Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 19:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe
-
Size
71KB
-
MD5
edf7d58ee39e666411a0e87af176b290
-
SHA1
bc98db6e8fbf547145fc400f72d20455933f31d7
-
SHA256
89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3d
-
SHA512
009568d3a9a6fb91bc4c172a61d6773b9e8c969f567b6ed73eb88703f73a7a7874e39306203152677e1eb79bfe13c3b1db9c702f14b5d8bfa66def47fb8cecc8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj9:ymb3NkkiQ3mdBjFI4VN
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/1312-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1424-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/472-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2316 ppjvd.exe 4116 9ttbtt.exe 4824 jvvpp.exe 1424 rllxrrf.exe 4452 lrlfxrl.exe 3540 nbbbtn.exe 1780 jvjdp.exe 3388 fllffff.exe 3764 lxxlfrr.exe 4968 hnbbbn.exe 2476 jddvj.exe 3552 xllrrfl.exe 1600 9nntbh.exe 472 pddpj.exe 1428 xrfxrff.exe 2456 hbtnbt.exe 2848 djddp.exe 1268 lrrrfxr.exe 2480 7xllffx.exe 4220 hnhhbb.exe 4524 jjvpp.exe 2244 pdvjv.exe 3660 xxxlxfr.exe 1052 tbbthb.exe 4480 xffxlfr.exe 5112 bnnnhb.exe 2112 jvddv.exe 4260 rlrllfx.exe 2232 7rfxlfx.exe 1392 ntthtn.exe 2816 dvvpj.exe 4792 dvvvp.exe 1412 rflxlfr.exe 1632 bhbtnn.exe 4104 ntbbnt.exe 5108 djppd.exe 2520 9xrfxrl.exe 4940 rllxrfx.exe 4076 ntthtb.exe 2260 jdjdd.exe 2700 rxrlxxx.exe 4132 frfxxrx.exe 4988 tnttbt.exe 3940 pjjjv.exe 3344 vjjjv.exe 1360 xrxxxlr.exe 3532 7hbthh.exe 4460 tntnbt.exe 1948 dvppd.exe 540 3xrxrxr.exe 4944 rffxrlf.exe 4092 btnnhh.exe 1764 vppjv.exe 5032 5djvv.exe 3412 7llxfxl.exe 2176 bntntn.exe 5092 thhbnn.exe 2788 pjvdv.exe 2024 lffxfxf.exe 3228 lfrrrrr.exe 5064 3tbbtn.exe 4052 3nnhhh.exe 4740 jddjv.exe 2756 vpjvj.exe -
resource yara_rule behavioral2/memory/1312-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1424-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/472-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-216-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fllxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2316 1312 89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe 84 PID 1312 wrote to memory of 2316 1312 89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe 84 PID 1312 wrote to memory of 2316 1312 89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe 84 PID 2316 wrote to memory of 4116 2316 ppjvd.exe 85 PID 2316 wrote to memory of 4116 2316 ppjvd.exe 85 PID 2316 wrote to memory of 4116 2316 ppjvd.exe 85 PID 4116 wrote to memory of 4824 4116 9ttbtt.exe 86 PID 4116 wrote to memory of 4824 4116 9ttbtt.exe 86 PID 4116 wrote to memory of 4824 4116 9ttbtt.exe 86 PID 4824 wrote to memory of 1424 4824 jvvpp.exe 87 PID 4824 wrote to memory of 1424 4824 jvvpp.exe 87 PID 4824 wrote to memory of 1424 4824 jvvpp.exe 87 PID 1424 wrote to memory of 4452 1424 rllxrrf.exe 88 PID 1424 wrote to memory of 4452 1424 rllxrrf.exe 88 PID 1424 wrote to memory of 4452 1424 rllxrrf.exe 88 PID 4452 wrote to memory of 3540 4452 lrlfxrl.exe 90 PID 4452 wrote to memory of 3540 4452 lrlfxrl.exe 90 PID 4452 wrote to memory of 3540 4452 lrlfxrl.exe 90 PID 3540 wrote to memory of 1780 3540 nbbbtn.exe 91 PID 3540 wrote to memory of 1780 3540 