Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2024, 00:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe
Resource
win7-20240705-en
6 signatures
150 seconds
General
-
Target
5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe
-
Size
71KB
-
MD5
5206e13281a5a2ec34dd159ed0643c94
-
SHA1
80c17d25e960c1eb58f0e5b245aaec297505ae65
-
SHA256
5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6
-
SHA512
961bab46a51921885139d7faaae396a2e387f8bbd775be16ffb9e38fafac626e343889462d30b72070be750216e08356472f55b2179dc84bc3ecbeaa91f08238
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hgVsz:ymb3NkkiQ3mdBjFIj+qNhgVsz
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/3152-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 884 frxrllf.exe 1000 hbhtnt.exe 1264 djvpp.exe 3652 ppjjd.exe 996 ffrlxxf.exe 4596 tnbhhn.exe 1028 vvjvd.exe 4264 xrlfffx.exe 3920 nbttnh.exe 640 dvvvp.exe 1888 rrfxrrr.exe 4568 btbbbb.exe 4608 1pvpv.exe 3676 pjjpj.exe 208 nbbhbb.exe 768 bbbtnt.exe 2632 jdpvv.exe 3076 7xlfxlf.exe 232 ttbtth.exe 1208 3vjpv.exe 5076 9vvpj.exe 5012 jdjdv.exe 4512 5hhhhh.exe 1544 tnbtbb.exe 1480 pvvpp.exe 2344 vvvpj.exe 2812 lflfffx.exe 3656 nhhbbn.exe 2728 9tbnnh.exe 3108 3vpdd.exe 3220 pdpjv.exe 4800 rffxlfr.exe 2256 nhnhbb.exe 2076 nbthnb.exe 3756 vdpjv.exe 684 3ffxfxr.exe 4392 rflfxrf.exe 3136 tbhbtn.exe 3316 5bnhtn.exe 5048 jdjjd.exe 408 pdjdv.exe 4600 bttnnt.exe 4548 tthhbb.exe 1180 jjvvj.exe 3880 dpdvv.exe 836 rlxrlrx.exe 1688 hhhnnn.exe 4016 ppddp.exe 876 pdjdv.exe 2928 xxlflll.exe 4484 5lxffff.exe 1576 bthhnn.exe 916 3hnnbh.exe 516 dpvvp.exe 1840 dpvjv.exe 1668 rxrlfxf.exe 1036 lfffxff.exe 4612 hbhhht.exe 1372 nbnhbb.exe 3544 jddvp.exe 4892 vpddv.exe 2880 frrfflr.exe 968 ffxxrxx.exe 3068 nbbbnn.exe -
resource yara_rule behavioral2/memory/3152-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1264-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnbbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1httnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3152 wrote to memory of 884 3152 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 86 PID 3152 wrote to memory of 884 3152 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 86 PID 3152 wrote to memory of 884 3152 5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe 86 PID 884 wrote to memory of 1000 884 frxrllf.exe 87 PID 884 wrote to memory of 1000 884 frxrllf.exe 87 PID 884 wrote to memory of 1000 884 frxrllf.exe 87 PID 1000 wrote to memory of 1264 1000 hbhtnt.exe 88 PID 1000 wrote to memory of 1264 1000 hbhtnt.exe 88 PID 1000 wrote to memory of 1264 1000 hbhtnt.exe 88 PID 1264 wrote to memory of 3652 1264 djvpp.exe 89 PID 1264 wrote to memory of 3652 1264 djvpp.exe 89 PID 1264 wrote to memory of 3652 1264 djvpp.exe 89 PID 3652 wrote to memory of 996 3652 ppjjd.exe 90 PID 3652 wrote to memory of 996 3652 ppjjd.exe 90 PID 3652 wrote to memory of 996 3652 ppjjd.exe 90 PID 996 wrote to memory of 4596 996 ffrlxxf.exe 91 PID 996 wrote to memory of 4596 996 ffrlxxf.exe 91 PID 996 wrote to memory of 4596 996 ffrlxxf.exe 91 PID 4596 wrote to memory of 1028 4596 tnbhhn.exe 92 PID 4596 wrote to memory of 1028 4596 tnbhhn.exe 92 PID 4596 wrote to memory