Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 05:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
91c5c53e7ba95541e09eacf9a5905100N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
91c5c53e7ba95541e09eacf9a5905100N.exe
-
Size
249KB
-
MD5
91c5c53e7ba95541e09eacf9a5905100
-
SHA1
18ca6da556a4c199a4aa79b459063bf0b04772d0
-
SHA256
00b804b9e35ac2aec95e9c0674bf609718656660dfc4cca1b9d7981a2922a230
-
SHA512
6483010af4027f26325dfb65c08f385ec43c5d1cd06910e1b06ae45c302b9e03d567522302e122d8703f614cd89594c61bea7e5e5e1d4028e206fbd0b564a3eb
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRliU:n3C9uD6AUDCa4NYmRMU
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4884-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2772-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4984 pdjdd.exe 4368 rxfxxxr.exe 2296 7bhbhn.exe 1104 rfrrlll.exe 3204 dddvp.exe 2724 tbtttt.exe 4280 bbnnhh.exe 4536 jvjdv.exe 2772 xrrrlll.exe 4560 nhbhbn.exe 1436 pvjdd.exe 1468 bhthnn.exe 860 vppjj.exe 1300 dvddv.exe 1476 hbhbht.exe 1424 jddvp.exe 1784 7rllfll.exe 5068 htttnn.exe 2796 ppddv.exe 3908 flxfxxx.exe 4792 hhhbbb.exe 1664 ffxxrrr.exe 3420 lxlfxxr.exe 4964 hbhbbb.exe 4124 vpjdj.exe 4088 frxlffx.exe 4568 9tttnt.exe 4036 vpvpv.exe 2572 llrxxfl.exe 1564 nthttn.exe 4488 djvpj.exe 4796 9bttnt.exe 3508 pjdvp.exe 2444 xflflrr.exe 3484 hbbtnn.exe 964 9nhhbh.exe 3896 5jpjd.exe 3372 lflxfxr.exe 4984 nnnbth.exe 756 jdpjp.exe 2040 vjdjd.exe 976 rlxrxxf.exe 1976 rrxxrxx.exe 868 1bhbnh.exe 4976 1jjdj.exe 2476 3jpjv.exe 4780 xlrlfff.exe 2164 7ttnhb.exe 4380 5hhbtt.exe 1212 pddvp.exe 3676 5fllfrx.exe 1204 lfxxrrl.exe 1236 3nnnnn.exe 4276 djvjd.exe 1608 rxrrfxr.exe 2432 xllfffl.exe 760 xflffxx.exe 860 llffxxx.exe 1300 nnbtbb.exe 228 hhnhbb.exe 1168 jjvpj.exe 1980 lfrrllr.exe 1784 fxfffff.exe 1180 nhbbtt.exe -
resource yara_rule behavioral2/memory/4884-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2772-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbntbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfflll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4884 wrote to memory of 4984 4884 91c5c53e7ba95541e09eacf9a5905100N.exe 84 PID 4884 wrote to memory of 4984 4884 91c5c53e7ba95541e09eacf9a5905100N.exe 84 PID 4884 wrote to memory of 4984 4884 91c5c53e7ba95541e09eacf9a5905100N.exe 84 PID 4984 wrote to memory of 4368 4984 pdjdd.exe 85 PID 4984 wrote to memory of 4368 4984 pdjdd.exe 85 PID 4984 wrote to memory of 4368 4984 pdjdd.exe 85 PID 4368 wrote to memory of 2296 4368 rxfxxxr.exe 87 PID 4368 wrote to memory of 2296 4368 rxfxxxr.exe 87 PID 4368 wrote to memory of 2296 4368 rxfxxxr.exe 87 PID 2296 wrote to memory of 1104 2296 7bhbhn.exe 88 PID 2296 wrote to memory of 1104 2296 7bhbhn.exe 88 PID 2296 wrote to memory of 1104 2296 7bhbhn.exe 88 PID 1104 wrote to memory of 3204 1104 rfrrlll.exe 89 PID 1104 wrote to memory of 3204 1104 rfrrlll.exe 89 PID 1104 wrote to memory of 3204 1104 rfrrlll.exe 89 PID 3204 wrote to memory of 2724 3204 dddvp.exe 91 PID 3204 wrote to memory of 2724 3204 dddvp.exe 91 PID 3204 wrote to memory of 2724 3204 dddvp.exe 91 PID 2724 wrote to memory of 4280 2724 tbtttt.exe 92 PID 2724 wrote to memory of 4280 2724 tbtttt.exe 92 PID 2724 wrote