Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 19:25
Static task
static1
Behavioral task
behavioral1
Sample
091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe
Resource
win7-20240708-en
General
-
Target
091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe
-
Size
91KB
-
MD5
6af719a5edf29e38892683f1a4bd57f0
-
SHA1
43088ca57e32503dedc3819c04ccea38ae096628
-
SHA256
091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8
-
SHA512
fa8175bd8d1e8ff76879daee88c59f5ab1fe962f31d4c729e4a7e66eda997e8993f731dd2ac28c6c9daf6d43606fd96bae6a3e2a11499c37b2f3a46368577a18
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkBc:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1a
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4936-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfllxxr.exebthtnn.exejjjdp.exe7frlrrr.exe7hhbbb.exehbtnhh.exefrrrllf.exebtttnn.exepjdvj.exerrlfxxx.exehtnhth.exexflffff.exenhbttn.exevpddv.exefrfxxxr.exe3hnhbb.exehbbttt.exedjppv.exerxxxrxx.exefxxxrrr.exebnbttt.exedvddj.exexffflxx.exe5bnhnn.exehhnnbb.exe1pddv.exejjjpp.exefrxffll.exenhtnnn.exelfllfxl.exetnbnnh.exetttnbh.exe9dddd.exefflrllx.exehhhnnn.exennnnnt.exevvvvj.exe7xxfxff.exebbnttb.exebbhnth.exejpdvd.exerxfxrrx.exetbhhhh.exebbnhhh.exedvpjd.exefxrrlxr.exehbbbtt.exepjvvv.exe3lxxrxr.exelllllll.exebnhtnh.exevjjdj.exepjvdd.exe9rrlxfl.exe9hhhtn.exebbhtnn.exejpdvp.exe3rrlflf.exennttnt.exe3vjpp.exedpppp.exehtnntb.exejjjdd.exefffffll.exepid process 3420 rfllxxr.exe 4452 bthtnn.exe 2132 jjjdp.exe 4908 7frlrrr.exe 3184 7hhbbb.exe 3676 hbtnhh.exe 3468 frrrllf.exe 4476 btttnn.exe 2920 pjdvj.exe 3020 rrlfxxx.exe 4104 htnhth.exe 720 xflffff.exe 3888 nhbttn.exe 3472 vpddv.exe 2332 frfxxxr.exe 4276 3hnhbb.exe 3828 hbbttt.exe 4248 djppv.exe 3444 rxxxrxx.exe 4244 fxxxrrr.exe 4440 bnbttt.exe 4404 dvddj.exe 396 xffflxx.exe 2420 5bnhnn.exe 3988 hhnnbb.exe 3136 1pddv.exe 1548 jjjpp.exe 2776 frxffll.exe 3664 nhtnnn.exe 4828 lfllfxl.exe 1620 tnbnnh.exe 3508 tttnbh.exe 4092 9dddd.exe 800 fflrllx.exe 3740 hhhnnn.exe 2904 nnnnnt.exe 2528 vvvvj.exe 3628 7xxfxff.exe 5012 bbnttb.exe 2872 bbhnth.exe 1664 jpdvd.exe 2428 rxfxrrx.exe 4036 tbhhhh.exe 3924 bbnhhh.exe 116 dvpjd.exe 536 fxrrlxr.exe 3388 hbbbtt.exe 1296 pjvvv.exe 728 3lxxrxr.exe 1440 lllllll.exe 4380 bnhtnh.exe 2832 vjjdj.exe 696 pjvdd.exe 3676 9rrlxfl.exe 3704 9hhhtn.exe 3056 bbhtnn.exe 968 jpdvp.exe 2920 3rrlflf.exe 2764 nnttnt.exe 1760 3vjpp.exe 2724 dpppp.exe 2468 htnntb.exe 388 jjjdd.exe 4016 fffffll.exe -
Processes:
resource yara_rule behavioral2/memory/4936-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
