Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 20:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe
-
Size
66KB
-
MD5
b6f6158171137f6fb40222dad373a2d0
-
SHA1
2728ffe716817fa9713731afb6f1c688776241ac
-
SHA256
d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9b
-
SHA512
a8e1d4d0f0756ba15ada349f65cf6231925779afb15fe9237883762fe14ad027d36b69cb77618ab24257a9231489b5c4d86d8107727a289738c7fea4966df41f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B5QO4:ymb3NkkiQ3mdBjFI9c+h
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/1656-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/996-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4936 lxrrrrr.exe 4888 ttbbbh.exe 3244 pvdjd.exe 2220 fllrrxf.exe 2924 bttttb.exe 3224 hnhtbh.exe 1008 vvvvp.exe 3008 lflrrff.exe 1972 tthhnn.exe 2084 dvvjj.exe 1948 7rrlrrx.exe 2760 1tbhht.exe 3312 djjpv.exe 3520 xfffflr.exe 2888 5nbnnt.exe 4268 pjppv.exe 3500 1lllflr.exe 3732 nhhtth.exe 4784 vvppd.exe 4904 xfrxfll.exe 1000 nnttbb.exe 544 vvpvv.exe 2500 fxllfrr.exe 3188 ntnntb.exe 1768 nbbbnt.exe 5076 vpjdd.exe 996 pddjj.exe 2988 1xxffrx.exe 64 bbnnbh.exe 976 jjvvv.exe 4788 rxlllll.exe 1412 tnnnnn.exe 5116 1djpp.exe 4300 5rrrfll.exe 4916 ttnbht.exe 1916 jdddd.exe 1388 xffllrl.exe 1460 pdjpv.exe 4912 jvppv.exe 4752 ddvvv.exe 4140 rlrrfff.exe 1052 lrfxflx.exe 2620 hbnnnb.exe 3004 bbbbtt.exe 4352 jvjjj.exe 4256 rxrrlff.exe 4928 rlxxrrf.exe 1924 bbhhhn.exe 436 jpppv.exe 3176 5rxrfll.exe 2036 xxlrlxx.exe 3756 nnnhhn.exe 2220 hhbhhn.exe 4056 pjvjj.exe 4792 xxlllrr.exe 4500 bbhbbb.exe 1936 pddjj.exe 2932 lxxxxfl.exe 3600 bhnbnn.exe 4884 ddjjj.exe 1520 vvdjp.exe 2944 lfllfff.exe 4260 nhhnth.exe 4380 bhbnht.exe -
resource yara_rule behavioral2/memory/1656-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/544-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/996-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllllrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfxllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbhtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 4936 1656 d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe 81 PID 1656 wrote to memory of 4936 1656 d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe 81 PID 1656 wrote to memory of 4936 1656 d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe 81 PID 4936 wrote to memory of 4888 4936 lxrrrrr.exe 82 PID 4936 wrote to memory of 4888 4936 lxrrrrr.exe 82 PID 4936 wrote to memory of 4888 4936 lxrrrrr.exe 82 PID 4888 wrote to memory of 3244 4888 ttbbbh.exe 83 PID 4888 wrote to memory of 3244 4888 ttbbbh.exe 83 PID 4888 wrote to memory of 3244 4888 ttbbbh.exe 83 PID 3244 wrote to memory of 2220 3244 pvdjd.exe 84 PID 3244 wrote to memory of 2220 3244 pvdjd.exe 84 PID 3244 wrote to memory of 2220 3244 pvdjd.exe 84 PID 2220 wrote to memory of 2924 2220 fllrrxf.exe 85 PID 2220 wrote to memory of 2924 2220 fllrrxf.exe 85 PID 2220 wrote to memory of 2924 2220 fllrrxf.exe 85 PID 2924 wrote to memory of 3224 2924 bttttb.exe 86 PID 2924 wrote to memory of 3224 2924 bttttb.exe 86 PID 2924 wrote to memory of 3224 2924 bttttb.exe 86 PID 3224 wrote to memory of 1008 3224 hnhtbh.exe 87 PID 3224 wrote to memory of 1008 3224 hnhtbh.exe 87 PID 3224 wrote to