to memory of 4280 2724 tbtttt.exe 92 PID 4280 wrote to memory of 4536 4280 bbnnhh.exe 93 PID 4280 wrote to memory of 4536 4280 bbnnhh.exe 93 PID 4280 wrote to memory of 4536 4280 bbnnhh.exe 93 PID 4536 wrote to memory of 2772 4536 jvjdv.exe 94 PID 4536 wrote to memory of 2772 4536 jvjdv.exe 94 PID 4536 wrote to memory of 2772 4536 jvjdv.exe 94 PID 2772 wrote to memory of 4560 2772 xrrrlll.exe 95 PID 2772 wrote to memory of 4560 2772 xrrrlll.exe 95 PID 2772 wrote to memory of 4560 2772 xrrrlll.exe 95 PID 4560 wrote to memory of 1436 4560 nhbhbn.exe 96 PID 4560 wrote to memory of 1436 4560 nhbhbn.exe 96 PID 4560 wrote to memory of 1436 4560 nhbhbn.exe 96 PID 1436 wrote to memory of 1468 1436 pvjdd.exe 97 PID 1436 wrote to memory of 1468 1436 pvjdd.exe 97 PID 1436 wrote to memory of 1468 1436 pvjdd.exe 97 PID 1468 wrote to memory of 860 1468 bhthnn.exe 98 PID 1468 wrote to memory of 860 1468 bhthnn.exe 98 PID 1468 wrote to memory of 860 1468 bhthnn.exe 98 PID 860 wrote to memory of 1300 860 vppjj.exe 99 PID 860 wrote to memory of 1300 860 vppjj.exe 99 PID 860 wrote to memory of 1300 860 vppjj.exe 99 PID 1300 wrote to memory of 1476 1300 dvddv.exe 100 PID 1300 wrote to memory of 1476 1300 dvddv.exe 100 PID 1300 wrote to memory of 1476 1300 dvddv.exe 100 PID 1476 wrote to memory of 1424 1476 hbhbht.exe 101 PID 1476 wrote to memory of 1424 1476 hbhbht.exe 101 PID 1476 wrote to memory of 1424 1476 hbhbht.exe 101 PID 1424 wrote to memory of 1784 1424 jddvp.exe 102 PID 1424 wrote to memory of 1784 1424 jddvp.exe 102 PID 1424 wrote to memory of 1784 1424 jddvp.exe 102 PID 1784 wrote to memory of 5068 1784 7rllfll.exe 103 PID 1784 wrote to memory of 5068 1784 7rllfll.exe 103 PID 1784 wrote to memory of 5068 1784 7rllfll.exe 103 PID 5068 wrote to memory of 2796 5068 htttnn.exe 104 PID 5068 wrote to memory of 2796 5068 htttnn.exe 104 PID 5068 wrote to memory of 2796 5068 htttnn.exe 104 PID 2796 wrote to memory of 3908 2796 ppddv.exe 105 PID 2796 wrote to memory of 3908 2796 ppddv.exe 105 PID 2796 wrote to memory of 3908 2796 ppddv.exe 105 PID 3908 wrote to memory of 4792 3908 flxfxxx.exe 106 PID 3908 wrote to memory of 4792 3908 flxfxxx.exe 106 PID 3908 wrote to memory of 4792 3908 flxfxxx.exe 106 PID 4792 wrote to memory of 1664 4792 hhhbbb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\91c5c53e7ba95541e09eacf9a5905100N.exe"C:\Users\Admin\AppData\Local\Temp\91c5c53e7ba95541e09eacf9a5905100N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\pdjdd.exec:\pdjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\7bhbhn.exec:\7bhbhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\rfrrlll.exec:\rfrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\dddvp.exec:\dddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\tbtttt.exec:\tbtttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\bbnnhh.exec:\bbnnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\jvjdv.exec:\jvjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\xrrrlll.exec:\xrrrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\nhbhbn.exec:\nhbhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\pvjdd.exec:\pvjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\bhthnn.exec:\bhthnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\vppjj.exec:\vppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\dvddv.exec:\dvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\hbhbht.exec:\hbhbht.