nbbbtn.exe 91 PID 3540 wrote to memory of 1780 3540 nbbbtn.exe 91 PID 1780 wrote to memory of 3388 1780 jvjdp.exe 92 PID 1780 wrote to memory of 3388 1780 jvjdp.exe 92 PID 1780 wrote to memory of 3388 1780 jvjdp.exe 92 PID 3388 wrote to memory of 3764 3388 fllffff.exe 93 PID 3388 wrote to memory of 3764 3388 fllffff.exe 93 PID 3388 wrote to memory of 3764 3388 fllffff.exe 93 PID 3764 wrote to memory of 4968 3764 lxxlfrr.exe 94 PID 3764 wrote to memory of 4968 3764 lxxlfrr.exe 94 PID 3764 wrote to memory of 4968 3764 lxxlfrr.exe 94 PID 4968 wrote to memory of 2476 4968 hnbbbn.exe 95 PID 4968 wrote to memory of 2476 4968 hnbbbn.exe 95 PID 4968 wrote to memory of 2476 4968 hnbbbn.exe 95 PID 2476 wrote to memory of 3552 2476 jddvj.exe 96 PID 2476 wrote to memory of 3552 2476 jddvj.exe 96 PID 2476 wrote to memory of 3552 2476 jddvj.exe 96 PID 3552 wrote to memory of 1600 3552 xllrrfl.exe 98 PID 3552 wrote to memory of 1600 3552 xllrrfl.exe 98 PID 3552 wrote to memory of 1600 3552 xllrrfl.exe 98 PID 1600 wrote to memory of 472 1600 9nntbh.exe 99 PID 1600 wrote to memory of 472 1600 9nntbh.exe 99 PID 1600 wrote to memory of 472 1600 9nntbh.exe 99 PID 472 wrote to memory of 1428 472 pddpj.exe 100 PID 472 wrote to memory of 1428 472 pddpj.exe 100 PID 472 wrote to memory of 1428 472 pddpj.exe 100 PID 1428 wrote to memory of 2456 1428 xrfxrff.exe 101 PID 1428 wrote to memory of 2456 1428 xrfxrff.exe 101 PID 1428 wrote to memory of 2456 1428 xrfxrff.exe 101 PID 2456 wrote to memory of 2848 2456 hbtnbt.exe 102 PID 2456 wrote to memory of 2848 2456 hbtnbt.exe 102 PID 2456 wrote to memory of 2848 2456 hbtnbt.exe 102 PID 2848 wrote to memory of 1268 2848 djddp.exe 103 PID 2848 wrote to memory of 1268 2848 djddp.exe 103 PID 2848 wrote to memory of 1268 2848 djddp.exe 103 PID 1268 wrote to memory of 2480 1268 lrrrfxr.exe 104 PID 1268 wrote to memory of 2480 1268 lrrrfxr.exe 104 PID 1268 wrote to memory of 2480 1268 lrrrfxr.exe 104 PID 2480 wrote to memory of 4220 2480 7xllffx.exe 105 PID 2480 wrote to memory of 4220 2480 7xllffx.exe 105 PID 2480 wrote to memory of 4220 2480 7xllffx.exe 105 PID 4220 wrote to memory of 4524 4220 hnhhbb.exe 106 PID 4220 wrote to memory of 4524 4220 hnhhbb.exe 106 PID 4220 wrote to memory of 4524 4220 hnhhbb.exe 106 PID 4524 wrote to memory of 2244 4524 jjvpp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe"C:\Users\Admin\AppData\Local\Temp\89c1b79e9c718fb243f2f43de9b1a9ae860627ec2a9f12949486e3b77633dc3dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\ppjvd.exec:\ppjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\9ttbtt.exec:\9ttbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\jvvpp.exec:\jvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\rllxrrf.exec:\rllxrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\nbbbtn.exec:\nbbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\jvjdp.exec:\jvjdp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\fllffff.exec:\fllffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\lxxlfrr.exec:\lxxlfrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\hnbbbn.exec:\hnbbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\jddvj.exec:\jddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