Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 14:02
Static task
static1
Behavioral task
behavioral1
Sample
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe
Resource
win7-20240729-en
General
-
Target
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe
-
Size
119KB
-
MD5
353f9c3a0b70ecabd365442b70213e10
-
SHA1
594c1301a40519e5e50a8212b2abb75cfb825e96
-
SHA256
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4b
-
SHA512
35a17eca735b306be3b8764ac863ad6b4a2bd62489051e51f26cddb79d3da5149b0bced67542c50714ab151831a02887e0f53f30ca10b5ecc9d4464c47018b12
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX8XFE:n3C9BRW0j/uVEZF9
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4948-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9pvpp.exexxxfxll.exebbntnt.exettbbtt.exe7xxrlrf.exetthhtt.exepjjdv.exevvjvj.exexfllrxr.exetbhbht.exejpvvv.exerrrrxfx.exehnhhhh.exe3djjp.exefrxxxff.exenttntt.exevvddd.exentbnbb.exenhtttn.exe3jjpd.exerrxfrrx.exetbhhtb.exeppjvd.exe1xfffff.exebtttnt.exeppppj.exelxrrrrx.exe5jpdd.exejjpvv.exelrrrrrr.exe3bhhhh.exevddvv.exetntbbh.exepvpjd.exelxxffll.exefllfxxl.exettthbn.exedddjj.exe3lfxrll.exebbhttb.exepdvvp.exe1xffxfl.exetnhthh.exe5rrxxff.exexfrxrxr.exetbbbbh.exejppvv.exebnbnbt.exedpjjv.exevdjdj.exelfrrffx.exenbhhhh.exedvppp.exeflrrrxr.exejdjdv.exexffrrll.exebhhbbb.exetbbbtt.exedvppp.exerxffxxx.exebnnnht.exe7pppv.exejdddd.exethnnnt.exepid Process 4680 9pvpp.exe 3648 xxxfxll.exe 2952 bbntnt.exe 4916 ttbbtt.exe 2264 7xxrlrf.exe 1924 tthhtt.exe 3148 pjjdv.exe 508 vvjvj.exe 5036 xfllrxr.exe 1196 tbhbht.exe 3400 jpvvv.exe 3732 rrrrxfx.exe 2928 hnhhhh.exe 4120 3djjp.exe 1708 frxxxff.exe 1872 nttntt.exe 4472 vvddd.exe 4708 ntbnbb.exe 4864 nhtttn.exe 3328 3jjpd.exe 4244 rrxfrrx.exe 116 tbhhtb.exe 2492 ppjvd.exe 1168 1xfffff.exe 4860 btttnt.exe 4220 ppppj.exe 3144 lxrrrrx.exe 4072 5jpdd.exe 3800 jjpvv.exe 2580 lrrrrrr.exe 4972 3bhhhh.exe 452 vddvv.exe 3136 tntbbh.exe 1692 pvpjd.exe 3460 lxxffll.exe 872 fllfxxl.exe 3184 ttthbn.exe 2184 dddjj.exe 4424 3lfxrll.exe 2392 bbhttb.exe 1300 pdvvp.exe 1608 1xffxfl.exe 208 tnhthh.exe 3980 5rrxxff.exe 2908 xfrxrxr.exe 3764 tbbbbh.exe 2296 jppvv.exe 1848 bnbnbt.exe 1916 dpjjv.exe 3988 vdjdj.exe 1484 lfrrffx.exe 4644 nbhhhh.exe 3824 dvppp.exe 2900 flrrrxr.exe 508 jdjdv.exe 1064 xffrrll.exe 2728 bhhbbb.exe 4128 tbbbtt.exe 2376 dvppp.exe 3112 rxffxxx.exe 4704 bnnnht.exe 3372 7pppv.exe 1704 jdddd.exe 3292 thnnnt.exe -
Processes:
resource yara_rule behavioral2/memory/4948-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rrlfxxx.exeddjpv.exevppdv.exefrffrrl.exe3xxxrrr.exethtbtt.exettbbtt.exetbbtnt.exedvdpv.exepvvpj.exejpjjd.exevvjvj.exethtthh.exe7lfxxxx.exefflxllx.exepvvdv.exe9xfffrl.exedpvdj.exebbhnnt.exe9nhbtb.exehhtbtt.exebbttbb.exebhhhbh.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frffrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe9pvpp.exexxxfxll.exebbntnt.exettbbtt.exe7xxrlrf.exetthhtt.exepjjdv.exevvjvj.exexfllrxr.exetbhbht.exejpvvv.exerrrrxfx.exehnhhhh.exe3djjp.exefrxxxff.exenttntt.exevvddd.exentbnbb.exenhtttn.exe3jjpd.exerrxfrrx.exedescription pid Process procid_target PID 4948 wrote to memory of 4680 4948 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 83 PID 4948 wrote to memory of 4680 4948 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 83 PID 4948 wrote to memory of 4680 4948 cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe 83 PID 4680 wrote to memory of 3648 4680 9pvpp.exe 84 PID 4680 wrote to memory of 3648 4680 9pvpp.exe 84 PID 4680 wrote to memory of 3648 4680 9pvpp.exe 84 PID 3648 wrote to memory of 2952 3648 xxxfxll.exe 85 PID 3648 wrote to memory of 2952 3648 xxxfxll.exe 85 PID 3648 wrote to memory of 2952 3648 xxxfxll.exe 85 PID 2952 wrote to memory of 4916 2952 bbntnt.exe 86 PID 2952 wrote to memory of 4916 2952 bbntnt.exe 86 PID 2952 wrote to memory of 4916 2952 bbntnt.exe 86 PID 4916 wrote to memory of 2264 4916 ttbbtt.exe 87 PID 4916 wrote to memory of 2264 4916 ttbbtt.exe 87 PID 4916 wrote to memory of 2264 4916 ttbbtt.exe 87 PID 2264 wrote to memory of 1924 2264 7xxrlrf.exe 88 PID 2264 wrote to memory of 1924 2264 7xxrlrf.exe 88 PID 2264 wrote to memory of 1924 2264 7xxrlrf.exe 88 PID 1924 wrote to memory of 3148 1924 tthhtt.exe 89 PID 1924 wrote to memory of 3148 1924 tthhtt.exe 89 PID 1924 wrote to memory of 3148 1924 tthhtt.exe 89 PID 3148 wrote to memory of 508 3148 pjjdv.exe 90 PID 3148 wrote to memory of 508 3148 pjjdv.exe 90 PID 3148 wrote to memory of 508 3148 pjjdv.exe 90 PID 508 wrote to memory of 5036 508 vvjvj.exe 91 PID 508 wrote to memory of 5036 508 vvjvj.exe 91 PID 508 wrote to memory of 5036 508 vvjvj.exe 91 PID 5036 wrote to memory of 1196 5036 xfllrxr.exe 92 PID 5036 wrote to memory of 1196 5036 xfllrxr.exe 92 PID 5036 wrote to memory of 1196 5036 xfllrxr.exe 92 PID 1196 wrote to memory of 3400 1196 tbhbht.exe 93 PID 1196 wrote to memory of 3400 1196 tbhbht.exe 93 PID 1196 wrote to memory of 3400 1196 tbhbht.exe 93 PID 3400 wrote to memory of 3732 3400 jpvvv.exe 94 PID 3400 wrote to memory of 3732 3400 jpvvv.exe 94 PID 3400 wrote to memory of 3732 3400 jpvvv.exe 94 PID 3732 wrote to memory of 2928 3732 rrrrxfx.exe 95 PID 3732 wrote to memory of 2928 3732 rrrrxfx.exe 95 PID 3732 wrote to memory of 2928 3732 rrrrxfx.exe 95 PID 2928 wrote to memory of 4120 2928 hnhhhh.exe 96 PID 2928 wrote to memory of 4120 2928 hnhhhh.exe 96 PID 2928 wrote to memory of 4120 2928 hnhhhh.exe 96 PID 4120 wrote to memory of 1708 4120 3djjp.exe 97 PID 4120 wrote to memory of 1708 4120 3djjp.exe 97 PID 4120 wrote to memory of 1708 4120 3djjp.exe 97 PID 1708 wrote to