Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 00:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe
-
Size
64KB
-
MD5
9a668fa652ac1a713627c30cd3138ee8
-
SHA1
b523013488088104ad80804151f2257279ea20f3
-
SHA256
9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88
-
SHA512
554bcab275a338d5d4d4d1c541a95ca2457c4ceaca4ee38e26d6d1966674d09c0b9e6d9ad1b8f2baec472faca69253be4ad94792dc3ccc2c48fa5c9f90d88230
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B1N:ymb3NkkiQ3mdBjFI9cz
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2836-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1920 fllffff.exe 4444 1thbbh.exe 2660 9hntnh.exe 2312 jdppj.exe 4652 hbhhbb.exe 2264 dpvvp.exe 3208 9bbtnn.exe 4020 bnnnhh.exe 1520 jvpjd.exe 2324 rffflrf.exe 4984 hbbbtb.exe 3352 djjjp.exe 1588 lrrxrrx.exe 1656 5xxlrxl.exe 3532 btbhhn.exe 4364 pjddv.exe 2160 9lrfrlr.exe 4952 tntttb.exe 4676 hbbtnn.exe 4808 9jvvj.exe 2024 rllfxxx.exe 2912 fffxffl.exe 1016 9ttttt.exe 4752 pjdjv.exe 916 frlxrlx.exe 4112 fxxxrrl.exe 4896 djddv.exe 1624 rfrrxfl.exe 2888 tnttnt.exe 648 tnnhnh.exe 1796 jjjjp.exe 4340 lfrlfff.exe 1220 ffrrlll.exe 1668 hhhhhh.exe 3552 9ttntn.exe 4836 vjvdv.exe 3512 9llfrlf.exe 1052 rxxffxf.exe 456 bnhbbb.exe 1064 hbnntt.exe 208 7vpjj.exe 3424 jjpjd.exe 2624 fxlfxxx.exe 232 rrfxffl.exe 1676 bbhntb.exe 1548 vvpjd.exe 4732 jjvpj.exe 4424 vpjjv.exe 536 xrlffrr.exe 4552 hhhhhh.exe 3080 tthhtt.exe 3536 jpvpd.exe 3224 vjpjd.exe 552 rffxrrl.exe 3780 ttbbhb.exe 1496 jpddv.exe 3124 vvpdv.exe 704 5dvpp.exe 3044 rxllrxr.exe 1408 hbhnnn.exe 2232 bnbbnn.exe 4976 dvjjd.exe 3624 pjjdv.exe 1792 xrrlrrl.exe -
resource yara_rule behavioral2/memory/2836-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flfxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fxrrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbnt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2836 wrote to memory of 1920 2836 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 83 PID 2836 wrote to memory of 1920 2836 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 83 PID 2836 wrote to memory of 1920 2836 9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe 83 PID 1920 wrote to memory of 4444 1920 fllffff.exe 84 PID 1920 wrote to memory of 4444 1920 fllffff.exe 84 PID 1920 wrote to memory of 4444 1920 fllffff.exe 84 PID 4444 wrote to memory of 2660 4444 1thbbh.exe 85 PID 4444 wrote to memory of 2660 4444 1thbbh.exe 85 PID 4444 wrote to memory of 2660 4444 1thbbh.exe 85 PID 2660 wrote to memory of 2312 2660 9hntnh.exe 87 PID 2660 wrote to memory of 2312 2660 9hntnh.exe 87 PID 2660 wrote to memory of 2312 2660 9hntnh.exe 87 PID 2312 wrote to memory of 4652 2312 jdppj.exe 88 PID 2312 wrote to memory of 4652 2312 jdppj.exe 88 PID 2312 wrote to memory of 4652 2312 jdppj.exe 88 PID 4652 wrote to memory of 2264 4652 hbhhbb.exe 89 PID 4652 wrote to memory of 2264 4652 hbhhbb.exe 89 PID 4652 wrote to memory of 2264 4652 hbhhbb.exe 89 PID 2264 wrote to memory of 3208 2264 dpvvp.exe 91 PID 2264 wrote to memory of 3208 2264 dpvvp.exe 91 PID 2264 wrote to memory of 3208 2264 dpvvp.exe 91 PID 3208 wrote to memory of 4020 3208 9bbtnn.exe 92 PID 3208 wrote to memory of 4020 3208 9bbtnn.exe 92 