Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7f149581054b45f83054d4b616e348c0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
7f149581054b45f83054d4b616e348c0N.exe
-
Size
64KB
-
MD5
7f149581054b45f83054d4b616e348c0
-
SHA1
ae484dcb3987e4d4db2a11f608d38d2e889f0d51
-
SHA256
794365d91ff6f206e7ca2b2f6ee6d2cc4acddaa061b7df73b168c7ef13ccd612
-
SHA512
8e3276aac1dfc686e0a49c15e788adb46fbfae39123f51d64c9e4c9d83db79854982ceb020016f6d7fcb411d6438fcf9fb1ee6fecd86f048bfac73d3e43beb29
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B11:ymb3NkkiQ3mdBjFI9cD
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/532-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/692-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2284 xrxrlrr.exe 4112 rffxlff.exe 2360 9hbbtt.exe 3996 5tnnhh.exe 1120 pvdvp.exe 1852 5xxrfll.exe 2736 tnbttt.exe 5076 htnthn.exe 2384 jvvjd.exe 2416 xfrfxxr.exe 2776 bnbtnh.exe 4424 pjdpj.exe 2440 3xxffll.exe 4256 1rrrllr.exe 3084 nntthh.exe 692 djpdv.exe 1396 fxffrlf.exe 1140 rxlxfrf.exe 4660 1tnhbn.exe 1572 jvjpd.exe 5008 jdvpj.exe 4504 lfllllr.exe 3188 bttnhb.exe 2172 9vdvp.exe 4948 fxfxrlr.exe 4676 xrllfff.exe 4488 thbhbb.exe 4988 jjppj.exe 3388 jdvpd.exe 1584 ntbhnb.exe 3364 hbhbnn.exe 4028 rlfxrrr.exe 3396 lrffllf.exe 1652 bhhbbb.exe 788 ddvpp.exe 4016 ppvpp.exe 2540 frrflrr.exe 224 xxxlrrr.exe 468 5hhbnn.exe 1432 jddpv.exe 5056 7pvvj.exe 2356 rrffrrx.exe 2892 ffxrlll.exe 640 nttttt.exe 1192 ppvpp.exe 2680 dvvpj.exe 2828 xlxlrrx.exe 1852 nhtntn.exe 3304 9vddv.exe 5040 1djjv.exe 728 frrlfxr.exe 4908 1bbbtt.exe 764 tnbtnh.exe 3228 ppvpv.exe 1372 3pdvv.exe 4404 xlllxfx.exe 5072 xllxlfr.exe 1228 hhbbbb.exe 4548 3bhhhh.exe 3888 dvjjj.exe 4772 ddddp.exe 744 llxrxxf.exe 4740 5rrllll.exe 2748 hhbbbb.exe -
resource yara_rule behavioral2/memory/532-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/692-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 532 wrote to memory of 2284 532 7f149581054b45f83054d4b616e348c0N.exe 85 PID 532 wrote to memory of 2284 532 7f149581054b45f83054d4b616e348c0N.exe 85 PID 532 wrote to memory of 2284 532 7f149581054b45f83054d4b616e348c0N.exe 85 PID 2284 wrote to memory of 4112 2284 xrxrlrr.exe 86 PID 2284 wrote to memory of 4112 2284 xrxrlrr.exe 86 PID 2284 wrote to memory of 4112 2284 xrxrlrr.exe 86 PID 4112 wrote to memory of 2360 4112 rffxlff.exe 87 PID 4112 wrote to memory of 2360 4112 rffxlff.exe 87 PID 4112 wrote to memory of 2360 4112 rffxlff.exe 87 PID 2360 wrote to memory of 3996 2360 9hbbtt.exe 88 PID 2360 wrote to memory of 3996 2360 9hbbtt.exe 88 PID 2360 wrote to memory of 3996 2360 9hbbtt.exe 88 PID 3996 wrote to memory of 1120 3996 5tnnhh.exe 89 PID 3996 wrote to memory of 1120 3996 5tnnhh.exe 89 PID 3996 wrote to memory of 1120 3996 5tnnhh.exe 89 PID 1120 wrote to memory of 1852 1120 pvdvp.exe 90 PID 1120 wrote to memory of 1852 1120 pvdvp.exe 90 PID 1120 wrote to memory of 1852 1120 pvdvp.exe 90 PID 1852 wrote to memory of 2736 1852 5xxrfll.exe 91 PID 1852 wrote to memory of 2736 1852 5xxrfll.exe 91 PID 1852 wrote to memory of 2736 1852 5xxrfll.exe 91 PID 2736 wrote to memory of 5076 2736 tnbttt.exe 92 PID 2736 wrote