Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe
Resource
win7-20240708-en
General
-
Target
dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe
-
Size
74KB
-
MD5
e7b7b20385117d468894cc6841e56b90
-
SHA1
0f4eec9b68da149dae012de798d1efdace685253
-
SHA256
dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1
-
SHA512
bf9dfa380bee5f61caff7c02caa6f059fbd2e726717234f641e62c014bd8d8a75f559eb44ae7f68e553b5f700fb2edc9fcd808dfbf5c6854da4a0e39f91d9693
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPB:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHC
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3056-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/228-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 400 9dvpd.exe 4568 frfrfxl.exe 228 hthbbt.exe 4280 tnbnhb.exe 3956 7jdjv.exe 2968 rrrlxxr.exe 3088 vpjvp.exe 2776 pdvvd.exe 4284 bntnbt.exe 4420 pdvjv.exe 4592 xllfrfx.exe 1608 frrfrlf.exe 3664 dpjvj.exe 4996 jvvpp.exe 4992 rfxlxrf.exe 1420 1xrfrrl.exe 1604 hhhbnh.exe 5096 jdvvd.exe 2472 djvvj.exe 3688 xxxlxlf.exe 3708 llfrlfr.exe 4540 thhbnh.exe 4504 nhtntn.exe 2676 vjpvd.exe 3212 xrlxlfr.exe 4620 frlrffr.exe 1204 hththh.exe 4552 dvjjd.exe 1084 xlrffrl.exe 116 7bbnhb.exe 3524 7tthtn.exe 4052 pvjjd.exe 2136 rlrxfxx.exe 3228 rrxxxxf.exe 716 bhbtnh.exe 4916 3vpdv.exe 2904 rfxlxlf.exe 2532 lxlxlff.exe 4784 nthtnh.exe 4348 pppdj.exe 3388 lffxlfl.exe 632 ddvvv.exe 4840 pvpjj.exe 892 btnhhh.exe 1044 pvvjv.exe 3416 lxfrfxr.exe 2916 htnhtn.exe 4600 pvddd.exe 3580 xrrflfr.exe 2832 xxxxrrl.exe 1236 hhhhnn.exe 2776 vpjjv.exe 2644 vpjvj.exe 1516 3xxlxll.exe 1356 xffrflf.exe 2740 hbnbnt.exe 2360 nbthth.exe 3352 vvvjv.exe 3664 vpdpj.exe 4128 lffxxrr.exe 2032 7tnhbn.exe 2960 hththb.exe 3620 pdvdv.exe 4268 jdpdp.exe -
resource yara_rule behavioral2/memory/3056-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/228-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflffxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 400 3056 dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe 82 PID 3056 wrote to memory of 400 3056 dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe 82 PID 3056 wrote to memory of 400 3056 dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe 82 PID 400 wrote to memory of 4568 400 9dvpd.exe 83 PID 400 wrote to memory of 4568 400 9dvpd.exe 83 PID 400 wrote to memory of 4568 400 9dvpd.exe 83 PID 4568 wrote to memory of 228 4568 frfrfxl.exe 84 PID 4568 wrote to memory of 228 4568 frfrfxl.exe 84 PID 4568 wrote to memory of 228 4568 frfrfxl.exe 84 PID 228 wrote to memory of 4280 228 hthbbt.exe 85 PID 228 wrote to memory of 4280 228 hthbbt.exe 85 PID 228 wrote to memory of 4280 228 hthbbt.exe 85 PID 4280 wrote to memory of 3956 4280 tnbnhb.exe 86 PID 4280 wrote to memory of 3956 4280 tnbnhb.exe 86 PID 4280 wrote to memory of 3956 4280 tnbnhb.exe 86 PID 3956 wrote to memory of 2968 3956 7jdjv.exe 87 PID 3956 wrote to memory of 2968 3956 7jdjv.exe 87 PID 3956 wrote to memory of 2968 3956 7jdjv.exe 87 PID 2968 wrote to memory of 3088 2968 rrrlxxr.exe 88 PID 2968 wrote to memory of 3088 2968 rrrlxxr.exe 88 PID 2968 wrote to memory of 3088 2968 rrrlxxr.exe 88 PID 3088 wrote to memory