Analysis
-
max time kernel
120s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 15:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85b079444830291d05cee2f07303fcb0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
85b079444830291d05cee2f07303fcb0N.exe
-
Size
94KB
-
MD5
85b079444830291d05cee2f07303fcb0
-
SHA1
09c73299b8d3dfd0ad4ae34c2e129d08c54b18ed
-
SHA256
f18474547c14b5bfb35a63a3b33f62f2eaf59d9753941f7f34ee9f15b537185a
-
SHA512
89737d9d4cc6ac0663f49ffda9e8196507636cce65c19d82810bfda305ab6f9d0229a74bf80c03efdef381fcbe8988f9e5344aad0b76998b547834458b5df38b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxS1rj/2C1:ymb3NkkiQ3mdBjFo73PYP1lri3K8Gwr
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2808-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/716-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/680-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/444-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4244 bntnhh.exe 4956 jpvpd.exe 3816 xflfxrl.exe 4400 hhbthh.exe 5016 vvvpj.exe 1960 rrllrfl.exe 4640 1nttnn.exe 716 tnbthh.exe 680 7pvpv.exe 2476 3lllfff.exe 4548 tntbbb.exe 1892 jvdvj.exe 1608 xxfxrlf.exe 3412 nhhbnh.exe 2976 htnhhb.exe 3416 1vdvp.exe 3144 xllflrr.exe 2240 xflfxlf.exe 3376 9hnhbb.exe 2604 pjdvj.exe 444 pdjvp.exe 2096 xxfxllf.exe 4896 vpdpj.exe 968 vvjdj.exe 4748 lffxfff.exe 2500 bthbtt.exe 4524 5nhbtt.exe 4448 dvvpj.exe 1820 lrxxrrl.exe 2396 bttbnt.exe 4272 ppjdv.exe 3996 jvvjv.exe 3088 fflflff.exe 4364 tnnntn.exe 1384 bbhtnh.exe 740 pddpd.exe 1036 jdpjv.exe 392 lllfrrl.exe 1160 lxxrffx.exe 3916 nnbbnh.exe 1540 vvjjp.exe 4304 5pvvd.exe 3980 hhhhbt.exe 1960 ppjjv.exe 4584 ddvpj.exe 1964 lxxrllf.exe 3788 nhhbtt.exe 3000 bhnhbb.exe 1704 pjdvv.exe 4920 3ppjv.exe 4548 rlffllr.exe 544 fflffxl.exe 4836 nhtntt.exe 4024 7bbthh.exe 2868 ppdvv.exe 4276 dpvdv.exe 3416 1ffxrrl.exe 8 1hbbhh.exe 3144 ntbttt.exe 4020 1vvpj.exe 3984 9ppdv.exe 3240 lxrlfrx.exe 1456 lllfxxr.exe 4636 5btnnt.exe -
resource yara_rule behavioral2/memory/2808-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/716-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/680-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/444-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bbhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4244 2808 85b079444830291d05cee2f07303fcb0N.exe 84 PID 2808 wrote to memory of 4244 2808 85b079444830291d05cee2f07303fcb0N.exe 84 PID 2808 wrote to memory of 4244 2808 85b079444830291d05cee2f07303fcb0N.exe 84 PID 4244 wrote to memory of 4956 4244 bntnhh.exe 85 PID 4244 wrote to memory of 4956 4244 bntnhh.exe 85 PID 4244 wrote to memory of 4956 4244 bntnhh.exe 85 PID 4956 wrote to memory of 3816 4956 jpvpd.exe 86 PID 4956 wrote to memory of 3816 4956 jpvpd.exe 86 PID 4956 wrote to memory of 3816 4956 jpvpd.exe 86 PID 3816 wrote to memory of 4400 3816 xflfxrl.exe 87 PID 3816 wrote to memory of 4400 3816 xflfxrl.exe 87 PID 3816 wrote to memory of 4400 3816 xflfxrl.exe 87 PID 4400 wrote to memory of 5016 4400 hhbthh.exe 88 PID 4400 wrote to memory of 5016 4400 hhbthh.exe 88 PID 4400 wrote to memory of 5016 4400 hhbthh.exe 88 PID 5016 wrote to memory of 1960 5016 vvvpj.exe 89 PID 5016 wrote to memory of 1960 5016 vvvpj.exe 89 PID 5016 wrote to memory of 1960 