Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 18:25
Static task
static1
Behavioral task
behavioral1
Sample
2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe
Resource
win7-20240903-en
General
-
Target
2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe
-
Size
82KB
-
MD5
54da9beff2981097b3531290564ce3d0
-
SHA1
a7e99b4c8d0317d43f822b98b27b5ea5d348ebdc
-
SHA256
2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437d
-
SHA512
e7bbfc6ad03f6eb409286dfc4228c0267f3e0f59449f798e2c8e61554660fde88774e0bee70532bc33d76e371d1bfb3a52ab0983d33a6285d8987a12f4b9965e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q1C:ymb3NkkiQ3mdBjFIIp9L9QrrA82C
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1656-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4404 vppjd.exe 2744 1xrlrrr.exe 1520 jjpdd.exe 3756 rlllllf.exe 4120 flxxfrx.exe 3468 hnntnt.exe 4500 vppdp.exe 4612 xxrrrxx.exe 2556 5nhbbb.exe 856 jpvvd.exe 1004 xllfflx.exe 2352 fllfrxl.exe 2644 hbbbtb.exe 4216 djvvv.exe 212 rrrrlll.exe 4060 nnhhhn.exe 4456 ppddj.exe 3852 ffrrlfr.exe 4832 bbbbtb.exe 708 nntnhh.exe 4632 7vvvv.exe 2080 fflrfrf.exe 544 ttbbbh.exe 2500 5vjjj.exe 3188 flrrrff.exe 1768 ttttbb.exe 5076 5bhbbt.exe 996 7pddd.exe 3276 frlrrlr.exe 1856 lrflxlr.exe 3736 9hnnnt.exe 3688 vdjpv.exe 4964 rrxxxff.exe 2056 tntbhh.exe 740 ddjpv.exe 1324 ntntth.exe 1572 vdvvj.exe 1664 fflxrxf.exe 1200 nbnntt.exe 4912 5pddd.exe 1776 7lxfflr.exe 1052 lflffxf.exe 4296 bbhhhn.exe 4260 jjvdj.exe 440 9rxfflr.exe 4344 btbbtb.exe 2772 nhnhtn.exe 5056 ddddd.exe 4936 tnhhht.exe 436 9jvvv.exe 2504 1xffrxf.exe 2044 bbttnn.exe 3244 nbnnnt.exe 1568 jdddd.exe 932 7jppv.exe 4792 rrxfflr.exe 3016 flrrrlr.exe 744 nnhnnt.exe 872 7pddj.exe 4612 vpdvp.exe 692 9xlfffx.exe 1436 nntbbh.exe 2832 fxlrxlx.exe 4188 fxxlffx.exe -
resource yara_rule behavioral2/memory/1656-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2644-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4060-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 4404 1656 2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe 81 PID 1656 wrote to memory of 4404 1656 2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe 81 PID 1656 wrote to memory of 4404 1656 2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe 81 PID 4404 wrote to memory of 2744 4404 vppjd.exe 82 PID 4404 wrote to memory of 2744 4404 vppjd.exe 82 PID 4404 wrote to memory of 2744 4404 vppjd.exe 82 PID 2744 wrote to memory of 1520 2744 1xrlrrr.exe 83 PID 2744 wrote to memory of 1520 2744 1xrlrrr.exe 83 PID 2744 wrote to memory of 1520 2744 1xrlrrr.exe 83 PID 1520 wrote to memory of 3756 1520 jjpdd.exe 84 PID 1520 wrote to memory of 3756 1520 jjpdd.exe 84 PID 1520 wrote to memory of 3756 1520 jjpdd.exe 84 PID 3756 wrote to memory of 4120 3756 rlllllf.exe 85 PID 3756 wrote to memory of 4120 3756 rlllllf.exe 85 PID 3756 wrote to memory of 4120 3756 rlllllf.exe 85 PID 4120 wrote to memory of 3468 4120 flxxfrx.exe 86 PID 4120 wrote to memory of 3468 4120 flxxfrx.exe 86 PID 4120 wrote to memory of 3468 4120 flxxfrx.exe 86 PID 3468 wrote to memory of 4500 3468 hnntnt.exe 87 PID 3468 wrote to memory of 4500 3468 hnntnt.exe 87 PID 3468 wrote to memory of 4500 3468 