Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 01:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe
-
Size
106KB
-
MD5
2242ae4a33111e3f17801b2528169300
-
SHA1
3a16c47aeac70b4170ef5fc6e08e140bd3786bc7
-
SHA256
be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5
-
SHA512
4608184fd314f226d52eb84d6eac49cf8cf943e29ef9dd698b95cb488d90b67a139021f565438c0945624d002c843a04cf9da0883dbe0bec9c23220fcbffbcd8
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CAZ:n3C9BRo7MlrWKVT+buBGu3Pl
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/5084-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3744-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1504 vpjjd.exe 4956 vdddv.exe 4480 bbbtbh.exe 3132 htnhtt.exe 3744 vdjdp.exe 3972 rllxrrl.exe 2136 bttnnn.exe 5012 3nhbnn.exe 1096 dvpjd.exe 376 pvdvd.exe 4664 rflxllf.exe 3248 nbbttt.exe 4520 pppjp.exe 728 xxfllrl.exe 1028 fxfxllf.exe 3660 hbbbtt.exe 4652 pjjvv.exe 3896 rllxrlf.exe 764 xllfxxr.exe 2748 3nhbtt.exe 4924 pvjvp.exe 1632 vjjdp.exe 3740 fxfrlxr.exe 4076 7hbbbb.exe 1244 nbnnbb.exe 1300 9pdpj.exe 2016 xlfxrlf.exe 3060 tnntnn.exe 4196 pjjdp.exe 1344 rrffrrr.exe 4968 xfrrlfx.exe 4024 btnnbb.exe 1640 bntnnn.exe 2336 9djdj.exe 3996 rfrrfrl.exe 3332 dvdvd.exe 3704 lllllll.exe 1092 hhnbbh.exe 2960 dvvpp.exe 3148 xllfrrx.exe 4748 xxrlfff.exe 932 bntttt.exe 4700 3hnhhb.exe 4476 7pppd.exe 5044 vpjvp.exe 3300 3frlrrl.exe 3348 5bbnhh.exe 2672 1ntnbb.exe 4956 vdjdp.exe 1956 dvjjj.exe 4780 rfffrrl.exe 1272 frrrrlr.exe 5088 tnhhhn.exe 512 ntbtnn.exe 4192 9djdp.exe 2308 rffxlll.exe 4912 flllffx.exe 3840 bbhbhh.exe 2380 nhbtnn.exe 4988 jjjjv.exe 3808 dpjdv.exe 4940 3xfxrrl.exe 4772 rllfxxr.exe 3512 btnhth.exe -
resource yara_rule behavioral2/memory/5084-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrxrxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5084 wrote to memory of 1504 5084 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 85 PID 5084 wrote to memory of 1504 5084 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 85 PID 5084 wrote to memory of 1504 5084 be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe 85 PID 1504 wrote to memory of 4956 1504 vpjjd.exe 86 PID 1504 wrote to memory of 4956 1504 vpjjd.exe 86 PID 1504 wrote to memory of 4956 1504 vpjjd.exe 86 PID 4956 wrote to memory of 4480 4956 vdddv.exe 87 PID 4956 wrote to memory of 4480 4956 vdddv.exe 87 PID 4956 wrote to memory of 4480 4956 vdddv.exe 87 PID 4480 wrote to memory of 3132 4480 bbbtbh.exe 88 PID 4480 wrote to memory of 3132 4480 bbbtbh.exe 88 PID 4480 wrote to memory of 3132 4480 bbbtbh.exe 88 PID 3132 wrote to memory of 3744 3132 htnhtt.exe 89 PID 3132 wrote to memory of 3744 3132 htnhtt.exe 89 PID 3132 wrote to memory of 3744 3132 htnhtt.exe 89 PID 3744 wrote to memory of 3972 3744 vdjdp.exe 90 PID 3744 wrote to memory of 3972 3744 vdjdp.exe 90 PID 3744 wrote to memory of 3972 3744 vdjdp.exe 90 PID 3972 wrote to memory of 2136 3972 rllxrrl.exe 91 PID 3972 wrote to memory of 2136 3972 rllxrrl.exe 91 PID 3972 wrote to memory of 2136 3972 rllxrrl.exe 91 PID 2136 wrote to memory of 5012 2136 bttnnn.exe 92 PID 2136 wrote to memory of 5012 2136 