Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/03/2025, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe
-
Size
458KB
-
MD5
8c3536d2885392ac1eb909d9cc40d073
-
SHA1
2209cc5e589f8f0687dd1618afee5569ce236184
-
SHA256
5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2
-
SHA512
142d95d144714db6556519dc63d98f4045e4fa019773b9fb06c71cafb3a55450b42145c477f912ebe9cb6127fa15cec5c2e0b060582da53066168d1814c2a63f
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeA:q7Tc2NYHUrAwfMp3CDA
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 36 IoCs
resource yara_rule behavioral1/memory/2676-12-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-10-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2476-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-40-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2540-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-57-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2956-71-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2972-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2372-84-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/824-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2020-107-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2348-115-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1240-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-162-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2196-177-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-199-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/964-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/540-258-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1020-267-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1548-284-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2828-302-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2568-315-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2340-328-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1920-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2396-375-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/824-384-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1056-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1716-424-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2996-527-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2736-566-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2852-579-0x00000000003B0000-0x00000000003DA000-memory.dmp family_blackmoon behavioral1/memory/1788-618-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2216-719-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2296-787-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 7vppj.exe 2476 hhnbtt.exe 2340 llxxffr.exe 2540 tnhnhh.exe 2324 lfrrrlr.exe 2972 1bnnnn.exe 2956 vjvpv.exe 2372 lxlxrrr.exe 824 ntbbbb.exe 2020 jvjjj.exe 2348 1bnntn.exe 1880 dvddv.exe 868 htnthh.exe 1240 ttthbh.exe 2896 xfrxxfl.exe 1696 7hbtbh.exe 1932 fxlrrrx.exe 2196 7xflrfr.exe 2176 pdppd.exe 1900 lfflxfr.exe 2060 jddjd.exe 2432 3xrxxxf.exe 288 hbnnbb.exe 964 1dddv.exe 1956 3xxxxfr.exe 2480 hbnthh.exe 540 1rffrrf.exe 1020 tnbtbb.exe 896 9jdjv.exe 1548 xrlrxxf.exe 2704 hbhhhh.exe 2880 1lxrrrx.exe 2828 vjddj.exe 2568 9jvvv.exe 2724 5lfffxl.exe 2340 btbbht.exe 2672 7nhnhn.exe 1920 vpvdd.exe 1276 5lffxxl.exe 1924 thbtbb.exe 2124 dpdvv.exe 2372 xlxrfrf.exe 2396 llflrxl.exe 824 bnbbnt.exe 1884 lffffff.exe 1056 fxrrrxf.exe 1092 tnhtbb.exe 2760 dpjjp.exe 680 5rfflfl.exe 588 xlxxllr.exe 1716 nbhbtt.exe 2152 dpddj.exe 2168 xflffff.exe 2300 9rlrllr.exe 2056 nhtttb.exe 2224 5vddv.exe 2344 7lfxxff.exe 1192 nbntbb.exe 1972 3bbnhh.exe 1316 3dppp.exe 2432 frfflll.exe 2312 hbnnnb.exe 2280 jvdvd.exe 2260 jpvpp.exe -
