Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-10-2024 02:57
Static task
static1
Behavioral task
behavioral1
Sample
765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe
Resource
win7-20240903-en
General
-
Target
765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe
-
Size
83KB
-
MD5
53ba38a37b6381e2ff8d282025783d10
-
SHA1
eeb7079c29be0c453cf6259c5d8c0843276c4921
-
SHA256
765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091ba
-
SHA512
11f8f1d21cd2e5a1fc3a6a89a09a85e6415178d244d2e942046a20d2fe93ea69996cb4379fee26bab337c5347314bb7717ca0767049be8173a6aef498d138081
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QF:ymb3NkkiQ3mdBjFIIp9L9QrrA8Q
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1636-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2576-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/524-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5012 lrrxxff.exe 1504 7tbnbb.exe 2576 vpppd.exe 4196 5lfxlrr.exe 4936 lfxrlff.exe 3148 bnhhbt.exe 4624 jddvp.exe 508 rrlfrlx.exe 4172 5ntnhh.exe 1528 nhhbnb.exe 1872 pjpjj.exe 4680 lxxrrrl.exe 220 nntttt.exe 1036 btnhtn.exe 1588 vjpjd.exe 524 rrrlxrr.exe 2800 ddjdv.exe 4792 lfllxrx.exe 2244 tntttn.exe 3176 pdvpj.exe 3036 dpvpj.exe 3436 lxxrlff.exe 1256 hbtnhb.exe 2956 nhnhhb.exe 824 5pjvd.exe 2432 pddpd.exe 3124 fllxllf.exe 2952 fxfflxf.exe 620 htnhth.exe 3508 jjvjd.exe 4032 fflfllf.exe 4376 lxxrfxr.exe 2488 nttnhn.exe 632 pjjpv.exe 224 xrrlffx.exe 4264 fxrllfx.exe 5020 7rfxfff.exe 1984 hnnnnb.exe 4760 jdddv.exe 2364 dddpd.exe 4004 5lxlrlf.exe 4120 rrrlxll.exe 4236 5bttbb.exe 1212 3bnhtn.exe 4336 dppjd.exe 1872 flfxrlf.exe 1712 xllfrrl.exe 3516 hhbthb.exe 1648 nttnhh.exe 2312 pjpdd.exe 2900 vjdpj.exe 2928 3xrfrrl.exe 544 ffffxxr.exe 4580 tbtnbt.exe 3668 htbthb.exe 3684 3dvpj.exe 976 dvppd.exe 1340 3xlflll.exe 3100 xrlxllf.exe 1916 5nhbnh.exe 2328 dvvjj.exe 3624 9jjdv.exe 4520 rffrfxl.exe 904 tbhbtn.exe -
resource yara_rule behavioral2/memory/1636-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2576-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/524-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfxlrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1636 wrote to memory of 5012 1636 765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe 84 PID 1636 wrote to memory of 5012 1636 765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe 84 PID 1636 wrote to memory of 5012 1636 765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe 84 PID 5012 wrote to memory of 1504 5012 lrrxxff.exe 85 PID 5012 wrote to memory of 1504 5012 lrrxxff.exe 85 PID 5012 wrote to memory of 1504 5012 lrrxxff.exe 85 PID 1504 wrote to memory of 2576 1504 7tbnbb.exe 86 PID 1504 wrote to memory of 2576 1504 7tbnbb.exe 86 PID 1504 wrote to memory of 2576 1504 7tbnbb.exe 86 PID 2576 wrote to memory of 4196 2576 vpppd.exe 87 PID 2576 wrote to memory of 4196 2576 vpppd.exe 87 PID 2576 wrote to memory of 4196 2576 vpppd.exe 87 PID 4196 wrote to memory of 4936 4196 5lfxlrr.exe 88 PID 4196 wrote to memory of 4936 4196 5lfxlrr.exe 88 PID 4196 wrote to memory of 4936 4196 5lfxlrr.exe 88 PID 4936 wrote to memory of 3148 4936 lfxrlff.exe 89 PID 4936 wrote to memory of 3148 4936 lfxrlff.exe 89 PID 4936 wrote to memory of 