of 1028 4596 tnbhhn.exe 92 PID 1028 wrote to memory of 4264 1028 vvjvd.exe 93 PID 1028 wrote to memory of 4264 1028 vvjvd.exe 93 PID 1028 wrote to memory of 4264 1028 vvjvd.exe 93 PID 4264 wrote to memory of 3920 4264 xrlfffx.exe 94 PID 4264 wrote to memory of 3920 4264 xrlfffx.exe 94 PID 4264 wrote to memory of 3920 4264 xrlfffx.exe 94 PID 3920 wrote to memory of 640 3920 nbttnh.exe 95 PID 3920 wrote to memory of 640 3920 nbttnh.exe 95 PID 3920 wrote to memory of 640 3920 nbttnh.exe 95 PID 640 wrote to memory of 1888 640 dvvvp.exe 96 PID 640 wrote to memory of 1888 640 dvvvp.exe 96 PID 640 wrote to memory of 1888 640 dvvvp.exe 96 PID 1888 wrote to memory of 4568 1888 rrfxrrr.exe 97 PID 1888 wrote to memory of 4568 1888 rrfxrrr.exe 97 PID 1888 wrote to memory of 4568 1888 rrfxrrr.exe 97 PID 4568 wrote to memory of 4608 4568 btbbbb.exe 98 PID 4568 wrote to memory of 4608 4568 btbbbb.exe 98 PID 4568 wrote to memory of 4608 4568 btbbbb.exe 98 PID 4608 wrote to memory of 3676 4608 1pvpv.exe 100 PID 4608 wrote to memory of 3676 4608 1pvpv.exe 100 PID 4608 wrote to memory of 3676 4608 1pvpv.exe 100 PID 3676 wrote to memory of 208 3676 pjjpj.exe 101 PID 3676 wrote to memory of 208 3676 pjjpj.exe 101 PID 3676 wrote to memory of 208 3676 pjjpj.exe 101 PID 208 wrote to memory of 768 208 nbbhbb.exe 102 PID 208 wrote to memory of 768 208 nbbhbb.exe 102 PID 208 wrote to memory of 768 208 nbbhbb.exe 102 PID 768 wrote to memory of 2632 768 bbbtnt.exe 103 PID 768 wrote to memory of 2632 768 bbbtnt.exe 103 PID 768 wrote to memory of 2632 768 bbbtnt.exe 103 PID 2632 wrote to memory of 3076 2632 jdpvv.exe 105 PID 2632 wrote to memory of 3076 2632 jdpvv.exe 105 PID 2632 wrote to memory of 3076 2632 jdpvv.exe 105 PID 3076 wrote to memory of 232 3076 7xlfxlf.exe 106 PID 3076 wrote to memory of 232 3076 7xlfxlf.exe 106 PID 3076 wrote to memory of 232 3076 7xlfxlf.exe 106 PID 232 wrote to memory of 1208 232 ttbtth.exe 107 PID 232 wrote to memory of 1208 232 ttbtth.exe 107 PID 232 wrote to memory of 1208 232 ttbtth.exe 107 PID 1208 wrote to memory of 5076 1208 3vjpv.exe 108 PID 1208 wrote to memory of 5076 1208 3vjpv.exe 108 PID 1208 wrote to memory of 5076 1208 3vjpv.exe 108 PID 5076 wrote to memory of 5012 5076 9vvpj.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe"C:\Users\Admin\AppData\Local\Temp\5a2f17a571075e8716d28ae94a69b50eaa042d2cee5bc834601c986779af7ba6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\frxrllf.exec:\frxrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\hbhtnt.exec:\hbhtnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\djvpp.exec:\djvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ppjjd.exec:\ppjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\ffrlxxf.exec:\ffrlxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\tnbhhn.exec:\tnbhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\vvjvd.exec:\vvjvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\xrlfffx.exec:\xrlfffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\nbttnh.exec:\nbttnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\dvvvp.exec:\dvvvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\btbbbb.exec:\btbbbb.