Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 21:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
Resource
win7-20241010-en
6 signatures
150 seconds
General
-
Target
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
-
Size
49KB
-
MD5
64ab0cd8df9d6d027937e65c52b2e498
-
SHA1
52f075d3aed88341b4f4d941eb7e1becdef42f7f
-
SHA256
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da
-
SHA512
093123d714d2987b28d79cee810c810988c5e2291182707e18cfae48ed69503d75b17b340b900c1be431c307746d4e1871cb7dcba8c301dbac054d2a40046a74
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlU:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1472-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/472-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-219-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-245-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-252-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-299-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-320-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-357-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-376-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-380-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-399-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-424-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-437-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-456-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-492-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-501-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-532-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-572-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-757-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-972-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-1031-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-1110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-1273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-1866-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4844 pdjvp.exe 2648 3flfxxr.exe 4612 3nbthb.exe 3604 pjpdj.exe 2804 lxfxfxr.exe 3636 lrrllfx.exe 4084 7httbh.exe 4952 9djdd.exe 2232 xflllll.exe 1292 9lfxrlf.exe 2984 hhbbtt.exe 1140 3hbnhh.exe 4544 7djdv.exe 3572 rrrfrlx.exe 3184 hbhbtn.exe 2092 nhnhbt.exe 1776 vjvvp.exe 684 jpppj.exe 3236 xlrlflx.exe 112 btntnh.exe 216 5tnnbb.exe 1696 dpvvj.exe 472 3rxrlrl.exe 2592 5fffxxr.exe 648 tttnbt.exe 4216 pppdv.exe 1228 lxfffrr.exe 3592 hntnhb.exe 2692 5hbthb.exe 2668 jjjdp.exe 1112 7rxxlfx.exe 3620 lffrlxr.exe 2148 tnnnhh.exe 3264 3jjvd.exe 4044 lflfxlr.exe 1852 9xfxrlf.exe 3156 9nbttn.exe 2296 1ntnhh.exe 872 3dvvp.exe 3792 xxrxfrf.exe 3544 xllfxrx.exe 1792 tnttbb.exe 4204 xrrrlfx.exe 2552 btbnhb.exe 2928 pdjjd.exe 3768 7rfxlfr.exe 4004 llxrfxl.exe 4940 pppjv.exe 232 1flffxr.exe 1016 7flffff.exe 848 ntbbbb.exe 632 xrrlffx.exe 1840 3xllllf.exe 4976 nhhhbn.exe 836 jdddp.exe 1120 fxlfrrl.exe 2368 5hbnhb.exe 2520 dvvpd.exe 3276 frrrfxr.exe 3660 hnbbbb.exe 1860 dvppv.exe 5048 9ppvp.exe 4864 5vpjv.exe 1972 lxxxllf.