5016 vvvpj.exe 89 PID 1960 wrote to memory of 4640 1960 rrllrfl.exe 90 PID 1960 wrote to memory of 4640 1960 rrllrfl.exe 90 PID 1960 wrote to memory of 4640 1960 rrllrfl.exe 90 PID 4640 wrote to memory of 716 4640 1nttnn.exe 91 PID 4640 wrote to memory of 716 4640 1nttnn.exe 91 PID 4640 wrote to memory of 716 4640 1nttnn.exe 91 PID 716 wrote to memory of 680 716 tnbthh.exe 92 PID 716 wrote to memory of 680 716 tnbthh.exe 92 PID 716 wrote to memory of 680 716 tnbthh.exe 92 PID 680 wrote to memory of 2476 680 7pvpv.exe 93 PID 680 wrote to memory of 2476 680 7pvpv.exe 93 PID 680 wrote to memory of 2476 680 7pvpv.exe 93 PID 2476 wrote to memory of 4548 2476 3lllfff.exe 94 PID 2476 wrote to memory of 4548 2476 3lllfff.exe 94 PID 2476 wrote to memory of 4548 2476 3lllfff.exe 94 PID 4548 wrote to memory of 1892 4548 tntbbb.exe 95 PID 4548 wrote to memory of 1892 4548 tntbbb.exe 95 PID 4548 wrote to memory of 1892 4548 tntbbb.exe 95 PID 1892 wrote to memory of 1608 1892 jvdvj.exe 97 PID 1892 wrote to memory of 1608 1892 jvdvj.exe 97 PID 1892 wrote to memory of 1608 1892 jvdvj.exe 97 PID 1608 wrote to memory of 3412 1608 xxfxrlf.exe 98 PID 1608 wrote to memory of 3412 1608 xxfxrlf.exe 98 PID 1608 wrote to memory of 3412 1608 xxfxrlf.exe 98 PID 3412 wrote to memory of 2976 3412 nhhbnh.exe 99 PID 3412 wrote to memory of 2976 3412 nhhbnh.exe 99 PID 3412 wrote to memory of 2976 3412 nhhbnh.exe 99 PID 2976 wrote to memory of 3416 2976 htnhhb.exe 100 PID 2976 wrote to memory of 3416 2976 htnhhb.exe 100 PID 2976 wrote to memory of 3416 2976 htnhhb.exe 100 PID 3416 wrote to memory of 3144 3416 1vdvp.exe 101 PID 3416 wrote to memory of 3144 3416 1vdvp.exe 101 PID 3416 wrote to memory of 3144 3416 1vdvp.exe 101 PID 3144 wrote to memory of 2240 3144 xllflrr.exe 102 PID 3144 wrote to memory of 2240 3144 xllflrr.exe 102 PID 3144 wrote to memory of 2240 3144 xllflrr.exe 102 PID 2240 wrote to memory of 3376 2240 xflfxlf.exe 103 PID 2240 wrote to memory of 3376 2240 xflfxlf.exe 103 PID 2240 wrote to memory of 3376 2240 xflfxlf.exe 103 PID 3376 wrote to memory of 2604 3376 9hnhbb.exe 104 PID 3376 wrote to memory of 2604 3376 9hnhbb.exe 104 PID 3376 wrote to memory of 2604 3376 9hnhbb.exe 104 PID 2604 wrote to memory of 444 2604 pjdvj.exe 105 PID 2604 wrote to memory of 444 2604 pjdvj.exe 105 PID 2604 wrote to memory of 444 2604 pjdvj.exe 105 PID 444 wrote to memory of 2096 444 pdjvp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\85b079444830291d05cee2f07303fcb0N.exe"C:\Users\Admin\AppData\Local\Temp\85b079444830291d05cee2f07303fcb0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\bntnhh.exec:\bntnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\jpvpd.exec:\jpvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\xflfxrl.exec:\xflfxrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\hhbthh.exec:\hhbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\vvvpj.exec:\vvvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\rrllrfl.exec:\rrllrfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\1nttnn.exec:\1nttnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\tnbthh.exec:\tnbthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
\??\c:\7pvpv.exec:\7pvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:680 -
