Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 20:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1be8f5a2eac89f517bb65fdafa0c5ca0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
1be8f5a2eac89f517bb65fdafa0c5ca0N.exe
-
Size
75KB
-
MD5
1be8f5a2eac89f517bb65fdafa0c5ca0
-
SHA1
2647a145e2510d69ca7f38c70170b71f7c79642c
-
SHA256
99614a00db9c0011ef6ab134a3d1f4114d45e020df191f89dcd7e66be710852e
-
SHA512
497c4d2510ae0444b6bf4bfcfc539d9c95de0f5bbb4217cd1816e50234433d3558a00bbbc9881e68c0868d64f10b65fc49d9e978b458a68cafa98cc6a9a1a285
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPL:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHg
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4216-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3724 3vvpp.exe 4468 xlllllf.exe 3728 hnhnhh.exe 2024 dvddj.exe 3708 jdpjj.exe 2412 lllflrl.exe 4448 hbnhnn.exe 2676 dpvpv.exe 224 pjpjj.exe 548 bhhttt.exe 5016 ppppj.exe 452 7lxxrrr.exe 4852 nnbbbt.exe 1956 1nbbhn.exe 3748 vvddv.exe 220 frrlffx.exe 1852 tthbtt.exe 4036 pppjd.exe 2416 fxrlrrf.exe 944 ntbtnn.exe 1044 tnnhbb.exe 2432 pvvjp.exe 2992 3xlxrrr.exe 4456 bntnhh.exe 2456 jjvvj.exe 3664 vvvdd.exe 2520 5lrfffx.exe 3160 tbhttt.exe 4932 dddpj.exe 2952 9djdv.exe 1796 5rfxxxf.exe 380 hhhthb.exe 4072 9vdvv.exe 432 jdvvp.exe 1452 nbhbbb.exe 2512 bbhbtb.exe 3956 vpvjd.exe 4376 rrlxrfr.exe 2128 nhhbbn.exe 1540 7btbtb.exe 3384 fxfrxfl.exe 828 tnbtnn.exe 2648 jjvpp.exe 4652 vpvvp.exe 2204 lxxlfxl.exe 4676 9nthbb.exe 464 djddv.exe 3476 djdvd.exe 4668 btntnh.exe 2976 ppvpp.exe 4920 dvjjj.exe 4448 xfxrrff.exe 1648 hbttnt.exe 2216 5dpvv.exe 1568 jvvdd.exe 2824 7frlxfr.exe 2744 bnnnnh.exe 1536 9jvpj.exe 3424 lrrllff.exe 1760 hhbtbb.exe 372 jpddp.exe 2892 xrxrlll.exe 2884 3rrlflf.exe 1468 thbthn.exe -
resource yara_rule behavioral2/memory/4216-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4216 wrote to memory of 3724 4216 1be8f5a2eac89f517bb65fdafa0c5ca0N.exe 83 PID 4216 wrote to memory of 3724 4216 1be8f5a2eac89f517bb65fdafa0c5ca0N.exe 83 PID 4216 wrote to memory of 3724 4216 1be8f5a2eac89f517bb65fdafa0c5ca0N.exe 83 PID 3724 wrote to memory of 4468 3724 3vvpp.exe 84 PID 3724 wrote to memory of 4468 3724 3vvpp.exe 84 PID 3724 wrote to memory of 4468 3724 3vvpp.exe 84 PID 4468 wrote to memory of 3728 4468 xlllllf.exe 85 PID 4468 wrote to memory of 3728 4468 xlllllf.exe 85 PID 4468 wrote to memory of 3728 4468 xlllllf.exe 85 PID 3728 wrote to memory of 2024 3728 hnhnhh.exe 87 PID 3728 wrote to memory of 2024 3728 hnhnhh.exe 87 PID 3728 wrote to memory of 2024 3728 hnhnhh.exe 87 PID 2024 wrote to memory of 3708 2024 dvddj.exe 88 PID 2024 wrote to memory of 3708 2024 dvddj.exe 88 PID 2024 wrote to memory of 3708 2024 dvddj.exe 88 PID 3708 wrote to memory of 2412 3708 jdpjj.exe 89 PID 3708 wrote to memory of 2412 3708 jdpjj.exe 89 PID 3708 wrote to memory of 2412 3708 jdpjj.exe 89 PID 2412 wrote to memory of 4448 2412 lllflrl.exe 90 PID 2412 wrote to memory of 4448 2412 lllflrl.exe 90 PID 2412 wrote to memory of 4448 2412 lllflrl.exe 90 PID 4448 wrote to memory of 2676 4448 hbnhnn.exe 91 PID 4448 wrote to memory of 2676 4448 hbnhnn.exe 91 PID 4448 wrote