Analysis
-
max time kernel
120s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 11:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f5c5af83ae83c05576b2d9e6aab42b0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7f5c5af83ae83c05576b2d9e6aab42b0N.exe
-
Size
57KB
-
MD5
7f5c5af83ae83c05576b2d9e6aab42b0
-
SHA1
94b366e10c4013a74db81b8569c0c1c2f976f745
-
SHA256
dc671d6ee3918912ef68e6167a4e4f1b72c17b20c4ad62a4e913cbd6c643595e
-
SHA512
2a8d33fd346c6eb952c43bc06eae00f268524031fe726dd16f1734c36817899b6437905c957b976d90eb42d1312477b687fdd39f17fb593e2ac02389ff1b6fd1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgTz:ymb3NkkiQ3mdBjFIg/
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1256 dpdvj.exe 1416 7ffrfxr.exe 3768 rlfxlfx.exe 2588 tbnhnh.exe 2440 vpjvv.exe 4840 9pjvp.exe 4892 fflflfx.exe 2996 vpvpd.exe 1916 vjjvj.exe 1780 3ffrfxl.exe 220 3hbnbt.exe 1608 vjvpv.exe 2584 7ddpd.exe 3524 ffflrfr.exe 2424 bnbtnh.exe 2540 thbnhb.exe 5028 dpjvj.exe 3620 fllfrlf.exe 1348 llfxlfr.exe 2892 nnbttt.exe 2016 dvdpv.exe 3364 1ffrffl.exe 1284 7xxrfxf.exe 1080 thhbnh.exe 4160 ddjpv.exe 1704 9xrlxrl.exe 1508 rfxlxlx.exe 4868 htnbbn.exe 4908 vdvjv.exe 2724 7rrfrrf.exe 856 frffxxr.exe 4920 1tnbtb.exe 228 nbtttb.exe 4476 ddvvp.exe 2860 pdvjd.exe 4792 rlfxlfr.exe 1972 xlrxfrr.exe 5100 bhhbnn.exe 3156 bttnnb.exe 1464 pdvjv.exe 3040 pddpd.exe 2136 frrfxrf.exe 1096 1lfxllf.exe 3280 hnhbtn.exe 1680 pdjvj.exe 4772 vvdpd.exe 4580 rrlxfxl.exe 2632 xxlfxrl.exe 2908 hnthnb.exe 1780 tthhht.exe 3064 jjdpd.exe 2252 fxxrrlx.exe 1436 1rrrfxl.exe 1064 btbtnt.exe 3524 jvvjj.exe 4924 vvvdv.exe 3048 frflxrf.exe 1540 lrrlxll.exe 5028 tnnhhb.exe 1964 pdvjv.exe 436 vvjdp.exe 1300 fxlffrr.exe 2892 fllllfr.exe 2216 hnhbnh.exe -
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1256 4792 7f5c5af83ae83c05576b2d9e6aab42b0N.exe 87 PID 4792 wrote to memory of 1256 4792 7f5c5af83ae83c05576b2d9e6aab42b0N.exe 87 PID 4792 wrote to memory of 1256 4792 7f5c5af83ae83c05576b2d9e6aab42b0N.exe 87 PID 1256 wrote to memory of 1416 1256 dpdvj.exe 88 PID 1256 wrote to memory of 1416 1256 dpdvj.exe 88 PID 1256 wrote to memory of 1416 1256 dpdvj.exe 88 PID 1416 wrote to memory of 3768 1416 7ffrfxr.exe 89 PID 1416 wrote to memory of 3768 1416 7ffrfxr.exe 89 PID 1416 wrote to memory of 3768 1416 7ffrfxr.exe 89 PID 3768 wrote to memory of 2588 3768 rlfxlfx.exe 90 PID 3768 wrote to memory of 2588 3768 rlfxlfx.exe 90 PID 3768 wrote to memory of 2588 3768 rlfxlfx.exe 90 PID 2588 wrote to memory of 2440 2588 tbnhnh.exe 91 PID 2588 wrote to memory of 2440 2588 tbnhnh.exe 91 PID 2588 wrote to memory of 2440 2588 tbnhnh.exe 91 PID 2440 wrote to memory of 4840 2440 vpjvv.exe 92 PID 2440 wrote to memory of 4840 2440 vpjvv.exe 92 PID 2440 wrote to memory of 4840 2440 vpjvv.exe 92 PID 4840 wrote to memory of 4892 4840 9pjvp.exe 93 PID 4840 wrote to memory of 4892 4840 9pjvp.exe 93 PID 4840 wrote to memory of 4892 4840 9pjvp.exe 93 PID 4892 wrote to memory of 2996 4892 fflflfx.exe 94 PID 4892 wrote to memory of 2996 4892 fflflfx.exe 94 PID 4892 wrote to memory of 2996 4892 fflflfx.exe 94 PID 2996 wrote to memory of 1916 2996 vpvpd.exe 95 PID 