Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe
Resource
win7-20240903-en
General
-
Target
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe
-
Size
66KB
-
MD5
b11198e1465010c9290fb7efe872e3a9
-
SHA1
3d8f120bcbf2edd336497cef282e066c0e3d2fea
-
SHA256
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab
-
SHA512
de6841436df8f6252299d56b6c166bd081d2ac16843876289fb8bc1d9717c33d8c57a7a40a40e05cce0979c104a3e6589ee32a3b96340b87c1ef19a7ea47080e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNMM:ymb3NkkiQ3mdBjFIvlpMM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/216-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfrrfrr.exe9bbbhn.exevddvv.exellrllll.exentbtth.exevvjjd.exeffxffff.exehbhbtn.exellfffff.exe9bhhnt.exepvvpv.exefffffff.exennnttb.exepvvpj.exefxlflfx.exentbttb.exerrlrrxr.exethnhbb.exexxlfxfx.exelrlfxlf.exebnnnhn.exeffxrlfx.exebbnhtn.exettnbnb.exe5jvpj.exeflxxxfx.exenhnnhn.exepvppv.exeflffrrx.exelxfflll.exehbhbhn.exeddppj.exellllxxf.exexxfrrfr.exebbntbb.exerlrrrrl.exexflrlrr.exettbbhh.exejjvvv.exexfxxrrr.exenhhntt.exepvddv.exerxlllll.exehbhhtb.exepjjjj.exefllflxl.exethnbbb.exehbbbhb.exevdjjd.exelxxrflr.exebhhhnt.exe1hbbbb.exedjjjd.exelrxlfxf.exerrxxxxx.exenhnnnt.exevvvvd.exejdddv.exexxxxffr.exe3rrfxfl.exenhtttb.exebtbbbb.exeddjjj.exexrxxxff.exepid process 3468 xfrrfrr.exe 3160 9bbbhn.exe 932 vddvv.exe 4532 llrllll.exe 3936 ntbtth.exe 3648 vvjjd.exe 1292 ffxffff.exe 2908 hbhbtn.exe 3968 llfffff.exe 3268 9bhhnt.exe 2440 pvvpv.exe 4360 fffffff.exe 4040 nnnttb.exe 4612 pvvpj.exe 4928 fxlflfx.exe 4348 ntbttb.exe 1596 rrlrrxr.exe 2616 thnhbb.exe 2340 xxlfxfx.exe 1476 lrlfxlf.exe 4856 bnnnhn.exe 1580 ffxrlfx.exe 336 bbnhtn.exe 1768 ttnbnb.exe 4636 5jvpj.exe 2040 flxxxfx.exe 3336 nhnnhn.exe 5052 pvppv.exe 396 flffrrx.exe 4004 lxfflll.exe 2996 hbhbhn.exe 2892 ddppj.exe 4184 llllxxf.exe 4208 xxfrrfr.exe 2464 bbntbb.exe 3196 rlrrrrl.exe 100 xflrlrr.exe 4756 ttbbhh.exe 1552 jjvvv.exe 3668 xfxxrrr.exe 4616 nhhntt.exe 1172 pvddv.exe 1860 rxlllll.exe 3504 hbhhtb.exe 824 pjjjj.exe 3112 fllflxl.exe 2236 thnbbb.exe 2240 hbbbhb.exe 4992 vdjjd.exe 2476 lxxrflr.exe 5076 bhhhnt.exe 3176 1hbbbb.exe 4812 djjjd.exe 1604 lrxlfxf.exe 4112 rrxxxxx.exe 4128 nhnnnt.exe 976 vvvvd.exe 1164 jdddv.exe 2012 xxxxffr.exe 3444 3rrfxfl.exe 3268 nhtttb.exe 1716 btbbbb.exe 4968 ddjjj.exe 4508 xrxxxff.exe -
Processes:
resource yara_rule behavioral2/memory/216-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