\??\c:\3lllfff.exec:\3lllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\tntbbb.exec:\tntbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\jvdvj.exec:\jvdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\nhhbnh.exec:\nhhbnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\htnhhb.exec:\htnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1vdvp.exec:\1vdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\xllflrr.exec:\xllflrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\xflfxlf.exec:\xflfxlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\9hnhbb.exec:\9hnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\pjdvj.exec:\pjdvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\pdjvp.exec:\pdjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
\??\c:\xxfxllf.exec:\xxfxllf.exe23⤵
- Executes dropped EXE
PID:2096 -
\??\c:\vpdpj.exec:\vpdpj.exe24⤵
- Executes dropped EXE
PID:4896 -
\??\c:\vvjdj.exec:\vvjdj.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:968 -
\??\c:\lffxfff.exec:\lffxfff.exe26⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bthbtt.exec:\bthbtt.exe27⤵
- Executes dropped EXE
PID:2500 -
\??\c:\5nhbtt.exec:\5nhbtt.exe28⤵
- Executes dropped EXE
PID:4524 -
\??\c:\dvvpj.exec:\dvvpj.exe29⤵
- Executes dropped EXE
PID:4448 -
\??\c:\lrxxrrl.exec:\lrxxrrl.exe30⤵
- Executes dropped EXE
PID:1820 -
\??\c:\bttbnt.exec:\bttbnt.exe31⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ppjdv.exec:\ppjdv.exe32⤵
- Executes dropped EXE
PID:4272 -
\??\c:\jvvjv.exec:\jvvjv.exe33⤵
- Executes dropped EXE
PID:3996 -
\??\c:\fflflff.exec:\fflflff.exe34⤵
- Executes dropped EXE
PID:3088 -
\??\c:\tnnntn.exec:\tnnntn.exe35⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bbhtnh.exec:\bbhtnh.exe36⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pddpd.exec:\pddpd.exe37⤵
- Executes dropped EXE
PID:740 -
\??\c:\jdpjv.exec:\jdpjv.exe38⤵
- Executes dropped EXE
PID:1036 -
\??\c:\lllfrrl.exec:\lllfrrl.exe39⤵
- Executes dropped EXE
PID:392 -
\??\c:\lxxrffx.exec:\lxxrffx.exe40⤵
- Executes dropped EXE
PID:1160 -
\??\c:\nnbbnh.exec:\nnbbnh.exe41⤵
- Executes dropped EXE
PID:3916 -
\??\c:\vvjjp.exec:\vvjjp.exe42⤵
- Executes dropped EXE
PID:1540 -
\??\c:\5pvvd.exec:\5pvvd.exe43⤵
- Executes dropped EXE
PID:4304 -
\??\c:\hhhhbt.exec:\hhhhbt.exe44⤵
- Executes dropped EXE
PID:3980 -
\??\c:\ppjjv.exec:\ppjjv.exe45⤵
- Executes dropped EXE
PID:1960 -
\??\c:\ddvpj.exec:\ddvpj.exe46⤵
- Executes dropped EXE
PID:4584 -
\??\c:\lxxrllf.exec:\lxxrllf.exe47⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nhhbtt.exec:\nhhbtt.exe48⤵
- Executes dropped EXE
PID:3788 -
\??\c:\bhnhbb.exec:\bhnhbb.exe49⤵
- Executes dropped EXE
PID:3000 -
\??\c:\pjdvv.exec:\pjdvv.exe50⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3ppjv.exec:\3ppjv.exe51⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rlffllr.exec:\rlffllr.exe52⤵
- Executes dropped EXE
PID:4548 -
\??\c:\fflffxl.exec:\fflffxl.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\nhtntt.exec:\nhtntt.exe54⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7bbthh.exec:\7bbthh.exe55⤵
- Executes dropped EXE
PID:4024 -
\??\c:\ppdvv.exec:\ppdvv.exe56⤵
- Executes dropped EXE
PID:2868 -
\??\c:\dpvdv.exec:\dpvdv.exe57⤵
- Executes dropped EXE