memory of 1008 3224 hnhtbh.exe 87 PID 1008 wrote to memory of 3008 1008 vvvvp.exe 88 PID 1008 wrote to memory of 3008 1008 vvvvp.exe 88 PID 1008 wrote to memory of 3008 1008 vvvvp.exe 88 PID 3008 wrote to memory of 1972 3008 lflrrff.exe 89 PID 3008 wrote to memory of 1972 3008 lflrrff.exe 89 PID 3008 wrote to memory of 1972 3008 lflrrff.exe 89 PID 1972 wrote to memory of 2084 1972 tthhnn.exe 90 PID 1972 wrote to memory of 2084 1972 tthhnn.exe 90 PID 1972 wrote to memory of 2084 1972 tthhnn.exe 90 PID 2084 wrote to memory of 1948 2084 dvvjj.exe 91 PID 2084 wrote to memory of 1948 2084 dvvjj.exe 91 PID 2084 wrote to memory of 1948 2084 dvvjj.exe 91 PID 1948 wrote to memory of 2760 1948 7rrlrrx.exe 92 PID 1948 wrote to memory of 2760 1948 7rrlrrx.exe 92 PID 1948 wrote to memory of 2760 1948 7rrlrrx.exe 92 PID 2760 wrote to memory of 3312 2760 1tbhht.exe 93 PID 2760 wrote to memory of 3312 2760 1tbhht.exe 93 PID 2760 wrote to memory of 3312 2760 1tbhht.exe 93 PID 3312 wrote to memory of 3520 3312 djjpv.exe 94 PID 3312 wrote to memory of 3520 3312 djjpv.exe 94 PID 3312 wrote to memory of 3520 3312 djjpv.exe 94 PID 3520 wrote to memory of 2888 3520 xfffflr.exe 95 PID 3520 wrote to memory of 2888 3520 xfffflr.exe 95 PID 3520 wrote to memory of 2888 3520 xfffflr.exe 95 PID 2888 wrote to memory of 4268 2888 5nbnnt.exe 96 PID 2888 wrote to memory of 4268 2888 5nbnnt.exe 96 PID 2888 wrote to memory of 4268 2888 5nbnnt.exe 96 PID 4268 wrote to memory of 3500 4268 pjppv.exe 97 PID 4268 wrote to memory of 3500 4268 pjppv.exe 97 PID 4268 wrote to memory of 3500 4268 pjppv.exe 97 PID 3500 wrote to memory of 3732 3500 1lllflr.exe 98 PID 3500 wrote to memory of 3732 3500 1lllflr.exe 98 PID 3500 wrote to memory of 3732 3500 1lllflr.exe 98 PID 3732 wrote to memory of 4784 3732 nhhtth.exe 99 PID 3732 wrote to memory of 4784 3732 nhhtth.exe 99 PID 3732 wrote to memory of 4784 3732 nhhtth.exe 99 PID 4784 wrote to memory of 4904 4784 vvppd.exe 100 PID 4784 wrote to memory of 4904 4784 vvppd.exe 100 PID 4784 wrote to memory of 4904 4784 vvppd.exe 100 PID 4904 wrote to memory of 1000 4904 xfrxfll.exe 101 PID 4904 wrote to memory of 1000 4904 xfrxfll.exe 101 PID 4904 wrote to memory of 1000 4904 xfrxfll.exe 101 PID 1000 wrote to memory of 544 1000 nnttbb.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe"C:\Users\Admin\AppData\Local\Temp\d9a23d3409c2e7ae13e57fc2c665b358b369e1e01dd9576de31177fa9f96ab9bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\lxrrrrr.exec:\lxrrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\ttbbbh.exec:\ttbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\pvdjd.exec:\pvdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\fllrrxf.exec:\fllrrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\bttttb.exec:\bttttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\hnhtbh.exec:\hnhtbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vvvvp.exec:\vvvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\lflrrff.exec:\lflrrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\tthhnn.exec:\tthhnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\dvvjj.exec:\dvvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\7rrlrrx.exec:\7rrlrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