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\jddvp.exec:\jddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\7rllfll.exec:\7rllfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\htttnn.exec:\htttnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\ppddv.exec:\ppddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\flxfxxx.exec:\flxfxxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\hhhbbb.exec:\hhhbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe23⤵
- Executes dropped EXE
PID:1664 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe24⤵
- Executes dropped EXE
PID:3420 -
\??\c:\hbhbbb.exec:\hbhbbb.exe25⤵
- Executes dropped EXE
PID:4964 -
\??\c:\vpjdj.exec:\vpjdj.exe26⤵
- Executes dropped EXE
PID:4124 -
\??\c:\frxlffx.exec:\frxlffx.exe27⤵
- Executes dropped EXE
PID:4088 -
\??\c:\9tttnt.exec:\9tttnt.exe28⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vpvpv.exec:\vpvpv.exe29⤵
- Executes dropped EXE
PID:4036 -
\??\c:\llrxxfl.exec:\llrxxfl.exe30⤵
- Executes dropped EXE
PID:2572 -
\??\c:\nthttn.exec:\nthttn.exe31⤵
- Executes dropped EXE
PID:1564 -
\??\c:\djvpj.exec:\djvpj.exe32⤵
- Executes dropped EXE
PID:4488 -
\??\c:\9bttnt.exec:\9bttnt.exe33⤵
- Executes dropped EXE
PID:4796 -
\??\c:\pjdvp.exec:\pjdvp.exe34⤵
- Executes dropped EXE
PID:3508 -
\??\c:\xflflrr.exec:\xflflrr.exe35⤵
- Executes dropped EXE
PID:2444 -
\??\c:\hbbtnn.exec:\hbbtnn.exe36⤵
- Executes dropped EXE
PID:3484 -
\??\c:\9nhhbh.exec:\9nhhbh.exe37⤵
- Executes dropped EXE
PID:964 -
\??\c:\5jpjd.exec:\5jpjd.exe38⤵
- Executes dropped EXE
PID:3896 -
\??\c:\lflxfxr.exec:\lflxfxr.exe39⤵
- Executes dropped EXE
PID:3372 -
\??\c:\nnnbth.exec:\nnnbth.exe40⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jdpjp.exec:\jdpjp.exe41⤵
- Executes dropped EXE
PID:756 -
\??\c:\vjdjd.exec:\vjdjd.exe42⤵
- Executes dropped EXE
PID:2040 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe43⤵
- Executes dropped EXE
PID:976 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1bhbnh.exec:\1bhbnh.exe45⤵
- Executes dropped EXE
PID:868 -
\??\c:\1jjdj.exec:\1jjdj.exe46⤵
- Executes dropped EXE
PID:4976 -
\??\c:\3jpjv.exec:\3jpjv.exe47⤵
- Executes dropped EXE
PID:2476 -
\??\c:\xlrlfff.exec:\xlrlfff.exe48⤵
- Executes dropped EXE
PID:4780 -
\??\c:\7ttnhb.exec:\7ttnhb.exe49⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5hhbtt.exec:\5hhbtt.exe50⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pddvp.exec:\pddvp.exe51⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5fllfrx.exec:\5fllfrx.exe52⤵
- Executes dropped EXE
PID:3676 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe53⤵
- Executes dropped EXE
PID:1204 -
\??\c:\3nnnnn.exec:\3nnnnn.exe54⤵
- Executes dropped EXE
PID:1236 -
\??\c:\djvjd.exec:\djvjd.exe55⤵
- Executes dropped EXE
PID:4276 -
\??\c:\rxrrfxr.exec:\rxrrfxr.exe56⤵
- Executes dropped EXE
PID:1608 -
\??\c:\xllfffl.exec:\xllfffl.exe57⤵
- Executes dropped EXE
PID:2432 -
\??\c:\xflffxx.exec:\xflffxx.exe58⤵
- Executes dropped EXE
PID:760 -
\??\c:\llffxxx.exec:\llffxxx.exe59⤵