memory of 1872 1708 frxxxff.exe 98 PID 1708 wrote to memory of 1872 1708 frxxxff.exe 98 PID 1708 wrote to memory of 1872 1708 frxxxff.exe 98 PID 1872 wrote to memory of 4472 1872 nttntt.exe 99 PID 1872 wrote to memory of 4472 1872 nttntt.exe 99 PID 1872 wrote to memory of 4472 1872 nttntt.exe 99 PID 4472 wrote to memory of 4708 4472 vvddd.exe 100 PID 4472 wrote to memory of 4708 4472 vvddd.exe 100 PID 4472 wrote to memory of 4708 4472 vvddd.exe 100 PID 4708 wrote to memory of 4864 4708 ntbnbb.exe 101 PID 4708 wrote to memory of 4864 4708 ntbnbb.exe 101 PID 4708 wrote to memory of 4864 4708 ntbnbb.exe 101 PID 4864 wrote to memory of 3328 4864 nhtttn.exe 102 PID 4864 wrote to memory of 3328 4864 nhtttn.exe 102 PID 4864 wrote to memory of 3328 4864 nhtttn.exe 102 PID 3328 wrote to memory of 4244 3328 3jjpd.exe 103 PID 3328 wrote to memory of 4244 3328 3jjpd.exe 103 PID 3328 wrote to memory of 4244 3328 3jjpd.exe 103 PID 4244 wrote to memory of 116 4244 rrxfrrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe"C:\Users\Admin\AppData\Local\Temp\cac7eddd9355c51184f2627ba88948f4a9d78918a2c0814fc1bd10ab52d4da4bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\9pvpp.exec:\9pvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\xxxfxll.exec:\xxxfxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\bbntnt.exec:\bbntnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\ttbbtt.exec:\ttbbtt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\7xxrlrf.exec:\7xxrlrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\tthhtt.exec:\tthhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\pjjdv.exec:\pjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\vvjvj.exec:\vvjvj.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\xfllrxr.exec:\xfllrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\tbhbht.exec:\tbhbht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\jpvvv.exec:\jpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
\??\c:\rrrrxfx.exec:\rrrrxfx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\hnhhhh.exec:\hnhhhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3djjp.exec:\3djjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\frxxxff.exec:\frxxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\nttntt.exec:\nttntt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\vvddd.exec:\vvddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\ntbnbb.exec:\ntbnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\nhtttn.exec:\nhtttn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\3jjpd.exec:\3jjpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\rrxfrrx.exec:\rrxfrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\tbhhtb.exec:\tbhhtb.exe23⤵
- Executes dropped EXE
PID:116 -
