Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 23:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe
-
Size
64KB
-
MD5
b833f628d7526528d79486cda269e83a
-
SHA1
9cd91da3588ddedd772226b231856e0c0b9ae55d
-
SHA256
87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca
-
SHA512
311eeb8cacd338fdb907299c1cc1f7f6bff6fffee41e335270c9acc615dcb190e31d722b4e022afc33dc9ecd0362e0d18e5d04ff742111c82e30bf28f4bc165b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L271:ymb3NkkiQ3mdBjFI9w
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4432-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/908-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/796-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1924 rfxrxfr.exe 4432 vjdvv.exe 2848 rrrxrff.exe 3956 nhbtnn.exe 4716 dpdvv.exe 1732 jdpdd.exe 4420 5nbnbt.exe 3220 jdvjv.exe 1996 lffxfxf.exe 2528 xrfrrrl.exe 5000 vpdpv.exe 4720 lffrlxr.exe 388 hnbnnh.exe 4236 ddjvd.exe 796 fxlfrll.exe 2040 nnntnn.exe 3512 jvdvp.exe 4336 ppppv.exe 4576 bbbhhh.exe 696 dppjv.exe 396 7vppv.exe 408 rfffxrf.exe 1648 ttnhtn.exe 2008 dvvjp.exe 1104 xfrlxff.exe 3088 ntntht.exe 4044 jdvdp.exe 2308 xxllfxx.exe 2312 tbbtnn.exe 2172 bnhthh.exe 4796 dvpjp.exe 3020 rrrfxxr.exe 3148 bnhbbn.exe 2544 httnnh.exe 4808 jjddv.exe 3436 lxxrllr.exe 3244 xxflfxr.exe 3392 1nbtnb.exe 332 jjpjp.exe 4340 5djdj.exe 3912 5xfrxfx.exe 4656 tttbtb.exe 116 nbbtnt.exe 4180 jdpjp.exe 4092 rrfrxlx.exe 3940 htbhnh.exe 1004 hhnhbb.exe 1524 jdvvj.exe 1128 flflrrf.exe 5016 nhhntt.exe 1732 jppdj.exe 4532 flfllll.exe 3380 1xlllxl.exe 3840 hbbbtn.exe 2772 pdpjd.exe 4932 flxfrxl.exe 4292 tnhbtn.exe 3988 pjjvd.exe 856 lfllxll.exe 4816 rflrrrl.exe 2348 tbhbbb.exe 1440 vvpjd.exe 4228 xxrxfll.exe 4492 tthbbb.exe -
resource yara_rule behavioral2/memory/908-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/908-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/796-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 908 wrote to memory of 1924 908 87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe 83 PID 908 wrote to memory of 1924 908 87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe 83 PID 908 wrote to memory of 1924 908 87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe 83 PID 1924 wrote to memory of 4432 1924 rfxrxfr.exe 84 PID 1924 wrote to memory of 4432 1924 rfxrxfr.exe 84 PID 1924 wrote to memory of 4432 1924 rfxrxfr.exe 84 PID 4432 wrote to memory of 2848 4432 vjdvv.exe 85 PID 4432 wrote to memory of 2848 4432 vjdvv.exe 85 PID 4432 wrote to memory of 2848 4432 vjdvv.exe 85 PID 2848 wrote to memory of 3956 2848 rrrxrff.exe 86 PID 2848 wrote to memory of 3956 2848 rrrxrff.exe 86 PID 2848 wrote to memory of 3956 2848 rrrxrff.exe 86 PID 3956 wrote to memory of 4716 3956 nhbtnn.exe 87 PID 3956 wrote to memory of 4716 3956 nhbtnn.exe 87 PID 3956 wrote to memory of 4716 3956 nhbtnn.exe 87 PID 4716 wrote to memory of 1732 4716 dpdvv.exe 88 PID 4716 wrote to memory of 1732 4716 dpdvv.exe 88 PID 4716 wrote to memory of 1732 4716 dpdvv.exe 88 PID 1732 wrote to memory of 4420 1732 jdpdd.exe 89 PID 1732 wrote to memory of 4420 1732 jdpdd.exe 89 PID 1732 wrote to memory of 4420 1732 jdpdd.exe 89 PID 4420 wrote