ppvpp.exe7bhhhn.exevvvjp.exedvppj.exexlllfxr.exejjjpp.exetnhhhh.exepdddd.exehntnnn.exevjjvv.exejdjpj.exerrlllll.exefrxxrlf.exevppvp.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exexfrrfrr.exe9bbbhn.exevddvv.exellrllll.exentbtth.exevvjjd.exeffxffff.exehbhbtn.exellfffff.exe9bhhnt.exepvvpv.exefffffff.exennnttb.exepvvpj.exefxlflfx.exentbttb.exerrlrrxr.exethnhbb.exexxlfxfx.exelrlfxlf.exebnnnhn.exedescription pid process target process PID 216 wrote to memory of 3468 216 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe xfrrfrr.exe PID 216 wrote to memory of 3468 216 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe xfrrfrr.exe PID 216 wrote to memory of 3468 216 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe xfrrfrr.exe PID 3468 wrote to memory of 3160 3468 xfrrfrr.exe 9bbbhn.exe PID 3468 wrote to memory of 3160 3468 xfrrfrr.exe 9bbbhn.exe PID 3468 wrote to memory of 3160 3468 xfrrfrr.exe 9bbbhn.exe PID 3160 wrote to memory of 932 3160 9bbbhn.exe vddvv.exe PID 3160 wrote to memory of 932 3160 9bbbhn.exe vddvv.exe PID 3160 wrote to memory of 932 3160 9bbbhn.exe vddvv.exe PID 932 wrote to memory of 4532 932 vddvv.exe llrllll.exe PID 932 wrote to memory of 4532 932 vddvv.exe llrllll.exe PID 932 wrote to memory of 4532 932 vddvv.exe llrllll.exe PID 4532 wrote to memory of 3936 4532 llrllll.exe ntbtth.exe PID 4532 wrote to memory of 3936 4532 llrllll.exe ntbtth.exe PID 4532 wrote to memory of 3936 4532 llrllll.exe ntbtth.exe PID 3936 wrote to memory of 3648 3936 ntbtth.exe vvjjd.exe PID 3936 wrote to memory of 3648 3936 ntbtth.exe vvjjd.exe PID 3936 wrote to memory of 3648 3936 ntbtth.exe vvjjd.exe PID 3648 wrote to memory of 1292 3648 vvjjd.exe ffxffff.exe PID 3648 wrote to memory of 1292 3648 vvjjd.exe ffxffff.exe PID 3648 wrote to memory of 1292 3648 vvjjd.exe ffxffff.exe PID 1292 wrote to memory of 2908 1292 ffxffff.exe hbhbtn.exe PID 1292 wrote to memory of 2908 1292 ffxffff.exe hbhbtn.exe PID 1292 wrote to memory of 2908 1292 ffxffff.exe hbhbtn.exe PID 2908 wrote to memory of 3968 2908 hbhbtn.exe llfffff.exe PID 2908 wrote to memory of 3968 2908 hbhbtn.exe llfffff.exe PID 2908 wrote to memory of 3968 2908 hbhbtn.exe llfffff.exe PID 3968 wrote to memory of 3268 3968 llfffff.exe 9bhhnt.exe PID 3968 wrote to memory of 3268 3968 llfffff.exe 9bhhnt.exe PID 3968 wrote to memory of 3268 3968 llfffff.exe 9bhhnt.exe PID 3268 wrote to memory of 2440 3268 9bhhnt.exe pvvpv.exe PID 3268 wrote to memory of 2440 3268 9bhhnt.exe pvvpv.exe PID 3268 wrote to memory of 2440 3268 9bhhnt.exe pvvpv.exe PID 2440 wrote to memory of 4360 2440 pvvpv.exe fffffff.exe PID 2440 wrote to memory of 4360 2440 pvvpv.exe fffffff.exe PID 2440 wrote to memory of 4360 2440 pvvpv.exe fffffff.exe PID 4360 wrote to memory of 4040 4360 fffffff.exe nnnttb.exe PID 4360 wrote to memory of 4040 4360 fffffff.exe nnnttb.exe PID 4360 wrote to memory of 4040 4360 fffffff.exe nnnttb.exe PID 4040 wrote to memory of 4612 4040 nnnttb.exe pvvpj.exe PID 4040 wrote to memory of 4612 4040 nnnttb.exe pvvpj.exe PID 4040 wrote to memory of 4612 4040 nnnttb.exe pvvpj.exe PID 4612 wrote to memory of 4928 4612 pvvpj.exe fxlflfx.exe PID 4612 wrote to memory of 4928 4612 pvvpj.exe