Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 08:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6f5c589d3adacd26919bac7eaf987540N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
6f5c589d3adacd26919bac7eaf987540N.exe
-
Size
589KB
-
MD5
6f5c589d3adacd26919bac7eaf987540
-
SHA1
2d580faca35e9e88b3075a5cb85ffc08e1b58634
-
SHA256
9d4ab1dc9029542ab5b7d6447f63c9a5023ff260a23f89ed608d172a4d653888
-
SHA512
a1144bdfb826c9a4e3533c513824f90c6d682233609d6eca3e4ac276b38b604c92a8fc5f32c6be38ee2c8d6da9dcd95bc2101d47888b68d5df223721f08684f3
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayu:n3C9Lebz+xt4vFeFmgayu
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4672-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3604 xlxrlrl.exe 1448 ntbtnn.exe 1092 7dvpp.exe 2012 3frfxrr.exe 2604 rxllrxf.exe 2968 3vpjj.exe 3852 jjvpv.exe 1660 frlfxxl.exe 4816 nnnhbb.exe 3224 vvpjd.exe 1992 tnnhhn.exe 4368 5pdjd.exe 1364 jjdvv.exe 2324 9tntnt.exe 1184 jvppj.exe 2608 xlrrlff.exe 4972 5fxrrrr.exe 5116 tnnhbt.exe 2464 djjdp.exe 2944 lllffff.exe 4348 tbbtnn.exe 2664 1dppp.exe 4160 lffffff.exe 3700 5lxrxrx.exe 864 bntthh.exe 2612 vdjdd.exe 1740 lfxrllf.exe 1568 1lxrrrr.exe 3172 3nnhnn.exe 2360 vjpjd.exe 3232 5xffffx.exe 4352 xrlrrll.exe 1944 nbnhtt.exe 4332 pjvpv.exe 2068 xrrfllr.exe 4704 nnhhbb.exe 1448 ffxlffr.exe 2344 3lrlffx.exe 4268 vdvjd.exe 3260 1llxxfx.exe 3524 9nnhhh.exe 5052 bhhhbb.exe 848 dvvjd.exe 4628 5lllllf.exe 4648 dvdvp.exe 1080 lflxrrl.exe 1708 nnnnnn.exe 3852 vpvvv.exe 4896 djvpp.exe 2288 xflxlfr.exe 4624 3tthhn.exe 3676 dpvpv.exe 2836 lrlrrrf.exe 1416 llrlfff.exe 1184 nnnhbb.exe 4528 pvdpj.exe 3100 rflfrrl.exe 2944 1hhhbb.exe 2064 nnbbnb.exe 3144 jdddd.exe 5100 9lfxrfx.exe 2264 bttnnn.exe 3876 dvdvv.exe 3392 1ffxrrl.exe -
resource yara_rule behavioral2/memory/4672-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2360-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lfxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrfrfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrxlrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4672 wrote to memory of 3604 4672 6f5c589d3adacd26919bac7eaf987540N.exe 85 PID 4672 wrote to memory of 3604 4672 6f5c589d3adacd26919bac7eaf987540N.exe 85 PID 4672 wrote to memory of 3604 4672 6f5c589d3adacd26919bac7eaf987540N.exe 85 PID 3604 wrote to memory of 1448 3604 xlxrlrl.exe 86 PID 3604 wrote to memory of 1448 3604 xlxrlrl.exe 86 PID 3604 wrote to memory of 1448 3604 xlxrlrl.exe 86 PID 1448 wrote to memory of 1092 1448 ntbtnn.exe 87 PID 1448 wrote to memory of 1092 1448 ntbtnn.exe 87 PID 1448 wrote to memory of 1092 1448 ntbtnn.exe 87 PID 1092 wrote to memory of 2012 1092 7dvpp.exe 89 PID 1092 wrote to memory of 2012 1092 7dvpp.exe 89 PID 1092 wrote to memory of 2012 1092 7dvpp.exe 89 PID 2012 wrote to memory of 2604 2012 3frfxrr.exe 90 PID 2012 wrote to memory of 2604 2012 3frfxrr.exe 90 PID 2012 wrote to memory of 2604 2012 3frfxrr.exe 90 PID 2604 wrote to memory of 2968 2604 rxllrxf.exe 92 PID 2604 wrote to memory of 2968 2604 rxllrxf.exe 92 PID 2604 wrote to memory of 2968 2604 rxllrxf.exe 92 PID 2968 wrote to memory of 3852 2968 3vpjj.exe 93 PID 2968 wrote to memory of 3852 2968 3vpjj.exe 93 PID 2968 wrote to