Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 06:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe
-
Size
455KB
-
MD5
e335c5e0d5274bad2367ea221fbf71f9
-
SHA1
7d24e398c729d3e9c137b495e33d73de0413ef64
-
SHA256
56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172
-
SHA512
d8825d1f6e2d3679cbbaa6a17fbaf627aeb3596addac12535ec85786fbd57f68942933653f4e2c7a58a22469e924a41475f10f53b903222e073264ec460b5b7c
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbew:q7Tc2NYHUrAwfMp3CDw
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2848-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3068-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2836-45-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2836-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2636-56-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/320-75-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/580-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2504-94-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2928-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-123-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1612-151-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1980-161-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2548-179-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-188-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-189-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/832-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-201-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-216-0x0000000001C70000-0x0000000001C9A000-memory.dmp family_blackmoon behavioral1/memory/2552-217-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-229-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-249-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1624-257-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2384-262-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1644-292-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2816-323-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2644-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2676-417-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1992-534-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/2380-535-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2492-556-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1588-590-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1588-589-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2336-612-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2264-715-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3068 vdpvj.exe 2704 1frrxxf.exe 2336 vjvdj.exe 2836 xlxrrrr.exe 2636 vpjpp.exe 1920 lxrllff.exe 320 5hbhtt.exe 580 ppdjv.exe 2504 bnbbhh.exe 2508 vjddj.exe 2928 bbtnbt.exe 2976 9thnnn.exe 2992 rlffllf.exe 2872 hbnttt.exe 1612 dpjdd.exe 1980 rlxrfxf.exe 2468 vpdpv.exe 2548 hbbhtb.exe 1108 vpdjp.exe 832 lfrrxxf.exe 2400 9vjjp.exe 2552 3ffxrrr.exe 288 btnnhb.exe 1804 vpvvj.exe 2388 tnbnbh.exe 1624 9pjpj.exe 2384 flfxxfx.exe 988 btbhbb.exe 1600 jdppv.exe 1644 tnbbnn.exe 1428 xrllllx.exe 2288 hbthnn.exe 2748 lflxxxr.exe 2816 nnhntt.exe 3020 5hbttn.exe 2592 1pddd.exe 2796 xrffffl.exe 2644 1fxlllx.exe 1344 nbnhnn.exe 2892 dpjjp.exe 2924 xrfxfxf.exe 320 nhbbhn.exe 2916 vjjdj.exe 2148 rrlxflr.exe 400 rlxxfxf.exe 2540 3bhhhh.exe 2984 jjvpd.exe 2676 frxrxxf.exe 2316 xlxrrrx.exe 2260 1nhhhh.exe 2872 dvjvv.exe 1064 llrxffl.exe 2244 rlrrrxf.exe 2496 nhhntt.exe 2468 vpvpp.exe 1476 frflrlf.exe 864 fflxlxf.exe 408 9nntbb.exe 1956 dvjjj.exe 1568 5xrflfl.exe 704 bnhbbt.exe 1912 vjvjv.exe 1712 pdjvd.exe 1536 rlffrxl.exe -