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7htnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1472 wrote to memory of 4844 1472 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 83 PID 1472 wrote to memory of 4844 1472 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 83 PID 1472 wrote to memory of 4844 1472 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 83 PID 4844 wrote to memory of 2648 4844 pdjvp.exe 84 PID 4844 wrote to memory of 2648 4844 pdjvp.exe 84 PID 4844 wrote to memory of 2648 4844 pdjvp.exe 84 PID 2648 wrote to memory of 4612 2648 3flfxxr.exe 85 PID 2648 wrote to memory of 4612 2648 3flfxxr.exe 85 PID 2648 wrote to memory of 4612 2648 3flfxxr.exe 85 PID 4612 wrote to memory of 3604 4612 3nbthb.exe 86 PID 4612 wrote to memory of 3604 4612 3nbthb.exe 86 PID 4612 wrote to memory of 3604 4612 3nbthb.exe 86 PID 3604 wrote to memory of 2804 3604 pjpdj.exe 87 PID 3604 wrote to memory of 2804 3604 pjpdj.exe 87 PID 3604 wrote to memory of 2804 3604 pjpdj.exe 87 PID 2804 wrote to memory of 3636 2804 lxfxfxr.exe 88 PID 2804 wrote to memory of 3636 2804 lxfxfxr.exe 88 PID 2804 wrote to memory of 3636 2804 lxfxfxr.exe 88 PID 3636 wrote to memory of 4084 3636 lrrllfx.exe 89 PID 3636 wrote to memory of 4084 3636 lrrllfx.exe 89 PID 3636 wrote to memory of 4084 3636 lrrllfx.exe 89 PID 4084 wrote to memory of 4952 4084 7httbh.exe 90 PID 4084 wrote to memory of 4952 4084 7httbh.exe 90 PID 4084 wrote to memory of 4952 4084 7httbh.exe 90 PID 4952 wrote to memory of 2232 4952 9djdd.exe 91 PID 4952 wrote to memory of 2232 4952 9djdd.exe 91 PID 4952 wrote to memory of 2232 4952 9djdd.exe 91 PID 2232 wrote to memory of 1292 2232 xflllll.exe 92 PID 2232 wrote to memory of 1292 2232 xflllll.exe 92 PID 2232 wrote to memory of 1292 2232 xflllll.exe 92 PID 1292 wrote to memory of 2984 1292 9lfxrlf.exe 93 PID 1292 wrote to memory of 2984 1292 9lfxrlf.exe 93 PID 1292 wrote to memory of 2984 1292 9lfxrlf.exe 93 PID 2984 wrote to memory of 1140 2984 hhbbtt.exe 94 PID 2984 wrote to memory of 1140 2984 hhbbtt.exe 94 PID 2984 wrote to memory of 1140 2984 hhbbtt.exe 94 PID 1140 wrote to memory of 4544 1140 3hbnhh.exe 95 PID 1140 wrote to memory of 4544 1140 3hbnhh.exe 95 PID 1140 wrote to memory of 4544 1140 3hbnhh.exe 95 PID 4544 wrote to memory of 3572 4544 7djdv.exe 96 PID 4544 wrote to memory of 3572 4544 7djdv.exe 96 PID 4544 wrote to memory of 3572 4544 7djdv.exe 96 PID 3572 wrote to memory of 3184 3572 rrrfrlx.exe 97 PID 3572 wrote to memory of 3184 3572 rrrfrlx.exe 97 PID 3572 wrote to memory of 3184 3572 rrrfrlx.exe 97 PID 3184 wrote to memory of 2092 3184 hbhbtn.exe 98 PID 3184 wrote to memory of 2092 3184 hbhbtn.exe 98 PID 3184 wrote to memory of 2092 3184 hbhbtn.exe 98 PID 2092 wrote to memory of 1776 2092 nhnhbt.exe 99 PID 2092 wrote to memory of 1776 2092 nhnhbt.exe 99 PID 2092 wrote to memory of 1776 2092 nhnhbt.exe 99 PID 1776 wrote to memory of 684 1776 vjvvp.exe 100 PID 1776 wrote to memory of 684 1776 vjvvp.exe 100 PID 1776 wrote to memory of 684 1776 vjvvp.exe 100 PID 684 wrote to memory of 3236 684 jpppj.exe 101 PID 684 wrote to memory of 3236 684 jpppj.exe 101 PID 684 wrote to memory of 3236 684 jpppj.exe 101 PID 3236 wrote to memory of 112 3236 xlrlflx.exe 102 PID 3236 wrote to memory of 112 3236 xlrlflx.exe 102 PID 3236 wrote to memory of 112 3236 xlrlflx.exe 102 PID 112 wrote to memory of 216 112 btntnh.exe 103 PID 112 wrote to memory of 216 112 btntnh.exe 103 PID 112 wrote to memory of 216 112 btntnh.exe 103 PID 216 wrote to memory of 1696 216 5tnnbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\pdjvp.exec:\pdjvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\3flfxxr.exec:\3flfxxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\3nbthb.exec:\3nbthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\pjpdj.exec:\pjpdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\lrrllfx.exec:\lrrllfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\7httbh.exec:\7httbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\9djdd.exec:\9djdd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\xflllll.exec:\xflllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\9lfxrlf.exec:\9lfxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\hhbbtt.exec:\hhbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\3hbnhh.exec:\3hbnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\7djdv.exec:\7djdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\rrrfrlx.exec:\rrrfrlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\hbhbtn.exec:\hbhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\nhnhbt.exec:\nhnhbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\vjvvp.exec:\vjvvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\jpppj.exec:\jpppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\xlrlflx.exec:\xlrlflx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\btntnh.exec:\btntnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\5tnnbb.exec:\5tnnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\dpvvj.exec:\dpvvj.exe23⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3rxrlrl.exec:\3rxrlrl.exe24⤵
- Executes dropped EXE
PID:472 -
\??\c:\5fffxxr.exec:\5fffxxr.exe25⤵
- Executes dropped EXE
PID:2592 -
\??\c:\tttnbt.exec:\tttnbt.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\pppdv.exec:\pppdv.exe27⤵
- Executes dropped EXE
PID:4216 -
\??\c:\lxfffrr.exec:\lxfffrr.exe28⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hntnhb.exec:\hntnhb.exe29⤵
- Executes dropped EXE
PID:3592 -
\??\c:\5hbthb.exec:\5hbthb.exe30⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jjjdp.exec:\jjjdp.exe31⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7rxxlfx.exec:\7rxxlfx.exe32⤵
- Executes dropped EXE
PID:1112 -
\??\c:\lffrlxr.exec:\lffrlxr.exe33⤵
- Executes dropped EXE
PID:3620 -
\??\c:\tnnnhh.exec:\tnnnhh.exe34⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3jjvd.exec:\3jjvd.exe35⤵
- Executes dropped EXE
PID:3264 -
\??\c:\lflfxlr.exec:\lflfxlr.exe36⤵
- Executes dropped EXE
PID:4044 -
\??\c:\9xfxrlf.exec:\9xfxrlf.exe37⤵
- Executes dropped EXE
PID:1852 -
\??\c:\9nbttn.exec:\9nbttn.exe38⤵
- Executes dropped EXE
PID:3156 -
\??\c:\1ntnhh.exec:\1ntnhh.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\3dvvp.exec:\3dvvp.exe40⤵
- Executes dropped EXE
PID:872 -
\??\c:\xxrxfrf.exec:\xxrxfrf.exe41⤵
- Executes dropped EXE
PID:3792 -
\??\c:\xllfxrx.exec:\xllfxrx.exe42⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnttbb.exec:\tnttbb.exe43⤵
- Executes dropped EXE
PID:1792 -
\??\c:\xllxxrl.exec:\xllxxrl.exe44⤵PID:3872
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe45⤵
- Executes dropped EXE
PID:4204 -
\??\c:\btbnhb.exec:\btbnhb.exe46⤵
- Executes dropped EXE
PID:2552 -
\??\c:\pdjjd.exec:\pdjjd.exe47⤵
- Executes dropped EXE
PID:2928 -
\??\c:\7rfxlfr.exec:\7rfxlfr.exe48⤵
- Executes dropped EXE
PID:3768 -
\??\c:\llxrfxl.exec:\llxrfxl.exe49⤵
- Executes dropped EXE
PID:4004 -
\??\c:\pppjv.exec:\pppjv.exe50⤵
- Executes dropped EXE
PID:4940 -
\??\c:\1flffxr.exec:\1flffxr.exe51⤵
- Executes dropped EXE
PID:232 -
\??\c:\7flffff.exec:\7flffff.exe52⤵
- Executes dropped EXE
PID:1016 -
\??\c:\ntbbbb.exec:\ntbbbb.exe53⤵
- Executes dropped EXE
PID:848 -
\??\c:\xrrlffx.exec:\xrrlffx.exe54⤵
- Executes dropped EXE
PID:632 -