hhntbh.exeddddv.exehhbtnt.exe1hbbtt.exeflffrxl.exedpdvd.exe9xfxffl.exefxxxrrr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exerfllxxr.exebthtnn.exejjjdp.exe7frlrrr.exe7hhbbb.exehbtnhh.exefrrrllf.exebtttnn.exepjdvj.exerrlfxxx.exehtnhth.exexflffff.exenhbttn.exevpddv.exefrfxxxr.exe3hnhbb.exehbbttt.exedjppv.exerxxxrxx.exefxxxrrr.exebnbttt.exedescription pid process target process PID 4936 wrote to memory of 3420 4936 091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe rfllxxr.exe PID 4936 wrote to memory of 3420 4936 091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe rfllxxr.exe PID 4936 wrote to memory of 3420 4936 091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe rfllxxr.exe PID 3420 wrote to memory of 4452 3420 rfllxxr.exe bthtnn.exe PID 3420 wrote to memory of 4452 3420 rfllxxr.exe bthtnn.exe PID 3420 wrote to memory of 4452 3420 rfllxxr.exe bthtnn.exe PID 4452 wrote to memory of 2132 4452 bthtnn.exe jjjdp.exe PID 4452 wrote to memory of 2132 4452 bthtnn.exe jjjdp.exe PID 4452 wrote to memory of 2132 4452 bthtnn.exe jjjdp.exe PID 2132 wrote to memory of 4908 2132 jjjdp.exe 7frlrrr.exe PID 2132 wrote to memory of 4908 2132 jjjdp.exe 7frlrrr.exe PID 2132 wrote to memory of 4908 2132 jjjdp.exe 7frlrrr.exe PID 4908 wrote to memory of 3184 4908 7frlrrr.exe 7hhbbb.exe PID 4908 wrote to memory of 3184 4908 7frlrrr.exe 7hhbbb.exe PID 4908 wrote to memory of 3184 4908 7frlrrr.exe 7hhbbb.exe PID 3184 wrote to memory of 3676 3184 7hhbbb.exe hbtnhh.exe PID 3184 wrote to memory of 3676 3184 7hhbbb.exe hbtnhh.exe PID 3184 wrote to memory of 3676 3184 7hhbbb.exe hbtnhh.exe PID 3676 wrote to memory of 3468 3676 hbtnhh.exe frrrllf.exe PID 3676 wrote to memory of 3468 3676 hbtnhh.exe frrrllf.exe PID 3676 wrote to memory of 3468 3676 hbtnhh.exe frrrllf.exe PID 3468 wrote to memory of 4476 3468 frrrllf.exe btttnn.exe PID 3468 wrote to memory of 4476 3468 frrrllf.exe btttnn.exe PID 3468 wrote to memory of 4476 3468 frrrllf.exe btttnn.exe PID 4476 wrote to memory of 2920 4476 btttnn.exe pjdvj.exe PID 4476 wrote to memory of 2920 4476 btttnn.exe pjdvj.exe PID 4476 wrote to memory of 2920 4476 btttnn.exe pjdvj.exe PID 2920 wrote to memory of 3020 2920 pjdvj.exe rrlfxxx.exe PID 2920 wrote to memory of 3020 2920 pjdvj.exe rrlfxxx.exe PID 2920 wrote to memory of 3020 2920 pjdvj.exe rrlfxxx.exe PID 3020 wrote to memory of 4104 3020 rrlfxxx.exe htnhth.exe PID 3020 wrote to memory of 4104 3020 rrlfxxx.exe htnhth.exe PID 3020 wrote to memory of 4104 3020 rrlfxxx.exe htnhth.exe PID 4104 wrote to memory of 720 4104 htnhth.exe xflffff.exe PID 4104 wrote to memory of 720 4104 htnhth.exe xflffff.exe PID 4104 wrote to memory of 720 4104 htnhth.exe xflffff.exe PID 720 wrote to memory of 3888 720 xflffff.exe nhbttn.exe PID 720 wrote to memory of 3888 720 xflffff.exe nhbttn.exe PID 720 wrote to memory of 3888 720 xflffff.exe nhbttn.exe PID 3888 wrote to memory of 3472 3888 nhbttn.exe vpddv.exe PID 3888 wrote to memory of 3472 3888 nhbttn.exe vpddv.exe PID 3888 wrote to memory of 3472 3888 nhbttn.exe vpddv.exe