to memory of 5076 2736 tnbttt.exe 92 PID 2736 wrote to memory of 5076 2736 tnbttt.exe 92 PID 5076 wrote to memory of 2384 5076 htnthn.exe 93 PID 5076 wrote to memory of 2384 5076 htnthn.exe 93 PID 5076 wrote to memory of 2384 5076 htnthn.exe 93 PID 2384 wrote to memory of 2416 2384 jvvjd.exe 94 PID 2384 wrote to memory of 2416 2384 jvvjd.exe 94 PID 2384 wrote to memory of 2416 2384 jvvjd.exe 94 PID 2416 wrote to memory of 2776 2416 xfrfxxr.exe 95 PID 2416 wrote to memory of 2776 2416 xfrfxxr.exe 95 PID 2416 wrote to memory of 2776 2416 xfrfxxr.exe 95 PID 2776 wrote to memory of 4424 2776 bnbtnh.exe 96 PID 2776 wrote to memory of 4424 2776 bnbtnh.exe 96 PID 2776 wrote to memory of 4424 2776 bnbtnh.exe 96 PID 4424 wrote to memory of 2440 4424 pjdpj.exe 97 PID 4424 wrote to memory of 2440 4424 pjdpj.exe 97 PID 4424 wrote to memory of 2440 4424 pjdpj.exe 97 PID 2440 wrote to memory of 4256 2440 3xxffll.exe 98 PID 2440 wrote to memory of 4256 2440 3xxffll.exe 98 PID 2440 wrote to memory of 4256 2440 3xxffll.exe 98 PID 4256 wrote to memory of 3084 4256 1rrrllr.exe 99 PID 4256 wrote to memory of 3084 4256 1rrrllr.exe 99 PID 4256 wrote to memory of 3084 4256 1rrrllr.exe 99 PID 3084 wrote to memory of 692 3084 nntthh.exe 100 PID 3084 wrote to memory of 692 3084 nntthh.exe 100 PID 3084 wrote to memory of 692 3084 nntthh.exe 100 PID 692 wrote to memory of 1396 692 djpdv.exe 101 PID 692 wrote to memory of 1396 692 djpdv.exe 101 PID 692 wrote to memory of 1396 692 djpdv.exe 101 PID 1396 wrote to memory of 1140 1396 fxffrlf.exe 102 PID 1396 wrote to memory of 1140 1396 fxffrlf.exe 102 PID 1396 wrote to memory of 1140 1396 fxffrlf.exe 102 PID 1140 wrote to memory of 4660 1140 rxlxfrf.exe 103 PID 1140 wrote to memory of 4660 1140 rxlxfrf.exe 103 PID 1140 wrote to memory of 4660 1140 rxlxfrf.exe 103 PID 4660 wrote to memory of 1572 4660 1tnhbn.exe 105 PID 4660 wrote to memory of 1572 4660 1tnhbn.exe 105 PID 4660 wrote to memory of 1572 4660 1tnhbn.exe 105 PID 1572 wrote to memory of 5008 1572 jvjpd.exe 106 PID 1572 wrote to memory of 5008 1572 jvjpd.exe 106 PID 1572 wrote to memory of 5008 1572 jvjpd.exe 106 PID 5008 wrote to memory of 4504 5008 jdvpj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f149581054b45f83054d4b616e348c0N.exe"C:\Users\Admin\AppData\Local\Temp\7f149581054b45f83054d4b616e348c0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\xrxrlrr.exec:\xrxrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\rffxlff.exec:\rffxlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\9hbbtt.exec:\9hbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\5tnnhh.exec:\5tnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\pvdvp.exec:\pvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\5xxrfll.exec:\5xxrfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\tnbttt.exec:\tnbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\htnthn.exec:\htnthn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\jvvjd.exec:\jvvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\bnbtnh.exec:\bnbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\pjdpj.exec:\pjdpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