resource yara_rule behavioral1/memory/2676-12-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-10-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2476-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-40-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2540-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-57-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2956-71-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2972-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2372-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-107-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2348-115-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1240-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-162-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2196-177-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1900-188-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-199-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/964-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/540-258-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1020-267-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-297-0x0000000000320000-0x000000000034A000-memory.dmp upx behavioral1/memory/2828-302-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2568-315-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-328-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1920-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-376-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2396-375-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/824-384-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1056-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1716-424-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2996-527-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-566-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1676-605-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1788-618-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2020-657-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2216-719-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2224-728-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2296-787-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1800-813-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2832-937-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xrxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2676 2736 5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe 30 PID 2736 wrote to memory of 2676 2736 5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe 30 PID 2736 wrote to memory of 2676 2736 5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe 30 PID 2736 wrote to memory of 2676 2736 5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe 30 PID 2676 wrote to memory of 2476 2676 7vppj.exe 31 PID 2676 wrote to memory of 2476 2676 7vppj.exe 31 PID 2676 wrote to memory of 2476 2676 7vppj.exe 31 PID 2676 wrote to memory of 2476 2676 7vppj.exe 31 PID 2476 wrote to memory of 2340 2476 hhnbtt.exe 32 PID 2476 wrote to memory of 2340 2476 hhnbtt.exe 32 PID 