memory of 3852 2968 3vpjj.exe 93 PID 3852 wrote to memory of 1660 3852 jjvpv.exe 94 PID 3852 wrote to memory of 1660 3852 jjvpv.exe 94 PID 3852 wrote to memory of 1660 3852 jjvpv.exe 94 PID 1660 wrote to memory of 4816 1660 frlfxxl.exe 95 PID 1660 wrote to memory of 4816 1660 frlfxxl.exe 95 PID 1660 wrote to memory of 4816 1660 frlfxxl.exe 95 PID 4816 wrote to memory of 3224 4816 nnnhbb.exe 96 PID 4816 wrote to memory of 3224 4816 nnnhbb.exe 96 PID 4816 wrote to memory of 3224 4816 nnnhbb.exe 96 PID 3224 wrote to memory of 1992 3224 vvpjd.exe 97 PID 3224 wrote to memory of 1992 3224 vvpjd.exe 97 PID 3224 wrote to memory of 1992 3224 vvpjd.exe 97 PID 1992 wrote to memory of 4368 1992 tnnhhn.exe 98 PID 1992 wrote to memory of 4368 1992 tnnhhn.exe 98 PID 1992 wrote to memory of 4368 1992 tnnhhn.exe 98 PID 4368 wrote to memory of 1364 4368 5pdjd.exe 100 PID 4368 wrote to memory of 1364 4368 5pdjd.exe 100 PID 4368 wrote to memory of 1364 4368 5pdjd.exe 100 PID 1364 wrote to memory of 2324 1364 jjdvv.exe 101 PID 1364 wrote to memory of 2324 1364 jjdvv.exe 101 PID 1364 wrote to memory of 2324 1364 jjdvv.exe 101 PID 2324 wrote to memory of 1184 2324 9tntnt.exe 102 PID 2324 wrote to memory of 1184 2324 9tntnt.exe 102 PID 2324 wrote to memory of 1184 2324 9tntnt.exe 102 PID 1184 wrote to memory of 2608 1184 jvppj.exe 103 PID 1184 wrote to memory of 2608 1184 jvppj.exe 103 PID 1184 wrote to memory of 2608 1184 jvppj.exe 103 PID 2608 wrote to memory of 4972 2608 xlrrlff.exe 104 PID 2608 wrote to memory of 4972 2608 xlrrlff.exe 104 PID 2608 wrote to memory of 4972 2608 xlrrlff.exe 104 PID 4972 wrote to memory of 5116 4972 5fxrrrr.exe 105 PID 4972 wrote to memory of 5116 4972 5fxrrrr.exe 105 PID 4972 wrote to memory of 5116 4972 5fxrrrr.exe 105 PID 5116 wrote to memory of 2464 5116 tnnhbt.exe 106 PID 5116 wrote to memory of 2464 5116 tnnhbt.exe 106 PID 5116 wrote to memory of 2464 5116 tnnhbt.exe 106 PID 2464 wrote to memory of 2944 2464 djjdp.exe 107 PID 2464 wrote to memory of 2944 2464 djjdp.exe 107 PID 2464 wrote to memory of 2944 2464 djjdp.exe 107 PID 2944 wrote to memory of 4348 2944 lllffff.exe 108 PID 2944 wrote to memory of 4348 2944 lllffff.exe 108 PID 2944 wrote to memory of 4348 2944 lllffff.exe 108 PID 4348 wrote to memory of 2664 4348 tbbtnn.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f5c589d3adacd26919bac7eaf987540N.exe"C:\Users\Admin\AppData\Local\Temp\6f5c589d3adacd26919bac7eaf987540N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\xlxrlrl.exec:\xlxrlrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ntbtnn.exec:\ntbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\7dvpp.exec:\7dvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\3frfxrr.exec:\3frfxrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\rxllrxf.exec:\rxllrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\3vpjj.exec:\3vpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jjvpv.exec:\jjvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\frlfxxl.exec:\frlfxxl.