Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 08:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe
-
Size
71KB
-
MD5
3d4811b42888ac18bdeffe44eb497600
-
SHA1
c5908b0c3e417e082006f62202a19e2aedcf8c88
-
SHA256
9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6
-
SHA512
ac4f87624d2d7a8ff92f0d287f93fe3762dc9da2de4b248df9e813545d2b14d2ded7d2c47802e3a9247b54c856d079bbfdc5f834f5a40f32afc0f662b5b6c4db
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj1:ymb3NkkiQ3mdBjFI4VF
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4172-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4972 hbhbbb.exe 1936 bhnnbb.exe 2440 7pvpd.exe 2448 fxrlfxx.exe 4544 hbbbbb.exe 1704 dddvv.exe 4784 rfrlllr.exe 2280 hhthbb.exe 1168 dppjd.exe 3232 fxxrllf.exe 4948 htnhtt.exe 3236 pdjdp.exe 684 ddjdj.exe 1600 xrlllrr.exe 2720 bbtnnn.exe 116 7djdv.exe 2156 dpppp.exe 5052 bnnhbb.exe 636 jpvjd.exe 1556 tbbthh.exe 4728 ppppd.exe 2996 xllrxrf.exe 2104 3flfxxr.exe 1116 9hbbhn.exe 3336 hbhthb.exe 1532 ppjjd.exe 4040 9flrrlx.exe 4372 lxfxrlf.exe 2960 dvdpj.exe 2668 lxxrlff.exe 4420 rllfxrl.exe 1200 btnhtn.exe 860 dppjv.exe 3212 ppjdv.exe 4568 thnbtn.exe 4656 9pdvd.exe 3808 frlfxrl.exe 4068 5hnhhh.exe 3340 vvddp.exe 2208 btthtt.exe 4700 hthttn.exe 908 vjvpd.exe 5100 1jddp.exe 3440 lfffrxl.exe 1612 9tbtnb.exe 3260 jvpjv.exe 4560 1xrfrfx.exe 3568 1fxxllf.exe 1936 7btnbb.exe 1344 bntnhb.exe 4944 9pjdv.exe 1860 pdvjd.exe 4376 rrfflfx.exe 1468 rflffxx.exe 1704 nnhbtn.exe 1304 pddvj.exe 1960 3jjdd.exe 1800 lffrxlf.exe 8 nhhhbt.exe 3088 tnhbnn.exe 1160 pddpd.exe 4908 vdddp.exe 1324 lfxlxxx.exe 2916 lllxrrl.exe -
resource yara_rule behavioral2/memory/4172-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3236-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbttbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4172 wrote to memory of 4972 4172 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 82 PID 4172 wrote to memory of 4972 4172 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 82 PID 4172 wrote to memory of 4972 4172 9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe 82 PID 4972 wrote to memory of 1936 4972 hbhbbb.exe 83 PID 4972 wrote to memory of 1936 4972 hbhbbb.exe 83 PID 4972 wrote to memory of 1936 4972 hbhbbb.exe 83 PID 1936 wrote to memory of 2440 1936 bhnnbb.exe 84 PID 1936 wrote to memory of 2440 1936 bhnnbb.exe 84 PID 1936 wrote to memory of 2440 1936 bhnnbb.exe 84 PID 2440 wrote to memory of 2448 2440 7pvpd.exe 85 PID 2440 wrote to memory of 2448 2440 7pvpd.exe 85 PID 2440 wrote to memory of 2448 2440 7pvpd.exe 85 PID 2448 wrote to memory of 4544 2448 fxrlfxx.exe 86 PID 2448 wrote to memory of 4544 2448 fxrlfxx.exe 86 PID 2448 wrote to memory of 4544 2448 fxrlfxx.exe 86 PID 4544 wrote to memory of 1704 4544 hbbbbb.exe 87 PID 4544 wrote to memory of 1704 4544 hbbbbb.exe 87 PID 4544 wrote to memory of 1704 4544 hbbbbb.exe 87 PID 1704 wrote to memory of 4784 1704 dddvv.exe 88 PID 1704 wrote to memory of 4784 1704 dddvv.exe 88 PID 1704 wrote to memory of 4784 1704 dddvv.exe 88 PID 4784 wrote to memory of 2280 4784 rfrlllr.exe 89 PID 4784 wrote to memory of 2280 4784 rfrlllr.exe 89 