Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 20:15
Static task
static1
Behavioral task
behavioral1
Sample
4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe
Resource
win7-20240903-en
General
-
Target
4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe
-
Size
132KB
-
MD5
cd4a651584f8cad238529e6fc5a7d8e0
-
SHA1
cd3da1994f4c6b70a34f598bb895d6d81db5d847
-
SHA256
4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893
-
SHA512
bd09f771f7f4b1c00ad8726600990c2b80efc8ace4cfe18951f074d2084ffdcc20bacb478354ecb075dadfb4ffbf9e3cee496d0e56eb7d8842cec49383f220b7
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9gFb8kSv3v1Jgs7hMw8s5bBZf1B:n3C9BRo7tvnJ9oLSvv1FhMVIfn
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/5084-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4988 7llffff.exe 2448 nnbttt.exe 4460 tthhbb.exe 1760 7pppp.exe 4480 3jjdv.exe 2340 xxrlffx.exe 2284 nbhhbb.exe 1108 3hnhhb.exe 1188 jdjdv.exe 1072 djddv.exe 2856 lfflxfr.exe 4844 jddpj.exe 2412 lllfxxr.exe 1220 9tbtnn.exe 384 jvvjv.exe 5016 xfrrlff.exe 3596 bnbnnn.exe 5020 dvddv.exe 3184 xfffxff.exe 5064 7bhbtn.exe 1820 jjvjv.exe 4312 3rffxxx.exe 3628 ntthtn.exe 660 pdddv.exe 1924 fxfxllf.exe 644 fxfxxxx.exe 3100 hbnnnt.exe 1956 btnhhh.exe 1972 nnbbtt.exe 3908 vdjpj.exe 2716 3rxrffx.exe 1784 7hbttn.exe 2328 ntbtbt.exe 1316 3jpjd.exe 2912 rlrrfxf.exe 3372 btnhnn.exe 2724 dvpjv.exe 4968 vppdv.exe 4640 fxfrfff.exe 3952 hbbbtb.exe 4416 nnbtbb.exe 3024 pvvpv.exe 2576 bbhbhb.exe 4800 vdvjd.exe 3956 lllrrrr.exe 1732 jjddv.exe 2936 bhttnn.exe 4876 1pdvv.exe 1180 nnhhnn.exe 4608 dpvjj.exe 4624 ddppj.exe 3868 nhbtbb.exe 872 rfrlfxr.exe 2896 xllfxxr.exe 3216 nnhnbb.exe 1012 fxllfrr.exe 3536 xrrlllf.exe 3484 jdppj.exe 1816 hntttt.exe 1400 7hnnhh.exe 1908 frfxxxf.exe 2840 lrxrlff.exe 5016 tnnnhn.exe 1196 7tbntt.exe -
resource yara_rule behavioral2/memory/5084-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-187-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 4988 5084 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 82 PID 5084 wrote to memory of 4988 5084 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 82 PID 5084 wrote to memory of 4988 5084 4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe 82 PID 4988 wrote to memory of 2448 4988 7llffff.exe 83 PID 4988 wrote to memory of 2448 4988 7llffff.exe 83 PID 4988 wrote to memory of 2448 4988 7llffff.exe 83 PID 2448 wrote to memory of 4460 2448 nnbttt.exe 84 PID 2448 wrote to memory of 4460 2448 nnbttt.exe 84 PID 2448 wrote to memory of 4460 2448 nnbttt.exe 84 PID 4460 wrote to memory of 1760 4460 tthhbb.exe 85 PID 4460 wrote to memory of 1760 4460 tthhbb.exe 85 PID 4460 wrote to memory of 1760 4460 tthhbb.exe 85 PID 1760 wrote to memory of 4480 1760 7pppp.exe 86 PID 1760 wrote to memory of 4480 1760 7pppp.exe 86 PID 1760 wrote to memory of 4480 1760 7pppp.exe 86 PID 4480 wrote to memory of 2340 4480 3jjdv.exe 87 PID 4480 wrote to memory of 2340 4480 3jjdv.exe 87 PID 4480 wrote to memory of 2340 4480 3jjdv.exe 87 PID 2340 wrote to memory of 2284 2340 xxrlffx.exe 88 PID 2340 wrote to memory of 2284 2340 xxrlffx.exe 88 PID 2340 wrote to memory of 2284 2340 xxrlffx.exe 88 PID 2284 wrote to memory of 1108 2284 nbhhbb.exe 89 PID 2284 wrote to