of 2776 3088 vpjvp.exe 89 PID 3088 wrote to memory of 2776 3088 vpjvp.exe 89 PID 3088 wrote to memory of 2776 3088 vpjvp.exe 89 PID 2776 wrote to memory of 4284 2776 pdvvd.exe 90 PID 2776 wrote to memory of 4284 2776 pdvvd.exe 90 PID 2776 wrote to memory of 4284 2776 pdvvd.exe 90 PID 4284 wrote to memory of 4420 4284 bntnbt.exe 91 PID 4284 wrote to memory of 4420 4284 bntnbt.exe 91 PID 4284 wrote to memory of 4420 4284 bntnbt.exe 91 PID 4420 wrote to memory of 4592 4420 pdvjv.exe 92 PID 4420 wrote to memory of 4592 4420 pdvjv.exe 92 PID 4420 wrote to memory of 4592 4420 pdvjv.exe 92 PID 4592 wrote to memory of 1608 4592 xllfrfx.exe 93 PID 4592 wrote to memory of 1608 4592 xllfrfx.exe 93 PID 4592 wrote to memory of 1608 4592 xllfrfx.exe 93 PID 1608 wrote to memory of 3664 1608 frrfrlf.exe 94 PID 1608 wrote to memory of 3664 1608 frrfrlf.exe 94 PID 1608 wrote to memory of 3664 1608 frrfrlf.exe 94 PID 3664 wrote to memory of 4996 3664 dpjvj.exe 95 PID 3664 wrote to memory of 4996 3664 dpjvj.exe 95 PID 3664 wrote to memory of 4996 3664 dpjvj.exe 95 PID 4996 wrote to memory of 4992 4996 jvvpp.exe 96 PID 4996 wrote to memory of 4992 4996 jvvpp.exe 96 PID 4996 wrote to memory of 4992 4996 jvvpp.exe 96 PID 4992 wrote to memory of 1420 4992 rfxlxrf.exe 97 PID 4992 wrote to memory of 1420 4992 rfxlxrf.exe 97 PID 4992 wrote to memory of 1420 4992 rfxlxrf.exe 97 PID 1420 wrote to memory of 1604 1420 1xrfrrl.exe 98 PID 1420 wrote to memory of 1604 1420 1xrfrrl.exe 98 PID 1420 wrote to memory of 1604 1420 1xrfrrl.exe 98 PID 1604 wrote to memory of 5096 1604 hhhbnh.exe 99 PID 1604 wrote to memory of 5096 1604 hhhbnh.exe 99 PID 1604 wrote to memory of 5096 1604 hhhbnh.exe 99 PID 5096 wrote to memory of 2472 5096 jdvvd.exe 100 PID 5096 wrote to memory of 2472 5096 jdvvd.exe 100 PID 5096 wrote to memory of 2472 5096 jdvvd.exe 100 PID 2472 wrote to memory of 3688 2472 djvvj.exe 101 PID 2472 wrote to memory of 3688 2472 djvvj.exe 101 PID 2472 wrote to memory of 3688 2472 djvvj.exe 101 PID 3688 wrote to memory of 3708 3688 xxxlxlf.exe 102 PID 3688 wrote to memory of 3708 3688 xxxlxlf.exe 102 PID 3688 wrote to memory of 3708 3688 xxxlxlf.exe 102 PID 3708 wrote to memory of 4540 3708 llfrlfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe"C:\Users\Admin\AppData\Local\Temp\dd10ad763665135b10f3ab207023d15a079f6aa35426ae4d86e0a7f91a3e20d1N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\9dvpd.exec:\9dvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\frfrfxl.exec:\frfrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\hthbbt.exec:\hthbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\tnbnhb.exec:\tnbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\7jdjv.exec:\7jdjv.