Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 22:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
db1e03fa390f2aecbb5862318d6cda60N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
db1e03fa390f2aecbb5862318d6cda60N.exe
-
Size
82KB
-
MD5
db1e03fa390f2aecbb5862318d6cda60
-
SHA1
7a0d75492148cd9724300f91a5d39792d51c9519
-
SHA256
c123e2d3e7a3a6ff937f3e1646afdc14cf1ad55a088cfc86734c5efa41df822f
-
SHA512
573f6306678b9df5a493fa3e1932461478448eb4084778daa4aae99036faafdd42d722a999fa2dc2b90e603d5cb743c64fb81c8c35df0557600da18fb9d2e46d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qj:ymb3NkkiQ3mdBjFIIp9L9QrrA8G
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4956-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4380 pvdvd.exe 1908 rxfrrll.exe 724 bbbttn.exe 2228 pppjj.exe 1812 ddppj.exe 3068 lxxxlrl.exe 4032 1bbtnn.exe 4764 jpvvv.exe 3440 xrrflff.exe 1436 nbnhhh.exe 3832 pvdvp.exe 1216 jdvvv.exe 3700 fxxlffx.exe 4152 bnbnbh.exe 1892 pjpjd.exe 964 ffrfllx.exe 2928 nbbbtn.exe 2276 vjvdv.exe 2684 xlxxxxx.exe 3088 bbhnhh.exe 5020 tnntbb.exe 4396 vvdvp.exe 3160 frfllrr.exe 3132 htnntb.exe 3096 ddjdp.exe 4996 pdddj.exe 4416 rlfrrrl.exe 2212 vddpj.exe 5056 lrxrfff.exe 2392 hbnhnh.exe 3856 dppvj.exe 2784 rlrllll.exe 832 htbnnn.exe 4896 3vvvp.exe 532 7rxrrrr.exe 2988 1tbttt.exe 4832 btnbtn.exe 4976 djppp.exe 4992 ffrrllf.exe 440 rllfxfx.exe 2228 tnnhtb.exe 2876 djjdd.exe 5084 djppj.exe 3388 rflllll.exe 2608 ntbhth.exe 4612 jpjjv.exe 1108 jddvv.exe 1076 xllfxxx.exe 2640 1thbhh.exe 1436 hhhbtt.exe 3832 7ppdv.exe 3624 xffxfll.exe 764 tnbtnh.exe 5092 hhttnn.exe 4556 jjppd.exe 3936 xrlxrfl.exe 4184 tntnnn.exe 3348 ttnhbb.exe 2316 dpvpp.exe 2304 ppvpj.exe 4980 ffrrrrx.exe 4584 xxxxfff.exe 3004 bbtnhh.exe 2116 vvdpp.exe -
resource yara_rule behavioral2/memory/4956-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3832-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htttth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxllllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4956 wrote to memory of 4380 4956 db1e03fa390f2aecbb5862318d6cda60N.exe 83 PID 4956 wrote to memory of 4380 4956 db1e03fa390f2aecbb5862318d6cda60N.exe 83 PID 4956 wrote to memory of 4380 4956 db1e03fa390f2aecbb5862318d6cda60N.exe 83 PID 4380 wrote to memory of 1908 4380 pvdvd.exe 84 PID 4380 wrote to memory of 1908 4380 pvdvd.exe 84 PID 4380 wrote to memory of 1908 4380 pvdvd.exe 84 PID 1908 wrote to memory of 724 1908 rxfrrll.exe 85 PID 1908 wrote to memory of 724 1908 rxfrrll.exe 85 PID 1908 wrote to memory of 724 1908 rxfrrll.exe 85 PID 724 wrote to memory of 2228 724 bbbttn.exe 86 PID 724 wrote to memory of 2228 724 bbbttn.exe 86 PID 724 wrote to memory of 2228 724 bbbttn.exe 86 PID 2228 wrote to memory of 1812 2228 pppjj.exe 87 PID 2228 wrote to memory of 1812 2228 pppjj.exe 87 PID 2228 wrote to memory of 1812 2228 pppjj.exe 87 PID 1812 wrote to memory of 3068 1812 ddppj.exe 88 PID 1812 wrote to memory of 3068 1812 ddppj.exe 88 PID 1812 wrote to memory of 3068 1812 ddppj.exe 88 PID 3068 wrote to memory of 4032 3068 lxxxlrl.exe 89 PID 3068 wrote to memory of 4032 3068 lxxxlrl.exe 89 PID 3068 wrote to memory of 4032 3068 lxxxlrl.exe 89 PID 4032 wrote