- Executes dropped EXE
PID:860 -
\??\c:\nnbtbb.exec:\nnbtbb.exe60⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hhnhbb.exec:\hhnhbb.exe61⤵
- Executes dropped EXE
PID:228 -
\??\c:\jjvpj.exec:\jjvpj.exe62⤵
- Executes dropped EXE
PID:1168 -
\??\c:\lfrrllr.exec:\lfrrllr.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\fxfffff.exec:\fxfffff.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\nhbbtt.exec:\nhbbtt.exe65⤵
- Executes dropped EXE
PID:1180 -
\??\c:\pvjvp.exec:\pvjvp.exe66⤵PID:4260
-
\??\c:\lrlxrlx.exec:\lrlxrlx.exe67⤵PID:1248
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe68⤵PID:3976
-
\??\c:\ttbhnh.exec:\ttbhnh.exe69⤵PID:4792
-
\??\c:\tnhhhb.exec:\tnhhhb.exe70⤵PID:388
-
\??\c:\3vdvv.exec:\3vdvv.exe71⤵PID:3312
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe72⤵PID:4012
-
\??\c:\nbbhbn.exec:\nbbhbn.exe73⤵PID:2104
-
\??\c:\nhbbbb.exec:\nhbbbb.exe74⤵PID:2932
-
\??\c:\vvdvp.exec:\vvdvp.exe75⤵PID:3800
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe76⤵PID:4568
-
\??\c:\hhtttt.exec:\hhtttt.exe77⤵PID:3228
-
\??\c:\ththhb.exec:\ththhb.exe78⤵PID:5100
-
\??\c:\vpdvp.exec:\vpdvp.exe79⤵PID:3752
-
\??\c:\djjpp.exec:\djjpp.exe80⤵PID:3772
-
\??\c:\rfxfrlf.exec:\rfxfrlf.exe81⤵PID:4908
-
\??\c:\9nhhbh.exec:\9nhhbh.exe82⤵PID:336
-
\??\c:\vpvpp.exec:\vpvpp.exe83⤵PID:1368
-
\??\c:\3djdp.exec:\3djdp.exe84⤵PID:2012
-
\??\c:\ffllfll.exec:\ffllfll.exe85⤵PID:5048
-
\??\c:\xrflfff.exec:\xrflfff.exe86⤵PID:948
-
\??\c:\btbbhh.exec:\btbbhh.exe87⤵PID:1044
-
\??\c:\jvvvv.exec:\jvvvv.exe88⤵PID:3812
-
\??\c:\vdjvv.exec:\vdjvv.exe89⤵PID:856
-
\??\c:\xrllfrr.exec:\xrllfrr.exe90⤵PID:3632
-
\??\c:\tnhbtn.exec:\tnhbtn.exe91⤵PID:4708
-
\??\c:\btbbnn.exec:\btbbnn.exe92⤵PID:3900
-
\??\c:\vvvvp.exec:\vvvvp.exe93⤵PID:1612
-
\??\c:\5ffxfxr.exec:\5ffxfxr.exe94⤵PID:4220
-
\??\c:\bnbbhn.exec:\bnbbhn.exe95⤵PID:1968
-
\??\c:\tnnhbb.exec:\tnnhbb.exe96⤵PID:1460
-
\??\c:\dvpjj.exec:\dvpjj.exe97⤵PID:2300
-
\??\c:\7jpjp.exec:\7jpjp.exe98⤵PID:4040
-
\??\c:\1flfxrf.exec:\1flfxrf.exe99⤵PID:4468
-
\??\c:\nnnbnh.exec:\nnnbnh.exe100⤵PID:2716
-
\??\c:\hbbtbb.exec:\hbbtbb.exe101⤵PID:3664
-
\??\c:\bttnnn.exec:\bttnnn.exe102⤵PID:1236
-
\??\c:\bhnhhh.exec:\bhnhhh.exe103⤵PID:4276
-
\??\c:\jpvvp.exec:\jpvvp.exe104⤵PID:464
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe105⤵PID:2432
-
\??\c:\bhhthb.exec:\bhhthb.exe106⤵PID:1272
-
\??\c:\3nnbhh.exec:\3nnbhh.exe107⤵
- System Location Discovery: System Language Discovery
PID:232 -
\??\c:\dpjvj.exec:\dpjvj.exe108⤵PID:1300
-
\??\c:\1vdvv.exec:\1vdvv.exe109⤵PID:1428
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe110⤵PID:4684
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe111⤵PID:1980
-
\??\c:\5bbnnn.exec:\5bbnnn.exe112⤵PID:1784
-
\??\c:\ddjvd.exec:\ddjvd.exe113⤵PID:2796
-
\??\c:\dpjjd.exec:\dpjjd.exe114⤵PID:4260
-
\??\c:\rlrlffx.exec:\rlrlffx.exe115⤵PID:1620
-
\??\c:\hthtnh.exec:\hthtnh.exe116⤵PID:3976
-
\??\c:\bhnhnn.exec:\bhnhnn.exe117⤵PID:3216
-
\??\c:\dpdpd.exec:\dpdpd.exe118⤵PID:3328
-
\??\c:\pdjdv.exec:\pdjdv.exe119⤵PID:3420
-
\??\c:\lrlfxfr.exec:\lrlfxfr.exe120⤵PID:2748
-
\??\c:\5rfxllf.exec:\5rfxllf.exe121⤵PID:1488
-
\??\c:\nnnbbt.exec:\nnnbbt.exe122⤵PID:664
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-