Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-10-2024 11:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe
-
Size
70KB
-
MD5
5ef41b873a0d73ab902e390f788ec5d0
-
SHA1
35dc366a5a453f99d1d95ba2dd00922134534191
-
SHA256
375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69e
-
SHA512
28f109170c6553a9c65728da9a90b1dfc2777cf473c52e782cbc3c2ce2858dc768d739f1ba65f449cf1765b128a14c2f3790bff999e5da949c5403d265758bd0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj5h9:ymb3NkkiQ3mdBjFI4V9
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/964-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5020 fflrrrr.exe 1800 ttbbhh.exe 4912 dpvpv.exe 3424 fxffffl.exe 3748 xllllrr.exe 4836 nhhnnn.exe 5008 9nhbbb.exe 1920 pjjjd.exe 1860 xxfffff.exe 1280 bnttnt.exe 224 9pvvd.exe 2056 9fllxxr.exe 1276 ththbn.exe 4204 pvjdj.exe 3012 vpjdv.exe 3528 rfrfrlf.exe 3108 bttttt.exe 2824 bhhhbb.exe 1164 vjpjd.exe 1528 llrrllf.exe 3768 btbtbb.exe 3632 nnnhhb.exe 1092 dvdvp.exe 2324 ppdvv.exe 3428 dvdvj.exe 4452 ppjdd.exe 4524 lfxxrrr.exe 1384 btbbhh.exe 2412 pdpjp.exe 60 1vdvd.exe 4832 lfxxrrl.exe 4048 nhhhbb.exe 3268 tnnhbn.exe 3112 tnttnn.exe 1656 rllfxxx.exe 404 lrxfllr.exe 4152 bbttnt.exe 1572 jjjdv.exe 4140 ppjjd.exe 4812 rxfffff.exe 1804 nttttb.exe 1600 bhnnnn.exe 4528 pjjjp.exe 4628 lxfflfl.exe 4976 hbtnhh.exe 4600 bttnnn.exe 3624 bbbbtt.exe 4348 9jppj.exe 4840 5llfffx.exe 2712 btnhnn.exe 4016 frxllfx.exe 1812 bhnhbb.exe 636 vdjdd.exe 3584 xllfxll.exe 216 nthhnn.exe 208 nntttb.exe 4708 rxxrllf.exe 1076 rxrllxr.exe 2076 5hnbbb.exe 1628 hnbtbh.exe 4044 vvvpd.exe 4908 lxlfxxx.exe 3092 nbbttt.exe 1244 nhhhtb.exe -
resource yara_rule behavioral2/memory/964-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbthbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 5020 964 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 82 PID 964 wrote to memory of 5020 964 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 82 PID 964 wrote to memory of 5020 964 375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe 82 PID 5020 wrote to memory of 1800 5020 fflrrrr.exe 83 PID 5020 wrote to memory of 1800 5020 fflrrrr.exe 83 PID 5020 wrote to memory of 1800 5020 fflrrrr.exe 83 PID 1800 wrote to memory of 4912 1800 ttbbhh.exe 84 PID 1800 wrote to memory of 4912 1800 ttbbhh.exe 84 PID 1800 wrote to memory of 4912 1800 ttbbhh.exe 84 PID 4912 wrote to memory of 3424 4912 dpvpv.exe 85 PID 4912 wrote to memory of 3424 4912 dpvpv.exe 85 PID 4912 wrote to memory of 3424 4912 dpvpv.exe 85 PID 3424 wrote to memory of 3748 3424 fxffffl.exe 86 PID 3424 wrote to memory of 3748 3424 fxffffl.exe 86 PID 3424 wrote to memory of 3748 3424 fxffffl.exe 86 PID 3748 wrote to memory of 4836 3748 xllllrr.exe 87 PID 3748 wrote to memory of 4836 3748 xllllrr.exe 87 PID 3748 wrote to memory of 4836 3748 xllllrr.exe 87 PID 4836 wrote to memory of 5008 4836 nhhnnn.exe 88 PID 4836 wrote to memory of 5008 4836 nhhnnn.exe 88 PID 4836 wrote to memory of 5008 4836 nhhnnn.exe 88 PID 5008 wrote to memory of 1920 5008 9nhbbb.exe 89 PID 5008 wrote to memory of 1920 5008 9nhbbb.exe 89 PID 5008 wrote to memory of 1920 5008 9nhbbb.exe 89 PID 1920 wrote