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\1pvpv.exec:\1pvpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\pjjpj.exec:\pjjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\nbbhbb.exec:\nbbhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\bbbtnt.exec:\bbbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\jdpvv.exec:\jdpvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\7xlfxlf.exec:\7xlfxlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\ttbtth.exec:\ttbtth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\3vjpv.exec:\3vjpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\9vvpj.exec:\9vvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\jdjdv.exec:\jdjdv.exe23⤵
- Executes dropped EXE
PID:5012 -
\??\c:\5hhhhh.exec:\5hhhhh.exe24⤵
- Executes dropped EXE
PID:4512 -
\??\c:\tnbtbb.exec:\tnbtbb.exe25⤵
- Executes dropped EXE
PID:1544 -
\??\c:\pvvpp.exec:\pvvpp.exe26⤵
- Executes dropped EXE
PID:1480 -
\??\c:\vvvpj.exec:\vvvpj.exe27⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lflfffx.exec:\lflfffx.exe28⤵
- Executes dropped EXE
PID:2812 -
\??\c:\nhhbbn.exec:\nhhbbn.exe29⤵
- Executes dropped EXE
PID:3656 -
\??\c:\9tbnnh.exec:\9tbnnh.exe30⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3vpdd.exec:\3vpdd.exe31⤵
- Executes dropped EXE
PID:3108 -
\??\c:\pdpjv.exec:\pdpjv.exe32⤵
- Executes dropped EXE
PID:3220 -
\??\c:\rffxlfr.exec:\rffxlfr.exe33⤵
- Executes dropped EXE
PID:4800 -
\??\c:\nhnhbb.exec:\nhnhbb.exe34⤵
- Executes dropped EXE
PID:2256 -
\??\c:\nbthnb.exec:\nbthnb.exe35⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vdpjv.exec:\vdpjv.exe36⤵
- Executes dropped EXE
PID:3756 -
\??\c:\3ffxfxr.exec:\3ffxfxr.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:684 -
\??\c:\rflfxrf.exec:\rflfxrf.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4392 -
\??\c:\tbhbtn.exec:\tbhbtn.exe39⤵
- Executes dropped EXE
PID:3136 -
\??\c:\5bnhtn.exec:\5bnhtn.exe40⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jdjjd.exec:\jdjjd.exe41⤵
- Executes dropped EXE
PID:5048 -
\??\c:\pdjdv.exec:\pdjdv.exe42⤵
- Executes dropped EXE
PID:408 -
\??\c:\bttnnt.exec:\bttnnt.exe43⤵
- Executes dropped EXE
PID:4600 -
\??\c:\tthhbb.exec:\tthhbb.exe44⤵
- Executes dropped EXE
PID:4548 -
\??\c:\jjvvj.exec:\jjvvj.exe45⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dpdvv.exec:\dpdvv.exe46⤵
- Executes dropped EXE
PID:3880 -
\??\c:\rlxrlrx.exec:\rlxrlrx.exe47⤵
- Executes dropped EXE
PID:836 -
\??\c:\hhhnnn.exec:\hhhnnn.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\ppddp.exec:\ppddp.exe49⤵
- Executes dropped EXE
PID:4016 -
\??\c:\pdjdv.exec:\pdjdv.exe50⤵
- Executes dropped EXE
PID:876 -
\??\c:\xxlflll.exec:\xxlflll.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\5lxffff.exec:\5lxffff.exe52⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bthhnn.exec:\bthhnn.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\3hnnbh.exec:\3hnnbh.exe54⤵
- Executes dropped EXE
PID:916 -
\??\c:\dpvvp.exec:\dpvvp.exe55⤵
- Executes dropped EXE
PID:516 -
\??\c:\dpvjv.exec:\dpvjv.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\rxrlfxf.exec:\rxrlfxf.exe57⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lfffxff.exec:\lfffxff.exe58⤵
