Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 04:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16661edacddb4bfb6aa5bd10301c5580N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
16661edacddb4bfb6aa5bd10301c5580N.exe
-
Size
64KB
-
MD5
16661edacddb4bfb6aa5bd10301c5580
-
SHA1
6f72cf2f5c1d9ad7ddbce3cdd55392c9e0429d30
-
SHA256
3f04d082c1b822186b37e1340d22184c6099c8e3976ae482b17b1a162403b347
-
SHA512
5272114d42411e8cdb3558d2ec0d1bb7675d8ccc6632d5962d4f0a9707e4a4d152f997a85608606251a20d40c7a306598256987f47ea9bbd216e8f3e4bbe3090
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxiX:ymb3NkkiQ3mdBjF0y7kbA
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3220-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1308-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 5ntnnn.exe 4996 vdjjd.exe 956 xlrrrrl.exe 3376 thnnnb.exe 3352 5ntnhb.exe 3200 pvjpj.exe 3156 lxrlfrl.exe 3520 xflfxfx.exe 3128 thbbtt.exe 4240 pjjjd.exe 3676 lfxflxx.exe 1928 thnbth.exe 2328 btnntt.exe 1496 jdvjd.exe 4536 fllfxxr.exe 3592 xrfxrxr.exe 2440 btbbbb.exe 3532 dddvp.exe 1464 rxlxrrr.exe 1036 htnnnn.exe 4084 bbttnn.exe 2076 thhnhh.exe 4200 jvdpj.exe 1308 frlflfl.exe 1228 flrrllf.exe 4128 xfrllll.exe 1092 hntbht.exe 4012 vddvv.exe 1436 jddvd.exe 2348 flxrffr.exe 2964 lxlffxx.exe 1192 hbnhnn.exe 4292 nhttnn.exe 4868 vpvjd.exe 2692 dvpjj.exe 1452 lrxflff.exe 4284 lfxrfxl.exe 664 tbbnht.exe 652 tnbthb.exe 2224 vpjvd.exe 3780 jjddd.exe 3704 rlrlrlr.exe 2400 xxrfxrf.exe 2260 nnbtnh.exe 1244 vpvpp.exe 2592 vjvvv.exe 2092 lxxrxxx.exe 2152 rxfffff.exe 1968 xxfxxrl.exe 4496 nbhbbb.exe 748 pjvvd.exe 3100 dvvvj.exe 4904 fffflxx.exe 1568 lllllll.exe 4228 tnhtnb.exe 3676 hhtnhh.exe 4752 5jjdd.exe 2136 dddvp.exe 1108 xxxxrxx.exe 1496 lxflfff.exe 4032 nbnhbt.exe 2472 tnhbtn.exe 2732 dvvvj.exe 1188 ppvdd.exe -
resource yara_rule behavioral2/memory/3220-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3532-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1308-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-187-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 2224 3220 16661edacddb4bfb6aa5bd10301c5580N.exe 83 PID 3220 wrote to memory of 2224 3220 16661edacddb4bfb6aa5bd10301c5580N.exe 83 PID 3220 wrote to memory of 2224 3220 16661edacddb4bfb6aa5bd10301c5580N.exe 83 PID 2224 wrote to memory of 4996 2224 5ntnnn.exe 84 PID 2224 wrote to memory of 4996 2224 5ntnnn.exe 84 PID 2224 wrote to memory of 4996 2224 5ntnnn.exe 84 PID 4996 wrote to memory of 956 4996 vdjjd.exe 85 PID 4996 wrote to memory of 956 4996 vdjjd.exe 85 PID 4996 wrote to memory of 956 4996 vdjjd.exe 85 PID 956 wrote to memory of 3376 956 xlrrrrl.exe 86 PID 956 wrote to memory of 3376 956 xlrrrrl.exe 86 PID 956 wrote to memory of 3376 956 xlrrrrl.exe 86 PID 3376 wrote to memory of 3352 3376 thnnnb.exe 87 PID 3376 wrote to memory of 3352 3376 thnnnb.exe 87 PID 3376 wrote to memory of 3352 3376 thnnnb.exe 87 PID 3352 wrote to memory of 3200 3352 5ntnhb.exe 89 PID 3352 wrote to memory of 3200 3352 5ntnhb.exe 89 PID 3352 wrote to memory of 3200 3352 5ntnhb.exe 89 PID 3200 wrote to memory of 3156 3200 pvjpj.exe 90 PID 3200 wrote to memory of 3156 3200 pvjpj.exe 90 PID 3200 wrote to memory of 3156 3200 pvjpj.exe 90 PID 3156 wrote to memory