Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23-08-2024 14:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ac7ae3832310c0ff5c45491ca38510d0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
ac7ae3832310c0ff5c45491ca38510d0N.exe
-
Size
309KB
-
MD5
ac7ae3832310c0ff5c45491ca38510d0
-
SHA1
2c0e4d51fb03ad5423ec2e858ec001ac4733ee10
-
SHA256
a668c97e8f3aa090553597fa234d4074eee4094f7597ebe1497ff921ab6fdb61
-
SHA512
ca844f2f5fa269ea98e0755ddd8e9da6293d95c55d12a106e5507aa8c7d6422adcfd54e5dd4364ecd91b34a9bef009a693735c18123d6e5a175bc70b7c5e3c25
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDLS0k+sLiiBVS0ILlMcGGW7sRCl9eMMV:n3C9BRo/AIuunS3+sOiBVSXxMxTsm9ex
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4484-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4364 bbtnnh.exe 4644 rllxflf.exe 4768 ppjdv.exe 1288 xxlflfx.exe 1704 7frfrxx.exe 2656 bnhhnn.exe 1152 lxllllr.exe 320 tnhhbb.exe 3568 lflfrll.exe 208 ffffxrr.exe 2108 hnnnhn.exe 2464 ddpvd.exe 4756 hbnnnt.exe 3564 vdpjd.exe 364 bnnbtb.exe 2076 ntttbh.exe 4480 jdpjv.exe 3968 pppvv.exe 4392 nttnbn.exe 4188 vvppd.exe 4524 xfrxfxl.exe 4128 7jvvp.exe 3864 rfllrxx.exe 1740 ddvpd.exe 1696 thhhbh.exe 1800 frrlrxf.exe 1848 lxfffll.exe 4120 tnbbhn.exe 4112 djvdv.exe 2956 nhtbbh.exe 2168 rrlfrfr.exe 1996 xrlflfx.exe 4812 jpjpj.exe 4328 lffxfxx.exe 4420 hhbtnt.exe 2348 jdjjj.exe 2232 lxlxfrl.exe 5092 bnnhbb.exe 2792 jdjvv.exe 3480 lrrrlxr.exe 3628 nnbhhn.exe 4160 xxlxxxl.exe 3332 tnbbbh.exe 5076 djvjp.exe 4888 ffrrrxx.exe 392 bbntnn.exe 2988 pvdvv.exe 2164 lrrllrx.exe 1104 jjpvv.exe 4252 fxlxxrl.exe 4952 dvvpp.exe 3280 lfrlrxr.exe 4504 hnttth.exe 3476 vpddj.exe 548 rxfxxlf.exe 1032 ntnnnh.exe 232 ppvvv.exe 2404 rffxffx.exe 4260 ttnbnb.exe 2972 pvpjj.exe 3964 lxflllr.exe 1580 bnthhh.exe 3508 pdpvp.exe 3228 ffrrflf.exe -
resource yara_rule behavioral2/memory/4484-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfflrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4484 wrote to memory of 4364 4484 ac7ae3832310c0ff5c45491ca38510d0N.exe 84 PID 4484 wrote to memory of 4364 4484 ac7ae3832310c0ff5c45491ca38510d0N.exe 84 PID 4484 wrote to memory of 4364 4484 ac7ae3832310c0ff5c45491ca38510d0N.exe 84 PID 4364 wrote to memory of 4644 4364 bbtnnh.exe 85 PID 4364 wrote to memory of 4644 4364 bbtnnh.exe 85 PID 4364 wrote to memory of 4644 4364 bbtnnh.exe 85 PID 4644 wrote to memory of 4768 4644 rllxflf.exe 86 PID 4644 wrote to memory of 4768 4644 rllxflf.exe 86 PID 4644 wrote to memory of 4768 4644 rllxflf.exe 86 PID 4768 wrote to memory of 1288 4768 ppjdv.exe 87 PID 4768 wrote to memory of 1288 4768 ppjdv.exe 87 PID 4768 wrote to memory of 1288 4768 ppjdv.exe 87 PID 1288 wrote to memory of 1704 1288 xxlflfx.exe 88 PID 1288 wrote to memory of 1704 1288 xxlflfx.exe 88 PID 1288 wrote to memory of 1704 1288 xxlflfx.exe 88 PID 1704 wrote to memory of 2656 1704 7frfrxx.exe 89 PID 1704 wrote to memory of 2656 1704 7frfrxx.exe 89 PID 1704 wrote to memory of 2656 1704 7frfrxx.exe 89 PID 2656 wrote to memory of 1152 2656 bnhhnn.exe 90 PID 2656 wrote to memory of 1152 2656 bnhhnn.exe 90 PID 2656 wrote to memory of 1152 2656 bnhhnn.exe 90 PID 1152 wrote to memory of 320 1152 lxllllr.exe 91 PID 1152 wrote