2996 wrote to memory of 1916 2996 vpvpd.exe 95 PID 2996 wrote to memory of 1916 2996 vpvpd.exe 95 PID 1916 wrote to memory of 1780 1916 vjjvj.exe 96 PID 1916 wrote to memory of 1780 1916 vjjvj.exe 96 PID 1916 wrote to memory of 1780 1916 vjjvj.exe 96 PID 1780 wrote to memory of 220 1780 3ffrfxl.exe 98 PID 1780 wrote to memory of 220 1780 3ffrfxl.exe 98 PID 1780 wrote to memory of 220 1780 3ffrfxl.exe 98 PID 220 wrote to memory of 1608 220 3hbnbt.exe 99 PID 220 wrote to memory of 1608 220 3hbnbt.exe 99 PID 220 wrote to memory of 1608 220 3hbnbt.exe 99 PID 1608 wrote to memory of 2584 1608 vjvpv.exe 100 PID 1608 wrote to memory of 2584 1608 vjvpv.exe 100 PID 1608 wrote to memory of 2584 1608 vjvpv.exe 100 PID 2584 wrote to memory of 3524 2584 7ddpd.exe 101 PID 2584 wrote to memory of 3524 2584 7ddpd.exe 101 PID 2584 wrote to memory of 3524 2584 7ddpd.exe 101 PID 3524 wrote to memory of 2424 3524 ffflrfr.exe 102 PID 3524 wrote to memory of 2424 3524 ffflrfr.exe 102 PID 3524 wrote to memory of 2424 3524 ffflrfr.exe 102 PID 2424 wrote to memory of 2540 2424 bnbtnh.exe 103 PID 2424 wrote to memory of 2540 2424 bnbtnh.exe 103 PID 2424 wrote to memory of 2540 2424 bnbtnh.exe 103 PID 2540 wrote to memory of 5028 2540 thbnhb.exe 104 PID 2540 wrote to memory of 5028 2540 thbnhb.exe 104 PID 2540 wrote to memory of 5028 2540 thbnhb.exe 104 PID 5028 wrote to memory of 3620 5028 dpjvj.exe 105 PID 5028 wrote to memory of 3620 5028 dpjvj.exe 105 PID 5028 wrote to memory of 3620 5028 dpjvj.exe 105 PID 3620 wrote to memory of 1348 3620 fllfrlf.exe 106 PID 3620 wrote to memory of 1348 3620 fllfrlf.exe 106 PID 3620 wrote to memory of 1348 3620 fllfrlf.exe 106 PID 1348 wrote to memory of 2892 1348 llfxlfr.exe 107 PID 1348 wrote to memory of 2892 1348 llfxlfr.exe 107 PID 1348 wrote to memory of 2892 1348 llfxlfr.exe 107 PID 2892 wrote to memory of 2016 2892 nnbttt.exe 108 PID 2892 wrote to memory of 2016 2892 nnbttt.exe 108 PID 2892 wrote to memory of 2016 2892 nnbttt.exe 108 PID 2016 wrote to memory of 3364 2016 dvdpv.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f5c5af83ae83c05576b2d9e6aab42b0N.exe"C:\Users\Admin\AppData\Local\Temp\7f5c5af83ae83c05576b2d9e6aab42b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\dpdvj.exec:\dpdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\7ffrfxr.exec:\7ffrfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\tbnhnh.exec:\tbnhnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\vpjvv.exec:\vpjvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\9pjvp.exec:\9pjvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\fflflfx.exec:\fflflfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\vpvpd.exec:\vpvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vjjvj.exec:\vjjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\3ffrfxl.exec:\3ffrfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\3hbnbt.exec:\3hbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\vjvpv.exec:\vjvpv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\7ddpd.exec:\7ddpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\ffflrfr.exec:\ffflrfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