3148 4936 lfxrlff.exe 89 PID 3148 wrote to memory of 4624 3148 bnhhbt.exe 90 PID 3148 wrote to memory of 4624 3148 bnhhbt.exe 90 PID 3148 wrote to memory of 4624 3148 bnhhbt.exe 90 PID 4624 wrote to memory of 508 4624 jddvp.exe 91 PID 4624 wrote to memory of 508 4624 jddvp.exe 91 PID 4624 wrote to memory of 508 4624 jddvp.exe 91 PID 508 wrote to memory of 4172 508 rrlfrlx.exe 92 PID 508 wrote to memory of 4172 508 rrlfrlx.exe 92 PID 508 wrote to memory of 4172 508 rrlfrlx.exe 92 PID 4172 wrote to memory of 1528 4172 5ntnhh.exe 93 PID 4172 wrote to memory of 1528 4172 5ntnhh.exe 93 PID 4172 wrote to memory of 1528 4172 5ntnhh.exe 93 PID 1528 wrote to memory of 1872 1528 nhhbnb.exe 94 PID 1528 wrote to memory of 1872 1528 nhhbnb.exe 94 PID 1528 wrote to memory of 1872 1528 nhhbnb.exe 94 PID 1872 wrote to memory of 4680 1872 pjpjj.exe 95 PID 1872 wrote to memory of 4680 1872 pjpjj.exe 95 PID 1872 wrote to memory of 4680 1872 pjpjj.exe 95 PID 4680 wrote to memory of 220 4680 lxxrrrl.exe 96 PID 4680 wrote to memory of 220 4680 lxxrrrl.exe 96 PID 4680 wrote to memory of 220 4680 lxxrrrl.exe 96 PID 220 wrote to memory of 1036 220 nntttt.exe 97 PID 220 wrote to memory of 1036 220 nntttt.exe 97 PID 220 wrote to memory of 1036 220 nntttt.exe 97 PID 1036 wrote to memory of 1588 1036 btnhtn.exe 98 PID 1036 wrote to memory of 1588 1036 btnhtn.exe 98 PID 1036 wrote to memory of 1588 1036 btnhtn.exe 98 PID 1588 wrote to memory of 524 1588 vjpjd.exe 99 PID 1588 wrote to memory of 524 1588 vjpjd.exe 99 PID 1588 wrote to memory of 524 1588 vjpjd.exe 99 PID 524 wrote to memory of 2800 524 rrrlxrr.exe 100 PID 524 wrote to memory of 2800 524 rrrlxrr.exe 100 PID 524 wrote to memory of 2800 524 rrrlxrr.exe 100 PID 2800 wrote to memory of 4792 2800 ddjdv.exe 101 PID 2800 wrote to memory of 4792 2800 ddjdv.exe 101 PID 2800 wrote to memory of 4792 2800 ddjdv.exe 101 PID 4792 wrote to memory of 2244 4792 lfllxrx.exe 103 PID 4792 wrote to memory of 2244 4792 lfllxrx.exe 103 PID 4792 wrote to memory of 2244 4792 lfllxrx.exe 103 PID 2244 wrote to memory of 3176 2244 tntttn.exe 104 PID 2244 wrote to memory of 3176 2244 tntttn.exe 104 PID 2244 wrote to memory of 3176 2244 tntttn.exe 104 PID 3176 wrote to memory of 3036 3176 pdvpj.exe 105 PID 3176 wrote to memory of 3036 3176 pdvpj.exe 105 PID 3176 wrote to memory of 3036 3176 pdvpj.exe 105 PID 3036 wrote to memory of 3436 3036 dpvpj.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe"C:\Users\Admin\AppData\Local\Temp\765e7940e30473f76c0ed2cb8eb1604447f64ce4cc7528afd5fa19bc5f4091baN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\lrrxxff.exec:\lrrxxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\7tbnbb.exec:\7tbnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vpppd.exec:\vpppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\5lfxlrr.exec:\5lfxlrr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\lfxrlff.exec:\lfxrlff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\bnhhbt.exec:\bnhhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\jddvp.exec:\jddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\rrlfrlx.exec:\rrlfrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\5ntnhh.exec:\5ntnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