resource yara_rule behavioral1/memory/2848-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3068-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2704-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2836-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/320-75-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/580-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2504-94-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2928-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-123-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2872-133-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1612-151-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-161-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2548-179-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/832-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-201-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-217-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-220-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-229-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1804-239-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1624-257-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-292-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2816-323-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2644-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2676-417-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/864-469-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2380-535-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2492-556-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/1776-576-0x00000000003A0000-0x00000000003CA000-memory.dmp upx behavioral1/memory/1588-589-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2336-612-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9thnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 3068 2848 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 30 PID 2848 wrote to memory of 3068 2848 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 30 PID 2848 wrote to memory of 3068 2848 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 30 PID 2848 wrote to memory of 3068 2848 56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe 30 PID 3068 wrote to memory of 2704 3068 vdpvj.exe 31 PID 3068 wrote to memory of 2704 3068 vdpvj.exe 31 PID 3068 wrote to memory of 2704 3068 vdpvj.exe 31 PID 3068 wrote to memory of 2704 3068 vdpvj.exe 31 PID 2704 wrote to memory of 2336 2704 1frrxxf.exe 32 PID 2704 wrote to memory of 2336 2704 1frrxxf.exe 32 PID 2704 wrote to memory of 2336 2704 1frrxxf.exe 32 PID 2704 wrote to memory of 2336 2704 1frrxxf.exe 32 PID 2336 wrote to memory of 2836 2336 vjvdj.exe 33 PID 2336 wrote to memory of 2836 2336 vjvdj.exe 33 PID 2336 wrote to memory of 2836 2336 vjvdj.exe 33 PID 2336 wrote to memory of 2836 2336 vjvdj.exe 33 PID 2836 wrote to memory of 2636 2836 xlxrrrr.exe 34 PID 2836 wrote to memory of 2636 2836 xlxrrrr.exe 34 PID 2836 wrote to memory of 2636 2836 xlxrrrr.exe 34 PID 2836 wrote to memory of 2636 2836 xlxrrrr.exe 34 PID 2636 wrote to memory of 1920 2636 vpjpp.exe 35 PID 2636 wrote to memory of 1920 2636 vpjpp.exe 35 PID 2636 wrote to memory of 1920 2636 vpjpp.exe 35 PID 2636 wrote to memory of 1920 2636 vpjpp.exe 35 PID 1920 wrote to memory of 320 1920 lxrllff.exe 36 PID 1920 wrote to memory of 320 1920 lxrllff.exe 36 PID 1920 wrote to memory of 320 1920 lxrllff.exe 36 PID 1920 wrote to memory of 320 1920 lxrllff.exe 36 PID 320 wrote to memory of 580 320 5hbhtt.exe 37 PID 320 wrote to memory of 580 320 5hbhtt.exe 37 PID 320 wrote to memory of 580 320 5hbhtt.exe 37 PID 320 wrote to memory of 580 320 5hbhtt.exe 37 PID 580 wrote to memory of 2504 580 ppdjv.exe 38 PID 580 wrote to memory of 2504 580 ppdjv.exe 38 PID 580 wrote to memory of 2504 580 ppdjv.exe 38 PID 580 wrote to memory of 2504 580 ppdjv.exe 38 PID 2504 wrote to memory of 2508 2504 bnbbhh.exe 39 PID 2504 wrote to memory of 2508 2504 bnbbhh.exe 39 PID 2504 wrote to memory of 2508 2504 bnbbhh.exe 39 PID 2504 wrote to memory of 2508 2504 bnbbhh.exe 39 PID 2508 wrote to memory of 2928 2508 vjddj.exe 40 PID 2508 wrote to memory of 2928 2508 vjddj.exe 40 PID 2508 wrote to memory of 2928 2508 vjddj.exe 40 PID 2508 wrote to memory of 2928 2508 vjddj.exe 40 PID 2928 wrote to memory of 2976 2928 bbtnbt.exe 41 PID 2928 wrote to memory of 2976 2928 bbtnbt.exe 41 PID 2928 wrote to memory of 2976 2928 bbtnbt.exe 41 PID 2928 wrote to memory of 2976 2928 bbtnbt.exe 41 PID 2976 wrote to