\bnbtnh.exec:\bnbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\thbnhb.exec:\thbnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\dpjvj.exec:\dpjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\fllfrlf.exec:\fllfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\llfxlfr.exec:\llfxlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\nnbttt.exec:\nnbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\dvdpv.exec:\dvdpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1ffrffl.exec:\1ffrffl.exe23⤵
- Executes dropped EXE
PID:3364 -
\??\c:\7xxrfxf.exec:\7xxrfxf.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\thhbnh.exec:\thhbnh.exe25⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ddjpv.exec:\ddjpv.exe26⤵
- Executes dropped EXE
PID:4160 -
\??\c:\9xrlxrl.exec:\9xrlxrl.exe27⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rfxlxlx.exec:\rfxlxlx.exe28⤵
- Executes dropped EXE
PID:1508 -
\??\c:\htnbbn.exec:\htnbbn.exe29⤵
- Executes dropped EXE
PID:4868 -
\??\c:\vdvjv.exec:\vdvjv.exe30⤵
- Executes dropped EXE
PID:4908 -
\??\c:\7rrfrrf.exec:\7rrfrrf.exe31⤵
- Executes dropped EXE
PID:2724 -
\??\c:\frffxxr.exec:\frffxxr.exe32⤵
- Executes dropped EXE
PID:856 -
\??\c:\1tnbtb.exec:\1tnbtb.exe33⤵
- Executes dropped EXE
PID:4920 -
\??\c:\nbtttb.exec:\nbtttb.exe34⤵
- Executes dropped EXE
PID:228 -
\??\c:\ddvvp.exec:\ddvvp.exe35⤵
- Executes dropped EXE
PID:4476 -
\??\c:\pdvjd.exec:\pdvjd.exe36⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe37⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xlrxfrr.exec:\xlrxfrr.exe38⤵
- Executes dropped EXE
PID:1972 -
\??\c:\bhhbnn.exec:\bhhbnn.exe39⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bttnnb.exec:\bttnnb.exe40⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pdvjv.exec:\pdvjv.exe41⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pddpd.exec:\pddpd.exe42⤵
- Executes dropped EXE
PID:3040 -
\??\c:\frrfxrf.exec:\frrfxrf.exe43⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1lfxllf.exec:\1lfxllf.exe44⤵
- Executes dropped EXE
PID:1096 -
\??\c:\hnhbtn.exec:\hnhbtn.exe45⤵
- Executes dropped EXE
PID:3280 -
\??\c:\pdjvj.exec:\pdjvj.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680 -
\??\c:\vvdpd.exec:\vvdpd.exe47⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rrlxfxl.exec:\rrlxfxl.exe48⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xxlfxrl.exec:\xxlfxrl.exe49⤵
- Executes dropped EXE
PID:2632 -
\??\c:\hnthnb.exec:\hnthnb.exe50⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tthhht.exec:\tthhht.exe51⤵
- Executes dropped EXE
PID:1780 -
\??\c:\jjdpd.exec:\jjdpd.exe52⤵
- Executes dropped EXE
PID:3064 -
\??\c:\fxxrrlx.exec:\fxxrrlx.exe53⤵
- Executes dropped EXE
PID:2252 -
\??\c:\1rrrfxl.exec:\1rrrfxl.exe54⤵
- Executes dropped EXE
PID:1436 -
\??\c:\btbtnt.exec:\btbtnt.exe55⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jvvjj.exec:\jvvjj.exe56⤵
- Executes dropped EXE
PID:3524 -
\??\c:\vvvdv.exec:\vvvdv.exe57⤵
- Executes dropped EXE
PID:4924 -
\??\c:\frflxrf.exec:\frflxrf.exe58⤵
- Executes dropped EXE
PID:3048 -