hnntnt.exe 87 PID 4500 wrote to memory of 4612 4500 vppdp.exe 88 PID 4500 wrote to memory of 4612 4500 vppdp.exe 88 PID 4500 wrote to memory of 4612 4500 vppdp.exe 88 PID 4612 wrote to memory of 2556 4612 xxrrrxx.exe 89 PID 4612 wrote to memory of 2556 4612 xxrrrxx.exe 89 PID 4612 wrote to memory of 2556 4612 xxrrrxx.exe 89 PID 2556 wrote to memory of 856 2556 5nhbbb.exe 90 PID 2556 wrote to memory of 856 2556 5nhbbb.exe 90 PID 2556 wrote to memory of 856 2556 5nhbbb.exe 90 PID 856 wrote to memory of 1004 856 jpvvd.exe 91 PID 856 wrote to memory of 1004 856 jpvvd.exe 91 PID 856 wrote to memory of 1004 856 jpvvd.exe 91 PID 1004 wrote to memory of 2352 1004 xllfflx.exe 92 PID 1004 wrote to memory of 2352 1004 xllfflx.exe 92 PID 1004 wrote to memory of 2352 1004 xllfflx.exe 92 PID 2352 wrote to memory of 2644 2352 fllfrxl.exe 93 PID 2352 wrote to memory of 2644 2352 fllfrxl.exe 93 PID 2352 wrote to memory of 2644 2352 fllfrxl.exe 93 PID 2644 wrote to memory of 4216 2644 hbbbtb.exe 94 PID 2644 wrote to memory of 4216 2644 hbbbtb.exe 94 PID 2644 wrote to memory of 4216 2644 hbbbtb.exe 94 PID 4216 wrote to memory of 212 4216 djvvv.exe 95 PID 4216 wrote to memory of 212 4216 djvvv.exe 95 PID 4216 wrote to memory of 212 4216 djvvv.exe 95 PID 212 wrote to memory of 4060 212 rrrrlll.exe 96 PID 212 wrote to memory of 4060 212 rrrrlll.exe 96 PID 212 wrote to memory of 4060 212 rrrrlll.exe 96 PID 4060 wrote to memory of 4456 4060 nnhhhn.exe 97 PID 4060 wrote to memory of 4456 4060 nnhhhn.exe 97 PID 4060 wrote to memory of 4456 4060 nnhhhn.exe 97 PID 4456 wrote to memory of 3852 4456 ppddj.exe 98 PID 4456 wrote to memory of 3852 4456 ppddj.exe 98 PID 4456 wrote to memory of 3852 4456 ppddj.exe 98 PID 3852 wrote to memory of 4832 3852 ffrrlfr.exe 99 PID 3852 wrote to memory of 4832 3852 ffrrlfr.exe 99 PID 3852 wrote to memory of 4832 3852 ffrrlfr.exe 99 PID 4832 wrote to memory of 708 4832 bbbbtb.exe 100 PID 4832 wrote to memory of 708 4832 bbbbtb.exe 100 PID 4832 wrote to memory of 708 4832 bbbbtb.exe 100 PID 708 wrote to memory of 4632 708 nntnhh.exe 101 PID 708 wrote to memory of 4632 708 nntnhh.exe 101 PID 708 wrote to memory of 4632 708 nntnhh.exe 101 PID 4632 wrote to memory of 2080 4632 7vvvv.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe"C:\Users\Admin\AppData\Local\Temp\2705f4e72962f07c9c4e02bbb284d1e3dab3f098ea789e700afa9612dcf8437dN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vppjd.exec:\vppjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\1xrlrrr.exec:\1xrlrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\jjpdd.exec:\jjpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\rlllllf.exec:\rlllllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\flxxfrx.exec:\flxxfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\hnntnt.exec:\hnntnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\vppdp.exec:\vppdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\xxrrrxx.exec:\xxrrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\5nhbbb.exec:\5nhbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\jpvvd.exec:\jpvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\xllfflx.exec:\xllfflx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