to memory of 2676 4448 hbnhnn.exe 91 PID 2676 wrote to memory of 224 2676 dpvpv.exe 92 PID 2676 wrote to memory of 224 2676 dpvpv.exe 92 PID 2676 wrote to memory of 224 2676 dpvpv.exe 92 PID 224 wrote to memory of 548 224 pjpjj.exe 93 PID 224 wrote to memory of 548 224 pjpjj.exe 93 PID 224 wrote to memory of 548 224 pjpjj.exe 93 PID 548 wrote to memory of 5016 548 bhhttt.exe 94 PID 548 wrote to memory of 5016 548 bhhttt.exe 94 PID 548 wrote to memory of 5016 548 bhhttt.exe 94 PID 5016 wrote to memory of 452 5016 ppppj.exe 95 PID 5016 wrote to memory of 452 5016 ppppj.exe 95 PID 5016 wrote to memory of 452 5016 ppppj.exe 95 PID 452 wrote to memory of 4852 452 7lxxrrr.exe 97 PID 452 wrote to memory of 4852 452 7lxxrrr.exe 97 PID 452 wrote to memory of 4852 452 7lxxrrr.exe 97 PID 4852 wrote to memory of 1956 4852 nnbbbt.exe 98 PID 4852 wrote to memory of 1956 4852 nnbbbt.exe 98 PID 4852 wrote to memory of 1956 4852 nnbbbt.exe 98 PID 1956 wrote to memory of 3748 1956 1nbbhn.exe 99 PID 1956 wrote to memory of 3748 1956 1nbbhn.exe 99 PID 1956 wrote to memory of 3748 1956 1nbbhn.exe 99 PID 3748 wrote to memory of 220 3748 vvddv.exe 100 PID 3748 wrote to memory of 220 3748 vvddv.exe 100 PID 3748 wrote to memory of 220 3748 vvddv.exe 100 PID 220 wrote to memory of 1852 220 frrlffx.exe 101 PID 220 wrote to memory of 1852 220 frrlffx.exe 101 PID 220 wrote to memory of 1852 220 frrlffx.exe 101 PID 1852 wrote to memory of 4036 1852 tthbtt.exe 102 PID 1852 wrote to memory of 4036 1852 tthbtt.exe 102 PID 1852 wrote to memory of 4036 1852 tthbtt.exe 102 PID 4036 wrote to memory of 2416 4036 pppjd.exe 103 PID 4036 wrote to memory of 2416 4036 pppjd.exe 103 PID 4036 wrote to memory of 2416 4036 pppjd.exe 103 PID 2416 wrote to memory of 944 2416 fxrlrrf.exe 104 PID 2416 wrote to memory of 944 2416 fxrlrrf.exe 104 PID 2416 wrote to memory of 944 2416 fxrlrrf.exe 104 PID 944 wrote to memory of 1044 944 ntbtnn.exe 106 PID 944 wrote to memory of 1044 944 ntbtnn.exe 106 PID 944 wrote to memory of 1044 944 ntbtnn.exe 106 PID 1044 wrote to memory of 2432 1044 tnnhbb.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1be8f5a2eac89f517bb65fdafa0c5ca0N.exe"C:\Users\Admin\AppData\Local\Temp\1be8f5a2eac89f517bb65fdafa0c5ca0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\3vvpp.exec:\3vvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\xlllllf.exec:\xlllllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\hnhnhh.exec:\hnhnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\dvddj.exec:\dvddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\jdpjj.exec:\jdpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\lllflrl.exec:\lllflrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\hbnhnn.exec:\hbnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\dpvpv.exec:\dpvpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\pjpjj.exec:\pjpjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\bhhttt.exec:\bhhttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ppppj.exec:\ppppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\7lxxrrr.exec:\7lxxrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\nnbbbt.exec:\nnbbbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\1nbbhn.exec:\1nbbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vvddv.exec:\vvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\frrlffx.exec:\frrlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\tthbtt.exec:\tthbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\pppjd.exec:\pppjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\fxrlrrf.exec:\fxrlrrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\ntbtnn.exec:\ntbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\tnnhbb.exec:\tnnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\pvvjp.exec:\pvvjp.exe23⤵
- Executes dropped EXE
PID:2432 -
\??\c:\3xlxrrr.exec:\3xlxrrr.exe24⤵
- Executes dropped EXE
PID:2992 -
\??\c:\bntnhh.exec:\bntnhh.exe25⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jjvvj.exec:\jjvvj.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vvvdd.exec:\vvvdd.exe27⤵
- Executes dropped EXE
PID:3664 -
\??\c:\5lrfffx.exec:\5lrfffx.exe28⤵
- Executes dropped EXE
PID:2520 -
\??\c:\tbhttt.exec:\tbhttt.exe29⤵
- Executes dropped EXE
PID:3160 -
\??\c:\dddpj.exec:\dddpj.exe30⤵
- Executes dropped EXE
PID:4932 -
\??\c:\9djdv.exec:\9djdv.exe31⤵
- Executes dropped EXE
PID:2952 -
\??\c:\5rfxxxf.exec:\5rfxxxf.exe32⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhhthb.exec:\hhhthb.exe33⤵
- Executes dropped EXE
PID:380 -
\??\c:\9vdvv.exec:\9vdvv.exe34⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jdvvp.exec:\jdvvp.exe35⤵
- Executes dropped EXE
PID:432 -
\??\c:\nbhbbb.exec:\nbhbbb.exe36⤵
- Executes dropped EXE
PID:1452 -
\??\c:\bbhbtb.exec:\bbhbtb.exe37⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vpvjd.exec:\vpvjd.exe38⤵
- Executes dropped EXE
PID:3956 -
\??\c:\rrlxrfr.exec:\rrlxrfr.exe39⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nhhbbn.exec:\nhhbbn.exe40⤵
- Executes dropped EXE
PID:2128 -
\??\c:\7btbtb.exec:\7btbtb.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\fxfrxfl.exec:\fxfrxfl.exe42⤵
- Executes dropped EXE
PID:3384 -
\??\c:\tnbtnn.exec:\tnbtnn.exe43⤵
- Executes dropped EXE
PID:828 -
\??\c:\jjvpp.exec:\jjvpp.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\vpvvp.exec:\vpvvp.exe45⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lxxlfxl.exec:\lxxlfxl.exe46⤵
- Executes dropped EXE
PID:2204 -
\??\c:\9nthbb.exec:\9nthbb.exe47⤵
- Executes dropped EXE
PID:4676 -
\??\c:\djddv.exec:\djddv.exe48⤵
- Executes dropped EXE
PID:464 -
\??\c:\djdvd.exec:\djdvd.exe49⤵
- Executes dropped EXE
PID:3476 -
\??\c:\btntnh.exec:\btntnh.exe50⤵
- Executes dropped EXE
PID:4668 -
\??\c:\ppvpp.exec:\ppvpp.exe51⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvjjj.exec:\dvjjj.exe52⤵
- Executes dropped EXE
PID:4920 -
\??\c:\xfxrrff.exec:\xfxrrff.exe53⤵
- Executes dropped EXE
PID:4448 -
\??\c:\hbttnt.exec:\hbttnt.exe54⤵
- Executes dropped EXE
PID:1648 -
\??\c:\5dpvv.exec:\5dpvv.exe55⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jvvdd.exec:\jvvdd.exe56⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7frlxfr.exec:\7frlxfr.exe57⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bnnnnh.exec:\bnnnnh.exe58⤵
- Executes dropped EXE