PID 4784 wrote to memory of 2280 4784 rfrlllr.exe 89 PID 2280 wrote to memory of 1168 2280 hhthbb.exe 90 PID 2280 wrote to memory of 1168 2280 hhthbb.exe 90 PID 2280 wrote to memory of 1168 2280 hhthbb.exe 90 PID 1168 wrote to memory of 3232 1168 dppjd.exe 91 PID 1168 wrote to memory of 3232 1168 dppjd.exe 91 PID 1168 wrote to memory of 3232 1168 dppjd.exe 91 PID 3232 wrote to memory of 4948 3232 fxxrllf.exe 92 PID 3232 wrote to memory of 4948 3232 fxxrllf.exe 92 PID 3232 wrote to memory of 4948 3232 fxxrllf.exe 92 PID 4948 wrote to memory of 3236 4948 htnhtt.exe 93 PID 4948 wrote to memory of 3236 4948 htnhtt.exe 93 PID 4948 wrote to memory of 3236 4948 htnhtt.exe 93 PID 3236 wrote to memory of 684 3236 pdjdp.exe 94 PID 3236 wrote to memory of 684 3236 pdjdp.exe 94 PID 3236 wrote to memory of 684 3236 pdjdp.exe 94 PID 684 wrote to memory of 1600 684 ddjdj.exe 95 PID 684 wrote to memory of 1600 684 ddjdj.exe 95 PID 684 wrote to memory of 1600 684 ddjdj.exe 95 PID 1600 wrote to memory of 2720 1600 xrlllrr.exe 96 PID 1600 wrote to memory of 2720 1600 xrlllrr.exe 96 PID 1600 wrote to memory of 2720 1600 xrlllrr.exe 96 PID 2720 wrote to memory of 116 2720 bbtnnn.exe 97 PID 2720 wrote to memory of 116 2720 bbtnnn.exe 97 PID 2720 wrote to memory of 116 2720 bbtnnn.exe 97 PID 116 wrote to memory of 2156 116 7djdv.exe 98 PID 116 wrote to memory of 2156 116 7djdv.exe 98 PID 116 wrote to memory of 2156 116 7djdv.exe 98 PID 2156 wrote to memory of 5052 2156 dpppp.exe 99 PID 2156 wrote to memory of 5052 2156 dpppp.exe 99 PID 2156 wrote to memory of 5052 2156 dpppp.exe 99 PID 5052 wrote to memory of 636 5052 bnnhbb.exe 100 PID 5052 wrote to memory of 636 5052 bnnhbb.exe 100 PID 5052 wrote to memory of 636 5052 bnnhbb.exe 100 PID 636 wrote to memory of 1556 636 jpvjd.exe 101 PID 636 wrote to memory of 1556 636 jpvjd.exe 101 PID 636 wrote to memory of 1556 636 jpvjd.exe 101 PID 1556 wrote to memory of 4728 1556 tbbthh.exe 102 PID 1556 wrote to memory of 4728 1556 tbbthh.exe 102 PID 1556 wrote to memory of 4728 1556 tbbthh.exe 102 PID 4728 wrote to memory of 2996 4728 ppppd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe"C:\Users\Admin\AppData\Local\Temp\9d4f60c2a85431e224da8876ef0c7947a057cb644bec2f8e9421c643a91d87b6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\hbhbbb.exec:\hbhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bhnnbb.exec:\bhnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\7pvpd.exec:\7pvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\hbbbbb.exec:\hbbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\dddvv.exec:\dddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\rfrlllr.exec:\rfrlllr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\hhthbb.exec:\hhthbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\dppjd.exec:\dppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\fxxrllf.exec:\fxxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\htnhtt.exec:\htnhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\pdjdp.exec:\pdjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\ddjdj.exec:\ddjdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\