to memory of 4764 4032 1bbtnn.exe 90 PID 4032 wrote to memory of 4764 4032 1bbtnn.exe 90 PID 4032 wrote to memory of 4764 4032 1bbtnn.exe 90 PID 4764 wrote to memory of 3440 4764 jpvvv.exe 91 PID 4764 wrote to memory of 3440 4764 jpvvv.exe 91 PID 4764 wrote to memory of 3440 4764 jpvvv.exe 91 PID 3440 wrote to memory of 1436 3440 xrrflff.exe 92 PID 3440 wrote to memory of 1436 3440 xrrflff.exe 92 PID 3440 wrote to memory of 1436 3440 xrrflff.exe 92 PID 1436 wrote to memory of 3832 1436 nbnhhh.exe 93 PID 1436 wrote to memory of 3832 1436 nbnhhh.exe 93 PID 1436 wrote to memory of 3832 1436 nbnhhh.exe 93 PID 3832 wrote to memory of 1216 3832 pvdvp.exe 94 PID 3832 wrote to memory of 1216 3832 pvdvp.exe 94 PID 3832 wrote to memory of 1216 3832 pvdvp.exe 94 PID 1216 wrote to memory of 3700 1216 jdvvv.exe 95 PID 1216 wrote to memory of 3700 1216 jdvvv.exe 95 PID 1216 wrote to memory of 3700 1216 jdvvv.exe 95 PID 3700 wrote to memory of 4152 3700 fxxlffx.exe 96 PID 3700 wrote to memory of 4152 3700 fxxlffx.exe 96 PID 3700 wrote to memory of 4152 3700 fxxlffx.exe 96 PID 4152 wrote to memory of 1892 4152 bnbnbh.exe 97 PID 4152 wrote to memory of 1892 4152 bnbnbh.exe 97 PID 4152 wrote to memory of 1892 4152 bnbnbh.exe 97 PID 1892 wrote to memory of 964 1892 pjpjd.exe 98 PID 1892 wrote to memory of 964 1892 pjpjd.exe 98 PID 1892 wrote to memory of 964 1892 pjpjd.exe 98 PID 964 wrote to memory of 2928 964 ffrfllx.exe 99 PID 964 wrote to memory of 2928 964 ffrfllx.exe 99 PID 964 wrote to memory of 2928 964 ffrfllx.exe 99 PID 2928 wrote to memory of 2276 2928 nbbbtn.exe 100 PID 2928 wrote to memory of 2276 2928 nbbbtn.exe 100 PID 2928 wrote to memory of 2276 2928 nbbbtn.exe 100 PID 2276 wrote to memory of 2684 2276 vjvdv.exe 101 PID 2276 wrote to memory of 2684 2276 vjvdv.exe 101 PID 2276 wrote to memory of 2684 2276 vjvdv.exe 101 PID 2684 wrote to memory of 3088 2684 xlxxxxx.exe 103 PID 2684 wrote to memory of 3088 2684 xlxxxxx.exe 103 PID 2684 wrote to memory of 3088 2684 xlxxxxx.exe 103 PID 3088 wrote to memory of 5020 3088 bbhnhh.exe 104 PID 3088 wrote to memory of 5020 3088 bbhnhh.exe 104 PID 3088 wrote to memory of 5020 3088 bbhnhh.exe 104 PID 5020 wrote to memory of 4396 5020 tnntbb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\db1e03fa390f2aecbb5862318d6cda60N.exe"C:\Users\Admin\AppData\Local\Temp\db1e03fa390f2aecbb5862318d6cda60N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\pvdvd.exec:\pvdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\rxfrrll.exec:\rxfrrll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\bbbttn.exec:\bbbttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\pppjj.exec:\pppjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ddppj.exec:\ddppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\lxxxlrl.exec:\lxxxlrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\1bbtnn.exec:\1bbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\jpvvv.exec:\jpvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\xrrflff.exec:\xrrflff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