\??\c:\3xllllf.exec:\3xllllf.exe55⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nhhhbn.exec:\nhhhbn.exe56⤵
- Executes dropped EXE
PID:4976 -
\??\c:\jdddp.exec:\jdddp.exe57⤵
- Executes dropped EXE
PID:836 -
\??\c:\fxlfrrl.exec:\fxlfrrl.exe58⤵
- Executes dropped EXE
PID:1120 -
\??\c:\5hbnhb.exec:\5hbnhb.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\dvvpd.exec:\dvvpd.exe60⤵
- Executes dropped EXE
PID:2520 -
\??\c:\frrrfxr.exec:\frrrfxr.exe61⤵
- Executes dropped EXE
PID:3276 -
\??\c:\hnbbbb.exec:\hnbbbb.exe62⤵
- Executes dropped EXE
PID:3660 -
\??\c:\dvppv.exec:\dvppv.exe63⤵
- Executes dropped EXE
PID:1860 -
\??\c:\9ppvp.exec:\9ppvp.exe64⤵
- Executes dropped EXE
PID:5048 -
\??\c:\5vpjv.exec:\5vpjv.exe65⤵
- Executes dropped EXE
PID:4864 -
\??\c:\lxxxllf.exec:\lxxxllf.exe66⤵
- Executes dropped EXE
PID:1972 -
\??\c:\btbbhh.exec:\btbbhh.exe67⤵PID:2208
-
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:2180
-
\??\c:\pjdvj.exec:\pjdvj.exe69⤵PID:1752
-
\??\c:\9llllll.exec:\9llllll.exe70⤵PID:684
-
\??\c:\xxxxfll.exec:\xxxxfll.exe71⤵PID:5052
-
\??\c:\7thbbt.exec:\7thbbt.exe72⤵PID:4816
-
\??\c:\3nbbbb.exec:\3nbbbb.exe73⤵PID:3824
-
\??\c:\dvddv.exec:\dvddv.exe74⤵PID:1420
-
\??\c:\9ffxlll.exec:\9ffxlll.exe75⤵PID:3856
-
\??\c:\tntbtt.exec:\tntbtt.exe76⤵PID:3568
-
\??\c:\nhhnht.exec:\nhhnht.exe77⤵PID:3124
-
\??\c:\7jjjd.exec:\7jjjd.exe78⤵PID:2384
-
\??\c:\vvppp.exec:\vvppp.exe79⤵PID:5072
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe80⤵PID:1232
-
\??\c:\tnbtbh.exec:\tnbtbh.exe81⤵PID:1520
-
\??\c:\tnnnnn.exec:\tnnnnn.exe82⤵PID:3664
-
\??\c:\vvvdv.exec:\vvvdv.exe83⤵PID:2884
-
\??\c:\lffxffx.exec:\lffxffx.exe84⤵PID:60
-
\??\c:\rrxflfr.exec:\rrxflfr.exe85⤵PID:3460
-
\??\c:\7ntnhn.exec:\7ntnhn.exe86⤵PID:3288
-
\??\c:\hnbnnh.exec:\hnbnnh.exe87⤵PID:3368
-
\??\c:\ppppd.exec:\ppppd.exe88⤵PID:3772
-
\??\c:\xxxrlll.exec:\xxxrlll.exe89⤵
- System Location Discovery: System Language Discovery
PID:1600 -
\??\c:\rxfrxff.exec:\rxfrxff.exe90⤵PID:4044
-
\??\c:\btbbhh.exec:\btbbhh.exe91⤵PID:1852
-
\??\c:\3pdvj.exec:\3pdvj.exe92⤵PID:3436
-
\??\c:\vjpdv.exec:\vjpdv.exe93⤵PID:2212
-
\??\c:\3fllxxx.exec:\3fllxxx.exe94⤵PID:1816
-
\??\c:\7xrxxxf.exec:\7xrxxxf.exe95⤵PID:3188
-
\??\c:\hnhhtt.exec:\hnhhtt.exe96⤵PID:3544
-
\??\c:\bttnhb.exec:\bttnhb.exe97⤵PID:3556
-
\??\c:\vpvvv.exec:\vpvvv.exe98⤵PID:4040
-
\??\c:\xxffrrf.exec:\xxffrrf.exe99⤵PID:4036
-
\??\c:\1xffffx.exec:\1xffffx.exe100⤵PID:4368
-
\??\c:\hhttbb.exec:\hhttbb.exe101⤵PID:3512
-
\??\c:\7tnnbh.exec:\7tnnbh.exe102⤵PID:3728
-
\??\c:\pvvvv.exec:\pvvvv.exe103⤵PID:5064
-
\??\c:\rrxrllf.exec:\rrxrllf.exe104⤵PID:2480
-
\??\c:\frxxrxr.exec:\frxxrxr.exe105⤵PID:2804
-
\??\c:\7ntbtt.exec:\7ntbtt.exe106⤵PID:2716
-
\??\c:\pjvpj.exec:\pjvpj.exe107⤵PID:4316
-
\??\c:\3jvpp.exec:\3jvpp.exe108⤵PID:4048
-
\??\c:\1rrxxxx.exec:\1rrxxxx.exe109⤵PID:2280
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe110⤵PID:2232
-
\??\c:\3bhhhh.exec:\3bhhhh.exe111⤵PID:2624
-
\??\c:\hnbttt.exec:\hnbttt.exe112⤵PID:2968
-
\??\c:\jvppp.exec:\jvppp.exe113⤵PID:1772
-
\??\c:\vpddv.exec:\vpddv.exe114⤵PID:2984
-
\??\c:\rrllflr.exec:\rrllflr.exe115⤵PID:4536
-
\??\c:\3bhhnh.exec:\3bhhnh.exe116⤵PID:2328
-
\??\c:\htbnbt.exec:\htbnbt.exe117⤵PID:4960
-
\??\c:\dpppd.exec:\dpppd.exe118⤵PID:3468
-
\??\c:\7lfxrfx.exec:\7lfxrfx.exe119⤵PID:4540
-
\??\c:\lfrxxff.exec:\lfrxxff.exe120⤵PID:4876
-
\??\c:\nnnhbb.exec:\nnnhbb.exe121⤵PID:1568
-
\??\c:\nnnnhh.exec:\nnnnhh.exe122⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-