\3xxffll.exec:\3xxffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\1rrrllr.exec:\1rrrllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\nntthh.exec:\nntthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\djpdv.exec:\djpdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\fxffrlf.exec:\fxffrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\rxlxfrf.exec:\rxlxfrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\1tnhbn.exec:\1tnhbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\jvjpd.exec:\jvjpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\jdvpj.exec:\jdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\lfllllr.exec:\lfllllr.exe23⤵
- Executes dropped EXE
PID:4504 -
\??\c:\bttnhb.exec:\bttnhb.exe24⤵
- Executes dropped EXE
PID:3188 -
\??\c:\9vdvp.exec:\9vdvp.exe25⤵
- Executes dropped EXE
PID:2172 -
\??\c:\fxfxrlr.exec:\fxfxrlr.exe26⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xrllfff.exec:\xrllfff.exe27⤵
- Executes dropped EXE
PID:4676 -
\??\c:\thbhbb.exec:\thbhbb.exe28⤵
- Executes dropped EXE
PID:4488 -
\??\c:\jjppj.exec:\jjppj.exe29⤵
- Executes dropped EXE
PID:4988 -
\??\c:\jdvpd.exec:\jdvpd.exe30⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ntbhnb.exec:\ntbhnb.exe31⤵
- Executes dropped EXE
PID:1584 -
\??\c:\hbhbnn.exec:\hbhbnn.exe32⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe33⤵
- Executes dropped EXE
PID:4028 -
\??\c:\lrffllf.exec:\lrffllf.exe34⤵
- Executes dropped EXE
PID:3396 -
\??\c:\bhhbbb.exec:\bhhbbb.exe35⤵
- Executes dropped EXE
PID:1652 -
\??\c:\ddvpp.exec:\ddvpp.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:788 -
\??\c:\ppvpp.exec:\ppvpp.exe37⤵
- Executes dropped EXE
PID:4016 -
\??\c:\frrflrr.exec:\frrflrr.exe38⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xxxlrrr.exec:\xxxlrrr.exe39⤵
- Executes dropped EXE
PID:224 -
\??\c:\hhttnn.exec:\hhttnn.exe40⤵PID:1968
-
\??\c:\5hhbnn.exec:\5hhbnn.exe41⤵
- Executes dropped EXE
PID:468 -
\??\c:\jddpv.exec:\jddpv.exe42⤵
- Executes dropped EXE
PID:1432 -
\??\c:\7pvvj.exec:\7pvvj.exe43⤵
- Executes dropped EXE
PID:5056 -
\??\c:\rrffrrx.exec:\rrffrrx.exe44⤵
- Executes dropped EXE
PID:2356 -
\??\c:\ffxrlll.exec:\ffxrlll.exe45⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nttttt.exec:\nttttt.exe46⤵
- Executes dropped EXE
PID:640 -
\??\c:\ppvpp.exec:\ppvpp.exe47⤵
- Executes dropped EXE
PID:1192 -
\??\c:\dvvpj.exec:\dvvpj.exe48⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xlxlrrx.exec:\xlxlrrx.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\nhtntn.exec:\nhtntn.exe50⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9vddv.exec:\9vddv.exe51⤵
- Executes dropped EXE
PID:3304 -
\??\c:\1djjv.exec:\1djjv.exe52⤵
- Executes dropped EXE
PID:5040 -
\??\c:\frrlfxr.exec:\frrlfxr.exe53⤵
- Executes dropped EXE
PID:728 -
\??\c:\1bbbtt.exec:\1bbbtt.exe54⤵
- Executes dropped EXE
PID:4908 -
\??\c:\tnbtnh.exec:\tnbtnh.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\ppvpv.exec:\ppvpv.exe56⤵
- Executes dropped EXE
PID:3228 -
\??\c:\3pdvv.exec:\3pdvv.exe57⤵
- Executes dropped EXE
PID:1372 -
\??\c:\xlllxfx.exec:\xlllxfx.exe58⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xllxlfr.exec:\xllxlfr.exe59⤵
