 PID 2740 wrote to memory of 2576 2740 9vdvd.exe 35 PID 2576 wrote to memory of 2068 2576 1rrfrxr.exe 36 PID 2576 wrote to memory of 2068 2576 1rrfrxr.exe 36 PID 2576 wrote to memory of 2068 2576 1rrfrxr.exe 36 PID 2576 wrote to memory of 2068 2576 1rrfrxr.exe 36 PID 2068 wrote to memory of 3016 2068 jddjd.exe 37 PID 2068 wrote to memory of 3016 2068 jddjd.exe 37 PID 2068 wrote to memory of 3016 2068 jddjd.exe 37 PID 2068 wrote to memory of 3016 2068 jddjd.exe 37 PID 3016 wrote to memory of 1852 3016 3nhtbh.exe 38 PID 3016 wrote to memory of 1852 3016 3nhtbh.exe 38 PID 3016 wrote to memory of 1852 3016 3nhtbh.exe 38 PID 3016 wrote to memory of 1852 3016 3nhtbh.exe 38 PID 1852 wrote to memory of 2832 1852 vvvdd.exe 39 PID 1852 wrote to memory of 2832 1852 vvvdd.exe 39 PID 1852 wrote to memory of 2832 1852 vvvdd.exe 39 PID 1852 wrote to memory of 2832 1852 vvvdd.exe 39 PID 2832 wrote to memory of 2900 2832 llflrxf.exe 40 PID 2832 wrote to memory of 2900 2832 llflrxf.exe 40 PID 2832 wrote to memory of 2900 2832 llflrxf.exe 40 PID 2832 wrote to memory of 2900 2832 llflrxf.exe 40 PID 2900 wrote to memory of 1556 2900 vvdpj.exe 41 PID 2900 wrote to memory of 1556 2900 vvdpj.exe 41 PID 2900 wrote to memory of 1556 2900 vvdpj.exe 41 PID 2900 wrote to memory of 1556 2900 vvdpj.exe 41 PID 1556 wrote to memory of 1152 1556 tnhntb.exe 42 PID 1556 wrote to memory of 1152 1556 tnhntb.exe 42 PID 1556 wrote to memory of 1152 1556 tnhntb.exe 42 PID 1556 wrote to memory of 1152 1556 tnhntb.exe 42 PID 1152 wrote to memory of 1364 1152 bnhbhn.exe 43 PID 1152 wrote to memory of 1364 1152 bnhbhn.exe 43 PID 1152 wrote to memory of 1364 1152 bnhbhn.exe 43 PID 1152 wrote to memory of 1364 1152 bnhbhn.exe 43 PID 1364 wrote to memory of 1740 1364 9vjpd.exe 44 PID 1364 wrote to memory of 1740 1364 9vjpd.exe 44 PID 1364 wrote to memory of 1740 1364 9vjpd.exe 44 PID 1364 wrote to memory of 1740 1364 9vjpd.exe 44 PID 1740 wrote to memory of 2384 1740 hbhhth.exe 45 PID 1740 wrote to memory of 2384 1740 hbhhth.exe 45 PID 1740 wrote to memory of 2384 1740 hbhhth.exe 45 PID 1740 wrote to memory of 2384 1740 hbhhth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe"C:\Users\Admin\AppData\Local\Temp\bde42708d0b4af794050df1d3d69edc0b881937ea876ef321192ae8a918b60ed.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\3pjvd.exec:\3pjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\3xfrlxl.exec:\3xfrlxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\hhhthn.exec:\hhhthn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\9vpvj.exec:\9vpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\9vdvd.exec:\9vdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\1rrfrxr.exec:\1rrfrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jddjd.exec:\jddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\3nhtbh.exec:\3nhtbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\vvvdd.exec:\vvvdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\llflrxf.exec:\llflrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\vvdpj.exec:\vvdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\tnhntb.exec:\tnhntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\bnhbhn.exec:\bnhbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\9vjpd.exec:\9vjpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\hbhhth.exec:\hbhhth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\pvddp.exec:\pvddp.exe17⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1hhhtt.exec:\1hhhtt.exe18⤵
