Analysis
-
max time kernel
120s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe
-
Size
64KB
-
MD5
0e27ecbb18e0117535d284707d2aa900
-
SHA1
cc14e4ec60ca0d8f0cd29398af98a2de9d60b0ca
-
SHA256
5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4
-
SHA512
b3844cd879bd1e9500128534a93a44605a1de6ecfc67cd273654983a507b7fac2cb2be131f26d086c6ffc59ef66771367413b6e698b77817a2af6afb34be84ba
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27i:ymb3NkkiQ3mdBjFI9t
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4300-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4152-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3488 thhbht.exe 1752 pvddv.exe 4852 rrfxxxx.exe 2680 tthhtt.exe 2560 httnbb.exe 4012 btnhbt.exe 3692 pjjdd.exe 2284 lffxlll.exe 4940 bbttht.exe 3232 ddpvp.exe 2068 tthhnn.exe 1952 ppvpp.exe 5116 xffxrrl.exe 4564 rxlfxfx.exe 372 nbbbtt.exe 1244 ddvvp.exe 1460 dvvpp.exe 2952 rrxrxxr.exe 4432 rxrflxf.exe 3928 ddpdv.exe 3896 httthh.exe 3752 9jpjd.exe 1620 pdddv.exe 3108 1lrfxll.exe 4680 rlxrlxr.exe 1964 htnhhb.exe 4736 ppjjd.exe 4152 jvjdv.exe 4204 lfxfxxx.exe 2528 nhbhhh.exe 3044 hbhbtt.exe 4400 pjjdv.exe 1160 xflfrrl.exe 4656 bnbbbb.exe 2960 pjpvp.exe 1956 jvdpv.exe 2972 lfxxrrr.exe 1864 thtttt.exe 4312 hhbbbb.exe 3936 jpdvp.exe 4768 rxfxrrr.exe 2288 7fxflll.exe 1348 jpjjj.exe 2568 nhhbtn.exe 544 nttnhh.exe 1488 djpjp.exe 4840 vpjjj.exe 3024 lfrrrxf.exe 4852 btbbnn.exe 4420 pdvvv.exe 2216 vjppj.exe 4012 rrlffff.exe 2076 hbhhhh.exe 4404 1tntnn.exe 2044 dvjdv.exe 2008 jddpd.exe 3616 lfxrllf.exe 1868 bhttnt.exe 1448 tbbbtb.exe 2068 ddvvv.exe 548 xrllffx.exe 4500 llfffxx.exe 3688 nnhbtn.exe 1768 hhbtnn.exe -
resource yara_rule behavioral2/memory/4300-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4152-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 3488 4300 5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe 82 PID 4300 wrote to memory of 3488 4300 5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe 82 PID 4300 wrote to memory of 3488 4300 5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe 82 PID 3488 wrote to memory of 1752 3488 thhbht.exe 83 PID 3488 wrote to memory of 1752 3488 thhbht.exe 83 PID 3488 wrote to memory of 1752 3488 thhbht.exe 83 PID 1752 wrote to memory of 4852 1752 pvddv.exe 84 PID 1752 wrote to memory of 4852 1752 pvddv.exe 84 PID 1752 wrote to memory of 4852 1752 pvddv.exe 84 PID 4852 wrote to memory of 2680 4852 rrfxxxx.exe 85 PID 4852 wrote to memory of 2680 4852 rrfxxxx.exe 85 PID 4852 wrote to memory of 2680 4852 rrfxxxx.exe 85 PID 2680 wrote to memory of 2560 2680 tthhtt.exe 86 PID 2680 wrote to memory of 2560 2680 tthhtt.exe 86 PID 2680 wrote to memory of 2560 2680 tthhtt.exe 86 PID 2560 wrote to memory of 4012 2560 httnbb.exe 87 PID 2560 wrote to memory of 4012 2560 httnbb.exe 87 PID 2560 wrote to memory of 4012 2560 httnbb.exe 87 PID 4012 wrote to memory of 3692 4012 btnhbt.exe 88 PID 4012 wrote to memory of 3692 4012 btnhbt.exe 88 PID 4012 wrote to memory of 3692 4012 btnhbt.exe 88 PID 3692 wrote to memory of 2284 3692 pjjdd.exe 89 PID 3692 wrote to memory of 2284 3692 pjjdd.exe 89 PID 