memory of 1108 2284 nbhhbb.exe 89 PID 2284 wrote to memory of 1108 2284 nbhhbb.exe 89 PID 1108 wrote to memory of 1188 1108 3hnhhb.exe 90 PID 1108 wrote to memory of 1188 1108 3hnhhb.exe 90 PID 1108 wrote to memory of 1188 1108 3hnhhb.exe 90 PID 1188 wrote to memory of 1072 1188 jdjdv.exe 91 PID 1188 wrote to memory of 1072 1188 jdjdv.exe 91 PID 1188 wrote to memory of 1072 1188 jdjdv.exe 91 PID 1072 wrote to memory of 2856 1072 djddv.exe 92 PID 1072 wrote to memory of 2856 1072 djddv.exe 92 PID 1072 wrote to memory of 2856 1072 djddv.exe 92 PID 2856 wrote to memory of 4844 2856 lfflxfr.exe 93 PID 2856 wrote to memory of 4844 2856 lfflxfr.exe 93 PID 2856 wrote to memory of 4844 2856 lfflxfr.exe 93 PID 4844 wrote to memory of 2412 4844 jddpj.exe 94 PID 4844 wrote to memory of 2412 4844 jddpj.exe 94 PID 4844 wrote to memory of 2412 4844 jddpj.exe 94 PID 2412 wrote to memory of 1220 2412 lllfxxr.exe 95 PID 2412 wrote to memory of 1220 2412 lllfxxr.exe 95 PID 2412 wrote to memory of 1220 2412 lllfxxr.exe 95 PID 1220 wrote to memory of 384 1220 9tbtnn.exe 96 PID 1220 wrote to memory of 384 1220 9tbtnn.exe 96 PID 1220 wrote to memory of 384 1220 9tbtnn.exe 96 PID 384 wrote to memory of 5016 384 jvvjv.exe 97 PID 384 wrote to memory of 5016 384 jvvjv.exe 97 PID 384 wrote to memory of 5016 384 jvvjv.exe 97 PID 5016 wrote to memory of 3596 5016 xfrrlff.exe 98 PID 5016 wrote to memory of 3596 5016 xfrrlff.exe 98 PID 5016 wrote to memory of 3596 5016 xfrrlff.exe 98 PID 3596 wrote to memory of 5020 3596 bnbnnn.exe 99 PID 3596 wrote to memory of 5020 3596 bnbnnn.exe 99 PID 3596 wrote to memory of 5020 3596 bnbnnn.exe 99 PID 5020 wrote to memory of 3184 5020 dvddv.exe 100 PID 5020 wrote to memory of 3184 5020 dvddv.exe 100 PID 5020 wrote to memory of 3184 5020 dvddv.exe 100 PID 3184 wrote to memory of 5064 3184 xfffxff.exe 101 PID 3184 wrote to memory of 5064 3184 xfffxff.exe 101 PID 3184 wrote to memory of 5064 3184 xfffxff.exe 101 PID 5064 wrote to memory of 1820 5064 7bhbtn.exe 102 PID 5064 wrote to memory of 1820 5064 7bhbtn.exe 102 PID 5064 wrote to memory of 1820 5064 7bhbtn.exe 102 PID 1820 wrote to memory of 4312 1820 jjvjv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe"C:\Users\Admin\AppData\Local\Temp\4ce9cc42dfe3c12f653943ba98a53c495709978c05e77dbb1071db114f2ed893N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\7llffff.exec:\7llffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\nnbttt.exec:\nnbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\tthhbb.exec:\tthhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\7pppp.exec:\7pppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\3jjdv.exec:\3jjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\xxrlffx.exec:\xxrlffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nbhhbb.exec:\nbhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\3hnhhb.exec:\3hnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jdjdv.exec:\jdjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\djddv.exec:\djddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\lfflxfr.exec:\lfflxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\jddpj.exec:\jddpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\lllfxxr.exec:\lllfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\9tbtnn.exec:\9tbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\jvvjv.exec:\jvvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\xfrrlff.exec:\xfrrlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\bnbnnn.exec:\bnbnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\dvddv.exec:\dvddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\xfffxff.exec:\xfffxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\7bhbtn.exec:\7bhbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\jjvjv.exec:\jjvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\3rffxxx.exec:\3rffxxx.exe23⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ntthtn.exec:\ntthtn.exe24⤵
- Executes dropped EXE
PID:3628 -
\??\c:\pdddv.exec:\pdddv.exe25⤵
- Executes dropped EXE
PID:660 -
\??\c:\fxfxllf.exec:\fxfxllf.exe26⤵
- Executes dropped EXE
PID:1924 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe27⤵
- Executes dropped EXE
PID:644 -
\??\c:\hbnnnt.exec:\hbnnnt.exe28⤵
- Executes dropped EXE
PID:3100 -
\??\c:\btnhhh.exec:\btnhhh.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\nnbbtt.exec:\nnbbtt.exe30⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vdjpj.exec:\vdjpj.exe31⤵
- Executes dropped EXE
PID:3908 -
\??\c:\3rxrffx.exec:\3rxrffx.exe32⤵
- Executes dropped EXE
PID:2716 -
\??\c:\7hbttn.exec:\7hbttn.exe33⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ntbtbt.exec:\ntbtbt.exe34⤵
- Executes dropped EXE
PID:2328 -
\??\c:\3jpjd.exec:\3jpjd.exe35⤵
- Executes dropped EXE
PID:1316 -
\??\c:\rlrrfxf.exec:\rlrrfxf.exe36⤵
- Executes dropped EXE
PID:2912 -
\??\c:\btnhnn.exec:\btnhnn.exe37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3372 -
\??\c:\dvpjv.exec:\dvpjv.exe38⤵
- Executes dropped EXE
PID:2724 -
\??\c:\vppdv.exec:\vppdv.exe39⤵
- Executes dropped EXE
PID:4968 -
\??\c:\fxfrfff.exec:\fxfrfff.exe40⤵
- Executes dropped EXE
PID:4640 -
\??\c:\hbbbtb.exec:\hbbbtb.exe41⤵
- Executes dropped EXE
PID:3952 -
\??\c:\nnbtbb.exec:\nnbtbb.exe42⤵
- Executes dropped EXE
PID:4416 -
\??\c:\pvvpv.exec:\pvvpv.exe43⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bbhbhb.exec:\bbhbhb.exe44⤵
- Executes dropped EXE
PID:2576 -
\??\c:\vdvjd.exec:\vdvjd.exe45⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lllrrrr.exec:\lllrrrr.exe46⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jjddv.exec:\jjddv.exe47⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bhttnn.exec:\bhttnn.exe48⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1pdvv.exec:\1pdvv.exe49⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nnhhnn.exec:\nnhhnn.exe50⤵
- Executes dropped EXE
PID:1180 -
\??\c:\dpvjj.exec:\dpvjj.exe51⤵
- Executes dropped EXE
PID:4608 -
\??\c:\ddppj.exec:\ddppj.exe52⤵
- Executes dropped EXE
PID:4624 -
\??\c:\nhbtbb.exec:\nhbtbb.exe53⤵
- Executes dropped EXE
PID:3868 -
\??\c:\rfrlfxr.exec:\rfrlfxr.exe54⤵
- Executes dropped EXE
PID:872 -
\??\c:\xllfxxr.exec:\xllfxxr.exe55⤵
- Executes dropped EXE
PID:2896 -
\??\c:\nnhnbb.exec:\nnhnbb.exe56⤵
- Executes dropped EXE
PID:3216 -
\??\c:\fxllfrr.exec:\fxllfrr.exe57⤵
- Executes dropped EXE
PID:1012 -
\??\c:\xrrlllf.exec:\xrrlllf.exe58⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jdppj.exec:\jdppj.exe59⤵