- Executes dropped EXE
PID:596 -
\??\c:\jjppj.exec:\jjppj.exe19⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ffllflf.exec:\ffllflf.exe20⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hbthbh.exec:\hbthbh.exe21⤵
- Executes dropped EXE
PID:2948 -
\??\c:\7xlxfxx.exec:\7xlxfxx.exe22⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jpvdv.exec:\jpvdv.exe23⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rxxrflr.exec:\rxxrflr.exe24⤵
- Executes dropped EXE
PID:2964 -
\??\c:\frlfxxl.exec:\frlfxxl.exe25⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lffflrx.exec:\lffflrx.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\vpjjj.exec:\vpjjj.exe27⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrlrlrx.exec:\rrlrlrx.exe28⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hhntnn.exec:\hhntnn.exe29⤵
- Executes dropped EXE
PID:2200 -
\??\c:\7jvdd.exec:\7jvdd.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:996 -
\??\c:\hthnth.exec:\hthnth.exe31⤵
- Executes dropped EXE
PID:288 -
\??\c:\5ttbnt.exec:\5ttbnt.exe32⤵
- Executes dropped EXE
PID:2020 -
\??\c:\fxfllrx.exec:\fxfllrx.exe33⤵
- Executes dropped EXE
PID:2352 -
\??\c:\tnhnbb.exec:\tnhnbb.exe34⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3jpjj.exec:\3jpjj.exe35⤵
- Executes dropped EXE
PID:2840 -
\??\c:\rflffxx.exec:\rflffxx.exe36⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xrfflrx.exec:\xrfflrx.exe37⤵
- Executes dropped EXE
PID:2708 -
\??\c:\5ttbtb.exec:\5ttbtb.exe38⤵
- Executes dropped EXE
PID:2932 -
\??\c:\1vjdd.exec:\1vjdd.exe39⤵
- Executes dropped EXE
PID:2600 -
\??\c:\rxllllf.exec:\rxllllf.exe40⤵
- Executes dropped EXE
PID:2764 -
\??\c:\nbtbnn.exec:\nbtbnn.exe41⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbtbnt.exec:\hbtbnt.exe42⤵
- Executes dropped EXE
PID:2568 -
\??\c:\vvjjj.exec:\vvjjj.exe43⤵
- Executes dropped EXE
PID:2632 -
\??\c:\9xrrrxx.exec:\9xrrrxx.exe44⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ttbthn.exec:\ttbthn.exe45⤵
- Executes dropped EXE
PID:1216 -
\??\c:\7thnnh.exec:\7thnnh.exe46⤵
- Executes dropped EXE
PID:2644 -
\??\c:\vjvdv.exec:\vjvdv.exe47⤵
- Executes dropped EXE
PID:2560 -
\??\c:\frxrrrf.exec:\frxrrrf.exe48⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nbtttt.exec:\nbtttt.exe49⤵
- Executes dropped EXE
PID:592 -
\??\c:\7ttntt.exec:\7ttntt.exe50⤵
- Executes dropped EXE
PID:1680 -
\??\c:\1dpvd.exec:\1dpvd.exe51⤵
- Executes dropped EXE
PID:872 -
\??\c:\3flllll.exec:\3flllll.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\htbbbb.exec:\htbbbb.exe53⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nhbhhh.exec:\nhbhhh.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\1vddd.exec:\1vddd.exe55⤵
- Executes dropped EXE
PID:668 -
\??\c:\1lllrrx.exec:\1lllrrx.exe56⤵
- Executes dropped EXE
PID:800 -
\??\c:\1nhhhh.exec:\1nhhhh.exe57⤵
- Executes dropped EXE