\1tbhht.exec:\1tbhht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\djjpv.exec:\djjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\xfffflr.exec:\xfffflr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\5nbnnt.exec:\5nbnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\pjppv.exec:\pjppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\1lllflr.exec:\1lllflr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\nhhtth.exec:\nhhtth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\vvppd.exec:\vvppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\xfrxfll.exec:\xfrxfll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\nnttbb.exec:\nnttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\vvpvv.exec:\vvpvv.exe23⤵
- Executes dropped EXE
PID:544 -
\??\c:\fxllfrr.exec:\fxllfrr.exe24⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ntnntb.exec:\ntnntb.exe25⤵
- Executes dropped EXE
PID:3188 -
\??\c:\nbbbnt.exec:\nbbbnt.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\vpjdd.exec:\vpjdd.exe27⤵
- Executes dropped EXE
PID:5076 -
\??\c:\pddjj.exec:\pddjj.exe28⤵
- Executes dropped EXE
PID:996 -
\??\c:\1xxffrx.exec:\1xxffrx.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bbnnbh.exec:\bbnnbh.exe30⤵
- Executes dropped EXE
PID:64 -
\??\c:\jjvvv.exec:\jjvvv.exe31⤵
- Executes dropped EXE
PID:976 -
\??\c:\rxlllll.exec:\rxlllll.exe32⤵
- Executes dropped EXE
PID:4788 -
\??\c:\tnnnnn.exec:\tnnnnn.exe33⤵
- Executes dropped EXE
PID:1412 -
\??\c:\1djpp.exec:\1djpp.exe34⤵
- Executes dropped EXE
PID:5116 -
\??\c:\5rrrfll.exec:\5rrrfll.exe35⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ttnbht.exec:\ttnbht.exe36⤵
- Executes dropped EXE
PID:4916 -
\??\c:\jdddd.exec:\jdddd.exe37⤵
- Executes dropped EXE
PID:1916 -
\??\c:\xffllrl.exec:\xffllrl.exe38⤵
- Executes dropped EXE
PID:1388 -
\??\c:\pdjpv.exec:\pdjpv.exe39⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jvppv.exec:\jvppv.exe40⤵
- Executes dropped EXE
PID:4912 -
\??\c:\ddvvv.exec:\ddvvv.exe41⤵
- Executes dropped EXE
PID:4752 -
\??\c:\rlrrfff.exec:\rlrrfff.exe42⤵
- Executes dropped EXE
PID:4140 -
\??\c:\lrfxflx.exec:\lrfxflx.exe43⤵
- Executes dropped EXE
PID:1052 -
\??\c:\hbnnnb.exec:\hbnnnb.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\bbbbtt.exec:\bbbbtt.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3004 -
\??\c:\jvjjj.exec:\jvjjj.exe46⤵
- Executes dropped EXE
PID:4352 -
\??\c:\rxrrlff.exec:\rxrrlff.exe47⤵
- Executes dropped EXE
PID:4256 -
\??\c:\rlxxrrf.exec:\rlxxrrf.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4928 -
\??\c:\bbhhhn.exec:\bbhhhn.exe49⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jpppv.exec:\jpppv.exe50⤵
- Executes dropped EXE
PID:436 -
\??\c:\5rxrfll.exec:\5rxrfll.exe51⤵
- Executes dropped EXE
PID:3176 -
\??\c:\xxlrlxx.exec:\xxlrlxx.exe52⤵
- Executes dropped EXE
PID:2036 -
\??\c:\nnnhhn.exec:\nnnhhn.exe53⤵
- Executes dropped EXE
PID:3756 -
\??\c:\hhbhhn.exec:\hhbhhn.exe54⤵
- Executes dropped EXE
PID:2220 -
\??\c:\pjvjj.exec:\pjvjj.exe55⤵
- Executes dropped EXE
PID:4056 -
\??\c:\xxlllrr.exec:\xxlllrr.exe56⤵
- Executes dropped EXE
PID:4792 -
\??\c:\bbhbbb.exec:\bbhbbb.exe57⤵
- Executes dropped EXE
PID:4500 -
\??\c:\pddjj.exec:\pddjj.exe58⤵