to memory of 320 1152 lxllllr.exe 91 PID 1152 wrote to memory of 320 1152 lxllllr.exe 91 PID 320 wrote to memory of 3568 320 tnhhbb.exe 92 PID 320 wrote to memory of 3568 320 tnhhbb.exe 92 PID 320 wrote to memory of 3568 320 tnhhbb.exe 92 PID 3568 wrote to memory of 208 3568 lflfrll.exe 93 PID 3568 wrote to memory of 208 3568 lflfrll.exe 93 PID 3568 wrote to memory of 208 3568 lflfrll.exe 93 PID 208 wrote to memory of 2108 208 ffffxrr.exe 94 PID 208 wrote to memory of 2108 208 ffffxrr.exe 94 PID 208 wrote to memory of 2108 208 ffffxrr.exe 94 PID 2108 wrote to memory of 2464 2108 hnnnhn.exe 95 PID 2108 wrote to memory of 2464 2108 hnnnhn.exe 95 PID 2108 wrote to memory of 2464 2108 hnnnhn.exe 95 PID 2464 wrote to memory of 4756 2464 ddpvd.exe 96 PID 2464 wrote to memory of 4756 2464 ddpvd.exe 96 PID 2464 wrote to memory of 4756 2464 ddpvd.exe 96 PID 4756 wrote to memory of 3564 4756 hbnnnt.exe 97 PID 4756 wrote to memory of 3564 4756 hbnnnt.exe 97 PID 4756 wrote to memory of 3564 4756 hbnnnt.exe 97 PID 3564 wrote to memory of 364 3564 vdpjd.exe 98 PID 3564 wrote to memory of 364 3564 vdpjd.exe 98 PID 3564 wrote to memory of 364 3564 vdpjd.exe 98 PID 364 wrote to memory of 2076 364 bnnbtb.exe 99 PID 364 wrote to memory of 2076 364 bnnbtb.exe 99 PID 364 wrote to memory of 2076 364 bnnbtb.exe 99 PID 2076 wrote to memory of 4480 2076 ntttbh.exe 100 PID 2076 wrote to memory of 4480 2076 ntttbh.exe 100 PID 2076 wrote to memory of 4480 2076 ntttbh.exe 100 PID 4480 wrote to memory of 3968 4480 jdpjv.exe 101 PID 4480 wrote to memory of 3968 4480 jdpjv.exe 101 PID 4480 wrote to memory of 3968 4480 jdpjv.exe 101 PID 3968 wrote to memory of 4392 3968 pppvv.exe 103 PID 3968 wrote to memory of 4392 3968 pppvv.exe 103 PID 3968 wrote to memory of 4392 3968 pppvv.exe 103 PID 4392 wrote to memory of 4188 4392 nttnbn.exe 104 PID 4392 wrote to memory of 4188 4392 nttnbn.exe 104 PID 4392 wrote to memory of 4188 4392 nttnbn.exe 104 PID 4188 wrote to memory of 4524 4188 vvppd.exe 105 PID 4188 wrote to memory of 4524 4188 vvppd.exe 105 PID 4188 wrote to memory of 4524 4188 vvppd.exe 105 PID 4524 wrote to memory of 4128 4524 xfrxfxl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac7ae3832310c0ff5c45491ca38510d0N.exe"C:\Users\Admin\AppData\Local\Temp\ac7ae3832310c0ff5c45491ca38510d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bbtnnh.exec:\bbtnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\rllxflf.exec:\rllxflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\ppjdv.exec:\ppjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\xxlflfx.exec:\xxlflfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\7frfrxx.exec:\7frfrxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\bnhhnn.exec:\bnhhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\lxllllr.exec:\lxllllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\tnhhbb.exec:\tnhhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\lflfrll.exec:\lflfrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\ffffxrr.exec:\ffffxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\hnnnhn.exec:\hnnnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\ddpvd.exec:\ddpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