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\nnnhbb.exec:\nnnhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\vvpjd.exec:\vvpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\tnnhhn.exec:\tnnhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\5pdjd.exec:\5pdjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\jjdvv.exec:\jjdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\9tntnt.exec:\9tntnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\jvppj.exec:\jvppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\xlrrlff.exec:\xlrrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\5fxrrrr.exec:\5fxrrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\tnnhbt.exec:\tnnhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\djjdp.exec:\djjdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\lllffff.exec:\lllffff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\tbbtnn.exec:\tbbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\1dppp.exec:\1dppp.exe23⤵
- Executes dropped EXE
PID:2664 -
\??\c:\lffffff.exec:\lffffff.exe24⤵
- Executes dropped EXE
PID:4160 -
\??\c:\5lxrxrx.exec:\5lxrxrx.exe25⤵
- Executes dropped EXE
PID:3700 -
\??\c:\bntthh.exec:\bntthh.exe26⤵
- Executes dropped EXE
PID:864 -
\??\c:\vdjdd.exec:\vdjdd.exe27⤵
- Executes dropped EXE
PID:2612 -
\??\c:\lfxrllf.exec:\lfxrllf.exe28⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1lxrrrr.exec:\1lxrrrr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1568 -
\??\c:\3nnhnn.exec:\3nnhnn.exe30⤵
- Executes dropped EXE
PID:3172 -
\??\c:\vjpjd.exec:\vjpjd.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\5xffffx.exec:\5xffffx.exe32⤵
- Executes dropped EXE
PID:3232 -
\??\c:\xrlrrll.exec:\xrlrrll.exe33⤵
- Executes dropped EXE
PID:4352 -
\??\c:\nbnhtt.exec:\nbnhtt.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pjvpv.exec:\pjvpv.exe35⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xrrfllr.exec:\xrrfllr.exe36⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nnhhbb.exec:\nnhhbb.exe37⤵
- Executes dropped EXE
PID:4704 -
\??\c:\ffxlffr.exec:\ffxlffr.exe38⤵
- Executes dropped EXE
PID:1448 -
\??\c:\3lrlffx.exec:\3lrlffx.exe39⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vdvjd.exec:\vdvjd.exe40⤵
- Executes dropped EXE
PID:4268 -
\??\c:\1llxxfx.exec:\1llxxfx.exe41⤵
- Executes dropped EXE
PID:3260 -
\??\c:\9nnhhh.exec:\9nnhhh.exe42⤵
- Executes dropped EXE
PID:3524 -
\??\c:\bhhhbb.exec:\bhhhbb.exe43⤵
- Executes dropped EXE
PID:5052 -
\??\c:\dvvjd.exec:\dvvjd.exe44⤵
- Executes dropped EXE
PID:848 -
\??\c:\5lllllf.exec:\5lllllf.exe45⤵
- Executes dropped EXE
PID:4628 -
\??\c:\dvdvp.exec:\dvdvp.exe46⤵
- Executes dropped EXE
PID:4648 -
\??\c:\lflxrrl.exec:\lflxrrl.exe47⤵
- Executes dropped EXE
PID:1080 -
\??\c:\nnnnnn.exec:\nnnnnn.exe48⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vpvvv.exec:\vpvvv.exe49⤵
- Executes dropped EXE
PID:3852 -
\??\c:\djvpp.exec:\djvpp.exe50⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xflxlfr.exec:\xflxlfr.exe51⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3tthhn.exec:\3tthhn.exe52⤵
- Executes dropped EXE
PID:4624 -
\??\c:\dpvpv.exec:\dpvpv.exe53⤵
- Executes dropped EXE
PID:3676 -
\??\c:\lrlrrrf.exec:\lrlrrrf.exe54⤵
- Executes dropped EXE
PID:2836 -
\??\c:\llrlfff.exec:\llrlfff.exe55⤵
- Executes dropped EXE
PID:1416 -
\??\c:\nnnhbb.exec:\nnnhbb.exe56⤵
- Executes dropped EXE
PID:1184 -
\??\c:\pvdpj.exec:\pvdpj.exe57⤵
- Executes dropped EXE