PID 3208 wrote to memory of 4020 3208 9bbtnn.exe 92 PID 4020 wrote to memory of 1520 4020 bnnnhh.exe 93 PID 4020 wrote to memory of 1520 4020 bnnnhh.exe 93 PID 4020 wrote to memory of 1520 4020 bnnnhh.exe 93 PID 1520 wrote to memory of 2324 1520 jvpjd.exe 94 PID 1520 wrote to memory of 2324 1520 jvpjd.exe 94 PID 1520 wrote to memory of 2324 1520 jvpjd.exe 94 PID 2324 wrote to memory of 4984 2324 rffflrf.exe 95 PID 2324 wrote to memory of 4984 2324 rffflrf.exe 95 PID 2324 wrote to memory of 4984 2324 rffflrf.exe 95 PID 4984 wrote to memory of 3352 4984 hbbbtb.exe 96 PID 4984 wrote to memory of 3352 4984 hbbbtb.exe 96 PID 4984 wrote to memory of 3352 4984 hbbbtb.exe 96 PID 3352 wrote to memory of 1588 3352 djjjp.exe 97 PID 3352 wrote to memory of 1588 3352 djjjp.exe 97 PID 3352 wrote to memory of 1588 3352 djjjp.exe 97 PID 1588 wrote to memory of 1656 1588 lrrxrrx.exe 98 PID 1588 wrote to memory of 1656 1588 lrrxrrx.exe 98 PID 1588 wrote to memory of 1656 1588 lrrxrrx.exe 98 PID 1656 wrote to memory of 3532 1656 5xxlrxl.exe 99 PID 1656 wrote to memory of 3532 1656 5xxlrxl.exe 99 PID 1656 wrote to memory of 3532 1656 5xxlrxl.exe 99 PID 3532 wrote to memory of 4364 3532 btbhhn.exe 100 PID 3532 wrote to memory of 4364 3532 btbhhn.exe 100 PID 3532 wrote to memory of 4364 3532 btbhhn.exe 100 PID 4364 wrote to memory of 2160 4364 pjddv.exe 101 PID 4364 wrote to memory of 2160 4364 pjddv.exe 101 PID 4364 wrote to memory of 2160 4364 pjddv.exe 101 PID 2160 wrote to memory of 4952 2160 9lrfrlr.exe 102 PID 2160 wrote to memory of 4952 2160 9lrfrlr.exe 102 PID 2160 wrote to memory of 4952 2160 9lrfrlr.exe 102 PID 4952 wrote to memory of 4676 4952 tntttb.exe 103 PID 4952 wrote to memory of 4676 4952 tntttb.exe 103 PID 4952 wrote to memory of 4676 4952 tntttb.exe 103 PID 4676 wrote to memory of 4808 4676 hbbtnn.exe 104 PID 4676 wrote to memory of 4808 4676 hbbtnn.exe 104 PID 4676 wrote to memory of 4808 4676 hbbtnn.exe 104 PID 4808 wrote to memory of 2024 4808 9jvvj.exe 105 PID 4808 wrote to memory of 2024 4808 9jvvj.exe 105 PID 4808 wrote to memory of 2024 4808 9jvvj.exe 105 PID 2024 wrote to memory of 2912 2024 rllfxxx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe"C:\Users\Admin\AppData\Local\Temp\9e24ad5032d147257f8028ed085d3566259cabddbc49c5233023710be036cb88.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\fllffff.exec:\fllffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\1thbbh.exec:\1thbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\9hntnh.exec:\9hntnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jdppj.exec:\jdppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\hbhhbb.exec:\hbhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\dpvvp.exec:\dpvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\9bbtnn.exec:\9bbtnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\bnnnhh.exec:\bnnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\jvpjd.exec:\jvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rffflrf.exec:\rffflrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\hbbbtb.exec:\hbbbtb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\djjjp.exec:\djjjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\lrrxrrx.exec:\lrrxrrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5xxlrxl.exec:\5xxlrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\btbhhn.exec:\btbhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\pjddv.exec:\pjddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\9lrfrlr.exec:\9lrfrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\tntttb.exec:\tntttb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\hbbtnn.exec:\hbbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\9jvvj.exec:\9jvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\rllfxxx.exec:\rllfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\fffxffl.exec:\fffxffl.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2912 -
\??\c:\9ttttt.exec:\9ttttt.exe24⤵
- Executes dropped EXE
PID:1016 -
\??\c:\pjdjv.exec:\pjdjv.exe25⤵
- Executes dropped EXE
PID:4752 -
\??\c:\frlxrlx.exec:\frlxrlx.exe26⤵
- Executes dropped EXE
PID:916 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe27⤵
- Executes dropped EXE
PID:4112 -
\??\c:\djddv.exec:\djddv.exe28⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rfrrxfl.exec:\rfrrxfl.exe29⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tnttnt.exec:\tnttnt.exe30⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnnhnh.exec:\tnnhnh.exe31⤵
- Executes dropped EXE
PID:648 -
\??\c:\jjjjp.exec:\jjjjp.exe32⤵
- Executes dropped EXE
PID:1796 -
\??\c:\lfrlfff.exec:\lfrlfff.exe33⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ffrrlll.exec:\ffrrlll.exe34⤵
- Executes dropped EXE
PID:1220 -
\??\c:\hhhhhh.exec:\hhhhhh.exe35⤵
- Executes dropped EXE
PID:1668 -
\??\c:\9ttntn.exec:\9ttntn.exe36⤵
- Executes dropped EXE
PID:3552 -
\??\c:\vjvdv.exec:\vjvdv.exe37⤵
- Executes dropped EXE
PID:4836 -
\??\c:\9llfrlf.exec:\9llfrlf.exe38⤵
- Executes dropped EXE
PID:3512 -
\??\c:\rxxffxf.exec:\rxxffxf.exe39⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bnhbbb.exec:\bnhbbb.exe40⤵
- Executes dropped EXE
PID:456 -
\??\c:\hbnntt.exec:\hbnntt.exe41⤵
- Executes dropped EXE
PID:1064 -
\??\c:\7vpjj.exec:\7vpjj.exe42⤵
- Executes dropped EXE
PID:208 -
\??\c:\jjpjd.exec:\jjpjd.exe43⤵
- Executes dropped EXE
PID:3424 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe44⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rrfxffl.exec:\rrfxffl.exe45⤵
- Executes dropped EXE
PID:232 -
\??\c:\bbhntb.exec:\bbhntb.exe46⤵
- Executes dropped EXE
PID:1676 -
\??\c:\vvpjd.exec:\vvpjd.exe47⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjvpj.exec:\jjvpj.exe48⤵
- Executes dropped EXE
PID:4732 -
\??\c:\vpjjv.exec:\vpjjv.exe49⤵
- Executes dropped EXE
PID:4424 -
\??\c:\xrlffrr.exec:\xrlffrr.exe50⤵
- Executes dropped EXE
PID:536 -
\??\c:\hhhhhh.exec:\hhhhhh.exe51⤵
- Executes dropped EXE
PID:4552 -
\??\c:\tthhtt.exec:\tthhtt.exe52⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jpvpd.exec:\jpvpd.exe53⤵
- Executes dropped EXE
PID:3536 -
\??\c:\vjpjd.exec:\vjpjd.exe54⤵
- Executes dropped EXE
PID:3224 -
\??\c:\rffxrrl.exec:\rffxrrl.exe55⤵
- Executes dropped EXE
PID:552 -
\??\c:\ttbbhb.exec:\ttbbhb.exe56⤵
- Executes dropped EXE
PID:3780 -
\??\c:\jpddv.exec:\jpddv.exe57⤵
- Executes dropped EXE
PID:1496 -
\??\c:\vvpdv.exec:\vvpdv.exe58⤵
- Executes dropped EXE