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\rrrlxxr.exec:\rrrlxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\vpjvp.exec:\vpjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\pdvvd.exec:\pdvvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\bntnbt.exec:\bntnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\pdvjv.exec:\pdvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\xllfrfx.exec:\xllfrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\frrfrlf.exec:\frrfrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\dpjvj.exec:\dpjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\jvvpp.exec:\jvvpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rfxlxrf.exec:\rfxlxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\1xrfrrl.exec:\1xrfrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\hhhbnh.exec:\hhhbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\jdvvd.exec:\jdvvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\djvvj.exec:\djvvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\xxxlxlf.exec:\xxxlxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\llfrlfr.exec:\llfrlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\thhbnh.exec:\thhbnh.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\nhtntn.exec:\nhtntn.exe24⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vjpvd.exec:\vjpvd.exe25⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe26⤵
- Executes dropped EXE
PID:3212 -
\??\c:\frlrffr.exec:\frlrffr.exe27⤵
- Executes dropped EXE
PID:4620 -
\??\c:\hththh.exec:\hththh.exe28⤵
- Executes dropped EXE
PID:1204 -
\??\c:\dvjjd.exec:\dvjjd.exe29⤵
- Executes dropped EXE
PID:4552 -
\??\c:\xlrffrl.exec:\xlrffrl.exe30⤵
- Executes dropped EXE
PID:1084 -
\??\c:\7bbnhb.exec:\7bbnhb.exe31⤵
- Executes dropped EXE
PID:116 -
\??\c:\7tthtn.exec:\7tthtn.exe32⤵
- Executes dropped EXE
PID:3524 -
\??\c:\pvjjd.exec:\pvjjd.exe33⤵
- Executes dropped EXE
PID:4052 -
\??\c:\rlrxfxx.exec:\rlrxfxx.exe34⤵
- Executes dropped EXE
PID:2136 -
\??\c:\rrxxxxf.exec:\rrxxxxf.exe35⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bhbtnh.exec:\bhbtnh.exe36⤵
- Executes dropped EXE
PID:716 -
\??\c:\3vpdv.exec:\3vpdv.exe37⤵
- Executes dropped EXE
PID:4916 -
\??\c:\rfxlxlf.exec:\rfxlxlf.exe38⤵
- Executes dropped EXE
PID:2904 -
\??\c:\lxlxlff.exec:\lxlxlff.exe39⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nthtnh.exec:\nthtnh.exe40⤵
- Executes dropped EXE
PID:4784 -
\??\c:\pppdj.exec:\pppdj.exe41⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lffxlfl.exec:\lffxlfl.exe42⤵
- Executes dropped EXE
PID:3388 -
\??\c:\ddvvv.exec:\ddvvv.exe43⤵
- Executes dropped EXE
PID:632 -
\??\c:\pvpjj.exec:\pvpjj.exe44⤵
- Executes dropped EXE
PID:4840 -
\??\c:\btnhhh.exec:\btnhhh.exe45⤵
- Executes dropped EXE
PID:892 -
\??\c:\pvvjv.exec:\pvvjv.exe46⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe47⤵
- Executes dropped EXE
PID:3416 -
\??\c:\htnhtn.exec:\htnhtn.exe48⤵
- Executes dropped EXE
PID:2916 -
\??\c:\pvddd.exec:\pvddd.exe49⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xrrflfr.exec:\xrrflfr.exe50⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe51⤵
- Executes dropped EXE
PID:2832 -
\??\c:\hhhhnn.exec:\hhhhnn.exe52⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vpjjv.exec:\vpjjv.exe53⤵
- Executes dropped EXE
PID:2776 -
\??\c:\vpjvj.exec:\vpjvj.exe54⤵
- Executes dropped EXE
PID:2644 -
\??\c:\3xxlxll.exec:\3xxlxll.exe55⤵
- Executes dropped EXE
PID:1516 -
\??\c:\xffrflf.exec:\xffrflf.exe56⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbnbnt.exec:\hbnbnt.exe57⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nbthth.exec:\nbthth.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vvvjv.exec:\vvvjv.exe59⤵
