Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 11:22
Static task
static1
Behavioral task
behavioral1
Sample
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
Resource
win7-20240903-en
General
-
Target
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe
-
Size
75KB
-
MD5
f0985b9122826e1f02a9b5c048e6eee4
-
SHA1
78296346200467974c34120e7d6ea37842c079c1
-
SHA256
ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7
-
SHA512
148b7583855d3c68365ecbd98499f2c6c4fe4959eace5111bb07a2894d81b8e57d2dfade487418bb0abc2fd96a6125556bd2a86273fef7eab01a82a4c76bd51c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmsL:ymb3NkkiQ3mdBjFIvl358nLA89OMFVH1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3164-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2800-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2260 s0602.exe 4032 o222004.exe 3980 5xrrffl.exe 2844 bntttb.exe 3976 4024642.exe 4132 o248282.exe 5052 jjpjd.exe 1248 5hthtn.exe 2016 jddpj.exe 3164 6260448.exe 4892 7rrlfxr.exe 540 480826.exe 3660 hbhbtt.exe 4652 xxlffxr.exe 3380 tbhbtt.exe 2800 ntbbbb.exe 3712 680080.exe 1440 0004624.exe 4496 flrxllf.exe 2296 7nhbnn.exe 4612 822268.exe 4448 460088.exe 2444 ttnntb.exe 1040 024008.exe 1408 rrxrlfx.exe 2316 22440.exe 2540 xxxlfff.exe 4092 thnhnh.exe 512 6644828.exe 4004 s4606.exe 4712 2804888.exe 2796 2202600.exe 660 5lfffxl.exe 1104 04642.exe 4832 thhbtn.exe 2876 rrrrrfr.exe 1660 q62604.exe 3904 848024.exe 2404 ddjvp.exe 4444 606284.exe 1484 nnnnhh.exe 5116 5hnhbb.exe 4984 tnbttt.exe 4192 rfrxlrx.exe 4032 fflxrlx.exe 1308 28060.exe 3152 xxxrfff.exe 4528 nhnbhh.exe 1396 ttnhhh.exe 5112 64660.exe 4388 ntbbbh.exe 4952 8248880.exe 3048 9nnnnn.exe 4408 m6028.exe 1760 1xxrrrr.exe 1920 vvpjd.exe 2032 w86822.exe 116 dvjvp.exe 1176 jddvp.exe 3940 488660.exe 4076 8626820.exe 1064 6244002.exe 1480 jpppj.exe 4312 4820606.exe -
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3164-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2800-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 22884.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64042.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4242082.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language s4600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2066448.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllrfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language u682004.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2604600.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 2260 2408 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe 83 PID 2408 wrote to memory of 2260 2408 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe 83 PID 2408 wrote to memory of 2260 2408 ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe 83 PID 2260 wrote to memory of 4032 2260 s0602.exe 84 PID 2260 wrote to memory of 4032 2260 s0602.exe 84 PID 2260 wrote to memory of 4032 2260 s0602.exe 84 PID 4032 wrote to memory of 3980 4032 o222004.exe 85 PID 4032 wrote to memory of 3980 4032 o222004.exe 85 PID 4032 wrote to memory of 3980 4032 o222004.exe 85 PID 3980 wrote to memory of 2844 3980 5xrrffl.exe 86 PID 3980 wrote to memory of 2844 3980 5xrrffl.exe 86 PID 3980 wrote to memory of 2844 3980 5xrrffl.exe 86 PID 2844 wrote to memory of 3976 2844 bntttb.exe 87 PID 2844 wrote to memory of 3976 