PID:3124 -
\??\c:\5dvpp.exec:\5dvpp.exe59⤵
- Executes dropped EXE
PID:704 -
\??\c:\rxllrxr.exec:\rxllrxr.exe60⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hbhnnn.exec:\hbhnnn.exe61⤵
- Executes dropped EXE
PID:1408 -
\??\c:\bnbbnn.exec:\bnbbnn.exe62⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dvjjd.exec:\dvjjd.exe63⤵
- Executes dropped EXE
PID:4976 -
\??\c:\pjjdv.exec:\pjjdv.exe64⤵
- Executes dropped EXE
PID:3624 -
\??\c:\xrrlrrl.exec:\xrrlrrl.exe65⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xxrflfl.exec:\xxrflfl.exe66⤵PID:4008
-
\??\c:\btnhnn.exec:\btnhnn.exe67⤵PID:4536
-
\??\c:\hthhbb.exec:\hthhbb.exe68⤵
- System Location Discovery: System Language Discovery
PID:4072 -
\??\c:\dvvjd.exec:\dvvjd.exe69⤵PID:3656
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe70⤵PID:4896
-
\??\c:\rffxllf.exec:\rffxllf.exe71⤵PID:1624
-
\??\c:\rllrrrl.exec:\rllrrrl.exe72⤵PID:1460
-
\??\c:\ttbntt.exec:\ttbntt.exe73⤵PID:2928
-
\??\c:\jpdvv.exec:\jpdvv.exe74⤵PID:4376
-
\??\c:\ddjdd.exec:\ddjdd.exe75⤵PID:4356
-
\??\c:\lffxxxx.exec:\lffxxxx.exe76⤵PID:1940
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe77⤵PID:1220
-
\??\c:\5ntnnn.exec:\5ntnnn.exe78⤵PID:1668
-
\??\c:\5dddv.exec:\5dddv.exe79⤵PID:3552
-
\??\c:\fxxrlll.exec:\fxxrlll.exe80⤵PID:2900
-
\??\c:\tbtttt.exec:\tbtttt.exe81⤵PID:3488
-
\??\c:\9httbb.exec:\9httbb.exe82⤵PID:1912
-
\??\c:\pdddd.exec:\pdddd.exe83⤵PID:1660
-
\??\c:\3ddvv.exec:\3ddvv.exe84⤵PID:1956
-
\??\c:\5fxrllf.exec:\5fxrllf.exe85⤵PID:4912
-
\??\c:\rllrrxf.exec:\rllrrxf.exe86⤵PID:1612
-
\??\c:\pdpdj.exec:\pdpdj.exe87⤵PID:3380
-
\??\c:\dpvjp.exec:\dpvjp.exe88⤵PID:3408
-
\??\c:\llrrrrf.exec:\llrrrrf.exe89⤵PID:1880
-
\??\c:\5nhhhh.exec:\5nhhhh.exe90⤵PID:4812
-
\??\c:\3ntnht.exec:\3ntnht.exe91⤵PID:3464
-
\??\c:\dddpp.exec:\dddpp.exe92⤵PID:3352
-
\??\c:\ddppp.exec:\ddppp.exe93⤵PID:2476
-
\??\c:\ffffxff.exec:\ffffxff.exe94⤵PID:1704
-
\??\c:\flrffrr.exec:\flrffrr.exe95⤵PID:2372
-
\??\c:\3nbtnt.exec:\3nbtnt.exe96⤵PID:220
-
\??\c:\5btnbb.exec:\5btnbb.exe97⤵PID:676
-
\??\c:\vpddj.exec:\vpddj.exe98⤵PID:5028
-
\??\c:\jdjjp.exec:\jdjjp.exe99⤵PID:1772
-
\??\c:\frxxxxl.exec:\frxxxxl.exe100⤵PID:4420
-
\??\c:\btbttt.exec:\btbttt.exe101⤵PID:5112
-
\??\c:\hbtntb.exec:\hbtntb.exe102⤵PID:2708
-
\??\c:\5llfxff.exec:\5llfxff.exe103⤵PID:4092
-
\??\c:\fxxlfxl.exec:\fxxlfxl.exe104⤵PID:2940
-
\??\c:\hbnttb.exec:\hbnttb.exe105⤵PID:1408
-
\??\c:\bbnntt.exec:\bbnntt.exe106⤵PID:2564
-
\??\c:\djdvp.exec:\djdvp.exe107⤵PID:2648
-
\??\c:\vjddv.exec:\vjddv.exe108⤵PID:1492
-
\??\c:\rrrrxrl.exec:\rrrrxrl.exe109⤵PID:4968
-
\??\c:\hthbtb.exec:\hthbtb.exe110⤵PID:4216
-
\??\c:\7nttnn.exec:\7nttnn.exe111⤵PID:4436
-
\??\c:\ddvvp.exec:\ddvvp.exe112⤵PID:2868
-
\??\c:\jdvvj.exec:\jdvvj.exe113⤵PID:2224
-
\??\c:\9lxrfll.exec:\9lxrfll.exe114⤵PID:3128
-
\??\c:\ffxrrll.exec:\ffxrrll.exe115⤵PID:2352
-
\??\c:\ttbtnh.exec:\ttbtnh.exe116⤵PID:3312
-
\??\c:\1nnnhh.exec:\1nnnhh.exe117⤵PID:716
-
\??\c:\dvvpj.exec:\dvvpj.exe118⤵PID:1740
-
\??\c:\lfffxxx.exec:\lfffxxx.exe119⤵PID:4748
-
\??\c:\lxlrrrl.exec:\lxlrrrl.exe120⤵PID:3940
-
\??\c:\hhtbbb.exec:\hhtbbb.exe121⤵PID:4560
-
\??\c:\hnhhtt.exec:\hnhhtt.exe122⤵PID:4464
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-