Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/12/2024, 03:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe
-
Size
454KB
-
MD5
84eddb140b1c8b34a2b934c8f2f65984
-
SHA1
5a6d69b674d0a23eef9c3bdf29f0729662999db0
-
SHA256
b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55
-
SHA512
3496cfdab8853e656d2543802c7c26a9d81faaf7cc3efa8c8d588076f96bf32a01426de85a91b29ca4dd69cc2a574f6266ba290e827af63d88acb2b449c5367e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbej:q7Tc2NYHUrAwfMp3CDj
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1552-11-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2408-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2472-26-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2148-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1452-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2952-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3032-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1488-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1576-110-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/896-127-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-146-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2140-155-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-167-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1080-165-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1748-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-189-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1956-206-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2664-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2108-235-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1968-245-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2052-254-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1580-263-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1604-274-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/816-314-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1160-387-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1104-408-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1788-407-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2260-467-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2028-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1552-590-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-648-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/2900-667-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2948-670-0x0000000000230000-0x000000000025A000-memory.dmp family_blackmoon behavioral1/memory/1436-726-0x0000000000320000-0x000000000034A000-memory.dmp family_blackmoon behavioral1/memory/532-773-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1552 xphdlr.exe 2472 pnnjfh.exe 2148 ftlhjp.exe 3020 hvhrf.exe 1452 phhph.exe 2952 pdppvj.exe 3032 plxnn.exe 2892 xvxlr.exe 2824 tfvjnfb.exe 1488 xpdtpx.exe 1576 pbplf.exe 812 vhbff.exe 896 pdnxtx.exe 2540 rfnvb.exe 3048 xvpbbth.exe 2140 nbphp.exe 1080 fvvxd.exe 1748 bxxdtfl.exe 2400 nxbjb.exe 944 ppvth.exe 1956 phttrpl.exe 1504 jxdfhrn.exe 2664 bdflrj.exe 2108 tnphj.exe 1968 njxbrx.exe 2052 vbnnr.exe 1580 hltltt.exe 1604 vtlvhr.exe 1752 jhrxf.exe 564 dhhnhhb.exe 868 lpvpbpr.exe 2256 fpfxn.exe 816 vfvhltl.exe 2564 rffndb.exe 2720 dbxrn.exe 2184 rdxpj.exe 3016 vvbpx.exe 2936 llxbx.exe 2976 xjlbx.exe 2992 phphb.exe 2172 hpdlhjn.exe 1384 nnrblb.exe 2820 hfjjfd.exe 2856 rpttb.exe 1160 dxvtp.exe 1424 jbpptf.exe 1788 tjhljln.exe 1104 tltndl.exe 2180 hxhjb.exe 896 bppdx.exe 1820 pptvxjf.exe 2104 hlxjn.exe 2752 txdntn.exe 624 thphhrt.exe 1080 ltdrd.exe 2260 txpxxd.exe 2420 lbldtrj.exe 2400 brrpbv.exe 1700 nntfdd.exe 2424 fhtlt.exe 2028 jtpvv.exe 2004 xrbfjxl.exe 2516 phfvhl.exe 1980 ftjjp.exe -