- Executes dropped EXE
PID:3352 -
\??\c:\vpdpj.exec:\vpdpj.exe60⤵
- Executes dropped EXE
PID:3664 -
\??\c:\lffxxrr.exec:\lffxxrr.exe61⤵
- Executes dropped EXE
PID:4128 -
\??\c:\7tnhbn.exec:\7tnhbn.exe62⤵
- Executes dropped EXE
PID:2032 -
\??\c:\hththb.exec:\hththb.exe63⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pdvdv.exec:\pdvdv.exe64⤵
- Executes dropped EXE
PID:3620 -
\??\c:\jdpdp.exec:\jdpdp.exe65⤵
- Executes dropped EXE
PID:4268 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe66⤵PID:3480
-
\??\c:\llrxrfx.exec:\llrxrfx.exe67⤵PID:5068
-
\??\c:\hnbhnb.exec:\hnbhnb.exe68⤵PID:1804
-
\??\c:\pjjjv.exec:\pjjjv.exe69⤵PID:864
-
\??\c:\djjvj.exec:\djjvj.exe70⤵PID:3456
-
\??\c:\lrrxxxf.exec:\lrrxxxf.exe71⤵PID:468
-
\??\c:\hbhhnt.exec:\hbhhnt.exe72⤵PID:4540
-
\??\c:\hnttbt.exec:\hnttbt.exe73⤵PID:1968
-
\??\c:\9jjvd.exec:\9jjvd.exe74⤵PID:828
-
\??\c:\7jjvj.exec:\7jjvj.exe75⤵PID:852
-
\??\c:\llfrfxr.exec:\llfrfxr.exe76⤵PID:3868
-
\??\c:\nbbnnh.exec:\nbbnnh.exe77⤵PID:4116
-
\??\c:\hnnbnh.exec:\hnnbnh.exe78⤵PID:1204
-
\??\c:\vjpjd.exec:\vjpjd.exe79⤵PID:4552
-
\??\c:\jddjv.exec:\jddjv.exe80⤵PID:4972
-
\??\c:\ppvpv.exec:\ppvpv.exe81⤵PID:2712
-
\??\c:\fxlxxxf.exec:\fxlxxxf.exe82⤵PID:4356
-
\??\c:\nbnnnn.exec:\nbnnnn.exe83⤵PID:1988
-
\??\c:\pvvjv.exec:\pvvjv.exe84⤵PID:4820
-
\??\c:\pjpjv.exec:\pjpjv.exe85⤵PID:2692
-
\??\c:\dpjpd.exec:\dpjpd.exe86⤵PID:912
-
\??\c:\fffxrrl.exec:\fffxrrl.exe87⤵PID:3028
-
\??\c:\tnhbbt.exec:\tnhbbt.exe88⤵PID:4688
-
\??\c:\pdvvp.exec:\pdvvp.exe89⤵PID:3780
-
\??\c:\pppdj.exec:\pppdj.exe90⤵PID:656
-
\??\c:\fxxrffx.exec:\fxxrffx.exe91⤵PID:4444
-
\??\c:\5rxrrlf.exec:\5rxrrlf.exe92⤵PID:2460
-
\??\c:\nttbtn.exec:\nttbtn.exe93⤵PID:2696
-
\??\c:\nbnhnh.exec:\nbnhnh.exe94⤵PID:4544
-
\??\c:\vjddp.exec:\vjddp.exe95⤵PID:400
-
\??\c:\lrfxxxx.exec:\lrfxxxx.exe96⤵PID:4188
-
\??\c:\xlrrxrr.exec:\xlrrxrr.exe97⤵PID:316
-
\??\c:\tnnhtt.exec:\tnnhtt.exe98⤵PID:2280
-
\??\c:\nbhnbb.exec:\nbhnbb.exe99⤵PID:3956
-
\??\c:\jvjdp.exec:\jvjdp.exe100⤵PID:2264
-
\??\c:\fllrfxl.exec:\fllrfxl.exe101⤵PID:4600
-
\??\c:\rfxrfxr.exec:\rfxrfxr.exe102⤵PID:3100
-
\??\c:\7ttnbb.exec:\7ttnbb.exe103⤵PID:4808
-
\??\c:\bhnhhn.exec:\bhnhhn.exe104⤵PID:4716
-
\??\c:\vjpdp.exec:\vjpdp.exe105⤵PID:1596
-
\??\c:\9rlfffl.exec:\9rlfffl.exe106⤵PID:4424
-
\??\c:\fxlflfl.exec:\fxlflfl.exe107⤵PID:5092
-
\??\c:\bhnnhb.exec:\bhnnhb.exe108⤵PID:3160
-
\??\c:\jppjd.exec:\jppjd.exe109⤵PID:2680
-
\??\c:\pjvpd.exec:\pjvpd.exe110⤵PID:3876
-
\??\c:\lxlxfxf.exec:\lxlxfxf.exe111⤵PID:4580
-
\??\c:\frlxrlf.exec:\frlxrlf.exe112⤵PID:4000
-
\??\c:\5nnbtn.exec:\5nnbtn.exe113⤵PID:4996
-
\??\c:\bbnhnn.exec:\bbnhnn.exe114⤵PID:2572
-
\??\c:\1jdvj.exec:\1jdvj.exe115⤵PID:4992
-
\??\c:\pddpp.exec:\pddpp.exe116⤵PID:5000
-
\??\c:\frllxrf.exec:\frllxrf.exe117⤵PID:3940
-
\??\c:\9rlxlfx.exec:\9rlxlfx.exe118⤵PID:1812
-
\??\c:\bhbthh.exec:\bhbthh.exe119⤵PID:2472
-
\??\c:\pvpdv.exec:\pvpdv.exe120⤵
- System Location Discovery: System Language Discovery
PID:3856 -
\??\c:\pjdpd.exec:\pjdpd.exe121⤵PID:440
-
\??\c:\jvvpj.exec:\jvvpj.exe122⤵PID:3176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-