Analysis
-
max time kernel
116s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 23:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
66d88b0c13254d87b3108a5bd42419c0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
66d88b0c13254d87b3108a5bd42419c0N.exe
-
Size
63KB
-
MD5
66d88b0c13254d87b3108a5bd42419c0
-
SHA1
76ef4b34e62c8aafc9177487f16c8374c1c347ce
-
SHA256
44dba63eac217705b051029a2b46fd68e4a95ec96f13ab13421089fc8d495996
-
SHA512
b19b946da97394ddaabea9a4c3d73256ee39274015c6ff722235ae9e3ec1478297f8e894570623a2c450653c77f50f1083bb5ec9825dd28c2afafc1b80d85b03
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNa:ymb3NkkiQ3mdBjFIvlpa
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2648-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2648 5frrrxf.exe 1892 fxflrrr.exe 4880 nththh.exe 2116 1vdpp.exe 3472 rxlllff.exe 2504 ttntbn.exe 2592 lxlllrx.exe 3476 xxfllxx.exe 1592 5httnt.exe 3736 frxxxxf.exe 4864 hnhhbb.exe 4596 jvpdv.exe 4480 xxfffff.exe 1428 9nbbtt.exe 4828 pjjjj.exe 4776 7rrxrll.exe 4364 rfrrrxr.exe 2272 bnnnnt.exe 4516 vvjjd.exe 2696 1dpjd.exe 1688 rxffxfx.exe 3388 7nnnnt.exe 1828 ddjjj.exe 1600 lrrrllf.exe 2208 nnttnn.exe 4832 vdppp.exe 2180 ffxfxxf.exe 2712 1ntnnt.exe 2640 bhhhbh.exe 756 vpvvv.exe 1184 rrxxflf.exe 1848 ntbtnt.exe 4932 5nnnnn.exe 1648 pvpjd.exe 5096 lrflxff.exe 3300 lxxxfxf.exe 4332 rflffxf.exe 2192 3ntnnn.exe 912 nbttbh.exe 2648 ddppd.exe 1168 rlllrfx.exe 5080 lxlllrr.exe 4456 9hhnhn.exe 2116 bbbbhh.exe 1680 pjjjd.exe 4608 fxrllrr.exe 1576 flllxfx.exe 3276 hhnttt.exe 1556 bbbnhn.exe 2412 7ddjd.exe 2800 vvdjj.exe 5036 9rfxrrr.exe 2656 lffffff.exe 2080 hhhhnn.exe 640 bntttt.exe 4596 vpddv.exe 4752 jdpjd.exe 3708 1lllfff.exe 908 9ntttt.exe 5016 3bbttb.exe 4776 htnnbb.exe 1668 1vddj.exe 2704 lrlllrr.exe 1060 rfrflfl.exe -
resource yara_rule behavioral2/memory/3140-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2640-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxlfx.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3140 wrote to memory of 2648 3140 66d88b0c13254d87b3108a5bd42419c0N.exe 84 PID 3140 wrote to memory of 2648 3140 66d88b0c13254d87b3108a5bd42419c0N.exe 84 PID 3140 wrote to memory of 2648 3140 66d88b0c13254d87b3108a5bd42419c0N.exe 84 PID 2648 wrote to memory of 1892 2648 5frrrxf.exe 85 PID 2648 wrote to memory of 1892 2648 5frrrxf.exe 85 PID 2648 wrote to memory of 1892 2648 5frrrxf.exe 85 PID 1892 wrote to memory of 4880 1892 fxflrrr.exe 86 PID 1892 wrote to memory of 4880 1892 fxflrrr.exe 86 PID 1892 wrote to memory of 4880 1892 fxflrrr.exe 86 PID 4880 wrote to memory of 2116 4880 nththh.exe 87 PID 4880 wrote to memory of 2116 4880 nththh.exe 87 PID 4880 wrote to memory of 2116 4880 nththh.exe 87 PID 2116 wrote to memory of 3472 2116 1vdpp.exe 88 PID 2116 wrote to memory of 3472 2116 1vdpp.exe 88 PID 2116 wrote to memory of 3472 2116 1vdpp.exe 88 PID 3472 wrote to memory of 2504 3472 rxlllff.exe 89 PID 3472 wrote to memory of 2504 3472 rxlllff.exe 89 PID 3472 wrote to memory of 2504 3472 rxlllff.exe 89 PID 2504 wrote to memory of 2592 2504 ttntbn.exe 90 PID 2504 wrote to memory of 2592 2504 ttntbn.exe 90 PID 2504 wrote to memory of 2592 2504 ttntbn.exe 90 PID 2592 wrote to