- Executes dropped EXE
PID:5072 -
\??\c:\hhbbbb.exec:\hhbbbb.exe60⤵
- Executes dropped EXE
PID:1228 -
\??\c:\3bhhhh.exec:\3bhhhh.exe61⤵
- Executes dropped EXE
PID:4548 -
\??\c:\dvjjj.exec:\dvjjj.exe62⤵
- Executes dropped EXE
PID:3888 -
\??\c:\ddddp.exec:\ddddp.exe63⤵
- Executes dropped EXE
PID:4772 -
\??\c:\llxrxxf.exec:\llxrxxf.exe64⤵
- Executes dropped EXE
PID:744 -
\??\c:\5rrllll.exec:\5rrllll.exe65⤵
- Executes dropped EXE
PID:4740 -
\??\c:\hhbbbb.exec:\hhbbbb.exe66⤵
- Executes dropped EXE
PID:2748 -
\??\c:\bbhnnn.exec:\bbhnnn.exe67⤵PID:4932
-
\??\c:\5nnhbb.exec:\5nnhbb.exe68⤵PID:2240
-
\??\c:\9jddp.exec:\9jddp.exe69⤵PID:4284
-
\??\c:\1frxlxr.exec:\1frxlxr.exe70⤵PID:1296
-
\??\c:\lllllll.exec:\lllllll.exe71⤵PID:1752
-
\??\c:\5hnhbt.exec:\5hnhbt.exe72⤵PID:1080
-
\??\c:\1ntbnt.exec:\1ntbnt.exe73⤵PID:4956
-
\??\c:\3thhtb.exec:\3thhtb.exe74⤵PID:2288
-
\??\c:\dvvpj.exec:\dvvpj.exe75⤵PID:3092
-
\??\c:\5vdvp.exec:\5vdvp.exe76⤵PID:4676
-
\??\c:\7lfxxff.exec:\7lfxxff.exe77⤵PID:1568
-
\??\c:\thnhhh.exec:\thnhhh.exe78⤵PID:4552
-
\??\c:\bthbtt.exec:\bthbtt.exe79⤵PID:2160
-
\??\c:\vdpjj.exec:\vdpjj.exe80⤵PID:2584
-
\??\c:\rlxxffl.exec:\rlxxffl.exe81⤵PID:1132
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe82⤵PID:2944
-
\??\c:\3ffllll.exec:\3ffllll.exe83⤵PID:1860
-
\??\c:\1hhbbb.exec:\1hhbbb.exe84⤵PID:3164
-
\??\c:\lfllllr.exec:\lfllllr.exe85⤵PID:1044
-
\??\c:\rrxfxxx.exec:\rrxfxxx.exe86⤵PID:4892
-
\??\c:\5tbtbb.exec:\5tbtbb.exe87⤵PID:1768
-
\??\c:\hhhhbb.exec:\hhhhbb.exe88⤵PID:3932
-
\??\c:\ddvvd.exec:\ddvvd.exe89⤵PID:3312
-
\??\c:\jdvvd.exec:\jdvvd.exe90⤵PID:4316
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe91⤵PID:2900
-
\??\c:\xfffxfx.exec:\xfffxfx.exe92⤵PID:1496
-
\??\c:\lllfxxr.exec:\lllfxxr.exe93⤵PID:2140
-
\??\c:\hthbbb.exec:\hthbbb.exe94⤵PID:4056
-
\??\c:\pjjvj.exec:\pjjvj.exe95⤵PID:1172
-
\??\c:\jjdvj.exec:\jjdvj.exe96⤵PID:2360
-
\??\c:\djppp.exec:\djppp.exe97⤵PID:1184
-
\??\c:\llrrxlr.exec:\llrrxlr.exe98⤵PID:2028
-
\??\c:\3fxxrrr.exec:\3fxxrrr.exe99⤵PID:2896
-
\??\c:\hhtntt.exec:\hhtntt.exe100⤵PID:4616
-
\??\c:\dddvd.exec:\dddvd.exe101⤵PID:1852
-
\??\c:\3jjdv.exec:\3jjdv.exe102⤵PID:4352
-
\??\c:\llxxrrr.exec:\llxxrrr.exe103⤵PID:5040
-
\??\c:\xfxrfrf.exec:\xfxrfrf.exe104⤵PID:1144
-
\??\c:\hnbhbt.exec:\hnbhbt.exe105⤵PID:2952
-
\??\c:\9ttnnn.exec:\9ttnnn.exe106⤵PID:764
-
\??\c:\jvvpp.exec:\jvvpp.exe107⤵PID:1648
-
\??\c:\7djvp.exec:\7djvp.exe108⤵PID:1372
-
\??\c:\1xfxxxl.exec:\1xfxxxl.exe109⤵PID:1812
-
\??\c:\frxrlll.exec:\frxrlll.exe110⤵PID:5072
-
\??\c:\bthhhh.exec:\bthhhh.exe111⤵PID:3808
-
\??\c:\ttbthn.exec:\ttbthn.exe112⤵PID:4720
-
\??\c:\jjjdv.exec:\jjjdv.exe113⤵PID:3888
-
\??\c:\5ddvj.exec:\5ddvj.exe114⤵PID:3080
-
\??\c:\pppjj.exec:\pppjj.exe115⤵PID:744
-
\??\c:\rfrlffx.exec:\rfrlffx.exe116⤵PID:996
-
\??\c:\xrllxxx.exec:\xrllxxx.exe117⤵PID:1020
-
\??\c:\9thhhh.exec:\9thhhh.exe118⤵PID:4932
-
\??\c:\nttnbn.exec:\nttnbn.exe119⤵PID:2240
-
\??\c:\3dvvp.exec:\3dvvp.exe120⤵PID:3576
-
\??\c:\pvjdv.exec:\pvjdv.exe121⤵PID:2964
-
\??\c:\frxrffx.exec:\frxrffx.exe122⤵PID:3140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-