\hbnnnt.exec:\hbnnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\vdpjd.exec:\vdpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\bnnbtb.exec:\bnnbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\ntttbh.exec:\ntttbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\jdpjv.exec:\jdpjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\pppvv.exec:\pppvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\nttnbn.exec:\nttnbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\vvppd.exec:\vvppd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\xfrxfxl.exec:\xfrxfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\7jvvp.exec:\7jvvp.exe23⤵
- Executes dropped EXE
PID:4128 -
\??\c:\rfllrxx.exec:\rfllrxx.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3864 -
\??\c:\ddvpd.exec:\ddvpd.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\thhhbh.exec:\thhhbh.exe26⤵
- Executes dropped EXE
PID:1696 -
\??\c:\frrlrxf.exec:\frrlrxf.exe27⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lxfffll.exec:\lxfffll.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\tnbbhn.exec:\tnbbhn.exe29⤵
- Executes dropped EXE
PID:4120 -
\??\c:\djvdv.exec:\djvdv.exe30⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhtbbh.exec:\nhtbbh.exe31⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rrlfrfr.exec:\rrlfrfr.exe32⤵
- Executes dropped EXE
PID:2168 -
\??\c:\xrlflfx.exec:\xrlflfx.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\jpjpj.exec:\jpjpj.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812 -
\??\c:\lffxfxx.exec:\lffxfxx.exe35⤵
- Executes dropped EXE
PID:4328 -
\??\c:\hhbtnt.exec:\hhbtnt.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420 -
\??\c:\jdjjj.exec:\jdjjj.exe37⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lxlxfrl.exec:\lxlxfrl.exe38⤵
- Executes dropped EXE
PID:2232 -
\??\c:\bnnhbb.exec:\bnnhbb.exe39⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jdjvv.exec:\jdjvv.exe40⤵
- Executes dropped EXE
PID:2792 -
\??\c:\lrrrlxr.exec:\lrrrlxr.exe41⤵
- Executes dropped EXE
PID:3480 -
\??\c:\nnbhhn.exec:\nnbhhn.exe42⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xxlxxxl.exec:\xxlxxxl.exe43⤵
- Executes dropped EXE
PID:4160 -
\??\c:\tnbbbh.exec:\tnbbbh.exe44⤵
- Executes dropped EXE
PID:3332 -
\??\c:\djvjp.exec:\djvjp.exe45⤵
- Executes dropped EXE
PID:5076 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe46⤵
- Executes dropped EXE
PID:4888 -
\??\c:\bbntnn.exec:\bbntnn.exe47⤵
- Executes dropped EXE
PID:392 -
\??\c:\pvdvv.exec:\pvdvv.exe48⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrrllrx.exec:\lrrllrx.exe49⤵
- Executes dropped EXE
PID:2164 -
\??\c:\jjpvv.exec:\jjpvv.exe50⤵
- Executes dropped EXE
PID:1104 -
\??\c:\fxlxxrl.exec:\fxlxxrl.exe51⤵
- Executes dropped EXE
PID:4252 -
\??\c:\dvvpp.exec:\dvvpp.exe52⤵
- Executes dropped EXE
PID:4952 -
\??\c:\lfrlrxr.exec:\lfrlrxr.exe53⤵
- Executes dropped EXE
PID:3280 -
\??\c:\hnttth.exec:\hnttth.exe54⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vpddj.exec:\vpddj.exe55⤵
- Executes dropped EXE
PID:3476 -
\??\c:\rxfxxlf.exec:\rxfxxlf.exe56⤵
- Executes dropped EXE
PID:548 -
\??\c:\ntnnnh.exec:\ntnnnh.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ppvvv.exec:\ppvvv.exe58⤵
