Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2024, 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe
-
Size
67KB
-
MD5
4ba16089b84673ee4c7304ef22b08180
-
SHA1
402de29c51fe3fa7490e7b1d876a77d7988d8d15
-
SHA256
e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9b
-
SHA512
5eabd2d6e2ede39633b22551edf7a1524b2e6a35895576ee8e4e60d98108e2ed5ea59e91de9d386a95dcc96ceb1d36714b62aa4e380bd019f8dd693079d1e1f1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B5QcJ:ymb3NkkiQ3mdBjFI9c+w
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2688-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2660-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3112 djpjv.exe 1044 dpdpd.exe 4308 fxxrlfx.exe 4420 ntnnnb.exe 3848 7tbtnh.exe 2176 jdvpj.exe 3800 5llfxrl.exe 1636 1hnbnh.exe 2388 3ttnbt.exe 2512 pppdp.exe 1556 frrrfff.exe 1620 jjjdv.exe 4860 jvddv.exe 4160 5ffrllf.exe 1972 hbhhhb.exe 3980 jvdpj.exe 4856 rlrlffr.exe 2980 rflxrrl.exe 3096 7nhbnn.exe 3524 3rxxlfl.exe 4248 3rxrrxx.exe 5012 hhhbtt.exe 4032 jddvp.exe 1040 rlxrxrr.exe 5048 jjpjp.exe 3880 vjjvp.exe 2660 bntnbb.exe 2412 tnhbtt.exe 4624 dpppj.exe 3284 xrrlfxr.exe 644 fxflffx.exe 1136 hbtnht.exe 3164 dpvpj.exe 3492 dvdpp.exe 4912 1frlfxx.exe 2872 xxlfxxl.exe 2860 jjpjp.exe 2012 lflfrlf.exe 1832 5rlfxxr.exe 1180 1hbtnh.exe 1372 hnnnhh.exe 1036 jppjv.exe 3480 vvppp.exe 4180 xrlrfxr.exe 4496 jvvpd.exe 5116 3rrrrrr.exe 3412 ttnhtt.exe 4472 bntnbt.exe 556 ddjvj.exe 2440 llllxxf.exe 1544 xrxxffl.exe 4056 hbhbbt.exe 1984 9tnthb.exe 2828 7djvv.exe 1476 xxrxrff.exe 2464 1rrrlrl.exe 4076 bnnnhh.exe 228 hbbttt.exe 1716 pppjd.exe 2836 lxrlxxr.exe 4560 bnhnnh.exe 2388 3nhhbh.exe 2368 pjpjv.exe 4808 pvdvp.exe -
resource yara_rule behavioral2/memory/2688-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3flfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tnthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 3112 2688 e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe 82 PID 2688 wrote to memory of 3112 2688 e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe 82 PID 2688 wrote to memory of 3112 2688 e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe 82 PID 3112 wrote to memory of 1044 3112 djpjv.exe 83 PID 3112 wrote to memory of 1044 3112 djpjv.exe 83 PID 3112 wrote to memory of 1044 3112 djpjv.exe 83 PID 1044 wrote to memory of 4308 1044 dpdpd.exe 84 PID 1044 wrote to memory of 4308 1044 dpdpd.exe 84 PID 1044 wrote to memory of 4308 1044 dpdpd.exe 84 PID 4308 wrote to memory of 4420 4308 fxxrlfx.exe 85 PID 4308 wrote to memory of 4420 4308 fxxrlfx.exe 85 PID 4308 wrote to memory of 4420 4308 fxxrlfx.exe 85 PID 4420 wrote to memory of 3848 4420 ntnnnb.exe 86 PID 4420 wrote to memory of 3848 4420 ntnnnb.exe 86 PID 4420 wrote to memory of 3848 4420 ntnnnb.exe 86 PID 3848 wrote to memory of 2176 3848 7tbtnh.exe 87 PID 3848 wrote to memory of 2176 3848 7tbtnh.exe 87 PID 3848 wrote to memory of 2176 3848 7tbtnh.exe 87 PID 2176 wrote to memory of 3800 2176 jdvpj.exe 88 PID 2176 wrote to memory of 3800 2176 jdvpj.exe 88 PID 2176 wrote to memory of 3800 2176 jdvpj.exe 88 PID 3800 wrote to memory of 1636 3800 5llfxrl.exe 89 PID 3800 wrote to memory of 1636 3800 5llfxrl.exe 89 PID 