of 3520 3156 lxrlfrl.exe 91 PID 3156 wrote to memory of 3520 3156 lxrlfrl.exe 91 PID 3156 wrote to memory of 3520 3156 lxrlfrl.exe 91 PID 3520 wrote to memory of 3128 3520 xflfxfx.exe 92 PID 3520 wrote to memory of 3128 3520 xflfxfx.exe 92 PID 3520 wrote to memory of 3128 3520 xflfxfx.exe 92 PID 3128 wrote to memory of 4240 3128 thbbtt.exe 93 PID 3128 wrote to memory of 4240 3128 thbbtt.exe 93 PID 3128 wrote to memory of 4240 3128 thbbtt.exe 93 PID 4240 wrote to memory of 3676 4240 pjjjd.exe 94 PID 4240 wrote to memory of 3676 4240 pjjjd.exe 94 PID 4240 wrote to memory of 3676 4240 pjjjd.exe 94 PID 3676 wrote to memory of 1928 3676 lfxflxx.exe 95 PID 3676 wrote to memory of 1928 3676 lfxflxx.exe 95 PID 3676 wrote to memory of 1928 3676 lfxflxx.exe 95 PID 1928 wrote to memory of 2328 1928 thnbth.exe 97 PID 1928 wrote to memory of 2328 1928 thnbth.exe 97 PID 1928 wrote to memory of 2328 1928 thnbth.exe 97 PID 2328 wrote to memory of 1496 2328 btnntt.exe 98 PID 2328 wrote to memory of 1496 2328 btnntt.exe 98 PID 2328 wrote to memory of 1496 2328 btnntt.exe 98 PID 1496 wrote to memory of 4536 1496 jdvjd.exe 99 PID 1496 wrote to memory of 4536 1496 jdvjd.exe 99 PID 1496 wrote to memory of 4536 1496 jdvjd.exe 99 PID 4536 wrote to memory of 3592 4536 fllfxxr.exe 100 PID 4536 wrote to memory of 3592 4536 fllfxxr.exe 100 PID 4536 wrote to memory of 3592 4536 fllfxxr.exe 100 PID 3592 wrote to memory of 2440 3592 xrfxrxr.exe 101 PID 3592 wrote to memory of 2440 3592 xrfxrxr.exe 101 PID 3592 wrote to memory of 2440 3592 xrfxrxr.exe 101 PID 2440 wrote to memory of 3532 2440 btbbbb.exe 102 PID 2440 wrote to memory of 3532 2440 btbbbb.exe 102 PID 2440 wrote to memory of 3532 2440 btbbbb.exe 102 PID 3532 wrote to memory of 1464 3532 dddvp.exe 103 PID 3532 wrote to memory of 1464 3532 dddvp.exe 103 PID 3532 wrote to memory of 1464 3532 dddvp.exe 103 PID 1464 wrote to memory of 1036 1464 rxlxrrr.exe 105 PID 1464 wrote to memory of 1036 1464 rxlxrrr.exe 105 PID 1464 wrote to memory of 1036 1464 rxlxrrr.exe 105 PID 1036 wrote to memory of 4084 1036 htnnnn.exe 106 PID 1036 wrote to memory of 4084 1036 htnnnn.exe 106 PID 1036 wrote to memory of 4084 1036 htnnnn.exe 106 PID 4084 wrote to memory of 2076 4084 bbttnn.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\16661edacddb4bfb6aa5bd10301c5580N.exe"C:\Users\Admin\AppData\Local\Temp\16661edacddb4bfb6aa5bd10301c5580N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\5ntnnn.exec:\5ntnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vdjjd.exec:\vdjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:956 -
\??\c:\thnnnb.exec:\thnnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\5ntnhb.exec:\5ntnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\pvjpj.exec:\pvjpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\lxrlfrl.exec:\lxrlfrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\xflfxfx.exec:\xflfxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\thbbtt.exec:\thbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\pjjjd.exec:\pjjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\lfxflxx.exec:\lfxflxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\thnbth.exec:\thnbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\btnntt.exec:\btnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\jdvjd.exec:\jdvjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\fllfxxr.exec:\fllfxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\xrfxrxr.exec:\xrfxrxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\btbbbb.exec:\btbbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\dddvp.exec:\dddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\rxlxrrr.exec:\rxlxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\htnnnn.exec:\htnnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\bbttnn.exec:\bbttnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\thhnhh.exec:\thhnhh.exe23⤵
- Executes dropped EXE
PID:2076 -
\??\c:\jvdpj.exec:\jvdpj.exe24⤵
- Executes dropped EXE
PID:4200 -
\??\c:\frlflfl.exec:\frlflfl.exe25⤵
- Executes dropped EXE
PID:1308 -
\??\c:\flrrllf.exec:\flrrllf.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1228 -
\??\c:\xfrllll.exec:\xfrllll.exe27⤵
- Executes dropped EXE
PID:4128 -
\??\c:\hntbht.exec:\hntbht.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vddvv.exec:\vddvv.exe29⤵
- Executes dropped EXE
PID:4012 -
\??\c:\jddvd.exec:\jddvd.exe30⤵
- Executes dropped EXE
PID:1436 -
\??\c:\flxrffr.exec:\flxrffr.exe31⤵
- Executes dropped EXE
PID:2348 -
\??\c:\lxlffxx.exec:\lxlffxx.exe32⤵
- Executes dropped EXE
PID:2964 -
\??\c:\hbnhnn.exec:\hbnhnn.exe33⤵
- Executes dropped EXE
PID:1192 -
\??\c:\nhttnn.exec:\nhttnn.exe34⤵
- Executes dropped EXE
PID:4292 -
\??\c:\vpvjd.exec:\vpvjd.exe35⤵
- Executes dropped EXE
PID:4868 -
\??\c:\dvpjj.exec:\dvpjj.exe36⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lrxflff.exec:\lrxflff.exe37⤵
- Executes dropped EXE
PID:1452 -
\??\c:\lfxrfxl.exec:\lfxrfxl.exe38⤵
- Executes dropped EXE
PID:4284 -
\??\c:\tbbnht.exec:\tbbnht.exe39⤵
- Executes dropped EXE
PID:664 -
\??\c:\tnbthb.exec:\tnbthb.exe40⤵
- Executes dropped EXE
PID:652 -
\??\c:\vpjvd.exec:\vpjvd.exe41⤵
- Executes dropped EXE
PID:2224 -
\??\c:\jjddd.exec:\jjddd.exe42⤵
- Executes dropped EXE
PID:3780 -
\??\c:\rlrlrlr.exec:\rlrlrlr.exe43⤵
- Executes dropped EXE
PID:3704 -
\??\c:\xxrfxrf.exec:\xxrfxrf.exe44⤵
- Executes dropped EXE
PID:2400 -
\??\c:\nnbtnh.exec:\nnbtnh.exe45⤵
- Executes dropped EXE
PID:2260 -
\??\c:\vpvpp.exec:\vpvpp.exe46⤵
- Executes dropped EXE
PID:1244 -
\??\c:\vjvvv.exec:\vjvvv.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\lxxrxxx.exec:\lxxrxxx.exe48⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxfffff.exec:\rxfffff.exe49⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xxfxxrl.exec:\xxfxxrl.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbhbbb.exec:\nbhbbb.exe51⤵
- Executes dropped EXE
PID:4496 -
\??\c:\pjvvd.exec:\pjvvd.exe52⤵
- Executes dropped EXE
PID:748 -
\??\c:\dvvvj.exec:\dvvvj.exe53⤵
- Executes dropped EXE
PID:3100 -
\??\c:\fffflxx.exec:\fffflxx.exe54⤵
- Executes dropped EXE
PID:4904 -
\??\c:\lllllll.exec:\lllllll.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\tnhtnb.exec:\tnhtnb.exe56⤵
- Executes dropped EXE
PID:4228 -
\??\c:\hhtnhh.exec:\hhtnhh.exe57⤵
- Executes dropped EXE
PID:3676 -
\??\c:\5jjdd.exec:\5jjdd.exe58⤵
- Executes dropped EXE
PID:4752 -