- Executes dropped EXE
PID:232 -
\??\c:\rffxffx.exec:\rffxffx.exe59⤵
- Executes dropped EXE
PID:2404 -
\??\c:\ttnbnb.exec:\ttnbnb.exe60⤵
- Executes dropped EXE
PID:4260 -
\??\c:\pvpjj.exec:\pvpjj.exe61⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lxflllr.exec:\lxflllr.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\bnthhh.exec:\bnthhh.exe63⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pdpvp.exec:\pdpvp.exe64⤵
- Executes dropped EXE
PID:3508 -
\??\c:\ffrrflf.exec:\ffrrflf.exe65⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bnhbth.exec:\bnhbth.exe66⤵PID:3456
-
\??\c:\vvdpp.exec:\vvdpp.exe67⤵PID:3856
-
\??\c:\ffllrrf.exec:\ffllrrf.exe68⤵PID:4896
-
\??\c:\btbtth.exec:\btbtth.exe69⤵PID:3340
-
\??\c:\ththtn.exec:\ththtn.exe70⤵PID:1736
-
\??\c:\dvdpv.exec:\dvdpv.exe71⤵PID:4588
-
\??\c:\fllrrxl.exec:\fllrrxl.exe72⤵PID:1800
-
\??\c:\hnhbbb.exec:\hnhbbb.exe73⤵PID:3484
-
\??\c:\nttbhh.exec:\nttbhh.exe74⤵PID:3736
-
\??\c:\jppdd.exec:\jppdd.exe75⤵PID:452
-
\??\c:\fxfxxfx.exec:\fxfxxfx.exe76⤵PID:3452
-
\??\c:\xrlllrx.exec:\xrlllrx.exe77⤵PID:2960
-
\??\c:\nbhnnb.exec:\nbhnnb.exe78⤵PID:1972
-
\??\c:\dvvjv.exec:\dvvjv.exe79⤵PID:440
-
\??\c:\lrrrfrr.exec:\lrrrfrr.exe80⤵PID:760
-
\??\c:\thnhbh.exec:\thnhbh.exe81⤵PID:4760
-
\??\c:\vjjpd.exec:\vjjpd.exe82⤵PID:3000
-
\??\c:\lfxrllf.exec:\lfxrllf.exe83⤵PID:2752
-
\??\c:\thbttb.exec:\thbttb.exe84⤵PID:1636
-
\??\c:\htnnbh.exec:\htnnbh.exe85⤵PID:4904
-
\??\c:\vpdjj.exec:\vpdjj.exe86⤵PID:1968
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe87⤵PID:2388
-
\??\c:\nttttn.exec:\nttttn.exe88⤵PID:4644
-
\??\c:\pddvp.exec:\pddvp.exe89⤵PID:956
-
\??\c:\rfxlfll.exec:\rfxlfll.exe90⤵PID:3512
-
\??\c:\nbhhhh.exec:\nbhhhh.exe91⤵PID:1860
-
\??\c:\djppp.exec:\djppp.exe92⤵PID:2608
-
\??\c:\ffrrlff.exec:\ffrrlff.exe93⤵PID:224
-
\??\c:\nhhhbh.exec:\nhhhbh.exe94⤵PID:2992
-
\??\c:\tnntht.exec:\tnntht.exe95⤵PID:3528
-
\??\c:\vdpvj.exec:\vdpvj.exe96⤵PID:208
-
\??\c:\xfrxfxf.exec:\xfrxfxf.exe97⤵PID:4504
-
\??\c:\ntbttb.exec:\ntbttb.exe98⤵PID:4404
-
\??\c:\tttbtt.exec:\tttbtt.exe99⤵PID:4928
-
\??\c:\jdjjp.exec:\jdjjp.exe100⤵PID:3368
-
\??\c:\ffrrrxf.exec:\ffrrrxf.exe101⤵PID:1064
-
\??\c:\tntbbh.exec:\tntbbh.exe102⤵PID:4816
-
\??\c:\jjddv.exec:\jjddv.exe103⤵PID:2972
-
\??\c:\djvdv.exec:\djvdv.exe104⤵PID:3964
-
\??\c:\xllxxfl.exec:\xllxxfl.exe105⤵PID:2296
-
\??\c:\tbtbbh.exec:\tbtbbh.exe106⤵PID:3200
-
\??\c:\jjvvd.exec:\jjvvd.exe107⤵PID:448
-
\??\c:\llrxlrr.exec:\llrxlrr.exe108⤵PID:4128
-
\??\c:\nbtbtt.exec:\nbtbtt.exe109⤵PID:4708
-
\??\c:\bbnhnh.exec:\bbnhnh.exe110⤵PID:1740
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe111⤵PID:1256
-
\??\c:\jpvvp.exec:\jpvvp.exe112⤵PID:1736
-
\??\c:\rxxllrx.exec:\rxxllrx.exe113⤵PID:1908
-
\??\c:\btbtbb.exec:\btbtbb.exe114⤵PID:4468
-
\??\c:\jjvpv.exec:\jjvpv.exe115⤵PID:5040
-
\??\c:\fffffll.exec:\fffffll.exe116⤵PID:3220
-
\??\c:\bnnbtt.exec:\bnnbtt.exe117⤵PID:452
-
\??\c:\vdppp.exec:\vdppp.exe118⤵PID:1780
-
\??\c:\xlllflx.exec:\xlllflx.exe119⤵PID:5100
-
\??\c:\hnttth.exec:\hnttth.exe120⤵PID:2104
-
\??\c:\djvjp.exec:\djvjp.exe121⤵PID:3288
-
\??\c:\bhbtbh.exec:\bhbtbh.exe122⤵PID:760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-