\xllrrfl.exec:\xllrrfl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\9nntbh.exec:\9nntbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\pddpj.exec:\pddpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\xrfxrff.exec:\xrfxrff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\hbtnbt.exec:\hbtnbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\djddp.exec:\djddp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\lrrrfxr.exec:\lrrrfxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\7xllffx.exec:\7xllffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\hnhhbb.exec:\hnhhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\jjvpp.exec:\jjvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\pdvjv.exec:\pdvjv.exe23⤵
- Executes dropped EXE
PID:2244 -
\??\c:\xxxlxfr.exec:\xxxlxfr.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3660 -
\??\c:\tbbthb.exec:\tbbthb.exe25⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xffxlfr.exec:\xffxlfr.exe26⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bnnnhb.exec:\bnnnhb.exe27⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jvddv.exec:\jvddv.exe28⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rlrllfx.exec:\rlrllfx.exe29⤵
- Executes dropped EXE
PID:4260 -
\??\c:\7rfxlfx.exec:\7rfxlfx.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ntthtn.exec:\ntthtn.exe31⤵
- Executes dropped EXE
PID:1392 -
\??\c:\dvvpj.exec:\dvvpj.exe32⤵
- Executes dropped EXE
PID:2816 -
\??\c:\dvvvp.exec:\dvvvp.exe33⤵
- Executes dropped EXE
PID:4792 -
\??\c:\rflxlfr.exec:\rflxlfr.exe34⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bhbtnn.exec:\bhbtnn.exe35⤵
- Executes dropped EXE
PID:1632 -
\??\c:\ntbbnt.exec:\ntbbnt.exe36⤵
- Executes dropped EXE
PID:4104 -
\??\c:\djppd.exec:\djppd.exe37⤵
- Executes dropped EXE
PID:5108 -
\??\c:\9xrfxrl.exec:\9xrfxrl.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\rllxrfx.exec:\rllxrfx.exe39⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ntthtb.exec:\ntthtb.exe40⤵
- Executes dropped EXE
PID:4076 -
\??\c:\5tttnh.exec:\5tttnh.exe41⤵PID:1212
-
\??\c:\jdjdd.exec:\jdjdd.exe42⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rxrlxxx.exec:\rxrlxxx.exe43⤵
- Executes dropped EXE
PID:2700 -
\??\c:\frfxxrx.exec:\frfxxrx.exe44⤵
- Executes dropped EXE
PID:4132 -
\??\c:\tnttbt.exec:\tnttbt.exe45⤵
- Executes dropped EXE
PID:4988 -
\??\c:\pjjjv.exec:\pjjjv.exe46⤵
- Executes dropped EXE
PID:3940 -
\??\c:\vjjjv.exec:\vjjjv.exe47⤵
- Executes dropped EXE
PID:3344 -
\??\c:\xrxxxlr.exec:\xrxxxlr.exe48⤵
- Executes dropped EXE
PID:1360 -
\??\c:\7hbthh.exec:\7hbthh.exe49⤵
- Executes dropped EXE
PID:3532 -
\??\c:\tntnbt.exec:\tntnbt.exe50⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dvppd.exec:\dvppd.exe51⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3xrxrxr.exec:\3xrxrxr.exe52⤵
- Executes dropped EXE
PID:540 -
\??\c:\rffxrlf.exec:\rffxrlf.exe53⤵
- Executes dropped EXE
PID:4944 -
\??\c:\btnnhh.exec:\btnnhh.exe54⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vppjv.exec:\vppjv.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\5djvv.exec:\5djvv.exe56⤵
- Executes dropped EXE
PID:5032 -