fxlflfx.exe PID 4612 wrote to memory of 4928 4612 pvvpj.exe fxlflfx.exe PID 4928 wrote to memory of 4348 4928 fxlflfx.exe ntbttb.exe PID 4928 wrote to memory of 4348 4928 fxlflfx.exe ntbttb.exe PID 4928 wrote to memory of 4348 4928 fxlflfx.exe ntbttb.exe PID 4348 wrote to memory of 1596 4348 ntbttb.exe rrlrrxr.exe PID 4348 wrote to memory of 1596 4348 ntbttb.exe rrlrrxr.exe PID 4348 wrote to memory of 1596 4348 ntbttb.exe rrlrrxr.exe PID 1596 wrote to memory of 2616 1596 rrlrrxr.exe thnhbb.exe PID 1596 wrote to memory of 2616 1596 rrlrrxr.exe thnhbb.exe PID 1596 wrote to memory of 2616 1596 rrlrrxr.exe thnhbb.exe PID 2616 wrote to memory of 2340 2616 thnhbb.exe xxlfxfx.exe PID 2616 wrote to memory of 2340 2616 thnhbb.exe xxlfxfx.exe PID 2616 wrote to memory of 2340 2616 thnhbb.exe xxlfxfx.exe PID 2340 wrote to memory of 1476 2340 xxlfxfx.exe lrlfxlf.exe PID 2340 wrote to memory of 1476 2340 xxlfxfx.exe lrlfxlf.exe PID 2340 wrote to memory of 1476 2340 xxlfxfx.exe lrlfxlf.exe PID 1476 wrote to memory of 4856 1476 lrlfxlf.exe bnnnhn.exe PID 1476 wrote to memory of 4856 1476 lrlfxlf.exe bnnnhn.exe PID 1476 wrote to memory of 4856 1476 lrlfxlf.exe bnnnhn.exe PID 4856 wrote to memory of 1580 4856 bnnnhn.exe ffxrlfx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe"C:\Users\Admin\AppData\Local\Temp\25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xfrrfrr.exec:\xfrrfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\9bbbhn.exec:\9bbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\vddvv.exec:\vddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\llrllll.exec:\llrllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\ntbtth.exec:\ntbtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vvjjd.exec:\vvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\ffxffff.exec:\ffxffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\hbhbtn.exec:\hbhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\llfffff.exec:\llfffff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\9bhhnt.exec:\9bhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\pvvpv.exec:\pvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fffffff.exec:\fffffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\nnnttb.exec:\nnnttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\pvvpj.exec:\pvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\fxlflfx.exec:\fxlflfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\ntbttb.exec:\ntbttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\thnhbb.exec:\thnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lrlfxlf.exec:\lrlfxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bnnnhn.exec:\bnnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe23⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bbnhtn.exec:\bbnhtn.exe24⤵
- Executes dropped EXE