2844 bntttb.exe 87 PID 2844 wrote to memory of 3976 2844 bntttb.exe 87 PID 3976 wrote to memory of 4132 3976 4024642.exe 88 PID 3976 wrote to memory of 4132 3976 4024642.exe 88 PID 3976 wrote to memory of 4132 3976 4024642.exe 88 PID 4132 wrote to memory of 5052 4132 o248282.exe 89 PID 4132 wrote to memory of 5052 4132 o248282.exe 89 PID 4132 wrote to memory of 5052 4132 o248282.exe 89 PID 5052 wrote to memory of 1248 5052 jjpjd.exe 90 PID 5052 wrote to memory of 1248 5052 jjpjd.exe 90 PID 5052 wrote to memory of 1248 5052 jjpjd.exe 90 PID 1248 wrote to memory of 2016 1248 5hthtn.exe 91 PID 1248 wrote to memory of 2016 1248 5hthtn.exe 91 PID 1248 wrote to memory of 2016 1248 5hthtn.exe 91 PID 2016 wrote to memory of 3164 2016 jddpj.exe 92 PID 2016 wrote to memory of 3164 2016 jddpj.exe 92 PID 2016 wrote to memory of 3164 2016 jddpj.exe 92 PID 3164 wrote to memory of 4892 3164 6260448.exe 93 PID 3164 wrote to memory of 4892 3164 6260448.exe 93 PID 3164 wrote to memory of 4892 3164 6260448.exe 93 PID 4892 wrote to memory of 540 4892 7rrlfxr.exe 94 PID 4892 wrote to memory of 540 4892 7rrlfxr.exe 94 PID 4892 wrote to memory of 540 4892 7rrlfxr.exe 94 PID 540 wrote to memory of 3660 540 480826.exe 95 PID 540 wrote to memory of 3660 540 480826.exe 95 PID 540 wrote to memory of 3660 540 480826.exe 95 PID 3660 wrote to memory of 4652 3660 hbhbtt.exe 96 PID 3660 wrote to memory of 4652 3660 hbhbtt.exe 96 PID 3660 wrote to memory of 4652 3660 hbhbtt.exe 96 PID 4652 wrote to memory of 3380 4652 xxlffxr.exe 97 PID 4652 wrote to memory of 3380 4652 xxlffxr.exe 97 PID 4652 wrote to memory of 3380 4652 xxlffxr.exe 97 PID 3380 wrote to memory of 2800 3380 tbhbtt.exe 98 PID 3380 wrote to memory of 2800 3380 tbhbtt.exe 98 PID 3380 wrote to memory of 2800 3380 tbhbtt.exe 98 PID 2800 wrote to memory of 3712 2800 ntbbbb.exe 99 PID 2800 wrote to memory of 3712 2800 ntbbbb.exe 99 PID 2800 wrote to memory of 3712 2800 ntbbbb.exe 99 PID 3712 wrote to memory of 1440 3712 680080.exe 100 PID 3712 wrote to memory of 1440 3712 680080.exe 100 PID 3712 wrote to memory of 1440 3712 680080.exe 100 PID 1440 wrote to memory of 4496 1440 0004624.exe 101 PID 1440 wrote to memory of 4496 1440 0004624.exe 101 PID 1440 wrote to memory of 4496 1440 0004624.exe 101 PID 4496 wrote to memory of 2296 4496 flrxllf.exe 102 PID 4496 wrote to memory of 2296 4496 flrxllf.exe 102 PID 4496 wrote to memory of 2296 4496 flrxllf.exe 102 PID 2296 wrote to memory of 4612 2296 7nhbnn.exe 103 PID 2296 wrote to memory of 4612 2296 7nhbnn.exe 103 PID 2296 wrote to memory of 4612 2296 7nhbnn.exe 103 PID 4612 wrote to memory of 4448 4612 822268.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"C:\Users\Admin\AppData\Local\Temp\ef9d4d868825ddc61895a1af8d86e3dd638a036e6c4326c6318c0ef5052f0ce7.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\s0602.exec:\s0602.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\o222004.exec:\o222004.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\5xrrffl.exec:\5xrrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\bntttb.exec:\bntttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\4024642.exec:\4024642.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\o248282.exec:\o248282.