- Executes dropped EXE
PID:1936 -
\??\c:\lxxxxfl.exec:\lxxxxfl.exe59⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bhnbnn.exec:\bhnbnn.exe60⤵
- Executes dropped EXE
PID:3600 -
\??\c:\ddjjj.exec:\ddjjj.exe61⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vvdjp.exec:\vvdjp.exe62⤵
- Executes dropped EXE
PID:1520 -
\??\c:\lfllfff.exec:\lfllfff.exe63⤵
- Executes dropped EXE
PID:2944 -
\??\c:\nhhnth.exec:\nhhnth.exe64⤵
- Executes dropped EXE
PID:4260 -
\??\c:\bhbnht.exec:\bhbnht.exe65⤵
- Executes dropped EXE
PID:4380 -
\??\c:\jvddd.exec:\jvddd.exe66⤵PID:5060
-
\??\c:\5djpj.exec:\5djpj.exe67⤵PID:1616
-
\??\c:\xflrxfl.exec:\xflrxfl.exe68⤵PID:5012
-
\??\c:\hbnnnn.exec:\hbnnnn.exe69⤵PID:1672
-
\??\c:\ntbbbt.exec:\ntbbbt.exe70⤵PID:3028
-
\??\c:\1jvpv.exec:\1jvpv.exe71⤵PID:4196
-
\??\c:\lllrxfx.exec:\lllrxfx.exe72⤵PID:4060
-
\??\c:\frxxxff.exec:\frxxxff.exe73⤵PID:3808
-
\??\c:\bhntnt.exec:\bhntnt.exe74⤵PID:2592
-
\??\c:\ppddd.exec:\ppddd.exe75⤵PID:4684
-
\??\c:\jjpjj.exec:\jjpjj.exe76⤵PID:3584
-
\??\c:\xlllfxr.exec:\xlllfxr.exe77⤵PID:708
-
\??\c:\bttttb.exec:\bttttb.exe78⤵PID:1060
-
\??\c:\nhnbbh.exec:\nhnbbh.exe79⤵PID:2956
-
\??\c:\ddpvj.exec:\ddpvj.exe80⤵PID:1644
-
\??\c:\7flrrxr.exec:\7flrrxr.exe81⤵PID:1812
-
\??\c:\lrffxxf.exec:\lrffxxf.exe82⤵PID:1480
-
\??\c:\tbnhtn.exec:\tbnhtn.exe83⤵PID:3324
-
\??\c:\vvvpp.exec:\vvvpp.exe84⤵PID:4924
-
\??\c:\llxxxxf.exec:\llxxxxf.exe85⤵PID:4988
-
\??\c:\rrffxxx.exec:\rrffxxx.exe86⤵PID:2532
-
\??\c:\3thhhn.exec:\3thhhn.exe87⤵PID:1624
-
\??\c:\pppvv.exec:\pppvv.exe88⤵PID:3276
-
\??\c:\djjjj.exec:\djjjj.exe89⤵PID:4132
-
\??\c:\7xfxrxf.exec:\7xfxrxf.exe90⤵PID:3636
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe91⤵PID:768
-
\??\c:\nhtttb.exec:\nhtttb.exe92⤵PID:3560
-
\??\c:\ttbbbb.exec:\ttbbbb.exe93⤵PID:2936
-
\??\c:\djjjj.exec:\djjjj.exe94⤵PID:4964
-
\??\c:\pjpdd.exec:\pjpdd.exe95⤵PID:2692
-
\??\c:\rxxlfrr.exec:\rxxlfrr.exe96⤵PID:2164
-
\??\c:\bbhtnn.exec:\bbhtnn.exe97⤵PID:1100
-
\??\c:\pvddd.exec:\pvddd.exe98⤵PID:2404
-
\??\c:\dddjp.exec:\dddjp.exe99⤵PID:388
-
\??\c:\xflxrxx.exec:\xflxrxx.exe100⤵PID:5080
-
\??\c:\pdvpv.exec:\pdvpv.exe101⤵PID:4484
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe102⤵PID:5052
-
\??\c:\fflffxr.exec:\fflffxr.exe103⤵PID:408
-
\??\c:\nnnnnn.exec:\nnnnnn.exe104⤵PID:4296
-
\??\c:\vpvpj.exec:\vpvpj.exe105⤵PID:2488
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe106⤵PID:4368
-
\??\c:\rxrlffr.exec:\rxrlffr.exe107⤵PID:2228
-
\??\c:\bntttt.exec:\bntttt.exe108⤵PID:2772
-
\??\c:\jdjjd.exec:\jdjjd.exe109⤵PID:1056
-
\??\c:\7pppp.exec:\7pppp.exe110⤵PID:1544
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe111⤵PID:1336
-
\??\c:\tnnnnn.exec:\tnnnnn.exe112⤵PID:3840
-
\??\c:\nnbhbh.exec:\nnbhbh.exe113⤵PID:1396
-
\??\c:\jjpvp.exec:\jjpvp.exe114⤵PID:932
-
\??\c:\jpppv.exec:\jpppv.exe115⤵PID:1268
-
\??\c:\xxlrrxx.exec:\xxlrrxx.exe116⤵PID:2392
-
\??\c:\9tbhhn.exec:\9tbhhn.exe117⤵PID:4512
-
\??\c:\hbhhbb.exec:\hbhhbb.exe118⤵PID:3224
-
\??\c:\ppppp.exec:\ppppp.exe119⤵PID:860
-
\??\c:\frrrrrr.exec:\frrrrrr.exe120⤵PID:3604
-
\??\c:\btnhtn.exec:\btnhtn.exe121⤵
- System Location Discovery: System Language Discovery
PID:732 -
\??\c:\9vdvv.exec:\9vdvv.exe122⤵PID:1512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-