\??\c:\lrrlxll.exec:\lrrlxll.exe59⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tnnhhb.exec:\tnnhhb.exe60⤵
- Executes dropped EXE
PID:5028 -
\??\c:\pdvjv.exec:\pdvjv.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvjdp.exec:\vvjdp.exe62⤵
- Executes dropped EXE
PID:436 -
\??\c:\fxlffrr.exec:\fxlffrr.exe63⤵
- Executes dropped EXE
PID:1300 -
\??\c:\fllllfr.exec:\fllllfr.exe64⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hnhbnh.exec:\hnhbnh.exe65⤵
- Executes dropped EXE
PID:2216 -
\??\c:\vvvjv.exec:\vvvjv.exe66⤵PID:2016
-
\??\c:\9ddpp.exec:\9ddpp.exe67⤵PID:1072
-
\??\c:\vvpdp.exec:\vvpdp.exe68⤵PID:2112
-
\??\c:\1xxlxxr.exec:\1xxlxxr.exe69⤵PID:940
-
\??\c:\bbbtnh.exec:\bbbtnh.exe70⤵PID:2180
-
\??\c:\bhnhbn.exec:\bhnhbn.exe71⤵PID:1820
-
\??\c:\bnbnhb.exec:\bnbnhb.exe72⤵PID:1648
-
\??\c:\vvppv.exec:\vvppv.exe73⤵PID:3628
-
\??\c:\djdpd.exec:\djdpd.exe74⤵PID:3556
-
\??\c:\rfxrlxr.exec:\rfxrlxr.exe75⤵PID:2248
-
\??\c:\3lxlfrf.exec:\3lxlfrf.exe76⤵PID:4824
-
\??\c:\tbtnhh.exec:\tbtnhh.exe77⤵PID:2148
-
\??\c:\nnhnbt.exec:\nnhnbt.exe78⤵PID:1036
-
\??\c:\vddpv.exec:\vddpv.exe79⤵PID:4052
-
\??\c:\dpjvp.exec:\dpjvp.exe80⤵PID:2360
-
\??\c:\llrfrrf.exec:\llrfrrf.exe81⤵PID:1864
-
\??\c:\fxrflfx.exec:\fxrflfx.exe82⤵PID:4560
-
\??\c:\rrfxxxf.exec:\rrfxxxf.exe83⤵PID:3236
-
\??\c:\3ttnnh.exec:\3ttnnh.exe84⤵PID:3972
-
\??\c:\hbtbhb.exec:\hbtbhb.exe85⤵PID:1972
-
\??\c:\1pjvp.exec:\1pjvp.exe86⤵PID:2308
-
\??\c:\vvpjv.exec:\vvpjv.exe87⤵PID:2588
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe88⤵PID:920
-
\??\c:\5lrfrlr.exec:\5lrfrlr.exe89⤵PID:2752
-
\??\c:\hbhnbn.exec:\hbhnbn.exe90⤵PID:2596
-
\??\c:\hnhbnb.exec:\hnhbnb.exe91⤵PID:3892
-
\??\c:\jvvpd.exec:\jvvpd.exe92⤵PID:4860
-
\??\c:\pvpdp.exec:\pvpdp.exe93⤵PID:4872
-
\??\c:\bnthhb.exec:\bnthhb.exe94⤵PID:4140
-
\??\c:\pjpdj.exec:\pjpdj.exe95⤵PID:2632
-
\??\c:\dpdpj.exec:\dpdpj.exe96⤵PID:3488
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe97⤵PID:4836
-
\??\c:\xxxrfxl.exec:\xxxrfxl.exe98⤵PID:3460
-
\??\c:\bntnhh.exec:\bntnhh.exe99⤵PID:4308
-
\??\c:\bnhbhh.exec:\bnhbhh.exe100⤵PID:3172
-
\??\c:\pvvjp.exec:\pvvjp.exe101⤵PID:316
-
\??\c:\pvdpd.exec:\pvdpd.exe102⤵PID:1632
-
\??\c:\lxfxlfr.exec:\lxfxlfr.exe103⤵PID:1212
-
\??\c:\rxrfrlf.exec:\rxrfrlf.exe104⤵PID:3760
-
\??\c:\tnhtnh.exec:\tnhtnh.exe105⤵PID:1440
-
\??\c:\nbbnnh.exec:\nbbnnh.exe106⤵PID:736
-
\??\c:\jjjjd.exec:\jjjjd.exe107⤵PID:4768
-
\??\c:\3pddp.exec:\3pddp.exe108⤵PID:2512
-
\??\c:\fflxlff.exec:\fflxlff.exe109⤵PID:764
-
\??\c:\frxxxll.exec:\frxxxll.exe110⤵PID:8
-
\??\c:\bhbnbt.exec:\bhbnbt.exe111⤵PID:2256
-
\??\c:\nbnbnb.exec:\nbnbnb.exe112⤵PID:2876
-
\??\c:\dpdpd.exec:\dpdpd.exe113⤵PID:2928
-
\??\c:\1xxfxrr.exec:\1xxfxrr.exe114⤵PID:3444
-
\??\c:\xflxrlf.exec:\xflxrlf.exe115⤵PID:1704
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe116⤵PID:2936
-
\??\c:\9nhhtb.exec:\9nhhtb.exe117⤵PID:3332
-
\??\c:\jjvjj.exec:\jjvjj.exe118⤵PID:3316
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe119⤵PID:3764
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe120⤵PID:3276
-
\??\c:\nbnhtn.exec:\nbnhtn.exe121⤵PID:5044
-
\??\c:\ntbnbh.exec:\ntbnbh.exe122⤵PID:3300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-