to memory of 1860 1920 pjjjd.exe 90 PID 1920 wrote to memory of 1860 1920 pjjjd.exe 90 PID 1920 wrote to memory of 1860 1920 pjjjd.exe 90 PID 1860 wrote to memory of 1280 1860 xxfffff.exe 91 PID 1860 wrote to memory of 1280 1860 xxfffff.exe 91 PID 1860 wrote to memory of 1280 1860 xxfffff.exe 91 PID 1280 wrote to memory of 224 1280 bnttnt.exe 92 PID 1280 wrote to memory of 224 1280 bnttnt.exe 92 PID 1280 wrote to memory of 224 1280 bnttnt.exe 92 PID 224 wrote to memory of 2056 224 9pvvd.exe 93 PID 224 wrote to memory of 2056 224 9pvvd.exe 93 PID 224 wrote to memory of 2056 224 9pvvd.exe 93 PID 2056 wrote to memory of 1276 2056 9fllxxr.exe 94 PID 2056 wrote to memory of 1276 2056 9fllxxr.exe 94 PID 2056 wrote to memory of 1276 2056 9fllxxr.exe 94 PID 1276 wrote to memory of 4204 1276 ththbn.exe 95 PID 1276 wrote to memory of 4204 1276 ththbn.exe 95 PID 1276 wrote to memory of 4204 1276 ththbn.exe 95 PID 4204 wrote to memory of 3012 4204 pvjdj.exe 96 PID 4204 wrote to memory of 3012 4204 pvjdj.exe 96 PID 4204 wrote to memory of 3012 4204 pvjdj.exe 96 PID 3012 wrote to memory of 3528 3012 vpjdv.exe 97 PID 3012 wrote to memory of 3528 3012 vpjdv.exe 97 PID 3012 wrote to memory of 3528 3012 vpjdv.exe 97 PID 3528 wrote to memory of 3108 3528 rfrfrlf.exe 98 PID 3528 wrote to memory of 3108 3528 rfrfrlf.exe 98 PID 3528 wrote to memory of 3108 3528 rfrfrlf.exe 98 PID 3108 wrote to memory of 2824 3108 bttttt.exe 99 PID 3108 wrote to memory of 2824 3108 bttttt.exe 99 PID 3108 wrote to memory of 2824 3108 bttttt.exe 99 PID 2824 wrote to memory of 1164 2824 bhhhbb.exe 100 PID 2824 wrote to memory of 1164 2824 bhhhbb.exe 100 PID 2824 wrote to memory of 1164 2824 bhhhbb.exe 100 PID 1164 wrote to memory of 1528 1164 vjpjd.exe 101 PID 1164 wrote to memory of 1528 1164 vjpjd.exe 101 PID 1164 wrote to memory of 1528 1164 vjpjd.exe 101 PID 1528 wrote to memory of 3768 1528 llrrllf.exe 102 PID 1528 wrote to memory of 3768 1528 llrrllf.exe 102 PID 1528 wrote to memory of 3768 1528 llrrllf.exe 102 PID 3768 wrote to memory of 3632 3768 btbtbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe"C:\Users\Admin\AppData\Local\Temp\375a88bef01a4a3237a62d910b471c4022ac477e53b25a761f4944cbb7b3a69eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\fflrrrr.exec:\fflrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\ttbbhh.exec:\ttbbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\dpvpv.exec:\dpvpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\fxffffl.exec:\fxffffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xllllrr.exec:\xllllrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\nhhnnn.exec:\nhhnnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\9nhbbb.exec:\9nhbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pjjjd.exec:\pjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xxfffff.exec:\xxfffff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\bnttnt.exec:\bnttnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\9pvvd.exec:\9pvvd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\9fllxxr.exec:\9fllxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\ththbn.exec:\ththbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\pvjdj.exec:\pvjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\vpjdv.exec:\vpjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\rfrfrlf.exec:\rfrfrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\bttttt.exec:\bttttt.