\??\c:\nbnhhh.exec:\nbnhhh.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\pvdvp.exec:\pvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\jdvvv.exec:\jdvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\fxxlffx.exec:\fxxlffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\bnbnbh.exec:\bnbnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\pjpjd.exec:\pjpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\ffrfllx.exec:\ffrfllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\nbbbtn.exec:\nbbbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\vjvdv.exec:\vjvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\bbhnhh.exec:\bbhnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\tnntbb.exec:\tnntbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\vvdvp.exec:\vvdvp.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396 -
\??\c:\frfllrr.exec:\frfllrr.exe24⤵
- Executes dropped EXE
PID:3160 -
\??\c:\htnntb.exec:\htnntb.exe25⤵
- Executes dropped EXE
PID:3132 -
\??\c:\ddjdp.exec:\ddjdp.exe26⤵
- Executes dropped EXE
PID:3096 -
\??\c:\pdddj.exec:\pdddj.exe27⤵
- Executes dropped EXE
PID:4996 -
\??\c:\rlfrrrl.exec:\rlfrrrl.exe28⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vddpj.exec:\vddpj.exe29⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lrxrfff.exec:\lrxrfff.exe30⤵
- Executes dropped EXE
PID:5056 -
\??\c:\hbnhnh.exec:\hbnhnh.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dppvj.exec:\dppvj.exe32⤵
- Executes dropped EXE
PID:3856 -
\??\c:\rlrllll.exec:\rlrllll.exe33⤵
- Executes dropped EXE
PID:2784 -
\??\c:\htbnnn.exec:\htbnnn.exe34⤵
- Executes dropped EXE
PID:832 -
\??\c:\3vvvp.exec:\3vvvp.exe35⤵
- Executes dropped EXE
PID:4896 -
\??\c:\7rxrrrr.exec:\7rxrrrr.exe36⤵
- Executes dropped EXE
PID:532 -
\??\c:\1tbttt.exec:\1tbttt.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\btnbtn.exec:\btnbtn.exe38⤵
- Executes dropped EXE
PID:4832 -
\??\c:\djppp.exec:\djppp.exe39⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ffrrllf.exec:\ffrrllf.exe40⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rllfxfx.exec:\rllfxfx.exe41⤵
- Executes dropped EXE
PID:440 -
\??\c:\tnnhtb.exec:\tnnhtb.exe42⤵
- Executes dropped EXE
PID:2228 -
\??\c:\djjdd.exec:\djjdd.exe43⤵
- Executes dropped EXE
PID:2876 -
\??\c:\djppj.exec:\djppj.exe44⤵
- Executes dropped EXE
PID:5084 -
\??\c:\rflllll.exec:\rflllll.exe45⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ntbhth.exec:\ntbhth.exe46⤵
- Executes dropped EXE
PID:2608 -
\??\c:\jpjjv.exec:\jpjjv.exe47⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jddvv.exec:\jddvv.exe48⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xllfxxx.exec:\xllfxxx.exe49⤵
- Executes dropped EXE
PID:1076 -
\??\c:\1thbhh.exec:\1thbhh.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hhhbtt.exec:\hhhbtt.exe51⤵
- Executes dropped EXE
PID:1436 -
\??\c:\7ppdv.exec:\7ppdv.exe52⤵
- Executes dropped EXE
PID:3832 -
\??\c:\xffxfll.exec:\xffxfll.exe53⤵
- Executes dropped EXE
PID:3624 -
\??\c:\tnbtnh.exec:\tnbtnh.exe54⤵
- Executes dropped EXE
PID:764 -
\??\c:\hhttnn.exec:\hhttnn.exe55⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jjppd.exec:\jjppd.exe56⤵
- Executes dropped EXE
PID:4556 -
\??\c:\xrlxrfl.exec:\xrlxrfl.exe57⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tntnnn.exec:\tntnnn.exe58⤵
