Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 23:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe
-
Size
51KB
-
MD5
b6aba0096d59f06550cbde07af9e2b8f
-
SHA1
9744e3b755f773bd80d83c1c09d081ab0e2f48b3
-
SHA256
9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6
-
SHA512
669b6698463774cd53191b9f34dc661d8c96030c435801230051058f4fbaccdddbc3d0d94a33d93fa91dc8e1fae2433c9792e69719043babaaa3995648355826
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvWwc:0cdpeeBSHHMHLf9RyIL
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4244-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-240-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-298-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-305-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-316-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-336-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-350-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-410-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-448-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-470-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-482-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-491-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-519-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-526-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-533-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-615-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-649-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-776-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-816-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-1297-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-1517-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4516 1lllfxr.exe 3364 3hthnh.exe 5044 pvjvp.exe 2712 rfxrfxl.exe 3936 1rfrrrr.exe 3004 tnthht.exe 3528 jpvpj.exe 1780 djjdv.exe 3680 rrxxxrl.exe 2428 nbbhbt.exe 1684 djvpv.exe 2924 dddvj.exe 4812 xxxfrrl.exe 2984 nttbnb.exe 1936 vvjdj.exe 4688 vdpvv.exe 1788 rllfrll.exe 4704 hntthb.exe 116 nnntnh.exe 4064 jpvvj.exe 1012 lxlxfxf.exe 2820 lflllfl.exe 4780 hhbbtn.exe 3504 vdjpp.exe 2080 ffffrlf.exe 1136 rfrlfrr.exe 4112 hhtnnb.exe 4264 jvjdp.exe 2016 xxlfrrl.exe 1484 btnntn.exe 4928 jdjdd.exe 2616 flfrlfx.exe 4080 hnhbbt.exe 4332 pjpvd.exe 3948 7fxlxxr.exe 3588 httnhh.exe 4968 hnnhbb.exe 5044 dvddp.exe 4532 xrrlxxx.exe 3936 xxlfrrl.exe 3732 3bthhh.exe 3008 5djdp.exe 2632 rflxlrr.exe 4964 7nhbbb.exe 640 5hhhbb.exe 5116 7ddpj.exe 1736 xrrrflf.exe 1444 1xflffx.exe 1496 jdddv.exe 2996 ppvpj.exe 4860 flrlffr.exe 1292 9lfxrrl.exe 1816 bhnnhh.exe 2880 pjpjj.exe 4792 jjvpj.exe 4372 flrfxrx.exe 1608 rxfxllx.exe 4356 1nhbth.exe 1848 tththn.exe 4400 jdpjd.exe 4932 3fffxrl.exe 4256 xlllflf.exe 1088 nhbtnb.exe 1416 vdpdv.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4244 wrote to memory of 4516 4244 9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe 87 PID 4244 wrote to memory of 4516 4244 9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe 87 PID 4244 wrote to memory of 4516 4244 9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe 87 PID 4516 wrote to memory of 3364 4516 1lllfxr.exe 88 PID 4516 wrote to memory of 3364 4516 1lllfxr.exe 88 PID 4516 wrote to memory of 3364 4516 1lllfxr.exe 88 PID 3364 wrote to memory of 5044 3364 3hthnh.exe 89 PID 3364 wrote to memory of 5044 3364 3hthnh.exe 89 PID 3364 wrote to memory of 5044 3364 