\??\c:\dddvp.exec:\dddvp.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xxxxrxx.exec:\xxxxrxx.exe60⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lxflfff.exec:\lxflfff.exe61⤵
- Executes dropped EXE
PID:1496 -
\??\c:\nbnhbt.exec:\nbnhbt.exe62⤵
- Executes dropped EXE
PID:4032 -
\??\c:\tnhbtn.exec:\tnhbtn.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dvvvj.exec:\dvvvj.exe64⤵
- Executes dropped EXE
PID:2732 -
\??\c:\ppvdd.exec:\ppvdd.exe65⤵
- Executes dropped EXE
PID:1188 -
\??\c:\rxlffxr.exec:\rxlffxr.exe66⤵PID:3740
-
\??\c:\3frlrrx.exec:\3frlrrx.exe67⤵PID:1096
-
\??\c:\nbbtnn.exec:\nbbtnn.exe68⤵PID:4492
-
\??\c:\ddjjv.exec:\ddjjv.exe69⤵PID:4780
-
\??\c:\djdpd.exec:\djdpd.exe70⤵PID:1652
-
\??\c:\lxrfllf.exec:\lxrfllf.exe71⤵PID:2596
-
\??\c:\hnnhbn.exec:\hnnhbn.exe72⤵PID:2452
-
\??\c:\bhhthh.exec:\bhhthh.exe73⤵PID:3136
-
\??\c:\pjdjv.exec:\pjdjv.exe74⤵PID:2212
-
\??\c:\pvdpd.exec:\pvdpd.exe75⤵PID:1908
-
\??\c:\flfrfxr.exec:\flfrfxr.exe76⤵PID:4200
-
\??\c:\bhbtht.exec:\bhbtht.exe77⤵
- System Location Discovery: System Language Discovery
PID:1308 -
\??\c:\hnhnbt.exec:\hnhnbt.exe78⤵PID:4788
-
\??\c:\pvdvj.exec:\pvdvj.exe79⤵PID:1104
-
\??\c:\jvdvj.exec:\jvdvj.exe80⤵PID:4828
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe81⤵PID:3148
-
\??\c:\bhnnhh.exec:\bhnnhh.exe82⤵PID:4176
-
\??\c:\nbhbtn.exec:\nbhbtn.exe83⤵PID:2280
-
\??\c:\ttbnbt.exec:\ttbnbt.exe84⤵PID:3892
-
\??\c:\dpvjd.exec:\dpvjd.exe85⤵PID:1964
-
\??\c:\lxxfrlf.exec:\lxxfrlf.exe86⤵PID:4756
-
\??\c:\1rrlxrl.exec:\1rrlxrl.exe87⤵PID:1192
-
\??\c:\btnthb.exec:\btnthb.exe88⤵
- System Location Discovery: System Language Discovery
PID:556 -
\??\c:\bbhbnb.exec:\bbhbnb.exe89⤵PID:5080
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:4824
-
\??\c:\jvvjp.exec:\jvvjp.exe91⤵PID:4352
-
\??\c:\3xxlfxr.exec:\3xxlfxr.exe92⤵PID:4384
-
\??\c:\jjjdp.exec:\jjjdp.exe93⤵PID:952
-
\??\c:\vpdpd.exec:\vpdpd.exe94⤵PID:1688
-
\??\c:\lrlxfxl.exec:\lrlxfxl.exe95⤵PID:3504
-
\??\c:\nbnhth.exec:\nbnhth.exe96⤵PID:3604
-
\??\c:\btnhbt.exec:\btnhbt.exe97⤵PID:3704
-
\??\c:\pvdvj.exec:\pvdvj.exe98⤵PID:3988
-
\??\c:\dddvj.exec:\dddvj.exe99⤵
- System Location Discovery: System Language Discovery
PID:1840 -
\??\c:\xxrflfx.exec:\xxrflfx.exe100⤵PID:2360
-
\??\c:\frxlfxr.exec:\frxlfxr.exe101⤵PID:3204
-
\??\c:\nbbnbt.exec:\nbbnbt.exe102⤵
- System Location Discovery: System Language Discovery
PID:3788 -
\??\c:\hnhtnh.exec:\hnhtnh.exe103⤵PID:3064
-
\??\c:\jvdpj.exec:\jvdpj.exe104⤵PID:3772
-
\??\c:\jddvv.exec:\jddvv.exe105⤵PID:2088
-
\??\c:\xlrfrrf.exec:\xlrfrrf.exe106⤵PID:3520
-
\??\c:\fxxlfrf.exec:\fxxlfrf.exe107⤵PID:208
-
\??\c:\bbbnth.exec:\bbbnth.exe108⤵PID:2648
-
\??\c:\bnnhtn.exec:\bnnhtn.exe109⤵PID:3656
-
\??\c:\pvdpd.exec:\pvdpd.exe110⤵PID:1724
-
\??\c:\3jdvd.exec:\3jdvd.exe111⤵PID:3900
-
\??\c:\rlfrfxr.exec:\rlfrfxr.exe112⤵PID:1324
-
\??\c:\9rrlfxl.exec:\9rrlfxl.exe113⤵PID:4816
-
\??\c:\nttnhb.exec:\nttnhb.exe114⤵PID:2560
-
\??\c:\htbnbt.exec:\htbnbt.exe115⤵PID:4020
-
\??\c:\vppjd.exec:\vppjd.exe116⤵PID:2392
-
\??\c:\rxlxlfx.exec:\rxlxlfx.exe117⤵PID:2584
-
\??\c:\lxlxxrx.exec:\lxlxxrx.exe118⤵PID:744
-
\??\c:\hhhbnh.exec:\hhhbnh.exe119⤵PID:1320
-
\??\c:\bntnhh.exec:\bntnhh.exe120⤵PID:4332
-
\??\c:\pvjvp.exec:\pvjvp.exe121⤵PID:2012
-
\??\c:\7ppvd.exec:\7ppvd.exe122⤵PID:4808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-