PID:1592 -
\??\c:\5jvdj.exec:\5jvdj.exe58⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vpvvv.exec:\vpvvv.exe59⤵
- Executes dropped EXE
PID:1928 -
\??\c:\rlxlrlx.exec:\rlxlrlx.exe60⤵
- Executes dropped EXE
PID:2300 -
\??\c:\btbbhn.exec:\btbbhn.exe61⤵
- Executes dropped EXE
PID:2168 -
\??\c:\7hhntb.exec:\7hhntb.exe62⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7dppv.exec:\7dppv.exe63⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rlrxllx.exec:\rlrxllx.exe64⤵
- Executes dropped EXE
PID:1744 -
\??\c:\hthbbb.exec:\hthbbb.exe65⤵
- Executes dropped EXE
PID:700 -
\??\c:\hbtthh.exec:\hbtthh.exe66⤵PID:1676
-
\??\c:\vpjpd.exec:\vpjpd.exe67⤵PID:1520
-
\??\c:\lfxxfxx.exec:\lfxxfxx.exe68⤵PID:2452
-
\??\c:\fxllrrl.exec:\fxllrrl.exe69⤵PID:1816
-
\??\c:\nhntbb.exec:\nhntbb.exe70⤵PID:1932
-
\??\c:\dpdvd.exec:\dpdvd.exe71⤵PID:2080
-
\??\c:\dpddj.exec:\dpddj.exe72⤵PID:2032
-
\??\c:\lxllllx.exec:\lxllllx.exe73⤵PID:984
-
\??\c:\hhtntb.exec:\hhtntb.exe74⤵PID:2036
-
\??\c:\vjvpp.exec:\vjvpp.exe75⤵PID:2324
-
\??\c:\jdddp.exec:\jdddp.exe76⤵PID:2316
-
\??\c:\rrrrrfx.exec:\rrrrrfx.exe77⤵PID:2788
-
\??\c:\hbthnt.exec:\hbthnt.exe78⤵PID:1696
-
\??\c:\3vjpv.exec:\3vjpv.exe79⤵PID:2848
-
\??\c:\9vvdj.exec:\9vvdj.exe80⤵PID:2812
-
\??\c:\ffxlxfx.exec:\ffxlxfx.exe81⤵PID:2596
-
\??\c:\3bthtb.exec:\3bthtb.exe82⤵PID:2628
-
\??\c:\tbttht.exec:\tbttht.exe83⤵PID:2764
-
\??\c:\pjdjj.exec:\pjdjj.exe84⤵PID:2748
-
\??\c:\xrrrfrl.exec:\xrrrfrl.exe85⤵PID:2568
-
\??\c:\3hntbb.exec:\3hntbb.exe86⤵PID:3008
-
\??\c:\bhnnhn.exec:\bhnnhn.exe87⤵PID:1428
-
\??\c:\pjjpd.exec:\pjjpd.exe88⤵PID:1468
-
\??\c:\xrflrxr.exec:\xrflrxr.exe89⤵PID:2892
-
\??\c:\llrlrxl.exec:\llrlrxl.exe90⤵PID:2636
-
\??\c:\btnbtb.exec:\btnbtb.exe91⤵PID:2040
-
\??\c:\dpjpd.exec:\dpjpd.exe92⤵PID:1656
-
\??\c:\xlxxrxf.exec:\xlxxrxf.exe93⤵PID:380
-
\??\c:\llfllxl.exec:\llfllxl.exe94⤵PID:1552
-
\??\c:\3nbbnb.exec:\3nbbnb.exe95⤵PID:2440
-
\??\c:\vddvj.exec:\vddvj.exe96⤵PID:2008
-
\??\c:\jdddp.exec:\jdddp.exe97⤵PID:484
-
\??\c:\1lfrffr.exec:\1lfrffr.exe98⤵PID:2412
-
\??\c:\tnntnn.exec:\tnntnn.exe99⤵PID:2284
-
\??\c:\nhhnbh.exec:\nhhnbh.exe100⤵PID:596
-
\??\c:\jvpvd.exec:\jvpvd.exe101⤵PID:2176
-
\??\c:\3xxlxll.exec:\3xxlxll.exe102⤵PID:2156
-
\??\c:\btnnbh.exec:\btnnbh.exe103⤵PID:1236
-
\??\c:\5nbtht.exec:\5nbtht.exe104⤵PID:2988
-
\??\c:\jppvp.exec:\jppvp.exe105⤵PID:340
-
\??\c:\frxlllx.exec:\frxlllx.exe106⤵PID:2992
-
\??\c:\fllxrff.exec:\fllxrff.exe107⤵PID:1028
-
\??\c:\ttnnnh.exec:\ttnnnh.exe108⤵PID:2052
-
\??\c:\1pvdd.exec:\1pvdd.exe109⤵PID:1712
-
\??\c:\7vjjp.exec:\7vjjp.exe110⤵PID:1520
-
\??\c:\lfrflxf.exec:\lfrflxf.exe111⤵PID:2980
-
\??\c:\ttnntb.exec:\ttnntb.exe112⤵PID:2512
-
\??\c:\9tnnth.exec:\9tnnth.exe113⤵PID:1036
-
\??\c:\vjvjp.exec:\vjvjp.exe114⤵PID:2080
-
\??\c:\xxxlfrx.exec:\xxxlfrx.exe115⤵PID:2464
-
\??\c:\btntbb.exec:\btntbb.exe116⤵PID:580
-
\??\c:\1bttbh.exec:\1bttbh.exe117⤵PID:2352
-
\??\c:\1vvdj.exec:\1vvdj.exe118⤵PID:2324
-
\??\c:\llfflrr.exec:\llfflrr.exe119⤵PID:2808
-
\??\c:\xrlrxrf.exec:\xrlrxrf.exe120⤵PID:2796
-
\??\c:\hbbhnn.exec:\hbbhnn.exe121⤵PID:2732
-
\??\c:\9pdpd.exec:\9pdpd.exe122⤵PID:2580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-