to memory of 3220 4420 5nbnbt.exe 90 PID 4420 wrote to memory of 3220 4420 5nbnbt.exe 90 PID 4420 wrote to memory of 3220 4420 5nbnbt.exe 90 PID 3220 wrote to memory of 1996 3220 jdvjv.exe 91 PID 3220 wrote to memory of 1996 3220 jdvjv.exe 91 PID 3220 wrote to memory of 1996 3220 jdvjv.exe 91 PID 1996 wrote to memory of 2528 1996 lffxfxf.exe 92 PID 1996 wrote to memory of 2528 1996 lffxfxf.exe 92 PID 1996 wrote to memory of 2528 1996 lffxfxf.exe 92 PID 2528 wrote to memory of 5000 2528 xrfrrrl.exe 93 PID 2528 wrote to memory of 5000 2528 xrfrrrl.exe 93 PID 2528 wrote to memory of 5000 2528 xrfrrrl.exe 93 PID 5000 wrote to memory of 4720 5000 vpdpv.exe 94 PID 5000 wrote to memory of 4720 5000 vpdpv.exe 94 PID 5000 wrote to memory of 4720 5000 vpdpv.exe 94 PID 4720 wrote to memory of 388 4720 lffrlxr.exe 96 PID 4720 wrote to memory of 388 4720 lffrlxr.exe 96 PID 4720 wrote to memory of 388 4720 lffrlxr.exe 96 PID 388 wrote to memory of 4236 388 hnbnnh.exe 97 PID 388 wrote to memory of 4236 388 hnbnnh.exe 97 PID 388 wrote to memory of 4236 388 hnbnnh.exe 97 PID 4236 wrote to memory of 796 4236 ddjvd.exe 98 PID 4236 wrote to memory of 796 4236 ddjvd.exe 98 PID 4236 wrote to memory of 796 4236 ddjvd.exe 98 PID 796 wrote to memory of 2040 796 fxlfrll.exe 99 PID 796 wrote to memory of 2040 796 fxlfrll.exe 99 PID 796 wrote to memory of 2040 796 fxlfrll.exe 99 PID 2040 wrote to memory of 3512 2040 nnntnn.exe 100 PID 2040 wrote to memory of 3512 2040 nnntnn.exe 100 PID 2040 wrote to memory of 3512 2040 nnntnn.exe 100 PID 3512 wrote to memory of 4336 3512 jvdvp.exe 101 PID 3512 wrote to memory of 4336 3512 jvdvp.exe 101 PID 3512 wrote to memory of 4336 3512 jvdvp.exe 101 PID 4336 wrote to memory of 4576 4336 ppppv.exe 102 PID 4336 wrote to memory of 4576 4336 ppppv.exe 102 PID 4336 wrote to memory of 4576 4336 ppppv.exe 102 PID 4576 wrote to memory of 696 4576 bbbhhh.exe 104 PID 4576 wrote to memory of 696 4576 bbbhhh.exe 104 PID 4576 wrote to memory of 696 4576 bbbhhh.exe 104 PID 696 wrote to memory of 396 696 dppjv.exe 105 PID 696 wrote to memory of 396 696 dppjv.exe 105 PID 696 wrote to memory of 396 696 dppjv.exe 105 PID 396 wrote to memory of 408 396 7vppv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe"C:\Users\Admin\AppData\Local\Temp\87d50aacbbe4d5c0e8c3bbcd6506cdb68b3332541f293f31821f40306ba6efca.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\rfxrxfr.exec:\rfxrxfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vjdvv.exec:\vjdvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\rrrxrff.exec:\rrrxrff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nhbtnn.exec:\nhbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\dpdvv.exec:\dpdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\jdpdd.exec:\jdpdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\5nbnbt.exec:\5nbnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\jdvjv.exec:\jdvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\lffxfxf.exec:\lffxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\xrfrrrl.exec:\xrfrrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\vpdpv.exec:\vpdpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\lffrlxr.exec:\lffrlxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\hnbnnh.exec:\hnbnnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ddjvd.exec:\ddjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\fxlfrll.exec:\fxlfrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\nnntnn.exec:\nnntnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jvdvp.exec:\jvdvp.