xrlllrr.exec:\xrlllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\bbtnnn.exec:\bbtnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\7djdv.exec:\7djdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\dpppp.exec:\dpppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\bnnhbb.exec:\bnnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\jpvjd.exec:\jpvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\tbbthh.exec:\tbbthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\ppppd.exec:\ppppd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\xllrxrf.exec:\xllrxrf.exe23⤵
- Executes dropped EXE
PID:2996 -
\??\c:\3flfxxr.exec:\3flfxxr.exe24⤵
- Executes dropped EXE
PID:2104 -
\??\c:\9hbbhn.exec:\9hbbhn.exe25⤵
- Executes dropped EXE
PID:1116 -
\??\c:\hbhthb.exec:\hbhthb.exe26⤵
- Executes dropped EXE
PID:3336 -
\??\c:\ppjjd.exec:\ppjjd.exe27⤵
- Executes dropped EXE
PID:1532 -
\??\c:\9flrrlx.exec:\9flrrlx.exe28⤵
- Executes dropped EXE
PID:4040 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe29⤵
- Executes dropped EXE
PID:4372 -
\??\c:\dvdpj.exec:\dvdpj.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\lxxrlff.exec:\lxxrlff.exe31⤵
- Executes dropped EXE
PID:2668 -
\??\c:\rllfxrl.exec:\rllfxrl.exe32⤵
- Executes dropped EXE
PID:4420 -
\??\c:\btnhtn.exec:\btnhtn.exe33⤵
- Executes dropped EXE
PID:1200 -
\??\c:\dppjv.exec:\dppjv.exe34⤵
- Executes dropped EXE
PID:860 -
\??\c:\ppjdv.exec:\ppjdv.exe35⤵
- Executes dropped EXE
PID:3212 -
\??\c:\thnbtn.exec:\thnbtn.exe36⤵
- Executes dropped EXE
PID:4568 -
\??\c:\9pdvd.exec:\9pdvd.exe37⤵
- Executes dropped EXE
PID:4656 -
\??\c:\frlfxrl.exec:\frlfxrl.exe38⤵
- Executes dropped EXE
PID:3808 -
\??\c:\5hnhhh.exec:\5hnhhh.exe39⤵
- Executes dropped EXE
PID:4068 -
\??\c:\vvddp.exec:\vvddp.exe40⤵
- Executes dropped EXE
PID:3340 -
\??\c:\btthtt.exec:\btthtt.exe41⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hthttn.exec:\hthttn.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4700 -
\??\c:\vjvpd.exec:\vjvpd.exe43⤵
- Executes dropped EXE
PID:908 -
\??\c:\1jddp.exec:\1jddp.exe44⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lfffrxl.exec:\lfffrxl.exe45⤵
- Executes dropped EXE
PID:3440 -
\??\c:\9tbtnb.exec:\9tbtnb.exe46⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jvpjv.exec:\jvpjv.exe47⤵
- Executes dropped EXE
PID:3260 -
\??\c:\1xrfrfx.exec:\1xrfrfx.exe48⤵
- Executes dropped EXE
PID:4560 -
\??\c:\1fxxllf.exec:\1fxxllf.exe49⤵
- Executes dropped EXE
PID:3568 -
\??\c:\7btnbb.exec:\7btnbb.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bntnhb.exec:\bntnhb.exe51⤵
- Executes dropped EXE
PID:1344 -
\??\c:\9pjdv.exec:\9pjdv.exe52⤵
- Executes dropped EXE
PID:4944 -
\??\c:\pdvjd.exec:\pdvjd.exe53⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rrfflfx.exec:\rrfflfx.exe54⤵
- Executes dropped EXE
PID:4376 -
\??\c:\rflffxx.exec:\rflffxx.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1468 -
\??\c:\nnhbtn.exec:\nnhbtn.exe56⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pddvj.exec:\pddvj.exe57⤵
- Executes dropped EXE
PID:1304 -
\??\c:\3jjdd.exec:\3jjdd.exe58⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lffrxlf.exec:\lffrxlf.exe59⤵