resource yara_rule behavioral1/memory/1552-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2472-26-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3020-38-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2148-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1452-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2952-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3032-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1488-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1576-110-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/896-127-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-146-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-155-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-169-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-167-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1748-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-189-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1956-206-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2664-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2108-235-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2052-254-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1580-263-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-266-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1604-274-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/816-314-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1160-387-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1104-408-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-407-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-467-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2420-468-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-488-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2028-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-582-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3024-611-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2900-667-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2140-719-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/532-766-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2452-786-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2628-805-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language phpdnx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hjdxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfftdbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfvxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrllbdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jlhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rvnndl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jndpnp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffprv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tvvtvhx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrlhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nrnbfp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdpt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ldthtrn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bdflrj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pnlxn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnfvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pfxtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rbvnhp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fjdxhxp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fptrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language drhvvxd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hdjdln.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language plxnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vhtjl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thjrxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pflfdx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxnvdn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dfhxpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trjprht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbnhr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vrxdfn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hfhdr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tfdtjx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 1552 2408 b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe 30 PID 2408 wrote to memory of 1552 2408 b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe 30 PID 2408 wrote to memory of 1552 2408 b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe 30 PID 2408 wrote to memory of 1552 2408 b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe 30 PID 1552 wrote to memory of 2472 1552 xphdlr.exe 31 PID 1552 wrote to memory of 2472 1552 xphdlr.exe 31 PID 1552 wrote to memory of 2472 1552 xphdlr.exe 31 PID 1552 wrote to memory of 2472 1552 xphdlr.exe 31 PID 2472 wrote to memory of 2148 2472 pnnjfh.exe 32 PID 2472 wrote to memory of 2148 2472 pnnjfh.exe 32 PID 2472 wrote to memory of 2148 2472 pnnjfh.exe 32 PID 2472 wrote to memory of 2148 2472 pnnjfh.exe 32 PID 2148 wrote to memory of 3020 2148 ftlhjp.exe 33 PID 2148 wrote to memory of 3020 2148 ftlhjp.exe 33 PID 2148 wrote to memory of 3020 2148 ftlhjp.exe 33 PID 2148 wrote to memory of 3020 2148 ftlhjp.exe 33 PID 3020 wrote to memory of 1452 3020 hvhrf.exe 34 PID 3020 wrote to memory of 1452 3020 hvhrf.exe 34 PID 3020 wrote to memory of 1452 3020 hvhrf.exe 34 PID 3020 wrote to memory of 1452 3020 hvhrf.exe 34 PID 1452 wrote to memory of 2952 1452 phhph.exe 35 PID 1452 wrote to memory of 2952 1452 phhph.exe 35 PID 1452 wrote to memory of 2952 1452 phhph.exe 35 PID 1452 wrote to memory of 2952 1452 phhph.exe 35 PID 2952 wrote to memory of 3032 2952 pdppvj.exe 36 PID 2952 wrote to memory of 3032 2952 pdppvj.exe 36 PID 2952 wrote to memory of 3032 2952 pdppvj.exe 36 PID 2952 wrote to memory of 3032 2952 pdppvj.exe 36 PID 3032 wrote to memory of 2892 3032 plxnn.exe 37 PID 3032 wrote to memory of 2892 3032 plxnn.exe 37 PID 3032 wrote to memory of 2892 3032 plxnn.exe 37 PID 3032 wrote to memory of 2892 3032 plxnn.exe 37 PID 2892 wrote to memory of 2824 2892 xvxlr.exe 38 PID 2892 wrote to memory of 2824 2892 xvxlr.exe 38 PID 2892 wrote to memory of 2824 2892 xvxlr.exe 38 PID 2892 wrote to memory of 2824 2892 xvxlr.exe 38 PID 2824 wrote to memory of 1488 2824 tfvjnfb.exe 39 PID 2824 wrote to memory of 1488 2824 tfvjnfb.exe 39 PID 2824 wrote to memory of 1488 2824 tfvjnfb.exe 39 PID 2824 wrote to memory of 1488 2824 tfvjnfb.exe 39 PID 1488 wrote to memory of 1576 1488 xpdtpx.exe 40 PID 1488 wrote to memory of 1576 1488 xpdtpx.exe 40 PID 1488 wrote to memory of 1576 1488 xpdtpx.exe 40 PID 1488 wrote to memory of 1576 1488 xpdtpx.exe 40 PID 1576 wrote to memory of 812 1576 pbplf.exe 41 PID 1576 wrote to memory of 812 1576 pbplf.exe 41 PID 1576 wrote to memory of 812 1576 pbplf.exe 41 PID 1576 wrote to memory of 812 1576 pbplf.exe 41 PID 812 wrote to memory of 896 812 vhbff.exe 42 PID 812 wrote to memory of 896 812 vhbff.exe 42 PID 812 wrote to memory of 896 812 vhbff.exe 42 PID 812 wrote to memory of 896 812 vhbff.exe 42 PID 896 wrote to memory of 2540 896 pdnxtx.exe 43 PID 896 wrote to memory of 2540 896 pdnxtx.exe 43 PID 896 wrote to memory of 2540 896 pdnxtx.exe 43 PID 896 wrote to memory of 2540 896 pdnxtx.exe 43 PID 2540 wrote to memory of 3048 2540 rfnvb.exe 44 PID 2540 wrote to memory of 3048 2540 rfnvb.exe 44 PID 2540 wrote to memory of 3048 2540 rfnvb.exe 44 PID 2540 wrote to memory of 3048 2540 rfnvb.exe 44 PID 3048 wrote to memory of 2140 3048 xvpbbth.exe 45 PID 3048 wrote to memory of 2140 3048 xvpbbth.exe 45 PID 3048 wrote to memory of 2140 3048 xvpbbth.exe 45 PID 3048 wrote to memory of 2140 3048 xvpbbth.