PID:4276 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe58⤵
- Executes dropped EXE
PID:3416 -
\??\c:\1hbbhh.exec:\1hbbhh.exe59⤵
- Executes dropped EXE
PID:8 -
\??\c:\ntbttt.exec:\ntbttt.exe60⤵
- Executes dropped EXE
PID:3144 -
\??\c:\1vvpj.exec:\1vvpj.exe61⤵
- Executes dropped EXE
PID:4020 -
\??\c:\9ppdv.exec:\9ppdv.exe62⤵
- Executes dropped EXE
PID:3984 -
\??\c:\lxrlfrx.exec:\lxrlfrx.exe63⤵
- Executes dropped EXE
PID:3240 -
\??\c:\lllfxxr.exec:\lllfxxr.exe64⤵
- Executes dropped EXE
PID:1456 -
\??\c:\5btnnt.exec:\5btnnt.exe65⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hthbnn.exec:\hthbnn.exe66⤵PID:3760
-
\??\c:\3jjjv.exec:\3jjjv.exe67⤵PID:1528
-
\??\c:\vppdp.exec:\vppdp.exe68⤵
- System Location Discovery: System Language Discovery
PID:1316 -
\??\c:\3rfxrrf.exec:\3rfxrrf.exe69⤵PID:4652
-
\??\c:\rfxxxlr.exec:\rfxxxlr.exe70⤵PID:2328
-
\??\c:\bnnhbt.exec:\bnnhbt.exe71⤵PID:4800
-
\??\c:\vdjdv.exec:\vdjdv.exe72⤵PID:2500
-
\??\c:\jvvpj.exec:\jvvpj.exe73⤵PID:1048
-
\??\c:\rfxrxrr.exec:\rfxrxrr.exe74⤵PID:552
-
\??\c:\xlllrrf.exec:\xlllrrf.exe75⤵PID:2668
-
\??\c:\thhtnh.exec:\thhtnh.exe76⤵PID:1796
-
\??\c:\bbtttt.exec:\bbtttt.exe77⤵PID:3772
-
\??\c:\dpvvj.exec:\dpvvj.exe78⤵PID:3624
-
\??\c:\lrfrffx.exec:\lrfrffx.exe79⤵PID:5068
-
\??\c:\fxrrxxl.exec:\fxrrxxl.exe80⤵PID:4696
-
\??\c:\thhhbb.exec:\thhhbb.exe81⤵PID:3080
-
\??\c:\nntthh.exec:\nntthh.exe82⤵PID:4364
-
\??\c:\ppvpj.exec:\ppvpj.exe83⤵PID:4816
-
\??\c:\jppdp.exec:\jppdp.exe84⤵PID:2808
-
\??\c:\rllfxrl.exec:\rllfxrl.exe85⤵PID:1096
-
\??\c:\5lfxrxr.exec:\5lfxrxr.exe86⤵PID:3316
-
\??\c:\tnhbbb.exec:\tnhbbb.exe87⤵PID:684
-
\??\c:\hhnhbb.exec:\hhnhbb.exe88⤵PID:4400
-
\??\c:\pvdvj.exec:\pvdvj.exe89⤵PID:2480
-
\??\c:\9rrrfff.exec:\9rrrfff.exe90⤵PID:316
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe91⤵PID:4744
-
\??\c:\bntthh.exec:\bntthh.exe92⤵PID:1972
-
\??\c:\bnnhbt.exec:\bnnhbt.exe93⤵PID:5044
-
\??\c:\jpppp.exec:\jpppp.exe94⤵PID:3464
-
\??\c:\jvdpj.exec:\jvdpj.exe95⤵PID:3000
-
\??\c:\xrffrrr.exec:\xrffrrr.exe96⤵PID:4884
-
\??\c:\5hhnhn.exec:\5hhnhn.exe97⤵PID:2008
-
\??\c:\pvdvj.exec:\pvdvj.exe98⤵PID:4548
-
\??\c:\rlxfxrr.exec:\rlxfxrr.exe99⤵PID:4056
-
\??\c:\hhhhhh.exec:\hhhhhh.exe100⤵PID:2128
-
\??\c:\5btnbb.exec:\5btnbb.exe101⤵PID:1720
-
\??\c:\pjpjd.exec:\pjpjd.exe102⤵PID:868
-
\??\c:\lfxrlll.exec:\lfxrlll.exe103⤵PID:3656
-
\??\c:\rlffrrx.exec:\rlffrrx.exe104⤵PID:4592
-
\??\c:\1tbbbb.exec:\1tbbbb.exe105⤵PID:3976
-
\??\c:\tntnnh.exec:\tntnnh.exe106⤵PID:4436
-
\??\c:\jddvv.exec:\jddvv.exe107⤵PID:2132
-
\??\c:\dppvj.exec:\dppvj.exe108⤵PID:4468
-
\??\c:\rfxrxrl.exec:\rfxrxrl.exe109⤵PID:444
-
\??\c:\bbbtnt.exec:\bbbtnt.exe110⤵PID:4688
-
\??\c:\nhhbnn.exec:\nhhbnn.exe111⤵PID:508
-
\??\c:\dpdvp.exec:\dpdvp.exe112⤵PID:1228
-
\??\c:\fxfxrlr.exec:\fxfxrlr.exe113⤵PID:1752
-
\??\c:\tnbhhb.exec:\tnbhhb.exe114⤵PID:3188
-
\??\c:\5djvj.exec:\5djvj.exe115⤵PID:2328
-
\??\c:\jddvp.exec:\jddvp.exe116⤵PID:2124
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe117⤵PID:2140
-
\??\c:\lxrlllf.exec:\lxrlllf.exe118⤵PID:3912
-
\??\c:\tthbhb.exec:\tthbhb.exe119⤵PID:1820
-
\??\c:\jdvpv.exec:\jdvpv.exe120⤵PID:4912
-
\??\c:\dvpjv.exec:\dvpjv.exe121⤵PID:3304
-
\??\c:\ffffxxx.exec:\ffffxxx.exe122⤵PID:4888
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-