PID 3472 wrote to memory of 2332 3472 vpddv.exe frfxxxr.exe PID 3472 wrote to memory of 2332 3472 vpddv.exe frfxxxr.exe PID 3472 wrote to memory of 2332 3472 vpddv.exe frfxxxr.exe PID 2332 wrote to memory of 4276 2332 frfxxxr.exe 3hnhbb.exe PID 2332 wrote to memory of 4276 2332 frfxxxr.exe 3hnhbb.exe PID 2332 wrote to memory of 4276 2332 frfxxxr.exe 3hnhbb.exe PID 4276 wrote to memory of 3828 4276 3hnhbb.exe hbbttt.exe PID 4276 wrote to memory of 3828 4276 3hnhbb.exe hbbttt.exe PID 4276 wrote to memory of 3828 4276 3hnhbb.exe hbbttt.exe PID 3828 wrote to memory of 4248 3828 hbbttt.exe djppv.exe PID 3828 wrote to memory of 4248 3828 hbbttt.exe djppv.exe PID 3828 wrote to memory of 4248 3828 hbbttt.exe djppv.exe PID 4248 wrote to memory of 3444 4248 djppv.exe rxxxrxx.exe PID 4248 wrote to memory of 3444 4248 djppv.exe rxxxrxx.exe PID 4248 wrote to memory of 3444 4248 djppv.exe rxxxrxx.exe PID 3444 wrote to memory of 4244 3444 rxxxrxx.exe fxxxrrr.exe PID 3444 wrote to memory of 4244 3444 rxxxrxx.exe fxxxrrr.exe PID 3444 wrote to memory of 4244 3444 rxxxrxx.exe fxxxrrr.exe PID 4244 wrote to memory of 4440 4244 fxxxrrr.exe bnbttt.exe PID 4244 wrote to memory of 4440 4244 fxxxrrr.exe bnbttt.exe PID 4244 wrote to memory of 4440 4244 fxxxrrr.exe bnbttt.exe PID 4440 wrote to memory of 4404 4440 bnbttt.exe dvddj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe"C:\Users\Admin\AppData\Local\Temp\091f39c2ac1698aac61599ca09d852ad8a8df5c5f7d9ac574d1fa76f830d5cc8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\rfllxxr.exec:\rfllxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\bthtnn.exec:\bthtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\jjjdp.exec:\jjjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\7frlrrr.exec:\7frlrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\7hhbbb.exec:\7hhbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\hbtnhh.exec:\hbtnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\frrrllf.exec:\frrrllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\btttnn.exec:\btttnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pjdvj.exec:\pjdvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\htnhth.exec:\htnhth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\xflffff.exec:\xflffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\nhbttn.exec:\nhbttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\vpddv.exec:\vpddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\frfxxxr.exec:\frfxxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\3hnhbb.exec:\3hnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\hbbttt.exec:\hbbttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\djppv.exec:\djppv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\bnbttt.exec:\bnbttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\dvddj.exec:\dvddj.exe23⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xffflxx.exec:\xffflxx.exe24⤵