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe"C:\Users\Admin\AppData\Local\Temp\b9387d176de595230f4a48f07791ed19d3f0dabc1ecae807fa8eaf0dae870e55.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xphdlr.exec:\xphdlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\pnnjfh.exec:\pnnjfh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\ftlhjp.exec:\ftlhjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hvhrf.exec:\hvhrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\phhph.exec:\phhph.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\pdppvj.exec:\pdppvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\plxnn.exec:\plxnn.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xvxlr.exec:\xvxlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\tfvjnfb.exec:\tfvjnfb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\xpdtpx.exec:\xpdtpx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pbplf.exec:\pbplf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\vhbff.exec:\vhbff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\pdnxtx.exec:\pdnxtx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\rfnvb.exec:\rfnvb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xvpbbth.exec:\xvpbbth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\nbphp.exec:\nbphp.exe17⤵
- Executes dropped EXE
PID:2140 -
\??\c:\fvvxd.exec:\fvvxd.exe18⤵
- Executes dropped EXE
PID:1080 -
\??\c:\bxxdtfl.exec:\bxxdtfl.exe19⤵
- Executes dropped EXE
PID:1748 -
\??\c:\nxbjb.exec:\nxbjb.exe20⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ppvth.exec:\ppvth.exe21⤵
- Executes dropped EXE
PID:944 -
\??\c:\phttrpl.exec:\phttrpl.exe22⤵
- Executes dropped EXE
PID:1956 -
\??\c:\jxdfhrn.exec:\jxdfhrn.exe23⤵
- Executes dropped EXE
PID:1504 -
\??\c:\bdflrj.exec:\bdflrj.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2664 -
\??\c:\tnphj.exec:\tnphj.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\njxbrx.exec:\njxbrx.exe26⤵
- Executes dropped EXE
PID:1968 -
\??\c:\vbnnr.exec:\vbnnr.exe27⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hltltt.exec:\hltltt.exe28⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vtlvhr.exec:\vtlvhr.exe29⤵
- Executes dropped EXE
PID:1604 -
\??\c:\jhrxf.exec:\jhrxf.exe30⤵
- Executes dropped EXE
PID:1752 -
\??\c:\dhhnhhb.exec:\dhhnhhb.exe31⤵
- Executes dropped EXE
PID:564 -
\??\c:\lpvpbpr.exec:\lpvpbpr.exe32⤵
- Executes dropped EXE
PID:868 -
\??\c:\fpfxn.exec:\fpfxn.exe33⤵
- Executes dropped EXE
PID:2256 -
\??\c:\vfvhltl.exec:\vfvhltl.exe34⤵
- Executes dropped EXE
PID:816 -
\??\c:\rffndb.exec:\rffndb.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\dbxrn.exec:\dbxrn.exe36⤵
- Executes dropped EXE
PID:2720 -
\??\c:\rdxpj.exec:\rdxpj.exe37⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vvbpx.exec:\vvbpx.exe38⤵
- Executes dropped EXE
PID:3016 -
\??\c:\llxbx.exec:\llxbx.exe39⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xjlbx.exec:\xjlbx.exe40⤵
- Executes dropped EXE
PID:2976 -
\??\c:\phphb.exec:\phphb.exe41⤵
- Executes dropped EXE
PID:2992 -
\??\c:\hpdlhjn.exec:\hpdlhjn.exe42⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nnrblb.exec:\nnrblb.exe43⤵
- Executes dropped EXE
PID:1384 -
\??\c:\hfjjfd.exec:\hfjjfd.exe44⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rpttb.exec:\rpttb.exe45⤵
- Executes dropped EXE
PID:2856 -
\??\c:\dxvtp.exec:\dxvtp.exe46⤵
- Executes dropped EXE
PID:1160 -
\??\c:\jbpptf.exec:\jbpptf.exe47⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tjhljln.exec:\tjhljln.exe48⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tltndl.exec:\tltndl.exe49⤵
- Executes dropped EXE
PID:1104 -
\??\c:\hxhjb.exec:\hxhjb.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\bppdx.exec:\bppdx.exe51⤵