\??\c:\ppjvd.exec:\ppjvd.exe24⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1xfffff.exec:\1xfffff.exe25⤵
- Executes dropped EXE
PID:1168 -
\??\c:\btttnt.exec:\btttnt.exe26⤵
- Executes dropped EXE
PID:4860 -
\??\c:\ppppj.exec:\ppppj.exe27⤵
- Executes dropped EXE
PID:4220 -
\??\c:\lxrrrrx.exec:\lxrrrrx.exe28⤵
- Executes dropped EXE
PID:3144 -
\??\c:\5jpdd.exec:\5jpdd.exe29⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jjpvv.exec:\jjpvv.exe30⤵
- Executes dropped EXE
PID:3800 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe31⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3bhhhh.exec:\3bhhhh.exe32⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vddvv.exec:\vddvv.exe33⤵
- Executes dropped EXE
PID:452 -
\??\c:\tntbbh.exec:\tntbbh.exe34⤵
- Executes dropped EXE
PID:3136 -
\??\c:\pvpjd.exec:\pvpjd.exe35⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lxxffll.exec:\lxxffll.exe36⤵
- Executes dropped EXE
PID:3460 -
\??\c:\fllfxxl.exec:\fllfxxl.exe37⤵
- Executes dropped EXE
PID:872 -
\??\c:\ttthbn.exec:\ttthbn.exe38⤵
- Executes dropped EXE
PID:3184 -
\??\c:\dddjj.exec:\dddjj.exe39⤵
- Executes dropped EXE
PID:2184 -
\??\c:\3lfxrll.exec:\3lfxrll.exe40⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bbhttb.exec:\bbhttb.exe41⤵
- Executes dropped EXE
PID:2392 -
\??\c:\pdvvp.exec:\pdvvp.exe42⤵
- Executes dropped EXE
PID:1300 -
\??\c:\frffflf.exec:\frffflf.exe43⤵PID:644
-
\??\c:\1xffxfl.exec:\1xffxfl.exe44⤵
- Executes dropped EXE
PID:1608 -
\??\c:\tnhthh.exec:\tnhthh.exe45⤵
- Executes dropped EXE
PID:208 -
\??\c:\5rrxxff.exec:\5rrxxff.exe46⤵
- Executes dropped EXE
PID:3980 -
\??\c:\xfrxrxr.exec:\xfrxrxr.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tbbbbh.exec:\tbbbbh.exe48⤵
- Executes dropped EXE
PID:3764 -
\??\c:\jppvv.exec:\jppvv.exe49⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bnbnbt.exec:\bnbnbt.exe50⤵
- Executes dropped EXE
PID:1848 -
\??\c:\dpjjv.exec:\dpjjv.exe51⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vdjdj.exec:\vdjdj.exe52⤵
- Executes dropped EXE
PID:3988 -
\??\c:\lfrrffx.exec:\lfrrffx.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\nbhhhh.exec:\nbhhhh.exe54⤵
- Executes dropped EXE
PID:4644 -
\??\c:\dvppp.exec:\dvppp.exe55⤵
- Executes dropped EXE
PID:3824 -
\??\c:\flrrrxr.exec:\flrrrxr.exe56⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jdjdv.exec:\jdjdv.exe57⤵
- Executes dropped EXE
PID:508 -
\??\c:\xffrrll.exec:\xffrrll.exe58⤵
- Executes dropped EXE
PID:1064 -
\??\c:\bhhbbb.exec:\bhhbbb.exe59⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tbbbtt.exec:\tbbbtt.exe60⤵
- Executes dropped EXE
PID:4128 -
\??\c:\dvppp.exec:\dvppp.exe61⤵
- Executes dropped EXE
PID:2376 -
\??\c:\rxffxxx.exec:\rxffxxx.exe62⤵
- Executes dropped EXE
PID:3112 -
\??\c:\bnnnht.exec:\bnnnht.exe63⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7pppv.exec:\7pppv.exe64⤵