2476 wrote to memory of 2340 2476 hhnbtt.exe 32 PID 2476 wrote to memory of 2340 2476 hhnbtt.exe 32 PID 2340 wrote to memory of 2540 2340 llxxffr.exe 33 PID 2340 wrote to memory of 2540 2340 llxxffr.exe 33 PID 2340 wrote to memory of 2540 2340 llxxffr.exe 33 PID 2340 wrote to memory of 2540 2340 llxxffr.exe 33 PID 2540 wrote to memory of 2324 2540 tnhnhh.exe 34 PID 2540 wrote to memory of 2324 2540 tnhnhh.exe 34 PID 2540 wrote to memory of 2324 2540 tnhnhh.exe 34 PID 2540 wrote to memory of 2324 2540 tnhnhh.exe 34 PID 2324 wrote to memory of 2972 2324 lfrrrlr.exe 35 PID 2324 wrote to memory of 2972 2324 lfrrrlr.exe 35 PID 2324 wrote to memory of 2972 2324 lfrrrlr.exe 35 PID 2324 wrote to memory of 2972 2324 lfrrrlr.exe 35 PID 2972 wrote to memory of 2956 2972 1bnnnn.exe 36 PID 2972 wrote to memory of 2956 2972 1bnnnn.exe 36 PID 2972 wrote to memory of 2956 2972 1bnnnn.exe 36 PID 2972 wrote to memory of 2956 2972 1bnnnn.exe 36 PID 2956 wrote to memory of 2372 2956 vjvpv.exe 37 PID 2956 wrote to memory of 2372 2956 vjvpv.exe 37 PID 2956 wrote to memory of 2372 2956 vjvpv.exe 37 PID 2956 wrote to memory of 2372 2956 vjvpv.exe 37 PID 2372 wrote to memory of 824 2372 lxlxrrr.exe 38 PID 2372 wrote to memory of 824 2372 lxlxrrr.exe 38 PID 2372 wrote to memory of 824 2372 lxlxrrr.exe 38 PID 2372 wrote to memory of 824 2372 lxlxrrr.exe 38 PID 824 wrote to memory of 2020 824 ntbbbb.exe 39 PID 824 wrote to memory of 2020 824 ntbbbb.exe 39 PID 824 wrote to memory of 2020 824 ntbbbb.exe 39 PID 824 wrote to memory of 2020 824 ntbbbb.exe 39 PID 2020 wrote to memory of 2348 2020 jvjjj.exe 40 PID 2020 wrote to memory of 2348 2020 jvjjj.exe 40 PID 2020 wrote to memory of 2348 2020 jvjjj.exe 40 PID 2020 wrote to memory of 2348 2020 jvjjj.exe 40 PID 2348 wrote to memory of 1880 2348 1bnntn.exe 41 PID 2348 wrote to memory of 1880 2348 1bnntn.exe 41 PID 2348 wrote to memory of 1880 2348 1bnntn.exe 41 PID 2348 wrote to memory of 1880 2348 1bnntn.exe 41 PID 1880 wrote to memory of 868 1880 dvddv.exe 42 PID 1880 wrote to memory of 868 1880 dvddv.exe 42 PID 1880 wrote to memory of 868 1880 dvddv.exe 42 PID 1880 wrote to memory of 868 1880 dvddv.exe 42 PID 868 wrote to memory of 1240 868 htnthh.exe 43 PID 868 wrote to memory of 1240 868 htnthh.exe 43 PID 868 wrote to memory of 1240 868 htnthh.exe 43 PID 868 wrote to memory of 1240 868 htnthh.exe 43 PID 1240 wrote to memory of 2896 1240 ttthbh.exe 44 PID 1240 wrote to memory of 2896 1240 ttthbh.exe 44 PID 1240 wrote to memory of 2896 1240 ttthbh.exe 44 PID 1240 wrote to memory of 2896 1240 ttthbh.exe 44 PID 2896 wrote to memory of 1696 2896 xfrxxfl.exe 45 PID 2896 wrote to memory of 1696 2896 xfrxxfl.exe 45 PID 2896 wrote to memory of 1696 2896 xfrxxfl.exe 45 PID 2896 wrote to memory of 1696 2896 xfrxxfl.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe"C:\Users\Admin\AppData\Local\Temp\5569ae7a73087b1ec0038aa584899a9de7e6d8b886bade897e975a2b5d3f02d2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\7vppj.exec:\7vppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\hhnbtt.exec:\hhnbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\llxxffr.exec:\llxxffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\tnhnhh.exec:\tnhnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\lfrrrlr.exec:\lfrrrlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\1bnnnn.exec:\1bnnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vjvpv.exec:\vjvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lxlxrrr.exec:\lxlxrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\ntbbbb.exec:\ntbbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\jvjjj.exec:\jvjjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\1bnntn.exec:\1bnntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\dvddv.exec:\dvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\htnthh.exec:\htnthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\ttthbh.exec:\ttthbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\xfrxxfl.exec:\xfrxxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\7hbtbh.exec:\7hbtbh.exe17⤵
- Executes dropped EXE
PID:1696 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe18⤵
- Executes dropped EXE
PID:1932 -
\??\c:\7xflrfr.exec:\7xflrfr.exe19⤵
- Executes dropped EXE
PID:2196 -
\??\c:\pdppd.exec:\pdppd.exe20⤵
- Executes dropped EXE
PID:2176 -
\??\c:\lfflxfr.exec:\lfflxfr.exe21⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jddjd.exec:\jddjd.exe22⤵
- Executes dropped EXE
PID:2060 -
\??\c:\3xrxxxf.exec:\3xrxxxf.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbnnbb.exec:\hbnnbb.exe24⤵
- Executes dropped EXE
PID:288 -
\??\c:\1dddv.exec:\1dddv.exe25⤵
- Executes dropped EXE
PID:964 -
\??\c:\3xxxxfr.exec:\3xxxxfr.exe26⤵
- Executes dropped EXE
PID:1956 -
\??\c:\hbnthh.exec:\hbnthh.exe27⤵
- Executes dropped EXE
PID:2480 -
\??\c:\1rffrrf.exec:\1rffrrf.exe28⤵
- Executes dropped EXE
PID:540 -
\??\c:\tnbtbb.exec:\tnbtbb.exe29⤵
- Executes dropped EXE
PID:1020 -
\??\c:\9jdjv.exec:\9jdjv.exe30⤵
- Executes dropped EXE
PID:896 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe31⤵
- Executes dropped EXE
PID:1548 -
\??\c:\hbhhhh.exec:\hbhhhh.exe32⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1lxrrrx.exec:\1lxrrrx.exe33⤵
- Executes dropped EXE
PID:2880 -
\??\c:\vjddj.exec:\vjddj.exe34⤵
- Executes dropped EXE
PID:2828 -
\??\c:\9jvvv.exec:\9jvvv.exe35⤵
- Executes dropped EXE
PID:2568 -
\??\c:\5lfffxl.exec:\5lfffxl.exe36⤵
- Executes dropped EXE
PID:2724 -
\??\c:\btbbht.exec:\btbbht.exe37⤵
- Executes dropped EXE
PID:2340 -
\??\c:\7nhnhn.exec:\7nhnhn.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vpvdd.exec:\vpvdd.exe39⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5lffxxl.exec:\5lffxxl.exe40⤵
- Executes dropped EXE
PID:1276 -
\??\c:\thbtbb.exec:\thbtbb.exe41⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dpdvv.exec:\dpdvv.exe42⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xlxrfrf.exec:\xlxrfrf.exe43⤵
- Executes dropped EXE
PID:2372 -
\??\c:\llflrxl.exec:\llflrxl.exe44⤵
- Executes dropped EXE
PID:2396 -
\??\c:\bnbbnt.exec:\bnbbnt.exe45⤵
- Executes dropped EXE
PID:824 -
\??\c:\lffffff.exec:\lffffff.exe46⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fxrrrxf.exec:\fxrrrxf.exe47⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tnhtbb.exec:\tnhtbb.exe48⤵
- Executes dropped EXE
PID:1092 -
\??\c:\dpjjp.exec:\dpjjp.exe49⤵
- Executes dropped EXE
PID:2760 -
\??\c:\5rfflfl.exec:\5rfflfl.exe50⤵
- Executes dropped EXE
PID:680 -
\??\c:\xlxxllr.exec:\xlxxllr.exe51⤵
- Executes dropped EXE
PID:588 -
\??\c:\nbhbtt.exec:\nbhbtt.exe52⤵
- Executes dropped EXE
PID:1716 -
\??\c:\dpddj.exec:\dpddj.exe53⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xflffff.exec:\xflffff.exe54⤵
- Executes dropped EXE
PID:2168 -