3800 wrote to memory of 1636 3800 5llfxrl.exe 89 PID 1636 wrote to memory of 2388 1636 1hnbnh.exe 90 PID 1636 wrote to memory of 2388 1636 1hnbnh.exe 90 PID 1636 wrote to memory of 2388 1636 1hnbnh.exe 90 PID 2388 wrote to memory of 2512 2388 3ttnbt.exe 91 PID 2388 wrote to memory of 2512 2388 3ttnbt.exe 91 PID 2388 wrote to memory of 2512 2388 3ttnbt.exe 91 PID 2512 wrote to memory of 1556 2512 pppdp.exe 92 PID 2512 wrote to memory of 1556 2512 pppdp.exe 92 PID 2512 wrote to memory of 1556 2512 pppdp.exe 92 PID 1556 wrote to memory of 1620 1556 frrrfff.exe 93 PID 1556 wrote to memory of 1620 1556 frrrfff.exe 93 PID 1556 wrote to memory of 1620 1556 frrrfff.exe 93 PID 1620 wrote to memory of 4860 1620 jjjdv.exe 94 PID 1620 wrote to memory of 4860 1620 jjjdv.exe 94 PID 1620 wrote to memory of 4860 1620 jjjdv.exe 94 PID 4860 wrote to memory of 4160 4860 jvddv.exe 95 PID 4860 wrote to memory of 4160 4860 jvddv.exe 95 PID 4860 wrote to memory of 4160 4860 jvddv.exe 95 PID 4160 wrote to memory of 1972 4160 5ffrllf.exe 96 PID 4160 wrote to memory of 1972 4160 5ffrllf.exe 96 PID 4160 wrote to memory of 1972 4160 5ffrllf.exe 96 PID 1972 wrote to memory of 3980 1972 hbhhhb.exe 97 PID 1972 wrote to memory of 3980 1972 hbhhhb.exe 97 PID 1972 wrote to memory of 3980 1972 hbhhhb.exe 97 PID 3980 wrote to memory of 4856 3980 jvdpj.exe 98 PID 3980 wrote to memory of 4856 3980 jvdpj.exe 98 PID 3980 wrote to memory of 4856 3980 jvdpj.exe 98 PID 4856 wrote to memory of 2980 4856 rlrlffr.exe 99 PID 4856 wrote to memory of 2980 4856 rlrlffr.exe 99 PID 4856 wrote to memory of 2980 4856 rlrlffr.exe 99 PID 2980 wrote to memory of 3096 2980 rflxrrl.exe 100 PID 2980 wrote to memory of 3096 2980 rflxrrl.exe 100 PID 2980 wrote to memory of 3096 2980 rflxrrl.exe 100 PID 3096 wrote to memory of 3524 3096 7nhbnn.exe 101 PID 3096 wrote to memory of 3524 3096 7nhbnn.exe 101 PID 3096 wrote to memory of 3524 3096 7nhbnn.exe 101 PID 3524 wrote to memory of 4248 3524 3rxxlfl.exe 102 PID 3524 wrote to memory of 4248 3524 3rxxlfl.exe 102 PID 3524 wrote to memory of 4248 3524 3rxxlfl.exe 102 PID 4248 wrote to memory of 5012 4248 3rxrrxx.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe"C:\Users\Admin\AppData\Local\Temp\e6b2f52c7d572dab09d5cbdfb6ed8e60975caa03a2d557dec98751082b0d1a9bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\djpjv.exec:\djpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\dpdpd.exec:\dpdpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\ntnnnb.exec:\ntnnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\7tbtnh.exec:\7tbtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\jdvpj.exec:\jdvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\5llfxrl.exec:\5llfxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\1hnbnh.exec:\1hnbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3ttnbt.exec:\3ttnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\pppdp.exec:\pppdp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\frrrfff.exec:\frrrfff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\jjjdv.exec:\jjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\jvddv.exec:\jvddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\5ffrllf.exec:\5ffrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\hbhhhb.exec:\hbhhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\jvdpj.exec:\jvdpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\rlrlffr.exec:\rlrlffr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\rflxrrl.exec:\rflxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\7nhbnn.exec:\7nhbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\3rxxlfl.exec:\3rxxlfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\3rxrrxx.exec:\3rxrrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\hhhbtt.exec:\hhhbtt.exe23⤵
- Executes dropped EXE
PID:5012 -
\??\c:\jddvp.exec:\jddvp.exe24⤵
- Executes dropped EXE
PID:4032 -
\??\c:\rlxrxrr.exec:\rlxrxrr.exe25⤵
- Executes dropped EXE
PID:1040 -
\??\c:\jjpjp.exec:\jjpjp.exe26⤵
- Executes dropped EXE
PID:5048 -
\??\c:\vjjvp.exec:\vjjvp.exe27⤵
- Executes dropped EXE
PID:3880 -
\??\c:\bntnbb.exec:\bntnbb.exe28⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnhbtt.exec:\tnhbtt.exe29⤵
- Executes dropped EXE
PID:2412 -
\??\c:\dpppj.exec:\dpppj.exe30⤵
- Executes dropped EXE
PID:4624 -
\??\c:\xrrlfxr.exec:\xrrlfxr.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3284 -
\??\c:\fxflffx.exec:\fxflffx.exe32⤵
- Executes dropped EXE
PID:644 -
\??\c:\hbtnht.exec:\hbtnht.exe33⤵
- Executes dropped EXE
PID:1136 -
\??\c:\dpvpj.exec:\dpvpj.exe34⤵
- Executes dropped EXE
PID:3164 -
\??\c:\dvdpp.exec:\dvdpp.exe35⤵
- Executes dropped EXE
PID:3492 -
\??\c:\1frlfxx.exec:\1frlfxx.exe36⤵
- Executes dropped EXE
PID:4912 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe37⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jjpjp.exec:\jjpjp.exe38⤵
- Executes dropped EXE
PID:2860 -
\??\c:\lflfrlf.exec:\lflfrlf.exe39⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5rlfxxr.exec:\5rlfxxr.exe40⤵
- Executes dropped EXE
PID:1832 -
\??\c:\1hbtnh.exec:\1hbtnh.exe41⤵
- Executes dropped EXE
PID:1180 -
\??\c:\hnnnhh.exec:\hnnnhh.exe42⤵
- Executes dropped EXE
PID:1372 -
\??\c:\jppjv.exec:\jppjv.exe43⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vvppp.exec:\vvppp.exe44⤵
- Executes dropped EXE
PID:3480 -
\??\c:\xrlrfxr.exec:\xrlrfxr.exe45⤵
- Executes dropped EXE
PID:4180 -
\??\c:\jvvpd.exec:\jvvpd.exe46⤵
- Executes dropped EXE
PID:4496 -
\??\c:\3rrrrrr.exec:\3rrrrrr.exe47⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ttnhtt.exec:\ttnhtt.exe48⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bntnbt.exec:\bntnbt.exe49⤵
- Executes dropped EXE
PID:4472 -
\??\c:\ddjvj.exec:\ddjvj.exe50⤵
- Executes dropped EXE
PID:556 -
\??\c:\llllxxf.exec:\llllxxf.exe51⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xrxxffl.exec:\xrxxffl.exe52⤵
- Executes dropped EXE
PID:1544 -
\??\c:\hbhbbt.exec:\hbhbbt.exe53⤵
- Executes dropped EXE
PID:4056 -
\??\c:\9tnthb.exec:\9tnthb.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\7djvv.exec:\7djvv.exe55⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xxrxrff.exec:\xxrxrff.exe56⤵
- Executes dropped EXE
PID:1476 -
\??\c:\1rrrlrl.exec:\1rrrlrl.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bnnnhh.exec:\bnnnhh.exe58⤵
- Executes dropped EXE
PID:4076 -
\??\c:\hbbttt.exec:\hbbttt.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\pppjd.exec:\pppjd.exe60⤵