- Executes dropped EXE
PID:1800 -
\??\c:\nhhhbt.exec:\nhhhbt.exe60⤵
- Executes dropped EXE
PID:8 -
\??\c:\tnhbnn.exec:\tnhbnn.exe61⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pddpd.exec:\pddpd.exe62⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vdddp.exec:\vdddp.exe63⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lfxlxxx.exec:\lfxlxxx.exe64⤵
- Executes dropped EXE
PID:1324 -
\??\c:\lllxrrl.exec:\lllxrrl.exe65⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nthbtn.exec:\nthbtn.exe66⤵PID:912
-
\??\c:\ttnbtt.exec:\ttnbtt.exe67⤵PID:4496
-
\??\c:\pjjvj.exec:\pjjvj.exe68⤵PID:4168
-
\??\c:\vvjpp.exec:\vvjpp.exe69⤵PID:4648
-
\??\c:\rfxlrlf.exec:\rfxlrlf.exe70⤵PID:2508
-
\??\c:\3xrxrlx.exec:\3xrxrlx.exe71⤵PID:116
-
\??\c:\tbtbbt.exec:\tbtbbt.exe72⤵PID:1308
-
\??\c:\thbnbb.exec:\thbnbb.exe73⤵PID:2156
-
\??\c:\ddpdv.exec:\ddpdv.exe74⤵PID:3348
-
\??\c:\vppdd.exec:\vppdd.exe75⤵PID:636
-
\??\c:\xlllxrl.exec:\xlllxrl.exe76⤵PID:2868
-
\??\c:\7fxlxrl.exec:\7fxlxrl.exe77⤵PID:4728
-
\??\c:\htnhbb.exec:\htnhbb.exe78⤵PID:4824
-
\??\c:\9pjdp.exec:\9pjdp.exe79⤵PID:1940
-
\??\c:\9jdvd.exec:\9jdvd.exe80⤵PID:1300
-
\??\c:\9xlxrlx.exec:\9xlxrlx.exe81⤵PID:3000
-
\??\c:\frxxfxf.exec:\frxxfxf.exe82⤵PID:2708
-
\??\c:\hbbthb.exec:\hbbthb.exe83⤵PID:1944
-
\??\c:\5ddpd.exec:\5ddpd.exe84⤵PID:4632
-
\??\c:\pdvjv.exec:\pdvjv.exe85⤵PID:4452
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe86⤵PID:3560
-
\??\c:\frxlxfx.exec:\frxlxfx.exe87⤵PID:2096
-
\??\c:\3bnnbt.exec:\3bnnbt.exe88⤵PID:1516
-
\??\c:\3hbttn.exec:\3hbttn.exe89⤵PID:4512
-
\??\c:\9pdvj.exec:\9pdvj.exe90⤵PID:456
-
\??\c:\5lrfxrf.exec:\5lrfxrf.exe91⤵PID:3544
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe92⤵PID:5000
-
\??\c:\9nbbtn.exec:\9nbbtn.exe93⤵PID:4588
-
\??\c:\nbhnnh.exec:\nbhnnh.exe94⤵PID:5012
-
\??\c:\pvvpj.exec:\pvvpj.exe95⤵PID:2888
-
\??\c:\ddvpj.exec:\ddvpj.exe96⤵PID:4788
-
\??\c:\lfffxrl.exec:\lfffxrl.exe97⤵PID:2248
-
\??\c:\9nnhtb.exec:\9nnhtb.exe98⤵PID:2164
-
\??\c:\nhnhtt.exec:\nhnhtt.exe99⤵PID:4232
-
\??\c:\9jjdp.exec:\9jjdp.exe100⤵PID:544
-
\??\c:\dvvjv.exec:\dvvjv.exe101⤵PID:4528
-
\??\c:\xllxfxr.exec:\xllxfxr.exe102⤵PID:4036
-
\??\c:\9ntntt.exec:\9ntntt.exe103⤵PID:680
-
\??\c:\httnhb.exec:\httnhb.exe104⤵PID:3684
-
\??\c:\9jpjd.exec:\9jpjd.exe105⤵PID:5032
-
\??\c:\vvpjd.exec:\vvpjd.exe106⤵PID:5064
-
\??\c:\7lxxlfr.exec:\7lxxlfr.exe107⤵PID:468
-
\??\c:\frxrrrr.exec:\frxrrrr.exe108⤵PID:4564
-
\??\c:\hnttnn.exec:\hnttnn.exe109⤵PID:1936
-
\??\c:\vdjjj.exec:\vdjjj.exe110⤵PID:4028
-
\??\c:\djjvj.exec:\djjvj.exe111⤵PID:4544
-
\??\c:\rffxrrl.exec:\rffxrrl.exe112⤵PID:3932
-
\??\c:\xffxllx.exec:\xffxllx.exe113⤵PID:3724
-
\??\c:\5bbbtn.exec:\5bbbtn.exe114⤵PID:2232
-
\??\c:\dppdp.exec:\dppdp.exe115⤵PID:4784
-
\??\c:\pvpjv.exec:\pvpjv.exe116⤵PID:1184
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe117⤵PID:2556
-
\??\c:\lllfxxr.exec:\lllfxxr.exe118⤵PID:1800
-
\??\c:\ttbbhn.exec:\ttbbhn.exe119⤵PID:3096
-
\??\c:\jpdjd.exec:\jpdjd.exe120⤵PID:3060
-
\??\c:\7fxrfff.exec:\7fxrfff.exe121⤵PID:1160
-
\??\c:\fflllrr.exec:\fflllrr.exe122⤵PID:528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-