\??\c:\fllfrxl.exec:\fllfrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\hbbbtb.exec:\hbbbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\djvvv.exec:\djvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\rrrrlll.exec:\rrrrlll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\nnhhhn.exec:\nnhhhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\ppddj.exec:\ppddj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\ffrrlfr.exec:\ffrrlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\bbbbtb.exec:\bbbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\nntnhh.exec:\nntnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\7vvvv.exec:\7vvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\fflrfrf.exec:\fflrfrf.exe23⤵
- Executes dropped EXE
PID:2080 -
\??\c:\ttbbbh.exec:\ttbbbh.exe24⤵
- Executes dropped EXE
PID:544 -
\??\c:\5vjjj.exec:\5vjjj.exe25⤵
- Executes dropped EXE
PID:2500 -
\??\c:\flrrrff.exec:\flrrrff.exe26⤵
- Executes dropped EXE
PID:3188 -
\??\c:\ttttbb.exec:\ttttbb.exe27⤵
- Executes dropped EXE
PID:1768 -
\??\c:\5bhbbt.exec:\5bhbbt.exe28⤵
- Executes dropped EXE
PID:5076 -
\??\c:\7pddd.exec:\7pddd.exe29⤵
- Executes dropped EXE
PID:996 -
\??\c:\frlrrlr.exec:\frlrrlr.exe30⤵
- Executes dropped EXE
PID:3276 -
\??\c:\lrflxlr.exec:\lrflxlr.exe31⤵
- Executes dropped EXE
PID:1856 -
\??\c:\9hnnnt.exec:\9hnnnt.exe32⤵
- Executes dropped EXE
PID:3736 -
\??\c:\vdjpv.exec:\vdjpv.exe33⤵
- Executes dropped EXE
PID:3688 -
\??\c:\rrxxxff.exec:\rrxxxff.exe34⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tntbhh.exec:\tntbhh.exe35⤵
- Executes dropped EXE
PID:2056 -
\??\c:\ddjpv.exec:\ddjpv.exe36⤵
- Executes dropped EXE
PID:740 -
\??\c:\ntntth.exec:\ntntth.exe37⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vdvvj.exec:\vdvvj.exe38⤵
- Executes dropped EXE
PID:1572 -
\??\c:\fflxrxf.exec:\fflxrxf.exe39⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nbnntt.exec:\nbnntt.exe40⤵
- Executes dropped EXE
PID:1200 -
\??\c:\5pddd.exec:\5pddd.exe41⤵
- Executes dropped EXE
PID:4912 -
\??\c:\7lxfflr.exec:\7lxfflr.exe42⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lflffxf.exec:\lflffxf.exe43⤵
- Executes dropped EXE
PID:1052 -
\??\c:\bbhhhn.exec:\bbhhhn.exe44⤵
- Executes dropped EXE
PID:4296 -
\??\c:\jjvdj.exec:\jjvdj.exe45⤵
- Executes dropped EXE
PID:4260 -
\??\c:\9rxfflr.exec:\9rxfflr.exe46⤵
- Executes dropped EXE
PID:440 -
\??\c:\btbbtb.exec:\btbbtb.exe47⤵
- Executes dropped EXE
PID:4344 -
\??\c:\nhnhtn.exec:\nhnhtn.exe48⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddddd.exec:\ddddd.exe49⤵
- Executes dropped EXE
PID:5056 -
\??\c:\tnhhht.exec:\tnhhht.exe50⤵
- Executes dropped EXE
PID:4936 -
\??\c:\9jvvv.exec:\9jvvv.exe51⤵
- Executes dropped EXE
PID:436 -
\??\c:\1xffrxf.exec:\1xffrxf.exe52⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bbttnn.exec:\bbttnn.exe53⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nbnnnt.exec:\nbnnnt.exe54⤵
- Executes dropped EXE
PID:3244 -
\??\c:\jdddd.exec:\jdddd.exe55⤵
- Executes dropped EXE
PID:1568 -
\??\c:\7jppv.exec:\7jppv.exe56⤵
- Executes dropped EXE
PID:932 -
\??\c:\rrxfflr.exec:\rrxfflr.exe57⤵
- Executes dropped EXE
PID:4792 -