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\jjpjd.exec:\jjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\5hthtn.exec:\5hthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\jddpj.exec:\jddpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\6260448.exec:\6260448.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\7rrlfxr.exec:\7rrlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\480826.exec:\480826.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\hbhbtt.exec:\hbhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\xxlffxr.exec:\xxlffxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\tbhbtt.exec:\tbhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\ntbbbb.exec:\ntbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\680080.exec:\680080.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\0004624.exec:\0004624.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\flrxllf.exec:\flrxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\7nhbnn.exec:\7nhbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\822268.exec:\822268.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\460088.exec:\460088.exe23⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ttnntb.exec:\ttnntb.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\024008.exec:\024008.exe25⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe26⤵
- Executes dropped EXE
PID:1408 -
\??\c:\22440.exec:\22440.exe27⤵
- Executes dropped EXE
PID:2316 -
\??\c:\xxxlfff.exec:\xxxlfff.exe28⤵
- Executes dropped EXE
PID:2540 -
\??\c:\thnhnh.exec:\thnhnh.exe29⤵
- Executes dropped EXE
PID:4092 -
\??\c:\6644828.exec:\6644828.exe30⤵
- Executes dropped EXE
PID:512 -
\??\c:\s4606.exec:\s4606.exe31⤵
- Executes dropped EXE
PID:4004 -
\??\c:\2804888.exec:\2804888.exe32⤵
- Executes dropped EXE
PID:4712 -
\??\c:\2202600.exec:\2202600.exe33⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5lfffxl.exec:\5lfffxl.exe34⤵
- Executes dropped EXE
PID:660 -
\??\c:\04642.exec:\04642.exe35⤵
- Executes dropped EXE
PID:1104 -
\??\c:\thhbtn.exec:\thhbtn.exe36⤵
- Executes dropped EXE
PID:4832 -
\??\c:\rrrrrfr.exec:\rrrrrfr.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\q62604.exec:\q62604.exe38⤵
- Executes dropped EXE
PID:1660 -
\??\c:\848024.exec:\848024.exe39⤵
- Executes dropped EXE
PID:3904 -
\??\c:\ddjvp.exec:\ddjvp.exe40⤵
- Executes dropped EXE
PID:2404 -
\??\c:\606284.exec:\606284.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\nnnnhh.exec:\nnnnhh.exe42⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5hnhbb.exec:\5hnhbb.exe43⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tnbttt.exec:\tnbttt.exe44⤵
- Executes dropped EXE
PID:4984 -
\??\c:\rfrxlrx.exec:\rfrxlrx.exe45⤵
- Executes dropped EXE
PID:4192 -
\??\c:\fflxrlx.exec:\fflxrlx.exe46⤵
- Executes dropped EXE
PID:4032 -
\??\c:\28060.exec:\28060.exe47⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xxxrfff.exec:\xxxrfff.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3152 -
\??\c:\nhnbhh.exec:\nhnbhh.exe49⤵
- Executes dropped EXE
PID:4528 -
\??\c:\ttnhhh.exec:\ttnhhh.exe50⤵
- Executes dropped EXE
PID:1396 -
\??\c:\64660.exec:\64660.exe51⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ntbbbh.exec:\ntbbbh.exe52⤵
- Executes dropped EXE
PID:4388 -
\??\c:\8248880.exec:\8248880.exe53⤵
- Executes dropped EXE
PID:4952 -
\??\c:\9nnnnn.exec:\9nnnnn.exe54⤵
- Executes dropped EXE
PID:3048 -
\??\c:\m6028.exec:\m6028.exe55⤵
- Executes dropped EXE