\nhhbnb.exec:\nhhbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\pjpjj.exec:\pjpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\nntttt.exec:\nntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\btnhtn.exec:\btnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\vjpjd.exec:\vjpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\rrrlxrr.exec:\rrrlxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\ddjdv.exec:\ddjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\lfllxrx.exec:\lfllxrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\tntttn.exec:\tntttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\pdvpj.exec:\pdvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\dpvpj.exec:\dpvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lxxrlff.exec:\lxxrlff.exe23⤵
- Executes dropped EXE
PID:3436 -
\??\c:\hbtnhb.exec:\hbtnhb.exe24⤵
- Executes dropped EXE
PID:1256 -
\??\c:\nhnhhb.exec:\nhnhhb.exe25⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5pjvd.exec:\5pjvd.exe26⤵
- Executes dropped EXE
PID:824 -
\??\c:\pddpd.exec:\pddpd.exe27⤵
- Executes dropped EXE
PID:2432 -
\??\c:\fllxllf.exec:\fllxllf.exe28⤵
- Executes dropped EXE
PID:3124 -
\??\c:\fxfflxf.exec:\fxfflxf.exe29⤵
- Executes dropped EXE
PID:2952 -
\??\c:\htnhth.exec:\htnhth.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\jjvjd.exec:\jjvjd.exe31⤵
- Executes dropped EXE
PID:3508 -
\??\c:\fflfllf.exec:\fflfllf.exe32⤵
- Executes dropped EXE
PID:4032 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe33⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nttnhn.exec:\nttnhn.exe34⤵
- Executes dropped EXE
PID:2488 -
\??\c:\pjjpv.exec:\pjjpv.exe35⤵
- Executes dropped EXE
PID:632 -
\??\c:\xrrlffx.exec:\xrrlffx.exe36⤵
- Executes dropped EXE
PID:224 -
\??\c:\fxrllfx.exec:\fxrllfx.exe37⤵
- Executes dropped EXE
PID:4264 -
\??\c:\7rfxfff.exec:\7rfxfff.exe38⤵
- Executes dropped EXE
PID:5020 -
\??\c:\hnnnnb.exec:\hnnnnb.exe39⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jdddv.exec:\jdddv.exe40⤵
- Executes dropped EXE
PID:4760 -
\??\c:\dddpd.exec:\dddpd.exe41⤵
- Executes dropped EXE
PID:2364 -
\??\c:\5lxlrlf.exec:\5lxlrlf.exe42⤵
- Executes dropped EXE
PID:4004 -
\??\c:\rrrlxll.exec:\rrrlxll.exe43⤵
- Executes dropped EXE
PID:4120 -
\??\c:\5bttbb.exec:\5bttbb.exe44⤵
- Executes dropped EXE
PID:4236 -
\??\c:\3bnhtn.exec:\3bnhtn.exe45⤵
- Executes dropped EXE
PID:1212 -
\??\c:\dppjd.exec:\dppjd.exe46⤵
- Executes dropped EXE
PID:4336 -
\??\c:\flfxrlf.exec:\flfxrlf.exe47⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xllfrrl.exec:\xllfrrl.exe48⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hhbthb.exec:\hhbthb.exe49⤵
- Executes dropped EXE
PID:3516 -
\??\c:\nttnhh.exec:\nttnhh.exe50⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pjpdd.exec:\pjpdd.exe51⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vjdpj.exec:\vjdpj.exe52⤵
- Executes dropped EXE
PID:2900 -
\??\c:\3xrfrrl.exec:\3xrfrrl.exe53⤵
- Executes dropped EXE
PID:2928 -
\??\c:\ffffxxr.exec:\ffffxxr.exe54⤵
- Executes dropped EXE
PID:544 -
\??\c:\tbtnbt.exec:\tbtnbt.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4580 -
\??\c:\htbthb.exec:\htbthb.exe56⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3dvpj.exec:\3dvpj.exe57⤵