\??\c:\flrrrlr.exec:\flrrrlr.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nnhnnt.exec:\nnhnnt.exe59⤵
- Executes dropped EXE
PID:744 -
\??\c:\7pddj.exec:\7pddj.exe60⤵
- Executes dropped EXE
PID:872 -
\??\c:\vpdvp.exec:\vpdvp.exe61⤵
- Executes dropped EXE
PID:4612 -
\??\c:\9xlfffx.exec:\9xlfffx.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\nntbbh.exec:\nntbbh.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1436 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe64⤵
- Executes dropped EXE
PID:2832 -
\??\c:\fxxlffx.exec:\fxxlffx.exe65⤵
- Executes dropped EXE
PID:4188 -
\??\c:\htntth.exec:\htntth.exe66⤵PID:2760
-
\??\c:\pvjvp.exec:\pvjvp.exe67⤵PID:3312
-
\??\c:\ppjjj.exec:\ppjjj.exe68⤵PID:1384
-
\??\c:\3lxxrxf.exec:\3lxxrxf.exe69⤵PID:3764
-
\??\c:\7httnt.exec:\7httnt.exe70⤵PID:5012
-
\??\c:\nhtbhb.exec:\nhtbhb.exe71⤵PID:1672
-
\??\c:\ddjpp.exec:\ddjpp.exe72⤵PID:208
-
\??\c:\ppdvv.exec:\ppdvv.exe73⤵PID:2120
-
\??\c:\rlllllr.exec:\rlllllr.exe74⤵PID:4060
-
\??\c:\tthhhn.exec:\tthhhn.exe75⤵PID:3500
-
\??\c:\tbbbnn.exec:\tbbbnn.exe76⤵PID:4528
-
\??\c:\3vjjd.exec:\3vjjd.exe77⤵PID:3256
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe78⤵PID:628
-
\??\c:\rlrxrxf.exec:\rlrxrxf.exe79⤵PID:4588
-
\??\c:\nnbbtb.exec:\nnbbtb.exe80⤵PID:1800
-
\??\c:\ddddv.exec:\ddddv.exe81⤵PID:1644
-
\??\c:\ddjjd.exec:\ddjjd.exe82⤵PID:4420
-
\??\c:\rfrrlrx.exec:\rfrrlrx.exe83⤵PID:3268
-
\??\c:\bnbhhn.exec:\bnbhhn.exe84⤵PID:1732
-
\??\c:\bhhnhn.exec:\bhhnhn.exe85⤵PID:3188
-
\??\c:\1jvvv.exec:\1jvvv.exe86⤵PID:4988
-
\??\c:\ffxxxlr.exec:\ffxxxlr.exe87⤵PID:3508
-
\??\c:\rrxffll.exec:\rrxffll.exe88⤵PID:552
-
\??\c:\hthhhh.exec:\hthhhh.exe89⤵PID:2000
-
\??\c:\vdjjd.exec:\vdjjd.exe90⤵PID:3132
-
\??\c:\vvvvv.exec:\vvvvv.exe91⤵PID:2496
-
\??\c:\ffrxxfl.exec:\ffrxxfl.exe92⤵PID:3960
-
\??\c:\ntbhhn.exec:\ntbhhn.exe93⤵PID:4844
-
\??\c:\ttnbnn.exec:\ttnbnn.exe94⤵PID:2480
-
\??\c:\vdjpp.exec:\vdjpp.exe95⤵PID:5116
-
\??\c:\5pddv.exec:\5pddv.exe96⤵PID:1188
-
\??\c:\7rfxrrl.exec:\7rfxrrl.exe97⤵PID:2232
-
\??\c:\bnhbbn.exec:\bnhbbn.exe98⤵PID:2788
-
\??\c:\htnnhh.exec:\htnnhh.exe99⤵PID:1100
-
\??\c:\dpvdd.exec:\dpvdd.exe100⤵PID:1792
-
\??\c:\7pppv.exec:\7pppv.exe101⤵PID:844
-
\??\c:\xfrrrxf.exec:\xfrrrxf.exe102⤵PID:3336
-
\??\c:\tthhhh.exec:\tthhhh.exe103⤵PID:4856
-
\??\c:\7nnnhn.exec:\7nnnhn.exe104⤵PID:4984
-
\??\c:\vppvv.exec:\vppvv.exe105⤵PID:2912
-
\??\c:\vvvvv.exec:\vvvvv.exe106⤵PID:3248
-
\??\c:\xxlrrrl.exec:\xxlrrrl.exe107⤵PID:2488
-
\??\c:\7hbhhn.exec:\7hbhhn.exe108⤵PID:4900
-
\??\c:\tbbbhn.exec:\tbbbhn.exe109⤵PID:2396
-
\??\c:\3dpvp.exec:\3dpvp.exe110⤵PID:1924
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe111⤵PID:5056
-
\??\c:\tttttt.exec:\tttttt.exe112⤵PID:4936
-
\??\c:\ppvvp.exec:\ppvvp.exe113⤵PID:436
-
\??\c:\jvjjj.exec:\jvjjj.exe114⤵PID:2220
-
\??\c:\1ffxrll.exec:\1ffxrll.exe115⤵PID:2044
-
\??\c:\flxffrx.exec:\flxffrx.exe116⤵PID:3612
-
\??\c:\hthbbh.exec:\hthbbh.exe117⤵PID:4056
-
\??\c:\nhhbbb.exec:\nhhbbb.exe118⤵PID:4496
-
\??\c:\5vpvj.exec:\5vpvj.exe119⤵PID:4792
-
\??\c:\5lrrrrx.exec:\5lrrrrx.exe120⤵PID:3016
-
\??\c:\rlllfll.exec:\rlllfll.exe121⤵PID:3600
-
\??\c:\hnnttb.exec:\hnnttb.exe122⤵PID:920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-