3692 wrote to memory of 2284 3692 pjjdd.exe 89 PID 2284 wrote to memory of 4940 2284 lffxlll.exe 90 PID 2284 wrote to memory of 4940 2284 lffxlll.exe 90 PID 2284 wrote to memory of 4940 2284 lffxlll.exe 90 PID 4940 wrote to memory of 3232 4940 bbttht.exe 91 PID 4940 wrote to memory of 3232 4940 bbttht.exe 91 PID 4940 wrote to memory of 3232 4940 bbttht.exe 91 PID 3232 wrote to memory of 2068 3232 ddpvp.exe 92 PID 3232 wrote to memory of 2068 3232 ddpvp.exe 92 PID 3232 wrote to memory of 2068 3232 ddpvp.exe 92 PID 2068 wrote to memory of 1952 2068 tthhnn.exe 93 PID 2068 wrote to memory of 1952 2068 tthhnn.exe 93 PID 2068 wrote to memory of 1952 2068 tthhnn.exe 93 PID 1952 wrote to memory of 5116 1952 ppvpp.exe 94 PID 1952 wrote to memory of 5116 1952 ppvpp.exe 94 PID 1952 wrote to memory of 5116 1952 ppvpp.exe 94 PID 5116 wrote to memory of 4564 5116 xffxrrl.exe 95 PID 5116 wrote to memory of 4564 5116 xffxrrl.exe 95 PID 5116 wrote to memory of 4564 5116 xffxrrl.exe 95 PID 4564 wrote to memory of 372 4564 rxlfxfx.exe 96 PID 4564 wrote to memory of 372 4564 rxlfxfx.exe 96 PID 4564 wrote to memory of 372 4564 rxlfxfx.exe 96 PID 372 wrote to memory of 1244 372 nbbbtt.exe 97 PID 372 wrote to memory of 1244 372 nbbbtt.exe 97 PID 372 wrote to memory of 1244 372 nbbbtt.exe 97 PID 1244 wrote to memory of 1460 1244 ddvvp.exe 98 PID 1244 wrote to memory of 1460 1244 ddvvp.exe 98 PID 1244 wrote to memory of 1460 1244 ddvvp.exe 98 PID 1460 wrote to memory of 2952 1460 dvvpp.exe 99 PID 1460 wrote to memory of 2952 1460 dvvpp.exe 99 PID 1460 wrote to memory of 2952 1460 dvvpp.exe 99 PID 2952 wrote to memory of 4432 2952 rrxrxxr.exe 100 PID 2952 wrote to memory of 4432 2952 rrxrxxr.exe 100 PID 2952 wrote to memory of 4432 2952 rrxrxxr.exe 100 PID 4432 wrote to memory of 3928 4432 rxrflxf.exe 101 PID 4432 wrote to memory of 3928 4432 rxrflxf.exe 101 PID 4432 wrote to memory of 3928 4432 rxrflxf.exe 101 PID 3928 wrote to memory of 3896 3928 ddpdv.exe 102 PID 3928 wrote to memory of 3896 3928 ddpdv.exe 102 PID 3928 wrote to memory of 3896 3928 ddpdv.exe 102 PID 3896 wrote to memory of 3752 3896 httthh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe"C:\Users\Admin\AppData\Local\Temp\5ff125fe3e22ed74e97814b76bf9cb11825bc1054b31eb081b8601971a11cff4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\thhbht.exec:\thhbht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\pvddv.exec:\pvddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\tthhtt.exec:\tthhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\httnbb.exec:\httnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\btnhbt.exec:\btnhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\pjjdd.exec:\pjjdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\lffxlll.exec:\lffxlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bbttht.exec:\bbttht.