- Executes dropped EXE
PID:3484 -
\??\c:\hntttt.exec:\hntttt.exe60⤵
- Executes dropped EXE
PID:1816 -
\??\c:\7hnnhh.exec:\7hnnhh.exe61⤵
- Executes dropped EXE
PID:1400 -
\??\c:\frfxxxf.exec:\frfxxxf.exe62⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lrxrlff.exec:\lrxrlff.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnnnhn.exec:\tnnnhn.exe64⤵
- Executes dropped EXE
PID:5016 -
\??\c:\7tbntt.exec:\7tbntt.exe65⤵
- Executes dropped EXE
PID:1196 -
\??\c:\9vpvd.exec:\9vpvd.exe66⤵PID:760
-
\??\c:\rfllfff.exec:\rfllfff.exe67⤵
- System Location Discovery: System Language Discovery
PID:2784 -
\??\c:\xrflrlr.exec:\xrflrlr.exe68⤵PID:3184
-
\??\c:\btbtth.exec:\btbtth.exe69⤵PID:2860
-
\??\c:\5jddv.exec:\5jddv.exe70⤵PID:4256
-
\??\c:\xlrlfff.exec:\xlrlfff.exe71⤵PID:1820
-
\??\c:\lxllfff.exec:\lxllfff.exe72⤵PID:1976
-
\??\c:\hhbbtb.exec:\hhbbtb.exe73⤵PID:3128
-
\??\c:\7pvpj.exec:\7pvpj.exe74⤵PID:3628
-
\??\c:\vppvv.exec:\vppvv.exe75⤵PID:1504
-
\??\c:\rlxlxlr.exec:\rlxlxlr.exe76⤵PID:1336
-
\??\c:\hbbbhh.exec:\hbbbhh.exe77⤵PID:4156
-
\??\c:\jjpjp.exec:\jjpjp.exe78⤵PID:3696
-
\??\c:\5dvpj.exec:\5dvpj.exe79⤵PID:3476
-
\??\c:\xrrllll.exec:\xrrllll.exe80⤵PID:2360
-
\??\c:\ttnnbb.exec:\ttnnbb.exe81⤵PID:4964
-
\??\c:\ttbbnn.exec:\ttbbnn.exe82⤵PID:916
-
\??\c:\3pdvd.exec:\3pdvd.exe83⤵PID:1368
-
\??\c:\llflrrx.exec:\llflrrx.exe84⤵PID:4504
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe85⤵PID:2580
-
\??\c:\bnnnhh.exec:\bnnnhh.exe86⤵PID:3004
-
\??\c:\hntnnn.exec:\hntnnn.exe87⤵PID:3256
-
\??\c:\djjdd.exec:\djjdd.exe88⤵PID:2328
-
\??\c:\flrffrf.exec:\flrffrf.exe89⤵PID:4456
-
\??\c:\xxxxfxf.exec:\xxxxfxf.exe90⤵PID:2912
-
\??\c:\1nthbb.exec:\1nthbb.exe91⤵PID:3372
-
\??\c:\pjpjp.exec:\pjpjp.exe92⤵PID:1632
-
\??\c:\3rrfxrl.exec:\3rrfxrl.exe93⤵
- System Location Discovery: System Language Discovery
PID:4636 -
\??\c:\9xrlfxr.exec:\9xrlfxr.exe94⤵PID:1460
-
\??\c:\bbhhbt.exec:\bbhhbt.exe95⤵PID:4496
-
\??\c:\vjvdd.exec:\vjvdd.exe96⤵PID:4388
-
\??\c:\ppjdp.exec:\ppjdp.exe97⤵PID:4024
-
\??\c:\xflfxxr.exec:\xflfxxr.exe98⤵PID:4296
-
\??\c:\xxlflfl.exec:\xxlflfl.exe99⤵PID:3444
-
\??\c:\nnhhtn.exec:\nnhhtn.exe100⤵
- System Location Discovery: System Language Discovery
PID:3876 -
\??\c:\ffxxrff.exec:\ffxxrff.exe101⤵PID:4996
-
\??\c:\xrrrllf.exec:\xrrrllf.exe102⤵PID:4484
-
\??\c:\hntnhb.exec:\hntnhb.exe103⤵PID:4460
-
\??\c:\dppjd.exec:\dppjd.exe104⤵PID:5024
-
\??\c:\llrlrrx.exec:\llrlrrx.exe105⤵PID:2936
-
\??\c:\1lxxxxx.exec:\1lxxxxx.exe106⤵PID:4056
-
\??\c:\hbnntt.exec:\hbnntt.exe107⤵PID:1180
-
\??\c:\tnhbtt.exec:\tnhbtt.exe108⤵PID:4608
-
\??\c:\ppjjd.exec:\ppjjd.exe109⤵PID:4888
-
\??\c:\jjppd.exec:\jjppd.exe110⤵PID:1624
-
\??\c:\fxxxrff.exec:\fxxxrff.exe111⤵PID:3940
-
\??\c:\1tbhbb.exec:\1tbhbb.exe112⤵PID:676
-
\??\c:\bhhhbb.exec:\bhhhbb.exe113⤵PID:3556
-
\??\c:\djjvp.exec:\djjvp.exe114⤵PID:5072
-
\??\c:\jvvpd.exec:\jvvpd.exe115⤵PID:220
-
\??\c:\9rrlllf.exec:\9rrlllf.exe116⤵PID:3156
-
\??\c:\hntnhh.exec:\hntnhh.exe117⤵PID:4556
-
\??\c:\jpvjp.exec:\jpvjp.exe118⤵PID:4500
-
\??\c:\vjvvj.exec:\vjvvj.exe119⤵PID:4912
-
\??\c:\7ffxlxr.exec:\7ffxlxr.exe120⤵PID:4884
-
\??\c:\lflxrrr.exec:\lflxrrr.exe121⤵PID:4476
-
\??\c:\tntnnn.exec:\tntnnn.exe122⤵PID:4652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-