- Executes dropped EXE
PID:396 -
\??\c:\5bnhnn.exec:\5bnhnn.exe25⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hhnnbb.exec:\hhnnbb.exe26⤵
- Executes dropped EXE
PID:3988 -
\??\c:\1pddv.exec:\1pddv.exe27⤵
- Executes dropped EXE
PID:3136 -
\??\c:\jjjpp.exec:\jjjpp.exe28⤵
- Executes dropped EXE
PID:1548 -
\??\c:\frxffll.exec:\frxffll.exe29⤵
- Executes dropped EXE
PID:2776 -
\??\c:\nhtnnn.exec:\nhtnnn.exe30⤵
- Executes dropped EXE
PID:3664 -
\??\c:\lfllfxl.exec:\lfllfxl.exe31⤵
- Executes dropped EXE
PID:4828 -
\??\c:\tnbnnh.exec:\tnbnnh.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tttnbh.exec:\tttnbh.exe33⤵
- Executes dropped EXE
PID:3508 -
\??\c:\9dddd.exec:\9dddd.exe34⤵
- Executes dropped EXE
PID:4092 -
\??\c:\fflrllx.exec:\fflrllx.exe35⤵
- Executes dropped EXE
PID:800 -
\??\c:\hhhnnn.exec:\hhhnnn.exe36⤵
- Executes dropped EXE
PID:3740 -
\??\c:\nnnnnt.exec:\nnnnnt.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vvvvj.exec:\vvvvj.exe38⤵
- Executes dropped EXE
PID:2528 -
\??\c:\7xxfxff.exec:\7xxfxff.exe39⤵
- Executes dropped EXE
PID:3628 -
\??\c:\bbnttb.exec:\bbnttb.exe40⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bbhnth.exec:\bbhnth.exe41⤵
- Executes dropped EXE
PID:2872 -
\??\c:\jpdvd.exec:\jpdvd.exe42⤵
- Executes dropped EXE
PID:1664 -
\??\c:\rxfxrrx.exec:\rxfxrrx.exe43⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tbhhhh.exec:\tbhhhh.exe44⤵
- Executes dropped EXE
PID:4036 -
\??\c:\bbnhhh.exec:\bbnhhh.exe45⤵
- Executes dropped EXE
PID:3924 -
\??\c:\pjjdd.exec:\pjjdd.exe46⤵PID:452
-
\??\c:\dvpjd.exec:\dvpjd.exe47⤵
- Executes dropped EXE
PID:116 -
\??\c:\fxrrlxr.exec:\fxrrlxr.exe48⤵
- Executes dropped EXE
PID:536 -
\??\c:\hbbbtt.exec:\hbbbtt.exe49⤵
- Executes dropped EXE
PID:3388 -
\??\c:\pjvvv.exec:\pjvvv.exe50⤵
- Executes dropped EXE
PID:1296 -
\??\c:\3lxxrxr.exec:\3lxxrxr.exe51⤵
- Executes dropped EXE
PID:728 -
\??\c:\lllllll.exec:\lllllll.exe52⤵
- Executes dropped EXE
PID:1440 -
\??\c:\bnhtnh.exec:\bnhtnh.exe53⤵
- Executes dropped EXE
PID:4380 -
\??\c:\vjjdj.exec:\vjjdj.exe54⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pjvdd.exec:\pjvdd.exe55⤵
- Executes dropped EXE
PID:696 -
\??\c:\9rrlxfl.exec:\9rrlxfl.exe56⤵
- Executes dropped EXE
PID:3676 -
\??\c:\9hhhtn.exec:\9hhhtn.exe57⤵
- Executes dropped EXE
PID:3704 -
\??\c:\bbhtnn.exec:\bbhtnn.exe58⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jpdvp.exec:\jpdvp.exe59⤵
- Executes dropped EXE
PID:968 -
\??\c:\3rrlflf.exec:\3rrlflf.exe60⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nnttnt.exec:\nnttnt.exe61⤵
- Executes dropped EXE
PID:2764 -
\??\c:\3vjpp.exec:\3vjpp.exe62⤵
- Executes dropped EXE
PID:1760 -
\??\c:\dpppp.exec:\dpppp.exe63⤵
- Executes dropped EXE