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\ddpvp.exec:\ddpvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\tthhnn.exec:\tthhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ppvpp.exec:\ppvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\xffxrrl.exec:\xffxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\rxlfxfx.exec:\rxlfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\nbbbtt.exec:\nbbbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\ddvvp.exec:\ddvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\dvvpp.exec:\dvvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\rrxrxxr.exec:\rrxrxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rxrflxf.exec:\rxrflxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\ddpdv.exec:\ddpdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\httthh.exec:\httthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\9jpjd.exec:\9jpjd.exe23⤵
- Executes dropped EXE
PID:3752 -
\??\c:\pdddv.exec:\pdddv.exe24⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1lrfxll.exec:\1lrfxll.exe25⤵
- Executes dropped EXE
PID:3108 -
\??\c:\rlxrlxr.exec:\rlxrlxr.exe26⤵
- Executes dropped EXE
PID:4680 -
\??\c:\htnhhb.exec:\htnhhb.exe27⤵
- Executes dropped EXE
PID:1964 -
\??\c:\ppjjd.exec:\ppjjd.exe28⤵
- Executes dropped EXE
PID:4736 -
\??\c:\jvjdv.exec:\jvjdv.exe29⤵
- Executes dropped EXE
PID:4152 -
\??\c:\lfxfxxx.exec:\lfxfxxx.exe30⤵
- Executes dropped EXE
PID:4204 -
\??\c:\nhbhhh.exec:\nhbhhh.exe31⤵
- Executes dropped EXE
PID:2528 -
\??\c:\hbhbtt.exec:\hbhbtt.exe32⤵
- Executes dropped EXE
PID:3044 -
\??\c:\pjjdv.exec:\pjjdv.exe33⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xflfrrl.exec:\xflfrrl.exe34⤵
- Executes dropped EXE
PID:1160 -
\??\c:\bnbbbb.exec:\bnbbbb.exe35⤵
- Executes dropped EXE
PID:4656 -
\??\c:\pjpvp.exec:\pjpvp.exe36⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvdpv.exec:\jvdpv.exe37⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe38⤵
- Executes dropped EXE
PID:2972 -
\??\c:\thtttt.exec:\thtttt.exe39⤵
- Executes dropped EXE
PID:1864 -
\??\c:\hhbbbb.exec:\hhbbbb.exe40⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jpdvp.exec:\jpdvp.exe41⤵
- Executes dropped EXE
PID:3936 -
\??\c:\rxfxrrr.exec:\rxfxrrr.exe42⤵
- Executes dropped EXE
PID:4768 -
\??\c:\7fxflll.exec:\7fxflll.exe43⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jpjjj.exec:\jpjjj.exe44⤵
- Executes dropped EXE
PID:1348 -
\??\c:\nhhbtn.exec:\nhhbtn.exe45⤵
- Executes dropped EXE
PID:2568 -
\??\c:\nttnhh.exec:\nttnhh.exe46⤵
- Executes dropped EXE
PID:544 -
\??\c:\djpjp.exec:\djpjp.exe47⤵
- Executes dropped EXE
PID:1488 -
\??\c:\vpjjj.exec:\vpjjj.exe48⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lfrrrxf.exec:\lfrrrxf.exe49⤵
- Executes dropped EXE
PID:3024 -
\??\c:\btbbnn.exec:\btbbnn.exe50⤵
- Executes dropped EXE
PID:4852 -
\??\c:\pdvvv.exec:\pdvvv.exe51⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vjppj.exec:\vjppj.exe52⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rrlffff.exec:\rrlffff.exe53⤵
- Executes dropped EXE
PID:4012 -
\??\c:\hbhhhh.exec:\hbhhhh.exe54⤵
- Executes dropped EXE
PID:2076 -
\??\c:\1tntnn.exec:\1tntnn.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\dvjdv.exec:\dvjdv.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\jddpd.exec:\jddpd.exe57⤵
- Executes dropped EXE
PID:2008 -
\??\c:\lfxrllf.exec:\lfxrllf.exe58⤵