PID:4528 -
\??\c:\rflfrrl.exec:\rflfrrl.exe58⤵
- Executes dropped EXE
PID:3100 -
\??\c:\1hhhbb.exec:\1hhhbb.exe59⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nnbbnb.exec:\nnbbnb.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\jdddd.exec:\jdddd.exe61⤵
- Executes dropped EXE
PID:3144 -
\??\c:\9lfxrfx.exec:\9lfxrfx.exe62⤵
- Executes dropped EXE
PID:5100 -
\??\c:\bttnnn.exec:\bttnnn.exe63⤵
- Executes dropped EXE
PID:2264 -
\??\c:\dvdvv.exec:\dvdvv.exe64⤵
- Executes dropped EXE
PID:3876 -
\??\c:\1ffxrrl.exec:\1ffxrrl.exe65⤵
- Executes dropped EXE
PID:3392 -
\??\c:\bnnnnn.exec:\bnnnnn.exe66⤵PID:2960
-
\??\c:\vvdvp.exec:\vvdvp.exe67⤵PID:2880
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe68⤵PID:4480
-
\??\c:\7ttnhh.exec:\7ttnhh.exe69⤵PID:4952
-
\??\c:\vddjj.exec:\vddjj.exe70⤵PID:3592
-
\??\c:\flfxlfr.exec:\flfxlfr.exe71⤵PID:680
-
\??\c:\nhnhtt.exec:\nhnhtt.exe72⤵PID:2644
-
\??\c:\dddvj.exec:\dddvj.exe73⤵PID:388
-
\??\c:\3jjdv.exec:\3jjdv.exe74⤵PID:3232
-
\??\c:\xxrrlll.exec:\xxrrlll.exe75⤵PID:4760
-
\??\c:\bbtnht.exec:\bbtnht.exe76⤵PID:4440
-
\??\c:\dvdjj.exec:\dvdjj.exe77⤵PID:1792
-
\??\c:\pjvpv.exec:\pjvpv.exe78⤵PID:3296
-
\??\c:\7rfxrfx.exec:\7rfxrfx.exe79⤵PID:4420
-
\??\c:\3nthtt.exec:\3nthtt.exe80⤵PID:3164
-
\??\c:\5vpjd.exec:\5vpjd.exe81⤵PID:456
-
\??\c:\xlxxllf.exec:\xlxxllf.exe82⤵PID:2012
-
\??\c:\rlfrlrl.exec:\rlfrlrl.exe83⤵PID:2672
-
\??\c:\thbbtt.exec:\thbbtt.exe84⤵PID:2660
-
\??\c:\ppvvp.exec:\ppvvp.exe85⤵PID:2604
-
\??\c:\fffxrxx.exec:\fffxrxx.exe86⤵PID:4928
-
\??\c:\3ttnhb.exec:\3ttnhb.exe87⤵PID:1088
-
\??\c:\jdvvp.exec:\jdvvp.exe88⤵PID:1856
-
\??\c:\7jvvd.exec:\7jvvd.exe89⤵PID:4292
-
\??\c:\frxfffx.exec:\frxfffx.exe90⤵PID:440
-
\??\c:\bhhbtn.exec:\bhhbtn.exe91⤵PID:852
-
\??\c:\pvdpp.exec:\pvdpp.exe92⤵PID:2696
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe93⤵PID:4996
-
\??\c:\tbhbtt.exec:\tbhbtt.exe94⤵PID:2184
-
\??\c:\vjjdv.exec:\vjjdv.exe95⤵PID:3916
-
\??\c:\1djvp.exec:\1djvp.exe96⤵PID:368
-
\??\c:\fxlfllr.exec:\fxlfllr.exe97⤵PID:4196
-
\??\c:\5nbtnt.exec:\5nbtnt.exe98⤵PID:1580
-
\??\c:\vddvj.exec:\vddvj.exe99⤵PID:1788
-
\??\c:\rrfxxrr.exec:\rrfxxrr.exe100⤵PID:2464
-
\??\c:\tbtthb.exec:\tbtthb.exe101⤵PID:2944
-
\??\c:\vppdv.exec:\vppdv.exe102⤵PID:2064
-
\??\c:\xflfrrl.exec:\xflfrrl.exe103⤵PID:4508
-
\??\c:\hhhhtt.exec:\hhhhtt.exe104⤵PID:5108
-
\??\c:\jjpdp.exec:\jjpdp.exe105⤵PID:1176
-
\??\c:\xxfrxrx.exec:\xxfrxrx.exe106⤵PID:3876
-
\??\c:\thhtnt.exec:\thhtnt.exe107⤵PID:2500
-
\??\c:\ddvjd.exec:\ddvjd.exe108⤵PID:5072
-
\??\c:\xlfxxxr.exec:\xlfxxxr.exe109⤵PID:2848
-
\??\c:\7bbtnn.exec:\7bbtnn.exe110⤵PID:3236
-
\??\c:\tnhbbb.exec:\tnhbbb.exe111⤵PID:532
-
\??\c:\djjdv.exec:\djjdv.exe112⤵PID:2420
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe113⤵PID:4240
-
\??\c:\hnbttt.exec:\hnbttt.exe114⤵PID:4340
-
\??\c:\jddvp.exec:\jddvp.exe115⤵PID:3016
-
\??\c:\xlxxrff.exec:\xlxxrff.exe116⤵PID:1476
-
\??\c:\flrffxx.exec:\flrffxx.exe117⤵PID:2340
-
\??\c:\btttnn.exec:\btttnn.exe118⤵PID:1848
-
\??\c:\pdjdv.exec:\pdjdv.exe119⤵PID:1576
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe120⤵PID:3956
-
\??\c:\bnnnhh.exec:\bnnnhh.exe121⤵PID:4704
-
\??\c:\jddvd.exec:\jddvd.exe122⤵PID:1092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-