bttnnn.exe 92 PID 2136 wrote to memory of 5012 2136 bttnnn.exe 92 PID 5012 wrote to memory of 1096 5012 3nhbnn.exe 93 PID 5012 wrote to memory of 1096 5012 3nhbnn.exe 93 PID 5012 wrote to memory of 1096 5012 3nhbnn.exe 93 PID 1096 wrote to memory of 376 1096 dvpjd.exe 94 PID 1096 wrote to memory of 376 1096 dvpjd.exe 94 PID 1096 wrote to memory of 376 1096 dvpjd.exe 94 PID 376 wrote to memory of 4664 376 pvdvd.exe 95 PID 376 wrote to memory of 4664 376 pvdvd.exe 95 PID 376 wrote to memory of 4664 376 pvdvd.exe 95 PID 4664 wrote to memory of 3248 4664 rflxllf.exe 96 PID 4664 wrote to memory of 3248 4664 rflxllf.exe 96 PID 4664 wrote to memory of 3248 4664 rflxllf.exe 96 PID 3248 wrote to memory of 4520 3248 nbbttt.exe 97 PID 3248 wrote to memory of 4520 3248 nbbttt.exe 97 PID 3248 wrote to memory of 4520 3248 nbbttt.exe 97 PID 4520 wrote to memory of 728 4520 pppjp.exe 98 PID 4520 wrote to memory of 728 4520 pppjp.exe 98 PID 4520 wrote to memory of 728 4520 pppjp.exe 98 PID 728 wrote to memory of 1028 728 xxfllrl.exe 99 PID 728 wrote to memory of 1028 728 xxfllrl.exe 99 PID 728 wrote to memory of 1028 728 xxfllrl.exe 99 PID 1028 wrote to memory of 3660 1028 fxfxllf.exe 100 PID 1028 wrote to memory of 3660 1028 fxfxllf.exe 100 PID 1028 wrote to memory of 3660 1028 fxfxllf.exe 100 PID 3660 wrote to memory of 4652 3660 hbbbtt.exe 101 PID 3660 wrote to memory of 4652 3660 hbbbtt.exe 101 PID 3660 wrote to memory of 4652 3660 hbbbtt.exe 101 PID 4652 wrote to memory of 3896 4652 pjjvv.exe 102 PID 4652 wrote to memory of 3896 4652 pjjvv.exe 102 PID 4652 wrote to memory of 3896 4652 pjjvv.exe 102 PID 3896 wrote to memory of 764 3896 rllxrlf.exe 103 PID 3896 wrote to memory of 764 3896 rllxrlf.exe 103 PID 3896 wrote to memory of 764 3896 rllxrlf.exe 103 PID 764 wrote to memory of 2748 764 xllfxxr.exe 104 PID 764 wrote to memory of 2748 764 xllfxxr.exe 104 PID 764 wrote to memory of 2748 764 xllfxxr.exe 104 PID 2748 wrote to memory of 4924 2748 3nhbtt.exe 105 PID 2748 wrote to memory of 4924 2748 3nhbtt.exe 105 PID 2748 wrote to memory of 4924 2748 3nhbtt.exe 105 PID 4924 wrote to memory of 1632 4924 pvjvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe"C:\Users\Admin\AppData\Local\Temp\be8c9a7f869aa36e2e182c6d95ab7e08cbfe93f4904ea0a3dea7db036ccae3c5N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\vpjjd.exec:\vpjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vdddv.exec:\vdddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\bbbtbh.exec:\bbbtbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\htnhtt.exec:\htnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\vdjdp.exec:\vdjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\rllxrrl.exec:\rllxrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\bttnnn.exec:\bttnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3nhbnn.exec:\3nhbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\dvpjd.exec:\dvpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\pvdvd.exec:\pvdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\rflxllf.exec:\rflxllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\nbbttt.exec:\nbbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\pppjp.exec:\pppjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\xxfllrl.exec:\xxfllrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\fxfxllf.exec:\fxfxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\hbbbtt.exec:\hbbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\pjjvv.exec:\pjjvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\rllxrlf.exec:\rllxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\xllfxxr.exec:\xllfxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\3nhbtt.exec:\3nhbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\pvjvp.exec:\pvjvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vjjdp.exec:\vjjdp.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\fxfrlxr.exec:\fxfrlxr.exe24⤵
- Executes dropped EXE
PID:3740 -
\??\c:\7hbbbb.exec:\7hbbbb.exe25⤵
- Executes dropped EXE
PID:4076 -
\??\c:\nbnnbb.exec:\nbnnbb.exe26⤵
- Executes dropped EXE
PID:1244 -
\??\c:\9pdpj.exec:\9pdpj.exe27⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe28⤵
- Executes dropped EXE
PID:2016 -
\??\c:\tnntnn.exec:\tnntnn.exe29⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pjjdp.exec:\pjjdp.exe30⤵
- Executes dropped EXE
PID:4196 -
\??\c:\rrffrrr.exec:\rrffrrr.exe31⤵
- Executes dropped EXE
PID:1344 -
\??\c:\xfrrlfx.exec:\xfrrlfx.exe32⤵
- Executes dropped EXE
PID:4968 -
\??\c:\btnnbb.exec:\btnnbb.exe33⤵
- Executes dropped EXE
PID:4024 -
\??\c:\bntnnn.exec:\bntnnn.exe34⤵
- Executes dropped EXE
PID:1640 -
\??\c:\9djdj.exec:\9djdj.exe35⤵
- Executes dropped EXE
PID:2336 -
\??\c:\rfrrfrl.exec:\rfrrfrl.exe36⤵
- Executes dropped EXE
PID:3996 -
\??\c:\dvdvd.exec:\dvdvd.exe37⤵
- Executes dropped EXE
PID:3332 -
\??\c:\lllllll.exec:\lllllll.exe38⤵
- Executes dropped EXE
PID:3704 -
\??\c:\hhnbbh.exec:\hhnbbh.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1092 -
\??\c:\dvvpp.exec:\dvvpp.exe40⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xllfrrx.exec:\xllfrrx.exe41⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xxrlfff.exec:\xxrlfff.exe42⤵
- Executes dropped EXE
PID:4748 -
\??\c:\bntttt.exec:\bntttt.exe43⤵
- Executes dropped EXE
PID:932 -
\??\c:\3hnhhb.exec:\3hnhhb.exe44⤵
- Executes dropped EXE
PID:4700 -
\??\c:\7pppd.exec:\7pppd.exe45⤵
- Executes dropped EXE
PID:4476 -
\??\c:\vpjvp.exec:\vpjvp.exe46⤵
- Executes dropped EXE
PID:5044 -
\??\c:\3frlrrl.exec:\3frlrrl.exe47⤵
- Executes dropped EXE
PID:3300 -
\??\c:\5bbnhh.exec:\5bbnhh.exe48⤵
- Executes dropped EXE
PID:3348 -
\??\c:\1ntnbb.exec:\1ntnbb.exe49⤵
- Executes dropped EXE
PID:2672 -
\??\c:\vdjdp.exec:\vdjdp.exe50⤵
- Executes dropped EXE
PID:4956 -
\??\c:\dvjjj.exec:\dvjjj.exe51⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rfffrrl.exec:\rfffrrl.exe52⤵
- Executes dropped EXE
PID:4780 -
\??\c:\frrrrlr.exec:\frrrrlr.exe53⤵
- Executes dropped EXE
PID:1272 -
\??\c:\tnhhhn.exec:\tnhhhn.exe54⤵
- Executes dropped EXE
PID:5088 -
\??\c:\ntbtnn.exec:\ntbtnn.exe55⤵
- Executes dropped EXE
PID:512 -
\??\c:\9djdp.exec:\9djdp.exe56⤵
- Executes dropped EXE
PID:4192 -
\??\c:\rffxlll.exec:\rffxlll.exe57⤵
- Executes dropped EXE
PID:2308 -
\??\c:\flllffx.exec:\flllffx.exe58⤵