memory of 3476 2592 lxlllrx.exe 91 PID 2592 wrote to memory of 3476 2592 lxlllrx.exe 91 PID 2592 wrote to memory of 3476 2592 lxlllrx.exe 91 PID 3476 wrote to memory of 1592 3476 xxfllxx.exe 92 PID 3476 wrote to memory of 1592 3476 xxfllxx.exe 92 PID 3476 wrote to memory of 1592 3476 xxfllxx.exe 92 PID 1592 wrote to memory of 3736 1592 5httnt.exe 93 PID 1592 wrote to memory of 3736 1592 5httnt.exe 93 PID 1592 wrote to memory of 3736 1592 5httnt.exe 93 PID 3736 wrote to memory of 4864 3736 frxxxxf.exe 94 PID 3736 wrote to memory of 4864 3736 frxxxxf.exe 94 PID 3736 wrote to memory of 4864 3736 frxxxxf.exe 94 PID 4864 wrote to memory of 4596 4864 hnhhbb.exe 95 PID 4864 wrote to memory of 4596 4864 hnhhbb.exe 95 PID 4864 wrote to memory of 4596 4864 hnhhbb.exe 95 PID 4596 wrote to memory of 4480 4596 jvpdv.exe 96 PID 4596 wrote to memory of 4480 4596 jvpdv.exe 96 PID 4596 wrote to memory of 4480 4596 jvpdv.exe 96 PID 4480 wrote to memory of 1428 4480 xxfffff.exe 97 PID 4480 wrote to memory of 1428 4480 xxfffff.exe 97 PID 4480 wrote to memory of 1428 4480 xxfffff.exe 97 PID 1428 wrote to memory of 4828 1428 9nbbtt.exe 98 PID 1428 wrote to memory of 4828 1428 9nbbtt.exe 98 PID 1428 wrote to memory of 4828 1428 9nbbtt.exe 98 PID 4828 wrote to memory of 4776 4828 pjjjj.exe 99 PID 4828 wrote to memory of 4776 4828 pjjjj.exe 99 PID 4828 wrote to memory of 4776 4828 pjjjj.exe 99 PID 4776 wrote to memory of 4364 4776 7rrxrll.exe 100 PID 4776 wrote to memory of 4364 4776 7rrxrll.exe 100 PID 4776 wrote to memory of 4364 4776 7rrxrll.exe 100 PID 4364 wrote to memory of 2272 4364 rfrrrxr.exe 102 PID 4364 wrote to memory of 2272 4364 rfrrrxr.exe 102 PID 4364 wrote to memory of 2272 4364 rfrrrxr.exe 102 PID 2272 wrote to memory of 4516 2272 bnnnnt.exe 103 PID 2272 wrote to memory of 4516 2272 bnnnnt.exe 103 PID 2272 wrote to memory of 4516 2272 bnnnnt.exe 103 PID 4516 wrote to memory of 2696 4516 vvjjd.exe 104 PID 4516 wrote to memory of 2696 4516 vvjjd.exe 104 PID 4516 wrote to memory of 2696 4516 vvjjd.exe 104 PID 2696 wrote to memory of 1688 2696 1dpjd.exe 105 PID 2696 wrote to memory of 1688 2696 1dpjd.exe 105 PID 2696 wrote to memory of 1688 2696 1dpjd.exe 105 PID 1688 wrote to memory of 3388 1688 rxffxfx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\66d88b0c13254d87b3108a5bd42419c0N.exe"C:\Users\Admin\AppData\Local\Temp\66d88b0c13254d87b3108a5bd42419c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\5frrrxf.exec:\5frrrxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\fxflrrr.exec:\fxflrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\nththh.exec:\nththh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\1vdpp.exec:\1vdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\rxlllff.exec:\rxlllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\ttntbn.exec:\ttntbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\lxlllrx.exec:\lxlllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\xxfllxx.exec:\xxfllxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\5httnt.exec:\5httnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\frxxxxf.exec:\frxxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\hnhhbb.exec:\hnhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\jvpdv.exec:\jvpdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\xxfffff.exec:\xxfffff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\9nbbtt.exec:\9nbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\pjjjj.exec:\pjjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\7rrxrll.exec:\7rrxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\rfrrrxr.exec:\rfrrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\bnnnnt.exec:\bnnnnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\vvjjd.exec:\vvjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\1dpjd.exec:\1dpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\rxffxfx.exec:\rxffxfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\7nnnnt.exec:\7nnnnt.exe23⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ddjjj.exec:\ddjjj.exe24⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lrrrllf.exec:\lrrrllf.exe25⤵
- Executes dropped EXE
PID:1600 -
\??\c:\nnttnn.exec:\nnttnn.exe26⤵
- Executes dropped EXE
PID:2208 -
\??\c:\vdppp.exec:\vdppp.exe27⤵
- Executes dropped EXE
PID:4832 -
\??\c:\ffxfxxf.exec:\ffxfxxf.exe28⤵
- Executes dropped EXE
PID:2180 -
\??\c:\1ntnnt.exec:\1ntnnt.exe29⤵
- Executes dropped EXE
PID:2712 -
\??\c:\bhhhbh.exec:\bhhhbh.exe30⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vpvvv.exec:\vpvvv.exe31⤵
- Executes dropped EXE
PID:756 -
\??\c:\rrxxflf.exec:\rrxxflf.exe32⤵
- Executes dropped EXE
PID:1184 -
\??\c:\ntbtnt.exec:\ntbtnt.exe33⤵
- Executes dropped EXE
PID:1848 -
\??\c:\5nnnnn.exec:\5nnnnn.exe34⤵
- Executes dropped EXE
PID:4932 -
\??\c:\pvpjd.exec:\pvpjd.exe35⤵
- Executes dropped EXE
PID:1648 -
\??\c:\lrflxff.exec:\lrflxff.exe36⤵
- Executes dropped EXE
PID:5096 -
\??\c:\lxxxfxf.exec:\lxxxfxf.exe37⤵
- Executes dropped EXE
PID:3300 -
\??\c:\rflffxf.exec:\rflffxf.exe38⤵
- Executes dropped EXE
PID:4332 -
\??\c:\3ntnnn.exec:\3ntnnn.exe39⤵
- Executes dropped EXE
PID:2192 -
\??\c:\nbttbh.exec:\nbttbh.exe40⤵
- Executes dropped EXE
PID:912 -
\??\c:\ddppd.exec:\ddppd.exe41⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rlllrfx.exec:\rlllrfx.exe42⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lxlllrr.exec:\lxlllrr.exe43⤵
- Executes dropped EXE
PID:5080 -
\??\c:\9hhnhn.exec:\9hhnhn.exe44⤵
- Executes dropped EXE
PID:4456 -
\??\c:\bbbbhh.exec:\bbbbhh.exe45⤵
- Executes dropped EXE
PID:2116 -
\??\c:\pjjjd.exec:\pjjjd.exe46⤵
- Executes dropped EXE
PID:1680 -
\??\c:\fxrllrr.exec:\fxrllrr.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4608 -
\??\c:\flllxfx.exec:\flllxfx.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hhnttt.exec:\hhnttt.exe49⤵
- Executes dropped EXE
PID:3276 -
\??\c:\bbbnhn.exec:\bbbnhn.exe50⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7ddjd.exec:\7ddjd.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vvdjj.exec:\vvdjj.exe52⤵
- Executes dropped EXE
PID:2800 -
\??\c:\9rfxrrr.exec:\9rfxrrr.exe53⤵
- Executes dropped EXE
PID:5036 -
\??\c:\lffffff.exec:\lffffff.exe54⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hhhhnn.exec:\hhhhnn.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bntttt.exec:\bntttt.exe56⤵
- Executes dropped EXE
PID:640 -
\??\c:\vpddv.exec:\vpddv.exe57⤵