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\ppppv.exec:\ppppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\bbbhhh.exec:\bbbhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\dppjv.exec:\dppjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\7vppv.exec:\7vppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\rfffxrf.exec:\rfffxrf.exe23⤵
- Executes dropped EXE
PID:408 -
\??\c:\ttnhtn.exec:\ttnhtn.exe24⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dvvjp.exec:\dvvjp.exe25⤵
- Executes dropped EXE
PID:2008 -
\??\c:\xfrlxff.exec:\xfrlxff.exe26⤵
- Executes dropped EXE
PID:1104 -
\??\c:\ntntht.exec:\ntntht.exe27⤵
- Executes dropped EXE
PID:3088 -
\??\c:\jdvdp.exec:\jdvdp.exe28⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xxllfxx.exec:\xxllfxx.exe29⤵
- Executes dropped EXE
PID:2308 -
\??\c:\tbbtnn.exec:\tbbtnn.exe30⤵
- Executes dropped EXE
PID:2312 -
\??\c:\bnhthh.exec:\bnhthh.exe31⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvpjp.exec:\dvpjp.exe32⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rrrfxxr.exec:\rrrfxxr.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\bnhbbn.exec:\bnhbbn.exe34⤵
- Executes dropped EXE
PID:3148 -
\??\c:\httnnh.exec:\httnnh.exe35⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jjddv.exec:\jjddv.exe36⤵
- Executes dropped EXE
PID:4808 -
\??\c:\lxxrllr.exec:\lxxrllr.exe37⤵
- Executes dropped EXE
PID:3436 -
\??\c:\xxflfxr.exec:\xxflfxr.exe38⤵
- Executes dropped EXE
PID:3244 -
\??\c:\1nbtnb.exec:\1nbtnb.exe39⤵
- Executes dropped EXE
PID:3392 -
\??\c:\jjpjp.exec:\jjpjp.exe40⤵
- Executes dropped EXE
PID:332 -
\??\c:\5djdj.exec:\5djdj.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5xfrxfx.exec:\5xfrxfx.exe42⤵
- Executes dropped EXE
PID:3912 -
\??\c:\tttbtb.exec:\tttbtb.exe43⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nbbtnt.exec:\nbbtnt.exe44⤵
- Executes dropped EXE
PID:116 -
\??\c:\jdpjp.exec:\jdpjp.exe45⤵
- Executes dropped EXE
PID:4180 -
\??\c:\rrfrxlx.exec:\rrfrxlx.exe46⤵
- Executes dropped EXE
PID:4092 -
\??\c:\htbhnh.exec:\htbhnh.exe47⤵
- Executes dropped EXE
PID:3940 -
\??\c:\hhnhbb.exec:\hhnhbb.exe48⤵
- Executes dropped EXE
PID:1004 -
\??\c:\jdvvj.exec:\jdvvj.exe49⤵
- Executes dropped EXE
PID:1524 -
\??\c:\flflrrf.exec:\flflrrf.exe50⤵
- Executes dropped EXE
PID:1128 -
\??\c:\nhhntt.exec:\nhhntt.exe51⤵
- Executes dropped EXE
PID:5016 -
\??\c:\jppdj.exec:\jppdj.exe52⤵
- Executes dropped EXE
PID:1732 -
\??\c:\flfllll.exec:\flfllll.exe53⤵
- Executes dropped EXE
PID:4532 -
\??\c:\1xlllxl.exec:\1xlllxl.exe54⤵
- Executes dropped EXE
PID:3380 -
\??\c:\hbbbtn.exec:\hbbbtn.exe55⤵
- Executes dropped EXE
PID:3840 -
\??\c:\pdpjd.exec:\pdpjd.exe56⤵
- Executes dropped EXE
PID:2772 -
\??\c:\flxfrxl.exec:\flxfrxl.exe57⤵
- Executes dropped EXE
PID:4932 -
\??\c:\tnhbtn.exec:\tnhbtn.exe58⤵