PID:2744 -
\??\c:\9jvpj.exec:\9jvpj.exe59⤵
- Executes dropped EXE
PID:1536 -
\??\c:\lrrllff.exec:\lrrllff.exe60⤵
- Executes dropped EXE
PID:3424 -
\??\c:\hhbtbb.exec:\hhbtbb.exe61⤵
- Executes dropped EXE
PID:1760 -
\??\c:\jpddp.exec:\jpddp.exe62⤵
- Executes dropped EXE
PID:372 -
\??\c:\xrxrlll.exec:\xrxrlll.exe63⤵
- Executes dropped EXE
PID:2892 -
\??\c:\3rrlflf.exec:\3rrlflf.exe64⤵
- Executes dropped EXE
PID:2884 -
\??\c:\thbthn.exec:\thbthn.exe65⤵
- Executes dropped EXE
PID:1468 -
\??\c:\ddjdj.exec:\ddjdj.exe66⤵PID:1984
-
\??\c:\1djdv.exec:\1djdv.exe67⤵PID:1804
-
\??\c:\xlrlllx.exec:\xlrlllx.exe68⤵PID:3120
-
\??\c:\tttnhh.exec:\tttnhh.exe69⤵PID:4748
-
\??\c:\bnhhhh.exec:\bnhhhh.exe70⤵PID:4824
-
\??\c:\jdjpj.exec:\jdjpj.exe71⤵PID:4872
-
\??\c:\dppdv.exec:\dppdv.exe72⤵PID:3240
-
\??\c:\xrfffll.exec:\xrfffll.exe73⤵PID:3984
-
\??\c:\fllfrrf.exec:\fllfrrf.exe74⤵
- System Location Discovery: System Language Discovery
PID:3096 -
\??\c:\nbhhbb.exec:\nbhhbb.exe75⤵PID:2944
-
\??\c:\dppjp.exec:\dppjp.exe76⤵PID:3692
-
\??\c:\9ppjd.exec:\9ppjd.exe77⤵PID:3592
-
\??\c:\xxrxlxf.exec:\xxrxlxf.exe78⤵PID:4180
-
\??\c:\btbttb.exec:\btbttb.exe79⤵PID:4684
-
\??\c:\hhhhbb.exec:\hhhhbb.exe80⤵PID:744
-
\??\c:\djjdj.exec:\djjdj.exe81⤵PID:2096
-
\??\c:\xlllffx.exec:\xlllffx.exe82⤵PID:4252
-
\??\c:\3xrffrl.exec:\3xrffrl.exe83⤵PID:412
-
\??\c:\nnbhnt.exec:\nnbhnt.exe84⤵PID:1708
-
\??\c:\7hnnbb.exec:\7hnnbb.exe85⤵PID:4968
-
\??\c:\jjddd.exec:\jjddd.exe86⤵PID:4800
-
\??\c:\jdvjd.exec:\jdvjd.exe87⤵PID:3972
-
\??\c:\rlffxxr.exec:\rlffxxr.exe88⤵PID:1312
-
\??\c:\5lrxlxr.exec:\5lrxlxr.exe89⤵PID:392
-
\??\c:\bnttnn.exec:\bnttnn.exe90⤵PID:4392
-
\??\c:\jdpvp.exec:\jdpvp.exe91⤵PID:4488
-
\??\c:\3vjdd.exec:\3vjdd.exe92⤵PID:1776
-
\??\c:\frfllll.exec:\frfllll.exe93⤵PID:4104
-
\??\c:\frffxxx.exec:\frffxxx.exe94⤵PID:4680
-
\??\c:\hbnhbh.exec:\hbnhbh.exe95⤵PID:892
-
\??\c:\tthnnt.exec:\tthnnt.exe96⤵PID:828
-
\??\c:\5dddv.exec:\5dddv.exe97⤵PID:1428
-
\??\c:\9jdvv.exec:\9jdvv.exe98⤵PID:1028
-
\??\c:\1lrlllf.exec:\1lrlllf.exe99⤵PID:2204
-
\??\c:\rrrlfff.exec:\rrrlfff.exe100⤵PID:1448
-
\??\c:\btbbbb.exec:\btbbbb.exe101⤵PID:464
-
\??\c:\jjpjd.exec:\jjpjd.exe102⤵PID:3708
-
\??\c:\vvppv.exec:\vvppv.exe103⤵PID:4728
-
\??\c:\xxffffl.exec:\xxffffl.exe104⤵PID:3576
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe105⤵PID:4920
-
\??\c:\hbbttt.exec:\hbbttt.exe106⤵PID:4912
-
\??\c:\nthhnt.exec:\nthhnt.exe107⤵PID:4420
-
\??\c:\dpppj.exec:\dpppj.exe108⤵PID:1560
-
\??\c:\3pvvp.exec:\3pvvp.exe109⤵PID:3028
-
\??\c:\9rfxxxx.exec:\9rfxxxx.exe110⤵PID:4296
-
\??\c:\bhnhbb.exec:\bhnhbb.exe111⤵PID:4868
-
\??\c:\jddvv.exec:\jddvv.exe112⤵PID:3920
-
\??\c:\vjvvv.exec:\vjvvv.exe113⤵PID:436
-
\??\c:\5hbtnt.exec:\5hbtnt.exe114⤵PID:2756
-
\??\c:\jppjd.exec:\jppjd.exe115⤵PID:2892
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe116⤵PID:3740
-
\??\c:\3flffff.exec:\3flffff.exe117⤵PID:1468
-
\??\c:\bthnnn.exec:\bthnnn.exe118⤵PID:1984
-
\??\c:\dvjpj.exec:\dvjpj.exe119⤵PID:4036
-
\??\c:\llxrfxl.exec:\llxrfxl.exe120⤵PID:968
-
\??\c:\bnbbbb.exec:\bnbbbb.exe121⤵PID:2416
-
\??\c:\ppdvv.exec:\ppdvv.exe122⤵PID:5076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-