PID:2724 -
\??\c:\htnntb.exec:\htnntb.exe64⤵
- Executes dropped EXE
PID:2468 -
\??\c:\jjjdd.exec:\jjjdd.exe65⤵
- Executes dropped EXE
PID:388 -
\??\c:\fffffll.exec:\fffffll.exe66⤵
- Executes dropped EXE
PID:4016 -
\??\c:\rlxrffl.exec:\rlxrffl.exe67⤵PID:3824
-
\??\c:\nnbbhh.exec:\nnbbhh.exe68⤵PID:5052
-
\??\c:\vvddd.exec:\vvddd.exe69⤵PID:4008
-
\??\c:\lxxxrlf.exec:\lxxxrlf.exe70⤵PID:3192
-
\??\c:\nnbbbh.exec:\nnbbbh.exe71⤵PID:2196
-
\??\c:\vvvvd.exec:\vvvvd.exe72⤵PID:4868
-
\??\c:\jjvpp.exec:\jjvpp.exe73⤵PID:1540
-
\??\c:\lfxxrxf.exec:\lfxxrxf.exe74⤵PID:3716
-
\??\c:\bbhhhn.exec:\bbhhhn.exe75⤵PID:2108
-
\??\c:\vjppp.exec:\vjppp.exe76⤵PID:4244
-
\??\c:\ppvpp.exec:\ppvpp.exe77⤵PID:3016
-
\??\c:\ddddv.exec:\ddddv.exe78⤵
- System Location Discovery: System Language Discovery
PID:3688 -
\??\c:\llllfff.exec:\llllfff.exe79⤵PID:1624
-
\??\c:\tntttb.exec:\tntttb.exe80⤵PID:3908
-
\??\c:\5htbbb.exec:\5htbbb.exe81⤵PID:1584
-
\??\c:\pdddd.exec:\pdddd.exe82⤵PID:3988
-
\??\c:\lxxfxff.exec:\lxxfxff.exe83⤵PID:64
-
\??\c:\hhnntt.exec:\hhnntt.exe84⤵PID:4716
-
\??\c:\tnbtnt.exec:\tnbtnt.exe85⤵PID:4880
-
\??\c:\ppjjj.exec:\ppjjj.exe86⤵PID:2776
-
\??\c:\jdjdd.exec:\jdjdd.exe87⤵PID:4616
-
\??\c:\lffxffx.exec:\lffxffx.exe88⤵PID:1784
-
\??\c:\xxxffxr.exec:\xxxffxr.exe89⤵PID:4852
-
\??\c:\hnnnhn.exec:\hnnnhn.exe90⤵PID:1692
-
\??\c:\bbbbtb.exec:\bbbbtb.exe91⤵PID:4964
-
\??\c:\lrxfflx.exec:\lrxfflx.exe92⤵PID:3604
-
\??\c:\nhttbb.exec:\nhttbb.exe93⤵PID:4236
-
\??\c:\vvvvp.exec:\vvvvp.exe94⤵PID:3308
-
\??\c:\frxxxrr.exec:\frxxxrr.exe95⤵PID:3064
-
\??\c:\rflxxff.exec:\rflxxff.exe96⤵PID:2984
-
\??\c:\3nthhh.exec:\3nthhh.exe97⤵PID:2164
-
\??\c:\ttbbhn.exec:\ttbbhn.exe98⤵PID:3848
-
\??\c:\3fxrflr.exec:\3fxrflr.exe99⤵PID:2384
-
\??\c:\7hthhn.exec:\7hthhn.exe100⤵PID:3924
-
\??\c:\5vdpp.exec:\5vdpp.exe101⤵PID:4592
-
\??\c:\pdjjd.exec:\pdjjd.exe102⤵PID:2360
-
\??\c:\frffflr.exec:\frffflr.exe103⤵PID:3420
-
\??\c:\hhtthh.exec:\hhtthh.exe104⤵PID:3388
-
\??\c:\tttntb.exec:\tttntb.exe105⤵PID:2132
-
\??\c:\vpjpv.exec:\vpjpv.exe106⤵PID:728
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:1440
-
\??\c:\9frflll.exec:\9frflll.exe108⤵PID:5020
-
\??\c:\bnbtnh.exec:\bnbtnh.exe109⤵PID:3728
-
\??\c:\jvvpp.exec:\jvvpp.exe110⤵PID:4696
-
\??\c:\ppvvp.exec:\ppvvp.exe111⤵PID:3468
-
\??\c:\5frllrr.exec:\5frllrr.exe112⤵PID:460
-
\??\c:\bhtbbh.exec:\bhtbbh.exe113⤵PID:2232
-
\??\c:\tnnnbh.exec:\tnnnbh.exe114⤵PID:2124
-
\??\c:\pvjdv.exec:\pvjdv.exe115⤵PID:1232
-
\??\c:\vvpjv.exec:\vvpjv.exe116⤵PID:1600
-
\??\c:\1ffffff.exec:\1ffffff.exe117⤵PID:3996
-
\??\c:\5bttnn.exec:\5bttnn.exe118⤵PID:2468
-
\??\c:\3hbtnn.exec:\3hbtnn.exe119⤵PID:4652
-
\??\c:\dddvv.exec:\dddvv.exe120⤵PID:4832
-
\??\c:\9fffrfx.exec:\9fffrfx.exe121⤵PID:2304
-
\??\c:\lrlfllf.exec:\lrlfllf.exe122⤵PID:2204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-