PID:336 -
\??\c:\ttnbnb.exec:\ttnbnb.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\5jvpj.exec:\5jvpj.exe26⤵
- Executes dropped EXE
PID:4636 -
\??\c:\flxxxfx.exec:\flxxxfx.exe27⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nhnnhn.exec:\nhnnhn.exe28⤵
- Executes dropped EXE
PID:3336 -
\??\c:\pvppv.exec:\pvppv.exe29⤵
- Executes dropped EXE
PID:5052 -
\??\c:\flffrrx.exec:\flffrrx.exe30⤵
- Executes dropped EXE
PID:396 -
\??\c:\lxfflll.exec:\lxfflll.exe31⤵
- Executes dropped EXE
PID:4004 -
\??\c:\hbhbhn.exec:\hbhbhn.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddppj.exec:\ddppj.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\llllxxf.exec:\llllxxf.exe34⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xxfrrfr.exec:\xxfrrfr.exe35⤵
- Executes dropped EXE
PID:4208 -
\??\c:\bbntbb.exec:\bbntbb.exe36⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe37⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xflrlrr.exec:\xflrlrr.exe38⤵
- Executes dropped EXE
PID:100 -
\??\c:\ttbbhh.exec:\ttbbhh.exe39⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jjvvv.exec:\jjvvv.exe40⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe41⤵
- Executes dropped EXE
PID:3668 -
\??\c:\nhhntt.exec:\nhhntt.exe42⤵
- Executes dropped EXE
PID:4616 -
\??\c:\pvddv.exec:\pvddv.exe43⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rxlllll.exec:\rxlllll.exe44⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hbhhtb.exec:\hbhhtb.exe45⤵
- Executes dropped EXE
PID:3504 -
\??\c:\pjjjj.exec:\pjjjj.exe46⤵
- Executes dropped EXE
PID:824 -
\??\c:\fllflxl.exec:\fllflxl.exe47⤵
- Executes dropped EXE
PID:3112 -
\??\c:\thnbbb.exec:\thnbbb.exe48⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbbbhb.exec:\hbbbhb.exe49⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vdjjd.exec:\vdjjd.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lxxrflr.exec:\lxxrflr.exe51⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bhhhnt.exec:\bhhhnt.exe52⤵
- Executes dropped EXE
PID:5076 -
\??\c:\1hbbbb.exec:\1hbbbb.exe53⤵
- Executes dropped EXE
PID:3176 -
\??\c:\djjjd.exec:\djjjd.exe54⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lrxlfxf.exec:\lrxlfxf.exe55⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe56⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhnnnt.exec:\nhnnnt.exe57⤵
- Executes dropped EXE
PID:4128 -
\??\c:\vvvvd.exec:\vvvvd.exe58⤵
- Executes dropped EXE
PID:976 -
\??\c:\jdddv.exec:\jdddv.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xxxxffr.exec:\xxxxffr.exe60⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3rrfxfl.exec:\3rrfxfl.exe61⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nhtttb.exec:\nhtttb.exe62⤵
- Executes dropped EXE
PID:3268 -