- Executes dropped EXE
PID:1036 -
\??\c:\hbhhht.exec:\hbhhht.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612 -
\??\c:\nbnhbb.exec:\nbnhbb.exe60⤵
- Executes dropped EXE
PID:1372 -
\??\c:\jddvp.exec:\jddvp.exe61⤵
- Executes dropped EXE
PID:3544 -
\??\c:\vpddv.exec:\vpddv.exe62⤵
- Executes dropped EXE
PID:4892 -
\??\c:\frrfflr.exec:\frrfflr.exe63⤵
- Executes dropped EXE
PID:2880 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe64⤵
- Executes dropped EXE
PID:968 -
\??\c:\nbbbnn.exec:\nbbbnn.exe65⤵
- Executes dropped EXE
PID:3068 -
\??\c:\pvdjd.exec:\pvdjd.exe66⤵PID:5056
-
\??\c:\5ddvv.exec:\5ddvv.exe67⤵PID:1208
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe68⤵PID:2300
-
\??\c:\xfrxrll.exec:\xfrxrll.exe69⤵PID:4580
-
\??\c:\1thnhh.exec:\1thnhh.exe70⤵PID:3864
-
\??\c:\tnnnnt.exec:\tnnnnt.exe71⤵PID:2184
-
\??\c:\dddvp.exec:\dddvp.exe72⤵PID:2904
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe73⤵PID:3576
-
\??\c:\fxfrrxr.exec:\fxfrrxr.exe74⤵PID:3548
-
\??\c:\tbtnht.exec:\tbtnht.exe75⤵PID:2796
-
\??\c:\3ttnnt.exec:\3ttnnt.exe76⤵PID:4688
-
\??\c:\pdvvp.exec:\pdvvp.exe77⤵PID:2856
-
\??\c:\jvpjj.exec:\jvpjj.exe78⤵PID:4412
-
\??\c:\9xlrlxf.exec:\9xlrlxf.exe79⤵PID:4644
-
\??\c:\xrlrxfl.exec:\xrlrxfl.exe80⤵PID:3244
-
\??\c:\nntnnn.exec:\nntnnn.exe81⤵PID:1644
-
\??\c:\bttnhb.exec:\bttnhb.exe82⤵PID:412
-
\??\c:\3pjdv.exec:\3pjdv.exe83⤵PID:3388
-
\??\c:\ddvpj.exec:\ddvpj.exe84⤵PID:4572
-
\??\c:\llfxrlr.exec:\llfxrlr.exe85⤵PID:3492
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe86⤵PID:2696
-
\??\c:\hbbbbb.exec:\hbbbbb.exe87⤵PID:3692
-
\??\c:\nhhbth.exec:\nhhbth.exe88⤵PID:2392
-
\??\c:\pddvp.exec:\pddvp.exe89⤵PID:3348
-
\??\c:\xrfrxlf.exec:\xrfrxlf.exe90⤵PID:3988
-
\??\c:\5xffxxx.exec:\5xffxxx.exe91⤵PID:1624
-
\??\c:\ttnnnn.exec:\ttnnnn.exe92⤵PID:1588
-
\??\c:\hnbbtb.exec:\hnbbtb.exe93⤵PID:2596
-
\??\c:\7djjv.exec:\7djjv.exe94⤵PID:3156
-
\??\c:\vjdpj.exec:\vjdpj.exe95⤵PID:4520
-
\??\c:\xllxllx.exec:\xllxllx.exe96⤵PID:1388
-
\??\c:\hbbbbb.exec:\hbbbbb.exe97⤵PID:2896
-
\??\c:\1tbthh.exec:\1tbthh.exe98⤵PID:1188
-
\??\c:\1jdpd.exec:\1jdpd.exe99⤵PID:436
-
\??\c:\pjpjd.exec:\pjpjd.exe100⤵PID:5100
-
\??\c:\frrrllf.exec:\frrrllf.exe101⤵PID:3256
-
\??\c:\1bbbtn.exec:\1bbbtn.exe102⤵PID:5064
-
\??\c:\ttbhbb.exec:\ttbhbb.exe103⤵PID:1032
-
\??\c:\jjpjd.exec:\jjpjd.exe104⤵PID:1876
-
\??\c:\5jpvp.exec:\5jpvp.exe105⤵PID:4740
-
\??\c:\rxflllr.exec:\rxflllr.exe106⤵PID:4668
-
\??\c:\xxfffll.exec:\xxfffll.exe107⤵PID:2280
-
\??\c:\tthhhn.exec:\tthhhn.exe108⤵PID:2360
-
\??\c:\tbhbtt.exec:\tbhbtt.exe109⤵PID:1040
-
\??\c:\vjjdv.exec:\vjjdv.exe110⤵PID:4060
-
\??\c:\lflfxxx.exec:\lflfxxx.exe111⤵PID:1968
-
\??\c:\ffffxxx.exec:\ffffxxx.exe112⤵PID:3632
-
\??\c:\bthnhh.exec:\bthnhh.exe113⤵PID:2428
-
\??\c:\nbhbtt.exec:\nbhbtt.exe114⤵PID:1016
-
\??\c:\jvvdp.exec:\jvvdp.exe115⤵PID:3264
-
\??\c:\5jddj.exec:\5jddj.exe116⤵PID:2668
-
\??\c:\fxfxrfr.exec:\fxfxrfr.exe117⤵PID:1824
-
\??\c:\fllxxrx.exec:\fllxxrx.exe118⤵PID:1320
-
\??\c:\btbntb.exec:\btbntb.exe119⤵PID:3460
-
\??\c:\vjpjd.exec:\vjpjd.exe120⤵PID:4636
-
\??\c:\jvddv.exec:\jvddv.exe121⤵PID:5012
-
\??\c:\xfxxffl.exec:\xfxxffl.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-