- Executes dropped EXE
PID:3616 -
\??\c:\bhttnt.exec:\bhttnt.exe59⤵
- Executes dropped EXE
PID:1868 -
\??\c:\tbbbtb.exec:\tbbbtb.exe60⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ddvvv.exec:\ddvvv.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\xrllffx.exec:\xrllffx.exe62⤵
- Executes dropped EXE
PID:548 -
\??\c:\llfffxx.exec:\llfffxx.exe63⤵
- Executes dropped EXE
PID:4500 -
\??\c:\nnhbtn.exec:\nnhbtn.exe64⤵
- Executes dropped EXE
PID:3688 -
\??\c:\hhbtnn.exec:\hhbtnn.exe65⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vppdp.exec:\vppdp.exe66⤵PID:2360
-
\??\c:\llfffff.exec:\llfffff.exe67⤵PID:452
-
\??\c:\fxffffx.exec:\fxffffx.exe68⤵PID:5076
-
\??\c:\nhhhbb.exec:\nhhhbb.exe69⤵PID:316
-
\??\c:\thnnnt.exec:\thnnnt.exe70⤵PID:2952
-
\??\c:\jdvpj.exec:\jdvpj.exe71⤵PID:3764
-
\??\c:\flrfxxr.exec:\flrfxxr.exe72⤵PID:4432
-
\??\c:\1frlfff.exec:\1frlfff.exe73⤵PID:3840
-
\??\c:\hnbhtt.exec:\hnbhtt.exe74⤵PID:2196
-
\??\c:\3ttbtt.exec:\3ttbtt.exe75⤵PID:4468
-
\??\c:\pjjvj.exec:\pjjvj.exe76⤵PID:436
-
\??\c:\lxxrrxx.exec:\lxxrrxx.exe77⤵PID:1620
-
\??\c:\bbhbbh.exec:\bbhbbh.exe78⤵PID:2904
-
\??\c:\hbtbth.exec:\hbtbth.exe79⤵PID:4928
-
\??\c:\jdjjv.exec:\jdjjv.exe80⤵PID:4068
-
\??\c:\xrllrxl.exec:\xrllrxl.exe81⤵PID:5004
-
\??\c:\frxxrrr.exec:\frxxrrr.exe82⤵PID:4268
-
\??\c:\hbthbt.exec:\hbthbt.exe83⤵PID:2732
-
\??\c:\bnhhbb.exec:\bnhhbb.exe84⤵PID:3704
-
\??\c:\9pvvj.exec:\9pvvj.exe85⤵PID:4976
-
\??\c:\xrxrlll.exec:\xrxrlll.exe86⤵PID:1000
-
\??\c:\1bbtnn.exec:\1bbtnn.exe87⤵PID:816
-
\??\c:\nbbthh.exec:\nbbthh.exe88⤵PID:2036
-
\??\c:\5vjjv.exec:\5vjjv.exe89⤵PID:4372
-
\??\c:\vppjv.exec:\vppjv.exe90⤵PID:624
-
\??\c:\xfffxxx.exec:\xfffxxx.exe91⤵PID:1332
-
\??\c:\7nhhtt.exec:\7nhhtt.exe92⤵PID:1956
-
\??\c:\3pppj.exec:\3pppj.exe93⤵PID:2972
-
\??\c:\jpvjp.exec:\jpvjp.exe94⤵PID:3052
-
\??\c:\7xlffff.exec:\7xlffff.exe95⤵PID:2384
-
\??\c:\rfllllr.exec:\rfllllr.exe96⤵PID:1556
-
\??\c:\vvppj.exec:\vvppj.exe97⤵PID:4464
-
\??\c:\dvjvj.exec:\dvjvj.exe98⤵PID:4548
-
\??\c:\frrlffx.exec:\frrlffx.exe99⤵PID:2496
-
\??\c:\tnhnbb.exec:\tnhnbb.exe100⤵PID:656
-
\??\c:\nnbbnn.exec:\nnbbnn.exe101⤵PID:1040
-
\??\c:\5jvpj.exec:\5jvpj.exe102⤵PID:3540
-
\??\c:\rlrrrll.exec:\rlrrrll.exe103⤵PID:1436
-
\??\c:\9fffxrr.exec:\9fffxrr.exe104⤵PID:4340
-
\??\c:\bbbttt.exec:\bbbttt.exe105⤵PID:2956
-
\??\c:\djpjv.exec:\djpjv.exe106⤵PID:3900
-
\??\c:\vdjdp.exec:\vdjdp.exe107⤵PID:3996
-
\??\c:\xfllfff.exec:\xfllfff.exe108⤵PID:1816
-
\??\c:\hhhhhh.exec:\hhhhhh.exe109⤵PID:3692
-
\??\c:\3nnhtt.exec:\3nnhtt.exe110⤵PID:4100
-
\??\c:\7ppjd.exec:\7ppjd.exe111⤵PID:5064
-
\??\c:\vpppd.exec:\vpppd.exe112⤵PID:764
-
\??\c:\lfxxffl.exec:\lfxxffl.exe113⤵PID:5044
-
\??\c:\tntnnn.exec:\tntnnn.exe114⤵PID:4244
-
\??\c:\9htnbh.exec:\9htnbh.exe115⤵PID:5040
-
\??\c:\nntttt.exec:\nntttt.exe116⤵PID:1448
-
\??\c:\pvpjd.exec:\pvpjd.exe117⤵PID:1240
-
\??\c:\jjdvd.exec:\jjdvd.exe118⤵PID:4004
-
\??\c:\rrrfxxx.exec:\rrrfxxx.exe119⤵PID:4500
-
\??\c:\bhhhhh.exec:\bhhhhh.exe120⤵PID:3688
-
\??\c:\hbhbbb.exec:\hbhbbb.exe121⤵PID:1768
-
\??\c:\ddjjp.exec:\ddjjp.exe122⤵PID:1656
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-