3hthnh.exe 89 PID 5044 wrote to memory of 2712 5044 pvjvp.exe 90 PID 5044 wrote to memory of 2712 5044 pvjvp.exe 90 PID 5044 wrote to memory of 2712 5044 pvjvp.exe 90 PID 2712 wrote to memory of 3936 2712 rfxrfxl.exe 91 PID 2712 wrote to memory of 3936 2712 rfxrfxl.exe 91 PID 2712 wrote to memory of 3936 2712 rfxrfxl.exe 91 PID 3936 wrote to memory of 3004 3936 1rfrrrr.exe 92 PID 3936 wrote to memory of 3004 3936 1rfrrrr.exe 92 PID 3936 wrote to memory of 3004 3936 1rfrrrr.exe 92 PID 3004 wrote to memory of 3528 3004 tnthht.exe 93 PID 3004 wrote to memory of 3528 3004 tnthht.exe 93 PID 3004 wrote to memory of 3528 3004 tnthht.exe 93 PID 3528 wrote to memory of 1780 3528 jpvpj.exe 94 PID 3528 wrote to memory of 1780 3528 jpvpj.exe 94 PID 3528 wrote to memory of 1780 3528 jpvpj.exe 94 PID 1780 wrote to memory of 3680 1780 djjdv.exe 95 PID 1780 wrote to memory of 3680 1780 djjdv.exe 95 PID 1780 wrote to memory of 3680 1780 djjdv.exe 95 PID 3680 wrote to memory of 2428 3680 rrxxxrl.exe 96 PID 3680 wrote to memory of 2428 3680 rrxxxrl.exe 96 PID 3680 wrote to memory of 2428 3680 rrxxxrl.exe 96 PID 2428 wrote to memory of 1684 2428 nbbhbt.exe 97 PID 2428 wrote to memory of 1684 2428 nbbhbt.exe 97 PID 2428 wrote to memory of 1684 2428 nbbhbt.exe 97 PID 1684 wrote to memory of 2924 1684 djvpv.exe 98 PID 1684 wrote to memory of 2924 1684 djvpv.exe 98 PID 1684 wrote to memory of 2924 1684 djvpv.exe 98 PID 2924 wrote to memory of 4812 2924 dddvj.exe 99 PID 2924 wrote to memory of 4812 2924 dddvj.exe 99 PID 2924 wrote to memory of 4812 2924 dddvj.exe 99 PID 4812 wrote to memory of 2984 4812 xxxfrrl.exe 100 PID 4812 wrote to memory of 2984 4812 xxxfrrl.exe 100 PID 4812 wrote to memory of 2984 4812 xxxfrrl.exe 100 PID 2984 wrote to memory of 1936 2984 nttbnb.exe 101 PID 2984 wrote to memory of 1936 2984 nttbnb.exe 101 PID 2984 wrote to memory of 1936 2984 nttbnb.exe 101 PID 1936 wrote to memory of 4688 1936 vvjdj.exe 102 PID 1936 wrote to memory of 4688 1936 vvjdj.exe 102 PID 1936 wrote to memory of 4688 1936 vvjdj.exe 102 PID 4688 wrote to memory of 1788 4688 vdpvv.exe 103 PID 4688 wrote to memory of 1788 4688 vdpvv.exe 103 PID 4688 wrote to memory of 1788 4688 vdpvv.exe 103 PID 1788 wrote to memory of 4704 1788 rllfrll.exe 104 PID 1788 wrote to memory of 4704 1788 rllfrll.exe 104 PID 1788 wrote to memory of 4704 1788 rllfrll.exe 104 PID 4704 wrote to memory of 116 4704 hntthb.exe 105 PID 4704 wrote to memory of 116 4704 hntthb.exe 105 PID 4704 wrote to memory of 116 4704 hntthb.exe 105 PID 116 wrote to memory of 4064 116 nnntnh.exe 106 PID 116 wrote to memory of 4064 116 nnntnh.exe 106 PID 116 wrote to memory of 4064 116 nnntnh.exe 106 PID 4064 wrote to memory of 1012 4064 jpvvj.exe 107 PID 4064 wrote to memory of 1012 4064 jpvvj.exe 107 PID 4064 wrote to memory of 1012 4064 jpvvj.exe 107 PID 1012 wrote to memory of 2820 1012 lxlxfxf.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe"C:\Users\Admin\AppData\Local\Temp\9b1cff1c37e5156be33773d45723181182f589acc6ff038645fccd77074b5ad6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\1lllfxr.exec:\1lllfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\3hthnh.exec:\3hthnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\pvjvp.exec:\pvjvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1rfrrrr.exec:\1rfrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\tnthht.exec:\tnthht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