PID:4408 -
\??\c:\1xxrrrr.exec:\1xxrrrr.exe56⤵
- Executes dropped EXE
PID:1760 -
\??\c:\vvpjd.exec:\vvpjd.exe57⤵
- Executes dropped EXE
PID:1920 -
\??\c:\w86822.exec:\w86822.exe58⤵
- Executes dropped EXE
PID:2032 -
\??\c:\dvjvp.exec:\dvjvp.exe59⤵
- Executes dropped EXE
PID:116 -
\??\c:\jddvp.exec:\jddvp.exe60⤵
- Executes dropped EXE
PID:1176 -
\??\c:\488660.exec:\488660.exe61⤵
- Executes dropped EXE
PID:3940 -
\??\c:\8626820.exec:\8626820.exe62⤵
- Executes dropped EXE
PID:4076 -
\??\c:\6244002.exec:\6244002.exe63⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jpppj.exec:\jpppj.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1480 -
\??\c:\4820606.exec:\4820606.exe65⤵
- Executes dropped EXE
PID:4312 -
\??\c:\264400.exec:\264400.exe66⤵PID:3380
-
\??\c:\bhhbtt.exec:\bhhbtt.exe67⤵PID:3932
-
\??\c:\9ntnhh.exec:\9ntnhh.exe68⤵PID:4568
-
\??\c:\bntbtt.exec:\bntbtt.exe69⤵PID:2912
-
\??\c:\nbhnbh.exec:\nbhnbh.exe70⤵PID:1980
-
\??\c:\jdjdj.exec:\jdjdj.exe71⤵PID:2976
-
\??\c:\xlxflll.exec:\xlxflll.exe72⤵PID:912
-
\??\c:\vddjj.exec:\vddjj.exe73⤵PID:5028
-
\??\c:\htbhnb.exec:\htbhnb.exe74⤵PID:5036
-
\??\c:\nhtbhb.exec:\nhtbhb.exe75⤵PID:3576
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe76⤵PID:4880
-
\??\c:\btthtn.exec:\btthtn.exe77⤵PID:2772
-
\??\c:\4868080.exec:\4868080.exe78⤵PID:1040
-
\??\c:\flrrlll.exec:\flrrlll.exe79⤵PID:1568
-
\??\c:\802268.exec:\802268.exe80⤵PID:1088
-
\??\c:\6060444.exec:\6060444.exe81⤵PID:3864
-
\??\c:\5ttbtt.exec:\5ttbtt.exe82⤵PID:3972
-
\??\c:\fxxrllf.exec:\fxxrllf.exe83⤵PID:4812
-
\??\c:\244488.exec:\244488.exe84⤵PID:3312
-
\??\c:\48882.exec:\48882.exe85⤵PID:2752
-
\??\c:\vpvjj.exec:\vpvjj.exe86⤵PID:3700
-
\??\c:\djpjd.exec:\djpjd.exe87⤵PID:2640
-
\??\c:\o620604.exec:\o620604.exe88⤵PID:4396
-
\??\c:\6804882.exec:\6804882.exe89⤵PID:3960
-
\??\c:\nhnhnh.exec:\nhnhnh.exe90⤵PID:3028
-
\??\c:\2666442.exec:\2666442.exe91⤵PID:1256
-
\??\c:\vvvpj.exec:\vvvpj.exe92⤵PID:2760
-
\??\c:\24648.exec:\24648.exe93⤵PID:2984
-
\??\c:\4080808.exec:\4080808.exe94⤵PID:2404
-
\??\c:\86028.exec:\86028.exe95⤵PID:2332
-
\??\c:\04802.exec:\04802.exe96⤵PID:1484
-
\??\c:\800620.exec:\800620.exe97⤵PID:5084
-
\??\c:\g4246.exec:\g4246.exe98⤵PID:4476
-
\??\c:\60044.exec:\60044.exe99⤵PID:4192
-
\??\c:\2248660.exec:\2248660.exe100⤵PID:1968
-
\??\c:\hbnnnn.exec:\hbnnnn.exe101⤵PID:4512
-
\??\c:\84286.exec:\84286.exe102⤵PID:4988
-
\??\c:\lffrxrx.exec:\lffrxrx.exe103⤵PID:2720
-
\??\c:\824484.exec:\824484.exe104⤵PID:2100
-
\??\c:\404046.exec:\404046.exe105⤵PID:4528
-
\??\c:\w68822.exec:\w68822.exe106⤵PID:1620
-
\??\c:\8868028.exec:\8868028.exe107⤵PID:5112
-
\??\c:\htttth.exec:\htttth.exe108⤵PID:4388
-
\??\c:\hnnbnn.exec:\hnnbnn.exe109⤵PID:3620
-
\??\c:\0608084.exec:\0608084.exe110⤵PID:3048
-
\??\c:\rxlxfrf.exec:\rxlxfrf.exe111⤵PID:2012
-
\??\c:\06242.exec:\06242.exe112⤵PID:4932
-
\??\c:\nnbtbh.exec:\nnbtbh.exe113⤵PID:1584
-
\??\c:\2626404.exec:\2626404.exe114⤵PID:112
-
\??\c:\84806.exec:\84806.exe115⤵PID:1872
-
\??\c:\460824.exec:\460824.exe116⤵PID:1924
-
\??\c:\088248.exec:\088248.exe117⤵PID:2792
-
\??\c:\jjdvp.exec:\jjdvp.exe118⤵PID:4416
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe119⤵PID:3996
-
\??\c:\24806.exec:\24806.exe120⤵PID:1840
-
\??\c:\bhnbnt.exec:\bhnbnt.exe121⤵PID:2860
-
\??\c:\thhbtn.exec:\thhbtn.exe122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-