- Executes dropped EXE
PID:896 -
\??\c:\pptvxjf.exec:\pptvxjf.exe52⤵
- Executes dropped EXE
PID:1820 -
\??\c:\hlxjn.exec:\hlxjn.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\txdntn.exec:\txdntn.exe54⤵
- Executes dropped EXE
PID:2752 -
\??\c:\thphhrt.exec:\thphhrt.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\ltdrd.exec:\ltdrd.exe56⤵
- Executes dropped EXE
PID:1080 -
\??\c:\txpxxd.exec:\txpxxd.exe57⤵
- Executes dropped EXE
PID:2260 -
\??\c:\lbldtrj.exec:\lbldtrj.exe58⤵
- Executes dropped EXE
PID:2420 -
\??\c:\brrpbv.exec:\brrpbv.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nntfdd.exec:\nntfdd.exe60⤵
- Executes dropped EXE
PID:1700 -
\??\c:\fhtlt.exec:\fhtlt.exe61⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jtpvv.exec:\jtpvv.exe62⤵
- Executes dropped EXE
PID:2028 -
\??\c:\xrbfjxl.exec:\xrbfjxl.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\phfvhl.exec:\phfvhl.exe64⤵
- Executes dropped EXE
PID:2516 -
\??\c:\ftjjp.exec:\ftjjp.exe65⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ljtdflj.exec:\ljtdflj.exe66⤵PID:2628
-
\??\c:\nvjlt.exec:\nvjlt.exe67⤵PID:1968
-
\??\c:\fxrjdj.exec:\fxrjdj.exe68⤵PID:1116
-
\??\c:\xnvlxtx.exec:\xnvlxtx.exe69⤵PID:2680
-
\??\c:\lphdxvr.exec:\lphdxvr.exe70⤵PID:1756
-
\??\c:\jnnbd.exec:\jnnbd.exe71⤵PID:2584
-
\??\c:\jtffdl.exec:\jtffdl.exe72⤵PID:1428
-
\??\c:\rrhfpht.exec:\rrhfpht.exe73⤵PID:2364
-
\??\c:\vxxnxj.exec:\vxxnxj.exe74⤵PID:876
-
\??\c:\lntdhfv.exec:\lntdhfv.exe75⤵PID:2296
-
\??\c:\fpbtnvv.exec:\fpbtnvv.exe76⤵PID:1552
-
\??\c:\trtvjtv.exec:\trtvjtv.exe77⤵PID:2652
-
\??\c:\pphprlx.exec:\pphprlx.exe78⤵PID:2388
-
\??\c:\ndrtp.exec:\ndrtp.exe79⤵PID:3024
-
\??\c:\hpxht.exec:\hpxht.exe80⤵PID:2920
-
\??\c:\vrxdfn.exec:\vrxdfn.exe81⤵
- System Location Discovery: System Language Discovery
PID:1712 -
\??\c:\jhrbjl.exec:\jhrbjl.exe82⤵PID:2896
-
\??\c:\rfhdlbx.exec:\rfhdlbx.exe83⤵PID:2812
-
\??\c:\vtrvlp.exec:\vtrvlp.exe84⤵PID:2948
-
\??\c:\pttfj.exec:\pttfj.exe85⤵PID:2772
-
\??\c:\nbplvfp.exec:\nbplvfp.exe86⤵PID:1148
-
\??\c:\bdjjfx.exec:\bdjjfx.exe87⤵PID:2900
-
\??\c:\vdxphf.exec:\vdxphf.exe88⤵PID:2596
-
\??\c:\pfttl.exec:\pfttl.exe89⤵PID:1160
-
\??\c:\rbvnhp.exec:\rbvnhp.exe90⤵
- System Location Discovery: System Language Discovery
PID:2968 -
\??\c:\fjdxhxp.exec:\fjdxhxp.exe91⤵
- System Location Discovery: System Language Discovery
PID:1788 -
\??\c:\ntdbpj.exec:\ntdbpj.exe92⤵PID:2764
-
\??\c:\rtxpxn.exec:\rtxpxn.exe93⤵PID:1436
-
\??\c:\ndtfbrv.exec:\ndtfbrv.exe94⤵PID:896
-
\??\c:\tpnnd.exec:\tpnnd.exe95⤵PID:1832
-
\??\c:\xhhpr.exec:\xhhpr.exe96⤵PID:2140
-
\??\c:\dpxlbx.exec:\dpxlbx.exe97⤵PID:112
-
\??\c:\pxrhx.exec:\pxrhx.exe98⤵PID:2436
-
\??\c:\btblbnt.exec:\btblbnt.exe99⤵PID:2480
-
\??\c:\ndbdb.exec:\ndbdb.exe100⤵PID:572
-
\??\c:\fhjll.exec:\fhjll.exe101⤵PID:2000
-
\??\c:\ffxbbvx.exec:\ffxbbvx.exe102⤵PID:2096
-
\??\c:\trjbx.exec:\trjbx.exe103⤵PID:532
-
\??\c:\xjnhl.exec:\xjnhl.exe104⤵PID:1864
-
\??\c:\tdddlf.exec:\tdddlf.exe105⤵PID:1736
-
\??\c:\rftnldv.exec:\rftnldv.exe106⤵PID:2452
-
\??\c:\hjvhxf.exec:\hjvhxf.exe107⤵PID:1624
-
\??\c:\xfnnr.exec:\xfnnr.exe108⤵PID:1500
-
\??\c:\pflpdbx.exec:\pflpdbx.exe109⤵PID:2628
-
\??\c:\jlpvh.exec:\jlpvh.exe110⤵PID:3040
-
\??\c:\jfjxdd.exec:\jfjxdd.exe111⤵PID:1828
-
\??\c:\pdnfhf.exec:\pdnfhf.exe112⤵PID:2668
-
\??\c:\pjxxrjt.exec:\pjxxrjt.exe113⤵PID:2536
-
\??\c:\lrljt.exec:\lrljt.exe114⤵PID:2320
-
\??\c:\jbvjfv.exec:\jbvjfv.exe115⤵PID:1244
-
\??\c:\xxvxp.exec:\xxvxp.exe116⤵PID:1908
-
\??\c:\tphttth.exec:\tphttth.exe117⤵PID:2712
-
\??\c:\hfnlpx.exec:\hfnlpx.exe118⤵PID:3068
-
\??\c:\txffflf.exec:\txffflf.exe119⤵PID:816
-
\??\c:\bvbtj.exec:\bvbtj.exe120⤵PID:2980
-
\??\c:\ndjftj.exec:\ndjftj.exe121⤵PID:3000
-
\??\c:\xpdhh.exec:\xpdhh.exe122⤵PID:2928
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-