- Executes dropped EXE
PID:3684 -
\??\c:\dvppd.exec:\dvppd.exe58⤵
- Executes dropped EXE
PID:976 -
\??\c:\3xlflll.exec:\3xlflll.exe59⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrlxllf.exec:\xrlxllf.exe60⤵
- Executes dropped EXE
PID:3100 -
\??\c:\5nhbnh.exec:\5nhbnh.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1916 -
\??\c:\dvvjj.exec:\dvvjj.exe62⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9jjdv.exec:\9jjdv.exe63⤵
- Executes dropped EXE
PID:3624 -
\??\c:\rffrfxl.exec:\rffrfxl.exe64⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tbhbtn.exec:\tbhbtn.exe65⤵
- Executes dropped EXE
PID:904 -
\??\c:\5hhbnh.exec:\5hhbnh.exe66⤵PID:3052
-
\??\c:\pvddv.exec:\pvddv.exe67⤵PID:1336
-
\??\c:\lrlfxxl.exec:\lrlfxxl.exe68⤵PID:3424
-
\??\c:\fxxrlxf.exec:\fxxrlxf.exe69⤵PID:964
-
\??\c:\5bnntb.exec:\5bnntb.exe70⤵PID:4304
-
\??\c:\thnbnh.exec:\thnbnh.exe71⤵PID:2952
-
\??\c:\jjpjv.exec:\jjpjv.exe72⤵PID:3816
-
\??\c:\dvjdp.exec:\dvjdp.exe73⤵PID:620
-
\??\c:\fffxlfx.exec:\fffxlfx.exe74⤵PID:2840
-
\??\c:\ntbnbb.exec:\ntbnbb.exe75⤵PID:4384
-
\??\c:\hnnnhb.exec:\hnnnhb.exe76⤵PID:2592
-
\??\c:\vdddp.exec:\vdddp.exe77⤵PID:452
-
\??\c:\ddjvj.exec:\ddjvj.exe78⤵PID:1604
-
\??\c:\5xrfrlx.exec:\5xrfrlx.exe79⤵PID:1592
-
\??\c:\lxxrfxl.exec:\lxxrfxl.exe80⤵PID:3064
-
\??\c:\3nnhbb.exec:\3nnhbb.exe81⤵PID:4612
-
\??\c:\ffxxlxx.exec:\ffxxlxx.exe82⤵PID:1092
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe83⤵PID:3280
-
\??\c:\tntntn.exec:\tntntn.exe84⤵PID:3860
-
\??\c:\nhtnbh.exec:\nhtnbh.exe85⤵PID:1808
-
\??\c:\ppjdp.exec:\ppjdp.exe86⤵PID:2068
-
\??\c:\ppvjv.exec:\ppvjv.exe87⤵PID:2364
-
\??\c:\lxrllll.exec:\lxrllll.exe88⤵PID:4004
-
\??\c:\bthbtn.exec:\bthbtn.exe89⤵PID:1920
-
\??\c:\nbhbtt.exec:\nbhbtt.exe90⤵PID:4800
-
\??\c:\dvvpj.exec:\dvvpj.exe91⤵PID:4000
-
\??\c:\frfffxr.exec:\frfffxr.exe92⤵PID:1184
-
\??\c:\ffrxflr.exec:\ffrxflr.exe93⤵PID:744
-
\??\c:\thhbtn.exec:\thhbtn.exe94⤵PID:3412
-
\??\c:\vjdvj.exec:\vjdvj.exe95⤵PID:2368
-
\??\c:\vpjjj.exec:\vpjjj.exe96⤵PID:2000
-
\??\c:\xlfxlfr.exec:\xlfxlfr.exe97⤵PID:3692
-
\??\c:\ntnnbn.exec:\ntnnbn.exe98⤵PID:448
-
\??\c:\hntnhb.exec:\hntnhb.exe99⤵PID:2532
-
\??\c:\pdddv.exec:\pdddv.exe100⤵PID:1104
-
\??\c:\3vjvp.exec:\3vjvp.exe101⤵PID:2284
-
\??\c:\rflfrff.exec:\rflfrff.exe102⤵PID:3568
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe103⤵PID:4472
-
\??\c:\ntnbnh.exec:\ntnbnh.exe104⤵PID:3376
-
\??\c:\vppdp.exec:\vppdp.exe105⤵PID:3176
-
\??\c:\jjvpv.exec:\jjvpv.exe106⤵PID:2980
-
\??\c:\5rrlxxl.exec:\5rrlxxl.exe107⤵PID:4876
-
\??\c:\rfrlfxl.exec:\rfrlfxl.exe108⤵PID:2716
-
\??\c:\nbnbtn.exec:\nbnbtn.exe109⤵PID:3136
-
\??\c:\pjvpd.exec:\pjvpd.exe110⤵PID:5004
-
\??\c:\lxlxxrr.exec:\lxlxxrr.exe111⤵PID:2164
-
\??\c:\lxfffff.exec:\lxfffff.exe112⤵PID:4496
-
\??\c:\bttnnh.exec:\bttnnh.exe113⤵PID:904
-
\??\c:\pppdp.exec:\pppdp.exe114⤵PID:3052
-
\??\c:\dpjvp.exec:\dpjvp.exe115⤵PID:2124
-
\??\c:\lllfxxf.exec:\lllfxxf.exe116⤵PID:3424
-
\??\c:\bnnbnn.exec:\bnnbnn.exe117⤵PID:964
-
\??\c:\hbttnh.exec:\hbttnh.exe118⤵PID:432
-
\??\c:\pjdjv.exec:\pjdjv.exe119⤵PID:2952
-
\??\c:\1llxllx.exec:\1llxllx.exe120⤵PID:3272
-
\??\c:\9lflfrl.exec:\9lflfrl.exe121⤵PID:4980
-
\??\c:\tnbtnh.exec:\tnbtnh.exe122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-