- Executes dropped EXE
PID:4184 -
\??\c:\ttnhbb.exec:\ttnhbb.exe59⤵
- Executes dropped EXE
PID:3348 -
\??\c:\dpvpp.exec:\dpvpp.exe60⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ppvpj.exec:\ppvpj.exe61⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe62⤵
- Executes dropped EXE
PID:4980 -
\??\c:\xxxxfff.exec:\xxxxfff.exe63⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bbtnhh.exec:\bbtnhh.exe64⤵
- Executes dropped EXE
PID:3004 -
\??\c:\vvdpp.exec:\vvdpp.exe65⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lffxrfx.exec:\lffxrfx.exe66⤵PID:1016
-
\??\c:\nhttbt.exec:\nhttbt.exe67⤵PID:4056
-
\??\c:\1btbtb.exec:\1btbtb.exe68⤵PID:3456
-
\??\c:\jppjv.exec:\jppjv.exe69⤵PID:392
-
\??\c:\vdvvd.exec:\vdvvd.exe70⤵PID:2060
-
\??\c:\lxxrlll.exec:\lxxrlll.exe71⤵PID:4972
-
\??\c:\hhbbth.exec:\hhbbth.exe72⤵PID:2516
-
\??\c:\nnbhbh.exec:\nnbhbh.exe73⤵PID:2152
-
\??\c:\pvdjv.exec:\pvdjv.exe74⤵PID:5056
-
\??\c:\xlllfrx.exec:\xlllfrx.exe75⤵PID:3888
-
\??\c:\lxxfxxx.exec:\lxxfxxx.exe76⤵PID:3504
-
\??\c:\tnhbtn.exec:\tnhbtn.exe77⤵PID:4852
-
\??\c:\jppjv.exec:\jppjv.exe78⤵PID:3992
-
\??\c:\djvjp.exec:\djvjp.exe79⤵PID:2080
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe80⤵PID:3656
-
\??\c:\ttntnt.exec:\ttntnt.exe81⤵PID:4448
-
\??\c:\ddvdp.exec:\ddvdp.exe82⤵PID:4844
-
\??\c:\lxrfrfr.exec:\lxrfrfr.exe83⤵PID:680
-
\??\c:\xrlflfl.exec:\xrlflfl.exe84⤵PID:3684
-
\??\c:\nhnnhb.exec:\nhnnhb.exe85⤵PID:3112
-
\??\c:\pddpj.exec:\pddpj.exe86⤵PID:2232
-
\??\c:\fllrflr.exec:\fllrflr.exe87⤵PID:4640
-
\??\c:\nttttt.exec:\nttttt.exe88⤵PID:2228
-
\??\c:\nthtnb.exec:\nthtnb.exe89⤵PID:2408
-
\??\c:\jvjdd.exec:\jvjdd.exe90⤵PID:4876
-
\??\c:\xfxfrlx.exec:\xfxfrlx.exe91⤵PID:2756
-
\??\c:\tthhbh.exec:\tthhbh.exe92⤵PID:2860
-
\??\c:\hbtbbb.exec:\hbtbbb.exe93⤵PID:4048
-
\??\c:\jdvpd.exec:\jdvpd.exe94⤵PID:2504
-
\??\c:\lrxxlrx.exec:\lrxxlrx.exe95⤵PID:3524
-
\??\c:\tntttt.exec:\tntttt.exe96⤵PID:3316
-
\??\c:\nthhtt.exec:\nthhtt.exe97⤵PID:4492
-
\??\c:\pvdvp.exec:\pvdvp.exe98⤵PID:1168
-
\??\c:\lllfrrr.exec:\lllfrrr.exe99⤵PID:1776
-
\??\c:\lxllllf.exec:\lxllllf.exe100⤵
- System Location Discovery: System Language Discovery
PID:3452 -
\??\c:\bntnnn.exec:\bntnnn.exe101⤵PID:1864
-
\??\c:\dvjdp.exec:\dvjdp.exe102⤵PID:4672
-
\??\c:\rxllrlr.exec:\rxllrlr.exe103⤵PID:3436
-
\??\c:\5rxxffr.exec:\5rxxffr.exe104⤵PID:3444
-
\??\c:\nnhhbt.exec:\nnhhbt.exe105⤵PID:760
-
\??\c:\xxxrxrr.exec:\xxxrxrr.exe106⤵PID:4212
-
\??\c:\tbnbnh.exec:\tbnbnh.exe107⤵PID:4628
-
\??\c:\dpdjv.exec:\dpdjv.exe108⤵PID:2480
-
\??\c:\jpdjd.exec:\jpdjd.exe109⤵PID:5040
-
\??\c:\fxxrffl.exec:\fxxrffl.exe110⤵PID:1268
-
\??\c:\5dpjv.exec:\5dpjv.exe111⤵PID:1448
-
\??\c:\pjddj.exec:\pjddj.exe112⤵PID:1632
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe113⤵PID:2820
-
\??\c:\rxxlfxr.exec:\rxxlfxr.exe114⤵PID:2552
-
\??\c:\hthttb.exec:\hthttb.exe115⤵PID:4104
-
\??\c:\bhhtbt.exec:\bhhtbt.exe116⤵PID:4300
-
\??\c:\djjvd.exec:\djjvd.exe117⤵PID:3796
-
\??\c:\lrrxrlf.exec:\lrrxrlf.exe118⤵PID:3692
-
\??\c:\hbntnt.exec:\hbntnt.exe119⤵PID:408
-
\??\c:\jdvvj.exec:\jdvvj.exe120⤵PID:4960
-
\??\c:\xrxxrfl.exec:\xrxxrfl.exe121⤵PID:2236
-
\??\c:\lxlxrff.exec:\lxlxrff.exe122⤵PID:4116
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-