\??\c:\7llxfxl.exec:\7llxfxl.exe57⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bntntn.exec:\bntntn.exe58⤵
- Executes dropped EXE
PID:2176 -
\??\c:\thhbnn.exec:\thhbnn.exe59⤵
- Executes dropped EXE
PID:5092 -
\??\c:\pjvdv.exec:\pjvdv.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lffxfxf.exec:\lffxfxf.exe61⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe62⤵
- Executes dropped EXE
PID:3228 -
\??\c:\3tbbtn.exec:\3tbbtn.exe63⤵
- Executes dropped EXE
PID:5064 -
\??\c:\3nnhhh.exec:\3nnhhh.exe64⤵
- Executes dropped EXE
PID:4052 -
\??\c:\jddjv.exec:\jddjv.exe65⤵
- Executes dropped EXE
PID:4740 -
\??\c:\vpjvj.exec:\vpjvj.exe66⤵
- Executes dropped EXE
PID:2756 -
\??\c:\fffxxrr.exec:\fffxxrr.exe67⤵PID:4796
-
\??\c:\hbnhtb.exec:\hbnhtb.exe68⤵PID:1268
-
\??\c:\hbnhtn.exec:\hbnhtn.exe69⤵PID:1952
-
\??\c:\ppvpd.exec:\ppvpd.exe70⤵PID:2288
-
\??\c:\xlllffx.exec:\xlllffx.exe71⤵PID:3876
-
\??\c:\xlrxxlf.exec:\xlrxxlf.exe72⤵PID:4564
-
\??\c:\hbhtnh.exec:\hbhtnh.exe73⤵PID:2244
-
\??\c:\lflrfrr.exec:\lflrfrr.exe74⤵PID:1624
-
\??\c:\bnnhtn.exec:\bnnhtn.exe75⤵PID:1400
-
\??\c:\7hbthh.exec:\7hbthh.exe76⤵PID:1468
-
\??\c:\3pvvj.exec:\3pvvj.exe77⤵PID:3016
-
\??\c:\dpdvv.exec:\dpdvv.exe78⤵PID:1352
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe79⤵PID:2392
-
\??\c:\nnhntb.exec:\nnhntb.exe80⤵PID:5084
-
\??\c:\hbbttn.exec:\hbbttn.exe81⤵PID:3772
-
\??\c:\vpjpp.exec:\vpjpp.exe82⤵PID:1216
-
\??\c:\pjppp.exec:\pjppp.exe83⤵PID:2908
-
\??\c:\fxfxxrf.exec:\fxfxxrf.exe84⤵PID:1640
-
\??\c:\tntttt.exec:\tntttt.exe85⤵PID:1208
-
\??\c:\nttttt.exec:\nttttt.exe86⤵PID:3680
-
\??\c:\jvvpj.exec:\jvvpj.exe87⤵PID:1028
-
\??\c:\1fxxrxr.exec:\1fxxrxr.exe88⤵PID:3932
-
\??\c:\3rfrffr.exec:\3rfrffr.exe89⤵PID:2940
-
\??\c:\nbtnhb.exec:\nbtnhb.exe90⤵PID:1644
-
\??\c:\dvvdd.exec:\dvvdd.exe91⤵PID:648
-
\??\c:\jpdvp.exec:\jpdvp.exe92⤵PID:4940
-
\??\c:\xrllxxr.exec:\xrllxxr.exe93⤵PID:3948
-
\??\c:\hnttbb.exec:\hnttbb.exe94⤵PID:4544
-
\??\c:\bbbtnn.exec:\bbbtnn.exe95⤵PID:3888
-
\??\c:\vddvp.exec:\vddvp.exe96⤵PID:2700
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe97⤵PID:3084
-
\??\c:\rxlxlfl.exec:\rxlxlfl.exe98⤵PID:4824
-
\??\c:\hhhbnt.exec:\hhhbnt.exe99⤵PID:1116
-
\??\c:\bhhhhh.exec:\bhhhhh.exe100⤵PID:4560
-
\??\c:\3pppj.exec:\3pppj.exe101⤵PID:1084
-
\??\c:\pvdpd.exec:\pvdpd.exe102⤵PID:3532
-
\??\c:\lllfrrr.exec:\lllfrrr.exe103⤵PID:3944
-
\??\c:\9ffffll.exec:\9ffffll.exe104⤵PID:3388
-
\??\c:\9hnnnn.exec:\9hnnnn.exe105⤵PID:4268
-
\??\c:\nhhbtt.exec:\nhhbtt.exe106⤵PID:3764
-
\??\c:\jpjjv.exec:\jpjjv.exe107⤵PID:2040
-
\??\c:\jvvjp.exec:\jvvjp.exe108⤵PID:1904
-
\??\c:\lfrlxlf.exec:\lfrlxlf.exe109⤵PID:3812
-
\??\c:\tnthtt.exec:\tnthtt.exe110⤵PID:1556
-
\??\c:\ttnhhb.exec:\ttnhhb.exe111⤵PID:4392
-
\??\c:\dpjvj.exec:\dpjvj.exe112⤵PID:2320
-
\??\c:\5vdvj.exec:\5vdvj.exe113⤵PID:1932
-
\??\c:\1lfxrlf.exec:\1lfxrlf.exe114⤵PID:456
-
\??\c:\xrxrxxx.exec:\xrxrxxx.exe115⤵PID:3580
-
\??\c:\hnnntt.exec:\hnnntt.exe116⤵PID:5060
-
\??\c:\pvpjv.exec:\pvpjv.exe117⤵PID:3132
-
\??\c:\djjvj.exec:\djjvj.exe118⤵PID:4396
-
\??\c:\fxlffrl.exec:\fxlffrl.exe119⤵PID:1336
-
\??\c:\tbnbth.exec:\tbnbth.exe120⤵PID:2256
-
\??\c:\bbthhh.exec:\bbthhh.exe121⤵PID:2748
-
\??\c:\nbnbnh.exec:\nbnbnh.exe122⤵PID:4532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-