- Executes dropped EXE
PID:4292 -
\??\c:\pjjvd.exec:\pjjvd.exe59⤵
- Executes dropped EXE
PID:3988 -
\??\c:\lfllxll.exec:\lfllxll.exe60⤵
- Executes dropped EXE
PID:856 -
\??\c:\rflrrrl.exec:\rflrrrl.exe61⤵
- Executes dropped EXE
PID:4816 -
\??\c:\tbhbbb.exec:\tbhbbb.exe62⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vvpjd.exec:\vvpjd.exe63⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xxrxfll.exec:\xxrxfll.exe64⤵
- Executes dropped EXE
PID:4228 -
\??\c:\tthbbb.exec:\tthbbb.exe65⤵
- Executes dropped EXE
PID:4492 -
\??\c:\3nnhbb.exec:\3nnhbb.exe66⤵PID:624
-
\??\c:\pjjjv.exec:\pjjjv.exe67⤵PID:1328
-
\??\c:\lxlffxr.exec:\lxlffxr.exe68⤵PID:2800
-
\??\c:\frxrllx.exec:\frxrllx.exe69⤵PID:2640
-
\??\c:\hthtbn.exec:\hthtbn.exe70⤵PID:3996
-
\??\c:\9pddv.exec:\9pddv.exe71⤵PID:4120
-
\??\c:\jdjvd.exec:\jdjvd.exe72⤵PID:2204
-
\??\c:\frfrlfx.exec:\frfrlfx.exe73⤵PID:3948
-
\??\c:\btnnnn.exec:\btnnnn.exe74⤵PID:3276
-
\??\c:\vjppv.exec:\vjppv.exe75⤵PID:4940
-
\??\c:\3jvdv.exec:\3jvdv.exe76⤵
- System Location Discovery: System Language Discovery
PID:1000 -
\??\c:\rllxrlf.exec:\rllxrlf.exe77⤵PID:1664
-
\??\c:\httnnh.exec:\httnnh.exe78⤵PID:2536
-
\??\c:\5hnnnn.exec:\5hnnnn.exe79⤵PID:3016
-
\??\c:\ppvpj.exec:\ppvpj.exe80⤵PID:3444
-
\??\c:\3jpjd.exec:\3jpjd.exe81⤵PID:4664
-
\??\c:\rfllfxr.exec:\rfllfxr.exe82⤵PID:768
-
\??\c:\nbnttn.exec:\nbnttn.exe83⤵PID:5112
-
\??\c:\tntnhb.exec:\tntnhb.exe84⤵PID:4672
-
\??\c:\jvvpp.exec:\jvvpp.exe85⤵PID:1544
-
\??\c:\xlrxllx.exec:\xlrxllx.exe86⤵PID:3020
-
\??\c:\lfxrfxx.exec:\lfxrfxx.exe87⤵PID:3148
-
\??\c:\7thhbb.exec:\7thhbb.exe88⤵PID:2960
-
\??\c:\pdjdp.exec:\pdjdp.exe89⤵PID:4808
-
\??\c:\vjjdp.exec:\vjjdp.exe90⤵PID:1308
-
\??\c:\xrffllf.exec:\xrffllf.exe91⤵PID:4828
-
\??\c:\5btnnh.exec:\5btnnh.exe92⤵PID:4316
-
\??\c:\vjjjd.exec:\vjjjd.exe93⤵PID:3892
-
\??\c:\jpdpv.exec:\jpdpv.exe94⤵PID:4140
-
\??\c:\frxrfxr.exec:\frxrfxr.exe95⤵PID:1924
-
\??\c:\lrrfrxr.exec:\lrrfrxr.exe96⤵PID:1400
-
\??\c:\tnbbtn.exec:\tnbbtn.exe97⤵PID:4884
-
\??\c:\jppvj.exec:\jppvj.exe98⤵PID:4928
-
\??\c:\pvjjj.exec:\pvjjj.exe99⤵PID:4084
-
\??\c:\xlrlllf.exec:\xlrlllf.exe100⤵PID:3956
-
\??\c:\dppjj.exec:\dppjj.exe101⤵PID:2752
-
\??\c:\7lrlffx.exec:\7lrlffx.exe102⤵PID:3528
-
\??\c:\lflrrxx.exec:\lflrrxx.exe103⤵PID:2964
-
\??\c:\9bhhtn.exec:\9bhhtn.exe104⤵PID:3828
-
\??\c:\hbbhhb.exec:\hbbhhb.exe105⤵PID:2364
-
\??\c:\pjdjd.exec:\pjdjd.exe106⤵PID:5060
-
\??\c:\rrxrlxr.exec:\rrxrlxr.exe107⤵PID:224
-
\??\c:\rrllrxf.exec:\rrllrxf.exe108⤵PID:5012
-
\??\c:\7nbbbn.exec:\7nbbbn.exe109⤵PID:5000
-
\??\c:\pvvpj.exec:\pvvpj.exe110⤵PID:3508
-
\??\c:\jvdvj.exec:\jvdvj.exe111⤵PID:3932
-
\??\c:\fxrlffx.exec:\fxrlffx.exe112⤵PID:3252
-
\??\c:\fxfxffx.exec:\fxfxffx.exe113⤵PID:2608
-
\??\c:\ttntbn.exec:\ttntbn.exe114⤵PID:3472
-
\??\c:\nnnhnb.exec:\nnnhnb.exe115⤵PID:3684
-
\??\c:\3djdd.exec:\3djdd.exe116⤵PID:3616
-
\??\c:\rxxfxfl.exec:\rxxfxfl.exe117⤵PID:548
-
\??\c:\5rffxxf.exec:\5rffxxf.exe118⤵PID:4488
-
\??\c:\nththb.exec:\nththb.exe119⤵PID:5024
-
\??\c:\ntbtnn.exec:\ntbtnn.exe120⤵PID:4444
-
\??\c:\ppdvv.exec:\ppdvv.exe121⤵PID:696
-
\??\c:\lxlfrxx.exec:\lxlfrxx.exe122⤵PID:1168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-