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\bhhhbb.exec:\bhhhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\vjpjd.exec:\vjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\llrrllf.exec:\llrrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\btbtbb.exec:\btbtbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\nnnhhb.exec:\nnnhhb.exe23⤵
- Executes dropped EXE
PID:3632 -
\??\c:\dvdvp.exec:\dvdvp.exe24⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ppdvv.exec:\ppdvv.exe25⤵
- Executes dropped EXE
PID:2324 -
\??\c:\dvdvj.exec:\dvdvj.exe26⤵
- Executes dropped EXE
PID:3428 -
\??\c:\ppjdd.exec:\ppjdd.exe27⤵
- Executes dropped EXE
PID:4452 -
\??\c:\lfxxrrr.exec:\lfxxrrr.exe28⤵
- Executes dropped EXE
PID:4524 -
\??\c:\btbbhh.exec:\btbbhh.exe29⤵
- Executes dropped EXE
PID:1384 -
\??\c:\pdpjp.exec:\pdpjp.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1vdvd.exec:\1vdvd.exe31⤵
- Executes dropped EXE
PID:60 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe32⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nhhhbb.exec:\nhhhbb.exe33⤵
- Executes dropped EXE
PID:4048 -
\??\c:\tnnhbn.exec:\tnnhbn.exe34⤵
- Executes dropped EXE
PID:3268 -
\??\c:\tnttnn.exec:\tnttnn.exe35⤵
- Executes dropped EXE
PID:3112 -
\??\c:\rllfxxx.exec:\rllfxxx.exe36⤵
- Executes dropped EXE
PID:1656 -
\??\c:\lrxfllr.exec:\lrxfllr.exe37⤵
- Executes dropped EXE
PID:404 -
\??\c:\bbttnt.exec:\bbttnt.exe38⤵
- Executes dropped EXE
PID:4152 -
\??\c:\jjjdv.exec:\jjjdv.exe39⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ppjjd.exec:\ppjjd.exe40⤵
- Executes dropped EXE
PID:4140 -
\??\c:\rxfffff.exec:\rxfffff.exe41⤵
- Executes dropped EXE
PID:4812 -
\??\c:\nttttb.exec:\nttttb.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\bhnnnn.exec:\bhnnnn.exe43⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pjjjp.exec:\pjjjp.exe44⤵
- Executes dropped EXE
PID:4528 -
\??\c:\lxfflfl.exec:\lxfflfl.exe45⤵
- Executes dropped EXE
PID:4628 -
\??\c:\hbtnhh.exec:\hbtnhh.exe46⤵
- Executes dropped EXE
PID:4976 -
\??\c:\bttnnn.exec:\bttnnn.exe47⤵
- Executes dropped EXE
PID:4600 -
\??\c:\bbbbtt.exec:\bbbbtt.exe48⤵
- Executes dropped EXE
PID:3624 -
\??\c:\9jppj.exec:\9jppj.exe49⤵
- Executes dropped EXE
PID:4348 -
\??\c:\5llfffx.exec:\5llfffx.exe50⤵
- Executes dropped EXE
PID:4840 -
\??\c:\btnhnn.exec:\btnhnn.exe51⤵
- Executes dropped EXE
PID:2712 -
\??\c:\frxllfx.exec:\frxllfx.exe52⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bhnhbb.exec:\bhnhbb.exe53⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vdjdd.exec:\vdjdd.exe54⤵
- Executes dropped EXE
PID:636 -
\??\c:\xllfxll.exec:\xllfxll.exe55⤵
- Executes dropped EXE
PID:3584 -
\??\c:\nthhnn.exec:\nthhnn.exe56⤵
- Executes dropped EXE
PID:216 -
\??\c:\nntttb.exec:\nntttb.exe57⤵
- Executes dropped EXE
PID:208 -
\??\c:\rxxrllf.exec:\rxxrllf.exe58⤵
- Executes dropped EXE
PID:4708 -
\??\c:\rxrllxr.exec:\rxrllxr.exe59⤵