memory of 2992 2976 9thnnn.exe 42 PID 2976 wrote to memory of 2992 2976 9thnnn.exe 42 PID 2976 wrote to memory of 2992 2976 9thnnn.exe 42 PID 2976 wrote to memory of 2992 2976 9thnnn.exe 42 PID 2992 wrote to memory of 2872 2992 rlffllf.exe 43 PID 2992 wrote to memory of 2872 2992 rlffllf.exe 43 PID 2992 wrote to memory of 2872 2992 rlffllf.exe 43 PID 2992 wrote to memory of 2872 2992 rlffllf.exe 43 PID 2872 wrote to memory of 1612 2872 hbnttt.exe 44 PID 2872 wrote to memory of 1612 2872 hbnttt.exe 44 PID 2872 wrote to memory of 1612 2872 hbnttt.exe 44 PID 2872 wrote to memory of 1612 2872 hbnttt.exe 44 PID 1612 wrote to memory of 1980 1612 dpjdd.exe 45 PID 1612 wrote to memory of 1980 1612 dpjdd.exe 45 PID 1612 wrote to memory of 1980 1612 dpjdd.exe 45 PID 1612 wrote to memory of 1980 1612 dpjdd.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe"C:\Users\Admin\AppData\Local\Temp\56e97693787322ceac7e7b395197d50f28ac235e72bea7e502f1cc42d428c172.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vdpvj.exec:\vdpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1frrxxf.exec:\1frrxxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vjvdj.exec:\vjvdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\xlxrrrr.exec:\xlxrrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\vpjpp.exec:\vpjpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\lxrllff.exec:\lxrllff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5hbhtt.exec:\5hbhtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\ppdjv.exec:\ppdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:580 -
\??\c:\bnbbhh.exec:\bnbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\vjddj.exec:\vjddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\bbtnbt.exec:\bbtnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\9thnnn.exec:\9thnnn.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\rlffllf.exec:\rlffllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\hbnttt.exec:\hbnttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\dpjdd.exec:\dpjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rlxrfxf.exec:\rlxrfxf.exe17⤵
- Executes dropped EXE
PID:1980 -
\??\c:\vpdpv.exec:\vpdpv.exe18⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbbhtb.exec:\hbbhtb.exe19⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vpdjp.exec:\vpdjp.exe20⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lfrrxxf.exec:\lfrrxxf.exe21⤵
- Executes dropped EXE
PID:832 -
\??\c:\9vjjp.exec:\9vjjp.exe22⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3ffxrrr.exec:\3ffxrrr.exe23⤵
- Executes dropped EXE
PID:2552 -
\??\c:\btnnhb.exec:\btnnhb.exe24⤵
- Executes dropped EXE
PID:288 -
\??\c:\vpvvj.exec:\vpvvj.exe25⤵
- Executes dropped EXE
PID:1804 -
\??\c:\tnbnbh.exec:\tnbnbh.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\9pjpj.exec:\9pjpj.exe27⤵
- Executes dropped EXE
PID:1624 -
\??\c:\flfxxfx.exec:\flfxxfx.exe28⤵
- Executes dropped EXE
PID:2384 -
\??\c:\btbhbb.exec:\btbhbb.exe29⤵
- Executes dropped EXE
PID:988 -
\??\c:\jdppv.exec:\jdppv.exe30⤵
- Executes dropped EXE
PID:1600 -
\??\c:\tnbbnn.exec:\tnbbnn.exe31⤵
- Executes dropped EXE
PID:1644 -
\??\c:\xrllllx.exec:\xrllllx.exe32⤵
- Executes dropped EXE
PID:1428 -
\??\c:\hbthnn.exec:\hbthnn.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lflxxxr.exec:\lflxxxr.exe34⤵
- Executes dropped EXE
PID:2748 -
\??\c:\nnhntt.exec:\nnhntt.exe35⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5hbttn.exec:\5hbttn.exe36⤵
- Executes dropped EXE
PID:3020 -
\??\c:\1pddd.exec:\1pddd.exe37⤵
- Executes dropped EXE
PID:2592 -
\??\c:\xrffffl.exec:\xrffffl.exe38⤵
- Executes dropped EXE
PID:2796 -
\??\c:\1fxlllx.exec:\1fxlllx.exe39⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nbnhnn.exec:\nbnhnn.exe40⤵
- Executes dropped EXE
PID:1344 -
\??\c:\dpjjp.exec:\dpjjp.exe41⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xrfxfxf.exec:\xrfxfxf.exe42⤵
- Executes dropped EXE
PID:2924 -
\??\c:\nhbbhn.exec:\nhbbhn.exe43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:320 -