\jpvpj.exec:\jpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\djjdv.exec:\djjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\rrxxxrl.exec:\rrxxxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\nbbhbt.exec:\nbbhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\djvpv.exec:\djvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\dddvj.exec:\dddvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\xxxfrrl.exec:\xxxfrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\nttbnb.exec:\nttbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vvjdj.exec:\vvjdj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\vdpvv.exec:\vdpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\rllfrll.exec:\rllfrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\hntthb.exec:\hntthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\nnntnh.exec:\nnntnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\jpvvj.exec:\jpvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\lxlxfxf.exec:\lxlxfxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
\??\c:\lflllfl.exec:\lflllfl.exe23⤵
- Executes dropped EXE
PID:2820 -
\??\c:\hhbbtn.exec:\hhbbtn.exe24⤵
- Executes dropped EXE
PID:4780 -
\??\c:\vdjpp.exec:\vdjpp.exe25⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ffffrlf.exec:\ffffrlf.exe26⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rfrlfrr.exec:\rfrlfrr.exe27⤵
- Executes dropped EXE
PID:1136 -
\??\c:\hhtnnb.exec:\hhtnnb.exe28⤵
- Executes dropped EXE
PID:4112 -
\??\c:\jvjdp.exec:\jvjdp.exe29⤵
- Executes dropped EXE
PID:4264 -
\??\c:\xxlfrrl.exec:\xxlfrrl.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\btnntn.exec:\btnntn.exe31⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jdjdd.exec:\jdjdd.exe32⤵
- Executes dropped EXE
PID:4928 -
\??\c:\flfrlfx.exec:\flfrlfx.exe33⤵
- Executes dropped EXE
PID:2616 -
\??\c:\hnhbbt.exec:\hnhbbt.exe34⤵
- Executes dropped EXE
PID:4080 -
\??\c:\pjpvd.exec:\pjpvd.exe35⤵
- Executes dropped EXE
PID:4332 -
\??\c:\7fxlxxr.exec:\7fxlxxr.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3948 -
\??\c:\httnhh.exec:\httnhh.exe37⤵
- Executes dropped EXE
PID:3588 -
\??\c:\hnnhbb.exec:\hnnhbb.exe38⤵
- Executes dropped EXE
PID:4968 -
\??\c:\dvddp.exec:\dvddp.exe39⤵
- Executes dropped EXE
PID:5044 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe40⤵
- Executes dropped EXE
PID:4532 -
\??\c:\xxlfrrl.exec:\xxlfrrl.exe41⤵
- Executes dropped EXE
PID:3936 -
\??\c:\3bthhh.exec:\3bthhh.exe42⤵
- Executes dropped EXE
PID:3732 -
\??\c:\5djdp.exec:\5djdp.exe43⤵
- Executes dropped EXE
PID:3008 -
\??\c:\rflxlrr.exec:\rflxlrr.exe44⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7nhbbb.exec:\7nhbbb.exe45⤵
- Executes dropped EXE
PID:4964 -
\??\c:\5hhhbb.exec:\5hhhbb.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\7ddpj.exec:\7ddpj.exe47⤵
- Executes dropped EXE
PID:5116 -
\??\c:\xrrrflf.exec:\xrrrflf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1736 -
\??\c:\1xflffx.exec:\1xflffx.exe49⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jdddv.exec:\jdddv.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1496 -
\??\c:\ppvpj.exec:\ppvpj.exe51⤵
- Executes dropped EXE
PID:2996 -
\??\c:\flrlffr.exec:\flrlffr.exe52⤵
- Executes dropped EXE
PID:4860 -
\??\c:\9lfxrrl.exec:\9lfxrrl.exe53⤵
- Executes dropped EXE
PID:1292 -
\??\c:\bhnnhh.exec:\bhnnhh.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pjpjj.exec:\pjpjj.exe55⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjvpj.exec:\jjvpj.exe56⤵