- Executes dropped EXE
PID:1716 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe61⤵
- Executes dropped EXE
PID:2836 -
\??\c:\bnhnnh.exec:\bnhnnh.exe62⤵
- Executes dropped EXE
PID:4560 -
\??\c:\3nhhbh.exec:\3nhhbh.exe63⤵
- Executes dropped EXE
PID:2388 -
\??\c:\pjpjv.exec:\pjpjv.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\pvdvp.exec:\pvdvp.exe65⤵
- Executes dropped EXE
PID:4808 -
\??\c:\3ffxlfx.exec:\3ffxlfx.exe66⤵PID:3328
-
\??\c:\rflffxr.exec:\rflffxr.exe67⤵PID:4732
-
\??\c:\bnnthh.exec:\bnnthh.exe68⤵PID:3348
-
\??\c:\jpjjj.exec:\jpjjj.exe69⤵PID:832
-
\??\c:\vjpdv.exec:\vjpdv.exe70⤵PID:4388
-
\??\c:\xlrlxrr.exec:\xlrlxrr.exe71⤵PID:1500
-
\??\c:\lrxrrll.exec:\lrxrrll.exe72⤵PID:5004
-
\??\c:\3ttntt.exec:\3ttntt.exe73⤵PID:3924
-
\??\c:\dvjjp.exec:\dvjjp.exe74⤵PID:4676
-
\??\c:\xlrlfff.exec:\xlrlfff.exe75⤵PID:2772
-
\??\c:\ttbthh.exec:\ttbthh.exe76⤵PID:2076
-
\??\c:\ntbtnn.exec:\ntbtnn.exe77⤵PID:772
-
\??\c:\vvpvj.exec:\vvpvj.exe78⤵PID:4984
-
\??\c:\5pvpd.exec:\5pvpd.exe79⤵PID:3484
-
\??\c:\lrrxlxr.exec:\lrrxlxr.exe80⤵PID:1748
-
\??\c:\9ttnbb.exec:\9ttnbb.exe81⤵PID:4528
-
\??\c:\thhbhh.exec:\thhbhh.exe82⤵PID:4956
-
\??\c:\vvvjj.exec:\vvvjj.exe83⤵PID:4040
-
\??\c:\9jjdp.exec:\9jjdp.exe84⤵PID:1440
-
\??\c:\lffxrfl.exec:\lffxrfl.exe85⤵PID:848
-
\??\c:\frfxrrl.exec:\frfxrrl.exe86⤵PID:1364
-
\??\c:\7ttnhb.exec:\7ttnhb.exe87⤵PID:1752
-
\??\c:\bthtbt.exec:\bthtbt.exe88⤵PID:1408
-
\??\c:\ppdvj.exec:\ppdvj.exe89⤵PID:4424
-
\??\c:\vdddp.exec:\vdddp.exe90⤵PID:4544
-
\??\c:\1fxrrrf.exec:\1fxrrrf.exe91⤵PID:1772
-
\??\c:\lfxrllf.exec:\lfxrllf.exe92⤵PID:932
-
\??\c:\ttnhtt.exec:\ttnhtt.exe93⤵PID:2880
-
\??\c:\hbhhhb.exec:\hbhhhb.exe94⤵PID:3084
-
\??\c:\vpvpj.exec:\vpvpj.exe95⤵PID:3664
-
\??\c:\djpjd.exec:\djpjd.exe96⤵PID:1812
-
\??\c:\9xxrllx.exec:\9xxrllx.exe97⤵PID:1196
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe98⤵PID:2872
-
\??\c:\hhthth.exec:\hhthth.exe99⤵
- System Location Discovery: System Language Discovery
PID:3160 -
\??\c:\ppppj.exec:\ppppj.exe100⤵PID:2012
-
\??\c:\dddvj.exec:\dddvj.exe101⤵PID:3684
-
\??\c:\fffxrrl.exec:\fffxrrl.exe102⤵PID:3756
-
\??\c:\rffxrrr.exec:\rffxrrr.exe103⤵PID:412
-
\??\c:\hnbhth.exec:\hnbhth.exe104⤵PID:2784
-
\??\c:\nbhhhn.exec:\nbhhhn.exe105⤵PID:3132
-
\??\c:\dvpvp.exec:\dvpvp.exe106⤵PID:1516
-
\??\c:\5jppp.exec:\5jppp.exe107⤵PID:1512
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe108⤵PID:4484
-
\??\c:\xrrrllf.exec:\xrrrllf.exe109⤵PID:224
-
\??\c:\hbbttn.exec:\hbbttn.exe110⤵PID:4444
-
\??\c:\vjjdv.exec:\vjjdv.exe111⤵PID:2448
-
\??\c:\9pjdp.exec:\9pjdp.exe112⤵PID:5000
-
\??\c:\flfxrrr.exec:\flfxrrr.exe113⤵PID:2376
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe114⤵PID:1444
-
\??\c:\bbbbhh.exec:\bbbbhh.exe115⤵PID:2892
-
\??\c:\7hhbbt.exec:\7hhbbt.exe116⤵PID:2752
-
\??\c:\dppjj.exec:\dppjj.exe117⤵PID:1360
-
\??\c:\pddvp.exec:\pddvp.exe118⤵PID:4952
-
\??\c:\rlxrlll.exec:\rlxrlll.exe119⤵PID:4668
-
\??\c:\fxfxrff.exec:\fxfxrff.exe120⤵
- System Location Discovery: System Language Discovery
PID:4828 -
\??\c:\hhbbtb.exec:\hhbbtb.exe121⤵PID:3472
-
\??\c:\hbtnhh.exec:\hbtnhh.exe122⤵PID:1636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-