\??\c:\vjjdj.exec:\vjjdj.exe44⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rrlxflr.exec:\rrlxflr.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\rlxxfxf.exec:\rlxxfxf.exe46⤵
- Executes dropped EXE
PID:400 -
\??\c:\3bhhhh.exec:\3bhhhh.exe47⤵
- Executes dropped EXE
PID:2540 -
\??\c:\jjvpd.exec:\jjvpd.exe48⤵
- Executes dropped EXE
PID:2984 -
\??\c:\frxrxxf.exec:\frxrxxf.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe50⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1nhhhh.exec:\1nhhhh.exe51⤵
- Executes dropped EXE
PID:2260 -
\??\c:\dvjvv.exec:\dvjvv.exe52⤵
- Executes dropped EXE
PID:2872 -
\??\c:\llrxffl.exec:\llrxffl.exe53⤵
- Executes dropped EXE
PID:1064 -
\??\c:\rlrrrxf.exec:\rlrrrxf.exe54⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nhhntt.exec:\nhhntt.exe55⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vpvpp.exec:\vpvpp.exe56⤵
- Executes dropped EXE
PID:2468 -
\??\c:\frflrlf.exec:\frflrlf.exe57⤵
- Executes dropped EXE
PID:1476 -
\??\c:\fflxlxf.exec:\fflxlxf.exe58⤵
- Executes dropped EXE
PID:864 -
\??\c:\9nntbb.exec:\9nntbb.exe59⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvjjj.exec:\dvjjj.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\5xrflfl.exec:\5xrflfl.exe61⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bnhbbt.exec:\bnhbbt.exe62⤵
- Executes dropped EXE
PID:704 -
\??\c:\vjvjv.exec:\vjvjv.exe63⤵
- Executes dropped EXE
PID:1912 -
\??\c:\pdjvd.exec:\pdjvd.exe64⤵
- Executes dropped EXE
PID:1712 -
\??\c:\rlffrxl.exec:\rlffrxl.exe65⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tnbhtt.exec:\tnbhtt.exe66⤵PID:1704
-
\??\c:\tnttbt.exec:\tnttbt.exe67⤵PID:1992
-
\??\c:\ppddp.exec:\ppddp.exe68⤵PID:2380
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe69⤵PID:1292
-
\??\c:\nhhnhh.exec:\nhhnhh.exe70⤵PID:2492
-
\??\c:\9tntbb.exec:\9tntbb.exe71⤵PID:896
-
\??\c:\pjddd.exec:\pjddd.exe72⤵PID:1600
-
\??\c:\fxrxllx.exec:\fxrxllx.exe73⤵PID:1776
-
\??\c:\btnthh.exec:\btnthh.exe74⤵PID:2476
-
\??\c:\vpddp.exec:\vpddp.exe75⤵PID:1588
-
\??\c:\xrflxfr.exec:\xrflxfr.exe76⤵PID:2712
-
\??\c:\7xfrlxf.exec:\7xfrlxf.exe77⤵PID:2616
-
\??\c:\5tbtbb.exec:\5tbtbb.exe78⤵PID:2336
-
\??\c:\jdvjp.exec:\jdvjp.exe79⤵PID:2700
-
\??\c:\7frxxxx.exec:\7frxxxx.exe80⤵PID:1984
-
\??\c:\nhtbtt.exec:\nhtbtt.exe81⤵PID:2636
-
\??\c:\nbbttt.exec:\nbbttt.exe82⤵PID:804
-
\??\c:\jpvjd.exec:\jpvjd.exe83⤵PID:696
-
\??\c:\1fllxxf.exec:\1fllxxf.exe84⤵PID:2988
-
\??\c:\tnhhtt.exec:\tnhhtt.exe85⤵PID:1672
-
\??\c:\jvjpv.exec:\jvjpv.exe86⤵PID:2500
-
\??\c:\5dvjp.exec:\5dvjp.exe87⤵PID:816
-
\??\c:\xxxflrf.exec:\xxxflrf.exe88⤵PID:400
-
\??\c:\9bhhhb.exec:\9bhhhb.exe89⤵PID:2540
-
\??\c:\jdppd.exec:\jdppd.exe90⤵PID:468
-
\??\c:\5ffffff.exec:\5ffffff.exe91⤵PID:2912
-
\??\c:\7lxxrrf.exec:\7lxxrrf.exe92⤵PID:2868
-
\??\c:\5bhbhh.exec:\5bhbhh.exe93⤵PID:2264
-
\??\c:\9djjj.exec:\9djjj.exe94⤵PID:2876
-
\??\c:\7pjjv.exec:\7pjjv.exe95⤵PID:1064
-
\??\c:\xxrfllx.exec:\xxrfllx.exe96⤵PID:1676
-
\??\c:\tthbnn.exec:\tthbnn.exe97⤵PID:308
-
\??\c:\5pddj.exec:\5pddj.exe98⤵PID:2468
-
\??\c:\ddpvp.exec:\ddpvp.exe99⤵PID:1108
-
\??\c:\ffxlxfr.exec:\ffxlxfr.exe100⤵PID:1148
-
\??\c:\fxrxffr.exec:\fxrxffr.exe101⤵PID:832
-
\??\c:\1nhnbh.exec:\1nhnbh.exe102⤵PID:2400
-
\??\c:\dvpdp.exec:\dvpdp.exe103⤵PID:1568
-
\??\c:\rrllrrx.exec:\rrllrrx.exe104⤵PID:1352
-
\??\c:\frflrlx.exec:\frflrlx.exe105⤵PID:1696
-
\??\c:\hntnhb.exec:\hntnhb.exe106⤵PID:1716
-
\??\c:\7hbhtb.exec:\7hbhtb.exe107⤵PID:2388
-
\??\c:\5jddd.exec:\5jddd.exe108⤵PID:2428
-
\??\c:\5rxrxrr.exec:\5rxrxrr.exe109⤵PID:944
-
\??\c:\xxllfxf.exec:\xxllfxf.exe110⤵PID:2464
-
\??\c:\htbbhn.exec:\htbbhn.exe111⤵PID:1664
-
\??\c:\vpvdp.exec:\vpvdp.exe112⤵PID:988
-
\??\c:\jvjpj.exec:\jvjpj.exe113⤵PID:1248
-
\??\c:\xxllrrx.exec:\xxllrrx.exe114⤵PID:2744
-
\??\c:\nhbhbb.exec:\nhbhbb.exe115⤵PID:2132
-
\??\c:\hbhhbb.exec:\hbhhbb.exe116⤵PID:2288
-
\??\c:\jjvpv.exec:\jjvpv.exe117⤵PID:3048
-
\??\c:\frfxrrx.exec:\frfxrrx.exe118⤵PID:3012
-
\??\c:\rlfflrx.exec:\rlfflrx.exe119⤵PID:3020
-
\??\c:\htttbb.exec:\htttbb.exe120⤵PID:2592
-
\??\c:\jvpvj.exec:\jvpvj.exe121⤵PID:2320
-
\??\c:\nthbhh.exec:\nthbhh.exe122⤵PID:592
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-