- Executes dropped EXE
PID:4792 -
\??\c:\flrfxrx.exec:\flrfxrx.exe57⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rxfxllx.exec:\rxfxllx.exe58⤵
- Executes dropped EXE
PID:1608 -
\??\c:\1nhbth.exec:\1nhbth.exe59⤵
- Executes dropped EXE
PID:4356 -
\??\c:\tththn.exec:\tththn.exe60⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jdpjd.exec:\jdpjd.exe61⤵
- Executes dropped EXE
PID:4400 -
\??\c:\3fffxrl.exec:\3fffxrl.exe62⤵
- Executes dropped EXE
PID:4932 -
\??\c:\xlllflf.exec:\xlllflf.exe63⤵
- Executes dropped EXE
PID:4256 -
\??\c:\nhbtnb.exec:\nhbtnb.exe64⤵
- Executes dropped EXE
PID:1088 -
\??\c:\vdpdv.exec:\vdpdv.exe65⤵
- Executes dropped EXE
PID:1416 -
\??\c:\pjvdd.exec:\pjvdd.exe66⤵PID:2752
-
\??\c:\lllfxrx.exec:\lllfxrx.exe67⤵PID:4232
-
\??\c:\7rfxlfr.exec:\7rfxlfr.exe68⤵PID:3208
-
\??\c:\nntnbb.exec:\nntnbb.exe69⤵PID:1136
-
\??\c:\9pvjd.exec:\9pvjd.exe70⤵PID:4112
-
\??\c:\vvdvp.exec:\vvdvp.exe71⤵PID:4056
-
\??\c:\frrrfxr.exec:\frrrfxr.exe72⤵PID:4280
-
\??\c:\rlrrfll.exec:\rlrrfll.exe73⤵PID:2992
-
\??\c:\9hnnnh.exec:\9hnnnh.exe74⤵PID:1600
-
\??\c:\vjvpj.exec:\vjvpj.exe75⤵PID:540
-
\??\c:\jdjdd.exec:\jdjdd.exe76⤵PID:2244
-
\??\c:\vvpdd.exec:\vvpdd.exe77⤵PID:2164
-
\??\c:\fflfxxf.exec:\fflfxxf.exe78⤵PID:4844
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe79⤵PID:384
-
\??\c:\thbhbt.exec:\thbhbt.exe80⤵PID:4960
-
\??\c:\bbbtnn.exec:\bbbtnn.exe81⤵PID:3068
-
\??\c:\pjjvj.exec:\pjjvj.exe82⤵PID:4660
-
\??\c:\pvddd.exec:\pvddd.exe83⤵PID:3256
-
\??\c:\rxrxlxl.exec:\rxrxlxl.exe84⤵PID:4152
-
\??\c:\frfxxrr.exec:\frfxxrr.exe85⤵PID:1376
-
\??\c:\nnhhbb.exec:\nnhhbb.exe86⤵PID:4532
-
\??\c:\thtnbb.exec:\thtnbb.exe87⤵PID:3936
-
\??\c:\dvvvj.exec:\dvvvj.exe88⤵PID:4748
-
\??\c:\jvjjv.exec:\jvjjv.exe89⤵PID:4716
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe90⤵PID:1188
-
\??\c:\7frrrll.exec:\7frrrll.exe91⤵PID:3744
-
\??\c:\thntnh.exec:\thntnh.exe92⤵PID:4044
-
\??\c:\ttnhnh.exec:\ttnhnh.exe93⤵PID:1544
-
\??\c:\ppjdp.exec:\ppjdp.exe94⤵PID:4424
-
\??\c:\dpdvd.exec:\dpdvd.exe95⤵PID:5052
-
\??\c:\rlfxlxr.exec:\rlfxlxr.exe96⤵PID:1512
-
\??\c:\nnhbnn.exec:\nnhbnn.exe97⤵PID:3312
-
\??\c:\nntthb.exec:\nntthb.exe98⤵PID:4832
-
\??\c:\djjdv.exec:\djjdv.exe99⤵PID:1496
-
\??\c:\vpjjd.exec:\vpjjd.exe100⤵PID:2864
-
\??\c:\lllfrll.exec:\lllfrll.exe101⤵PID:5060
-
\??\c:\lffxrrl.exec:\lffxrrl.exe102⤵PID:3444
-
\??\c:\bnnhbt.exec:\bnnhbt.exe103⤵PID:4060
-
\??\c:\3dddp.exec:\3dddp.exe104⤵PID:2196
-
\??\c:\vddpd.exec:\vddpd.exe105⤵PID:2584
-
\??\c:\frxrfxx.exec:\frxrfxx.exe106⤵PID:4792
-
\??\c:\pdvvp.exec:\pdvvp.exe107⤵PID:4372
-
\??\c:\5lxlfxl.exec:\5lxlfxl.exe108⤵
- System Location Discovery: System Language Discovery
PID:8 -
\??\c:\9llfxrl.exec:\9llfxrl.exe109⤵PID:3536
-
\??\c:\xxfrrff.exec:\xxfrrff.exe110⤵PID:3488
-
\??\c:\bthbbb.exec:\bthbbb.exe111⤵PID:4932
-
\??\c:\nhtbhb.exec:\nhtbhb.exe112⤵PID:4900
-
\??\c:\5ddvp.exec:\5ddvp.exe113⤵PID:3088
-
\??\c:\vvjdp.exec:\vvjdp.exe114⤵PID:656
-
\??\c:\xxlrlrl.exec:\xxlrlrl.exe115⤵PID:1068
-
\??\c:\nntntn.exec:\nntntn.exe116⤵PID:3308
-
\??\c:\ttbthh.exec:\ttbthh.exe117⤵PID:452
-
\??\c:\3pjdp.exec:\3pjdp.exe118⤵PID:1988
-
\??\c:\fxxllfx.exec:\fxxllfx.exe119⤵PID:4264
-
\??\c:\ttttth.exec:\ttttth.exe120⤵PID:3944
-
\??\c:\nhbnbt.exec:\nhbnbt.exe121⤵PID:2308
-
\??\c:\jjpdp.exec:\jjpdp.exe122⤵PID:2992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-