- Executes dropped EXE
PID:4596 -
\??\c:\jdpjd.exec:\jdpjd.exe58⤵
- Executes dropped EXE
PID:4752 -
\??\c:\1lllfff.exec:\1lllfff.exe59⤵
- Executes dropped EXE
PID:3708 -
\??\c:\9ntttt.exec:\9ntttt.exe60⤵
- Executes dropped EXE
PID:908 -
\??\c:\3bbttb.exec:\3bbttb.exe61⤵
- Executes dropped EXE
PID:5016 -
\??\c:\htnnbb.exec:\htnnbb.exe62⤵
- Executes dropped EXE
PID:4776 -
\??\c:\1vddj.exec:\1vddj.exe63⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lrlllrr.exec:\lrlllrr.exe64⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rfrflfl.exec:\rfrflfl.exe65⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nhbhhn.exec:\nhbhhn.exe66⤵PID:3468
-
\??\c:\3tnntb.exec:\3tnntb.exe67⤵PID:1392
-
\??\c:\jdjvv.exec:\jdjvv.exe68⤵PID:4028
-
\??\c:\rlllfxx.exec:\rlllfxx.exe69⤵PID:4124
-
\??\c:\hhbhnn.exec:\hhbhnn.exe70⤵PID:1940
-
\??\c:\tnhbhn.exec:\tnhbhn.exe71⤵PID:4508
-
\??\c:\ppjdj.exec:\ppjdj.exe72⤵PID:4756
-
\??\c:\vpjvv.exec:\vpjvv.exe73⤵PID:1380
-
\??\c:\xrfxffl.exec:\xrfxffl.exe74⤵PID:652
-
\??\c:\nhnnnt.exec:\nhnnnt.exe75⤵PID:4656
-
\??\c:\nbbtnn.exec:\nbbtnn.exe76⤵PID:1612
-
\??\c:\djdjv.exec:\djdjv.exe77⤵PID:388
-
\??\c:\jjjjd.exec:\jjjjd.exe78⤵PID:5092
-
\??\c:\7lrlrxf.exec:\7lrlrxf.exe79⤵PID:1056
-
\??\c:\rllllll.exec:\rllllll.exe80⤵PID:2756
-
\??\c:\nhhhbh.exec:\nhhhbh.exe81⤵PID:1740
-
\??\c:\vdjjd.exec:\vdjjd.exe82⤵PID:2480
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe83⤵PID:3100
-
\??\c:\htbthh.exec:\htbthh.exe84⤵PID:4932
-
\??\c:\pddjj.exec:\pddjj.exe85⤵PID:4560
-
\??\c:\jvddv.exec:\jvddv.exe86⤵PID:2276
-
\??\c:\5xlllll.exec:\5xlllll.exe87⤵PID:2176
-
\??\c:\frfffff.exec:\frfffff.exe88⤵PID:3140
-
\??\c:\nnttth.exec:\nnttth.exe89⤵PID:4332
-
\??\c:\9bnthh.exec:\9bnthh.exe90⤵PID:912
-
\??\c:\ntbhbt.exec:\ntbhbt.exe91⤵PID:624
-
\??\c:\jjddj.exec:\jjddj.exe92⤵PID:1168
-
\??\c:\llfflrx.exec:\llfflrx.exe93⤵PID:5080
-
\??\c:\thnnhn.exec:\thnnhn.exe94⤵PID:3092
-
\??\c:\dpjdv.exec:\dpjdv.exe95⤵PID:4964
-
\??\c:\3vvpd.exec:\3vvpd.exe96⤵PID:2380
-
\??\c:\xxfffff.exec:\xxfffff.exe97⤵PID:4608
-
\??\c:\bhtbbh.exec:\bhtbbh.exe98⤵PID:4980
-
\??\c:\vpjjd.exec:\vpjjd.exe99⤵PID:2812
-
\??\c:\1djdv.exec:\1djdv.exe100⤵PID:2408
-
\??\c:\5xxrffr.exec:\5xxrffr.exe101⤵PID:2412
-
\??\c:\7rrxrxr.exec:\7rrxrxr.exe102⤵PID:2800
-
\??\c:\nnttbh.exec:\nnttbh.exe103⤵PID:4496
-
\??\c:\7vvvv.exec:\7vvvv.exe104⤵PID:1528
-
\??\c:\vpddv.exec:\vpddv.exe105⤵PID:700
-
\??\c:\xfllfff.exec:\xfllfff.exe106⤵PID:1040
-
\??\c:\5thbbb.exec:\5thbbb.exe107⤵PID:452
-
\??\c:\hhbbth.exec:\hhbbth.exe108⤵PID:3640
-
\??\c:\thbtnt.exec:\thbtnt.exe109⤵PID:2164
-
\??\c:\vpddj.exec:\vpddj.exe110⤵PID:3940
-
\??\c:\jdpjd.exec:\jdpjd.exe111⤵PID:548
-
\??\c:\nbhbhn.exec:\nbhbhn.exe112⤵PID:1016
-
\??\c:\djddp.exec:\djddp.exe113⤵PID:428
-
\??\c:\9pdjp.exec:\9pdjp.exe114⤵PID:2768
-
\??\c:\flllllr.exec:\flllllr.exe115⤵PID:4480
-
\??\c:\7rxrrrr.exec:\7rxrrrr.exe116⤵PID:3588
-
\??\c:\jjddj.exec:\jjddj.exe117⤵PID:3528
-
\??\c:\pjvvp.exec:\pjvvp.exe118⤵PID:3968
-
\??\c:\7xxrrxl.exec:\7xxrrxl.exe119⤵PID:1940
-
\??\c:\xfrrlll.exec:\xfrrlll.exe120⤵PID:4288
-
\??\c:\nnttnn.exec:\nnttnn.exe121⤵PID:3336
-
\??\c:\btbhbh.exec:\btbhbh.exe122⤵PID:4652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-