\??\c:\btbbbb.exec:\btbbbb.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ddjjj.exec:\ddjjj.exe64⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xrxxxff.exec:\xrxxxff.exe65⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ffxxxrl.exec:\ffxxxrl.exe66⤵PID:1448
-
\??\c:\3htthn.exec:\3htthn.exe67⤵PID:4104
-
\??\c:\ppvdd.exec:\ppvdd.exe68⤵PID:4996
-
\??\c:\9ppjj.exec:\9ppjj.exe69⤵PID:3776
-
\??\c:\xrrrrxf.exec:\xrrrrxf.exe70⤵PID:3420
-
\??\c:\htbbbh.exec:\htbbbh.exe71⤵PID:1784
-
\??\c:\ntthhh.exec:\ntthhh.exe72⤵PID:3904
-
\??\c:\vvdjd.exec:\vvdjd.exe73⤵PID:4908
-
\??\c:\dvddd.exec:\dvddd.exe74⤵PID:4340
-
\??\c:\ffrrllf.exec:\ffrrllf.exe75⤵PID:2764
-
\??\c:\bhnntb.exec:\bhnntb.exe76⤵PID:1444
-
\??\c:\bnhttb.exec:\bnhttb.exe77⤵PID:5060
-
\??\c:\7dvpp.exec:\7dvpp.exe78⤵PID:4168
-
\??\c:\lrfxrlr.exec:\lrfxrlr.exe79⤵PID:4932
-
\??\c:\xfrrfrr.exec:\xfrrfrr.exe80⤵PID:3188
-
\??\c:\1nbbbh.exec:\1nbbbh.exe81⤵PID:1428
-
\??\c:\jpvvd.exec:\jpvvd.exe82⤵PID:3604
-
\??\c:\rrlllll.exec:\rrlllll.exe83⤵
- System Location Discovery: System Language Discovery
PID:4108 -
\??\c:\nbnnhh.exec:\nbnnhh.exe84⤵PID:2124
-
\??\c:\vpddp.exec:\vpddp.exe85⤵PID:516
-
\??\c:\ppddd.exec:\ppddd.exe86⤵PID:5052
-
\??\c:\xxlffll.exec:\xxlffll.exe87⤵PID:5100
-
\??\c:\lllfffx.exec:\lllfffx.exe88⤵PID:3116
-
\??\c:\jpddp.exec:\jpddp.exe89⤵PID:692
-
\??\c:\vvvvp.exec:\vvvvp.exe90⤵PID:3868
-
\??\c:\xxfffff.exec:\xxfffff.exe91⤵PID:2892
-
\??\c:\lrfffll.exec:\lrfffll.exe92⤵PID:2480
-
\??\c:\nntntb.exec:\nntntb.exe93⤵PID:2348
-
\??\c:\pdvjv.exec:\pdvjv.exe94⤵PID:3264
-
\??\c:\dpvvv.exec:\dpvvv.exe95⤵PID:1820
-
\??\c:\xfflfll.exec:\xfflfll.exe96⤵PID:1424
-
\??\c:\bbbbbh.exec:\bbbbbh.exe97⤵PID:904
-
\??\c:\ppjjj.exec:\ppjjj.exe98⤵PID:900
-
\??\c:\ppppp.exec:\ppppp.exe99⤵PID:1032
-
\??\c:\flrrlrx.exec:\flrrlrx.exe100⤵PID:1500
-
\??\c:\llxxrff.exec:\llxxrff.exe101⤵PID:1376
-
\??\c:\3bnntb.exec:\3bnntb.exe102⤵PID:2936
-
\??\c:\pdvdd.exec:\pdvdd.exe103⤵PID:1488
-
\??\c:\5jddj.exec:\5jddj.exe104⤵PID:4420
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe105⤵PID:4016
-
\??\c:\httttb.exec:\httttb.exe106⤵PID:2412
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:1756
-
\??\c:\1vdjj.exec:\1vdjj.exe108⤵PID:2848
-
\??\c:\xlllfxr.exec:\xlllfxr.exe109⤵
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\bhttbh.exec:\bhttbh.exe110⤵PID:4788
-
\??\c:\pvvpp.exec:\pvvpp.exe111⤵PID:4592
-
\??\c:\vvvvv.exec:\vvvvv.exe112⤵PID:2768
-
\??\c:\ffxxxff.exec:\ffxxxff.exe113⤵PID:4540
-
\??\c:\9tnnnt.exec:\9tnnnt.exe114⤵PID:2664
-
\??\c:\ppvpd.exec:\ppvpd.exe115⤵PID:3588
-
\??\c:\vvvvp.exec:\vvvvp.exe116⤵PID:1292
-
\??\c:\lxflllr.exec:\lxflllr.exe117⤵PID:4560
-
\??\c:\1fffxfx.exec:\1fffxfx.exe118⤵PID:3496
-
\??\c:\nbhhhb.exec:\nbhhhb.exe119⤵PID:3596
-
\??\c:\jpdpp.exec:\jpdpp.exe120⤵PID:1388
-
\??\c:\pdddd.exec:\pdddd.exe121⤵PID:4520
-
\??\c:\lxxxxfl.exec:\lxxxxfl.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-