- Executes dropped EXE
PID:1076 -
\??\c:\5hnbbb.exec:\5hnbbb.exe60⤵
- Executes dropped EXE
PID:2076 -
\??\c:\hnbtbh.exec:\hnbtbh.exe61⤵
- Executes dropped EXE
PID:1628 -
\??\c:\vvvpd.exec:\vvvpd.exe62⤵
- Executes dropped EXE
PID:4044 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe63⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nbbttt.exec:\nbbttt.exe64⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nhhhtb.exec:\nhhhtb.exe65⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dpvdv.exec:\dpvdv.exe66⤵PID:5024
-
\??\c:\lfrlffl.exec:\lfrlffl.exe67⤵PID:4408
-
\??\c:\bbtttt.exec:\bbtttt.exe68⤵PID:5100
-
\??\c:\ddpjp.exec:\ddpjp.exe69⤵PID:4724
-
\??\c:\jjvpd.exec:\jjvpd.exe70⤵PID:4204
-
\??\c:\rfrlllr.exec:\rfrlllr.exe71⤵PID:5060
-
\??\c:\nttnhh.exec:\nttnhh.exe72⤵PID:3248
-
\??\c:\jvppj.exec:\jvppj.exe73⤵PID:1288
-
\??\c:\vdddv.exec:\vdddv.exe74⤵PID:3916
-
\??\c:\llrrxxf.exec:\llrrxxf.exe75⤵PID:2560
-
\??\c:\nhnnnt.exec:\nhnnnt.exe76⤵PID:2064
-
\??\c:\thnhhh.exec:\thnhhh.exe77⤵PID:2860
-
\??\c:\9vdvd.exec:\9vdvd.exe78⤵PID:1448
-
\??\c:\pjjjv.exec:\pjjjv.exe79⤵PID:1480
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe80⤵PID:1124
-
\??\c:\nnnntt.exec:\nnnntt.exe81⤵PID:4356
-
\??\c:\1hnhbb.exec:\1hnhbb.exe82⤵PID:2060
-
\??\c:\dpppd.exec:\dpppd.exe83⤵PID:3292
-
\??\c:\jdjdv.exec:\jdjdv.exe84⤵PID:2520
-
\??\c:\1lrlllr.exec:\1lrlllr.exe85⤵PID:3428
-
\??\c:\thnnhh.exec:\thnnhh.exe86⤵PID:4688
-
\??\c:\nttnhh.exec:\nttnhh.exe87⤵PID:3920
-
\??\c:\5jjjj.exec:\5jjjj.exe88⤵PID:4332
-
\??\c:\1djdj.exec:\1djdj.exe89⤵PID:1064
-
\??\c:\fffxxfx.exec:\fffxxfx.exe90⤵PID:1736
-
\??\c:\rrrrllf.exec:\rrrrllf.exe91⤵PID:948
-
\??\c:\tnnnhh.exec:\tnnnhh.exe92⤵PID:2892
-
\??\c:\ppppd.exec:\ppppd.exe93⤵PID:4160
-
\??\c:\frrlfff.exec:\frrlfff.exe94⤵PID:2628
-
\??\c:\llrrrrr.exec:\llrrrrr.exe95⤵PID:4312
-
\??\c:\hhbbtt.exec:\hhbbtt.exe96⤵PID:4924
-
\??\c:\bnbtnn.exec:\bnbtnn.exe97⤵PID:4128
-
\??\c:\dvvvp.exec:\dvvvp.exe98⤵PID:1984
-
\??\c:\lflfrrl.exec:\lflfrrl.exe99⤵PID:388
-
\??\c:\ffrrlff.exec:\ffrrlff.exe100⤵PID:4760
-
\??\c:\bbbbtt.exec:\bbbbtt.exe101⤵PID:4416
-
\??\c:\nhbttt.exec:\nhbttt.exe102⤵PID:32
-
\??\c:\pjpvv.exec:\pjpvv.exe103⤵PID:4812
-
\??\c:\vpvpj.exec:\vpvpj.exe104⤵
- System Location Discovery: System Language Discovery
PID:1804 -
\??\c:\lfrrfxx.exec:\lfrrfxx.exe105⤵PID:1696
-
\??\c:\nnhhtt.exec:\nnhhtt.exe106⤵PID:2524
-
\??\c:\nnnhbh.exec:\nnnhbh.exe107⤵PID:3312
-
\??\c:\nbbtnn.exec:\nbbtnn.exe108⤵PID:4136
-
\??\c:\7jpjv.exec:\7jpjv.exe109⤵PID:4420
-
\??\c:\rffxllf.exec:\rffxllf.exe110⤵PID:1960
-
\??\c:\xfllfll.exec:\xfllfll.exe111⤵PID:1868
-
\??\c:\bttthh.exec:\bttthh.exe112⤵PID:4704
-
\??\c:\thtnhh.exec:\thtnhh.exe113⤵PID:1668
-
\??\c:\dpvpp.exec:\dpvpp.exe114⤵PID:448
-
\??\c:\pjppv.exec:\pjppv.exe115⤵PID:3116
-
\??\c:\flllflf.exec:\flllflf.exe116⤵PID:4912
-
\??\c:\3bnnnn.exec:\3bnnnn.exe117⤵PID:3500
-
\??\c:\nhtntt.exec:\nhtntt.exe118⤵PID:3344
-
\??\c:\pdjdj.exec:\pdjdj.exe119⤵PID:1116
-
\??\c:\jjddv.exec:\jjddv.exe120⤵PID:3612
-
\??\c:\9ffrflf.exec:\9ffrflf.exe121⤵PID:1484
-
\??\c:\rflffff.exec:\rflffff.exe122⤵PID:1972
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-