- Executes dropped EXE
PID:4912 -
\??\c:\bbhbhh.exec:\bbhbhh.exe59⤵
- Executes dropped EXE
PID:3840 -
\??\c:\nhbtnn.exec:\nhbtnn.exe60⤵
- Executes dropped EXE
PID:2380 -
\??\c:\jjjjv.exec:\jjjjv.exe61⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dpjdv.exec:\dpjdv.exe62⤵
- Executes dropped EXE
PID:3808 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe63⤵
- Executes dropped EXE
PID:4940 -
\??\c:\rllfxxr.exec:\rllfxxr.exe64⤵
- Executes dropped EXE
PID:4772 -
\??\c:\btnhth.exec:\btnhth.exe65⤵
- Executes dropped EXE
PID:3512 -
\??\c:\9bhhnn.exec:\9bhhnn.exe66⤵PID:3960
-
\??\c:\jppjd.exec:\jppjd.exe67⤵PID:848
-
\??\c:\lflrrrx.exec:\lflrrrx.exe68⤵PID:1028
-
\??\c:\lfffxxx.exec:\lfffxxx.exe69⤵PID:4992
-
\??\c:\nhhhbt.exec:\nhhhbt.exe70⤵PID:4652
-
\??\c:\ntbhtt.exec:\ntbhtt.exe71⤵PID:4552
-
\??\c:\1pvpp.exec:\1pvpp.exe72⤵PID:3656
-
\??\c:\frxrlll.exec:\frxrlll.exe73⤵PID:3596
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe74⤵PID:2540
-
\??\c:\rrllllf.exec:\rrllllf.exe75⤵PID:5028
-
\??\c:\nhbtbb.exec:\nhbtbb.exe76⤵PID:3068
-
\??\c:\pjjdv.exec:\pjjdv.exe77⤵PID:3532
-
\??\c:\7jddp.exec:\7jddp.exe78⤵PID:432
-
\??\c:\xlfllxf.exec:\xlfllxf.exe79⤵PID:3804
-
\??\c:\lffxrfx.exec:\lffxrfx.exe80⤵PID:2736
-
\??\c:\ttbbht.exec:\ttbbht.exe81⤵PID:2292
-
\??\c:\nhhhtt.exec:\nhhhtt.exe82⤵PID:2072
-
\??\c:\vpvpp.exec:\vpvpp.exe83⤵PID:1788
-
\??\c:\jjpjp.exec:\jjpjp.exe84⤵PID:4368
-
\??\c:\jdppv.exec:\jdppv.exe85⤵PID:1672
-
\??\c:\9rxrllf.exec:\9rxrllf.exe86⤵PID:4196
-
\??\c:\xrffffx.exec:\xrffffx.exe87⤵PID:940
-
\??\c:\htbtnn.exec:\htbtnn.exe88⤵PID:2180
-
\??\c:\btbbth.exec:\btbbth.exe89⤵PID:456
-
\??\c:\ppjjv.exec:\ppjjv.exe90⤵PID:4024
-
\??\c:\rfrffrx.exec:\rfrffrx.exe91⤵PID:1640
-
\??\c:\lffxrrl.exec:\lffxrrl.exe92⤵PID:3628
-
\??\c:\hnbthn.exec:\hnbthn.exe93⤵PID:3996
-
\??\c:\nhhbtt.exec:\nhhbtt.exe94⤵PID:5040
-
\??\c:\dvdvv.exec:\dvdvv.exe95⤵PID:5064
-
\??\c:\vjjvp.exec:\vjjvp.exe96⤵PID:5056
-
\??\c:\lrrfxrr.exec:\lrrfxrr.exe97⤵PID:2960
-
\??\c:\xlrlrrr.exec:\xlrlrrr.exe98⤵PID:1264
-
\??\c:\tbbthh.exec:\tbbthh.exe99⤵PID:4748
-
\??\c:\httnbb.exec:\httnbb.exe100⤵PID:3748
-
\??\c:\jdddd.exec:\jdddd.exe101⤵PID:2360
-
\??\c:\vppvj.exec:\vppvj.exe102⤵PID:1168
-
\??\c:\frrlxxx.exec:\frrlxxx.exe103⤵PID:3296
-
\??\c:\ffffxfx.exec:\ffffxfx.exe104⤵PID:3556
-
\??\c:\ttbbbn.exec:\ttbbbn.exe105⤵PID:3348
-
\??\c:\9tttnn.exec:\9tttnn.exe106⤵PID:2516
-
\??\c:\pjdvj.exec:\pjdvj.exe107⤵PID:4956
-
\??\c:\ppdvd.exec:\ppdvd.exe108⤵PID:1416
-
\??\c:\xfrfxrl.exec:\xfrfxrl.exe109⤵PID:4780
-
\??\c:\xlrfrfl.exec:\xlrfrfl.exe110⤵PID:1272
-
\??\c:\ttthhb.exec:\ttthhb.exe111⤵PID:688
-
\??\c:\jjjdd.exec:\jjjdd.exe112⤵PID:2440
-
\??\c:\vvvpd.exec:\vvvpd.exe113⤵PID:4876
-
\??\c:\xfllxxr.exec:\xfllxxr.exe114⤵PID:1484
-
\??\c:\hbbnhb.exec:\hbbnhb.exe115⤵PID:2296
-
\??\c:\hntnbb.exec:\hntnbb.exe116⤵PID:5072
-
\??\c:\pjppj.exec:\pjppj.exe117⤵PID:1680
-
\??\c:\pppdv.exec:\pppdv.exe118⤵PID:1856
-
\??\c:\xfrrxxr.exec:\xfrrxxr.exe119⤵PID:3320
-
\??\c:\fxxxffl.exec:\fxxxffl.exe120⤵PID:3224
-
\??\c:\5nbtnn.exec:\5nbtnn.exe121⤵PID:1460
-
\??\c:\btnhbb.exec:\btnhbb.exe122⤵PID:528
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-