\??\c:\9rlrllr.exec:\9rlrllr.exe55⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nhtttb.exec:\nhtttb.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5vddv.exec:\5vddv.exe57⤵
- Executes dropped EXE
PID:2224 -
\??\c:\7lfxxff.exec:\7lfxxff.exe58⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nbntbb.exec:\nbntbb.exe59⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3bbnhh.exec:\3bbnhh.exe60⤵
- Executes dropped EXE
PID:1972 -
\??\c:\3dppp.exec:\3dppp.exe61⤵
- Executes dropped EXE
PID:1316 -
\??\c:\frfflll.exec:\frfflll.exe62⤵
- Executes dropped EXE
PID:2432 -
\??\c:\hbnnnb.exec:\hbnnnb.exe63⤵
- Executes dropped EXE
PID:2312 -
\??\c:\jvdvd.exec:\jvdvd.exe64⤵
- Executes dropped EXE
PID:2280 -
\??\c:\jpvpp.exec:\jpvpp.exe65⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9ffrrlx.exec:\9ffrrlx.exe66⤵PID:1956
-
\??\c:\bhtnhh.exec:\bhtnhh.exe67⤵PID:2996
-
\??\c:\jvdvd.exec:\jvdvd.exe68⤵PID:2220
-
\??\c:\pdppd.exec:\pdppd.exe69⤵PID:3004
-
\??\c:\7rxxllx.exec:\7rxxllx.exe70⤵PID:2660
-
\??\c:\bnbttn.exec:\bnbttn.exe71⤵PID:1892
-
\??\c:\pjppp.exec:\pjppp.exe72⤵PID:1908
-
\??\c:\pjvvd.exec:\pjvvd.exe73⤵PID:2736
-
\??\c:\xrffffl.exec:\xrffffl.exe74⤵PID:2836
-
\??\c:\3nttbb.exec:\3nttbb.exe75⤵PID:2852
-
\??\c:\9hbbbb.exec:\9hbbbb.exe76⤵PID:2720
-
\??\c:\vjvpp.exec:\vjvpp.exe77⤵PID:2560
-
\??\c:\rlffllr.exec:\rlffllr.exe78⤵PID:2620
-
\??\c:\7nnntb.exec:\7nnntb.exe79⤵PID:2964
-
\??\c:\bbbbbt.exec:\bbbbbt.exe80⤵PID:1676
-
\??\c:\vvvvj.exec:\vvvvj.exe81⤵
- System Location Discovery: System Language Discovery
PID:2648 -
\??\c:\fxxlfff.exec:\fxxlfff.exe82⤵PID:1788
-
\??\c:\hbnbnb.exec:\hbnbnb.exe83⤵PID:2208
-
\??\c:\bbhttb.exec:\bbhttb.exe84⤵PID:2016
-
\??\c:\jdvjv.exec:\jdvjv.exe85⤵PID:1420
-
\??\c:\rllrrrl.exec:\rllrrrl.exe86⤵PID:1196
-
\??\c:\bbthbh.exec:\bbthbh.exe87⤵PID:824
-
\??\c:\7tntbh.exec:\7tntbh.exe88⤵PID:2020
-
\??\c:\jdpdp.exec:\jdpdp.exe89⤵PID:2276
-
\??\c:\xrfxllr.exec:\xrfxllr.exe90⤵PID:1092
-
\??\c:\tnnnbn.exec:\tnnnbn.exe91⤵PID:2760
-
\??\c:\tnhhnn.exec:\tnhhnn.exe92⤵PID:1240
-
\??\c:\3pppv.exec:\3pppv.exe93⤵PID:1568
-
\??\c:\7rxrxlx.exec:\7rxrxlx.exe94⤵PID:2252
-
\??\c:\frflflx.exec:\frflflx.exe95⤵PID:3056
-
\??\c:\tnbbhn.exec:\tnbbhn.exe96⤵PID:1000
-
\??\c:\ppdjv.exec:\ppdjv.exe97⤵PID:2216
-
\??\c:\jvppd.exec:\jvppd.exe98⤵PID:2180
-
\??\c:\lllrlrf.exec:\lllrlrf.exe99⤵PID:2224
-
\??\c:\9tnthn.exec:\9tnthn.exe100⤵PID:1900
-
\??\c:\7htbbb.exec:\7htbbb.exe101⤵PID:2060
-
\??\c:\vvpjp.exec:\vvpjp.exe102⤵PID:620
-
\??\c:\rfxfrrf.exec:\rfxfrrf.exe103⤵PID:336
-
\??\c:\rllxrxl.exec:\rllxrxl.exe104⤵PID:1732
-
\??\c:\btbbhh.exec:\btbbhh.exe105⤵PID:2312
-
\??\c:\1dppd.exec:\1dppd.exe106⤵PID:1608
-
\??\c:\pjvdj.exec:\pjvdj.exe107⤵PID:2296
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe108⤵PID:1468
-
\??\c:\5htbbb.exec:\5htbbb.exe109⤵PID:540
-
\??\c:\jdppv.exec:\jdppv.exe110⤵PID:1856
-
\??\c:\vjpdj.exec:\vjpdj.exe111⤵PID:904
-
\??\c:\lxlfrrx.exec:\lxlfrrx.exe112⤵PID:1800
-
\??\c:\7fxfllx.exec:\7fxfllx.exe113⤵PID:2840
-
\??\c:\hbbtbb.exec:\hbbtbb.exe114⤵PID:1908
-
\??\c:\pdvvd.exec:\pdvvd.exe115⤵PID:2880
-
\??\c:\jjdjp.exec:\jjdjp.exe116⤵PID:2636
-
\??\c:\7rflrxr.exec:\7rflrxr.exe117⤵PID:2568
-
\??\c:\3ntbnn.exec:\3ntbnn.exe118⤵PID:2688
-
\??\c:\hhbhtt.exec:\hhbhtt.exe119⤵PID:2560
-
\??\c:\9pppp.exec:\9pppp.exe120⤵PID:2620
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe121⤵PID:2964
-
\??\c:\lxxxllf.exec:\lxxxllf.exe122⤵PID:1676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-