- Executes dropped EXE
PID:3372 -
\??\c:\jdddd.exec:\jdddd.exe65⤵
- Executes dropped EXE
PID:1704 -
\??\c:\thnnnt.exec:\thnnnt.exe66⤵
- Executes dropped EXE
PID:3292 -
\??\c:\hntntt.exec:\hntntt.exe67⤵PID:2504
-
\??\c:\dppdd.exec:\dppdd.exe68⤵PID:2052
-
\??\c:\lflflxx.exec:\lflflxx.exe69⤵PID:2012
-
\??\c:\jjvvp.exec:\jjvvp.exe70⤵PID:4472
-
\??\c:\rrlxrxl.exec:\rrlxrxl.exe71⤵PID:4160
-
\??\c:\hhhbbh.exec:\hhhbbh.exe72⤵PID:2964
-
\??\c:\vpvpj.exec:\vpvpj.exe73⤵PID:3744
-
\??\c:\vvjvp.exec:\vvjvp.exe74⤵PID:2132
-
\??\c:\xrfllxl.exec:\xrfllxl.exe75⤵PID:1732
-
\??\c:\nnnbhb.exec:\nnnbhb.exe76⤵PID:2328
-
\??\c:\hntthh.exec:\hntthh.exe77⤵PID:4100
-
\??\c:\pvdpp.exec:\pvdpp.exe78⤵PID:3128
-
\??\c:\jjddd.exec:\jjddd.exe79⤵PID:2884
-
\??\c:\lxrrlrl.exec:\lxrrlrl.exe80⤵PID:3272
-
\??\c:\rllllrr.exec:\rllllrr.exe81⤵PID:4212
-
\??\c:\btbhhh.exec:\btbhhh.exe82⤵PID:3436
-
\??\c:\nnnhth.exec:\nnnhth.exe83⤵PID:4956
-
\??\c:\lfllflf.exec:\lfllflf.exe84⤵PID:912
-
\??\c:\hbhhtt.exec:\hbhhtt.exe85⤵PID:4648
-
\??\c:\ppppp.exec:\ppppp.exe86⤵PID:3660
-
\??\c:\dpjjd.exec:\dpjjd.exe87⤵PID:528
-
\??\c:\rrfllrr.exec:\rrfllrr.exe88⤵PID:2912
-
\??\c:\ffxrflr.exec:\ffxrflr.exe89⤵PID:3460
-
\??\c:\tbhnnn.exec:\tbhnnn.exe90⤵PID:872
-
\??\c:\ddjjp.exec:\ddjjp.exe91⤵PID:2112
-
\??\c:\1jjpj.exec:\1jjpj.exe92⤵PID:3104
-
\??\c:\xxfffff.exec:\xxfffff.exe93⤵PID:4400
-
\??\c:\xllllxx.exec:\xllllxx.exe94⤵PID:1404
-
\??\c:\1bhhbb.exec:\1bhhbb.exe95⤵PID:4752
-
\??\c:\jdjvj.exec:\jdjvj.exe96⤵PID:2212
-
\??\c:\flllflf.exec:\flllflf.exe97⤵PID:532
-
\??\c:\ntbttt.exec:\ntbttt.exe98⤵PID:3648
-
\??\c:\vppjj.exec:\vppjj.exe99⤵PID:2192
-
\??\c:\xrffflf.exec:\xrffflf.exe100⤵PID:1208
-
\??\c:\nnnnnn.exec:\nnnnnn.exe101⤵PID:444
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe102⤵PID:1600
-
\??\c:\frlflrl.exec:\frlflrl.exe103⤵PID:3840
-
\??\c:\bhnbbb.exec:\bhnbbb.exe104⤵PID:692
-
\??\c:\vdddj.exec:\vdddj.exe105⤵PID:3740
-
\??\c:\xrrlllr.exec:\xrrlllr.exe106⤵PID:2664
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe107⤵PID:4728
-
\??\c:\tnbbbh.exec:\tnbbbh.exe108⤵PID:5036
-
\??\c:\ppjvj.exec:\ppjvj.exe109⤵PID:2440
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe110⤵PID:2444
-
\??\c:\ntbbnn.exec:\ntbbnn.exe111⤵PID:4140
-
\??\c:\jjjjj.exec:\jjjjj.exe112⤵PID:3108
-
\??\c:\dvppp.exec:\dvppp.exe113⤵PID:2376
-
\??\c:\rffflll.exec:\rffflll.exe114⤵PID:3340
-
\??\c:\3rffffl.exec:\3rffffl.exe115⤵PID:1596
-
\??\c:\5bbbht.exec:\5bbbht.exe116⤵PID:5072
-
\??\c:\7vvpj.exec:\7vvpj.exe117⤵PID:1704
-
\??\c:\rllflll.exec:\rllflll.exe118⤵PID:3304
-
\??\c:\hhnnnn.exec:\hhnnnn.exe119⤵PID:4056
-
\??\c:\vvjvp.exec:\vvjvp.exe120⤵PID:2660
-
\??\c:\xlxlxrf.exec:\xlxlxrf.exe121⤵PID:4920
-
\??\c:\ntnnnn.exec:\ntnnnn.exe122⤵PID:1996
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-