Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 08:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe
-
Size
64KB
-
MD5
5a092aba06b25a3bab39707b9cb8f740
-
SHA1
191c9d682e8d8e303c9db4ffbccb2f97b54509ae
-
SHA256
587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0c
-
SHA512
4e98927577990c35071ea71c9d8bf07748c26a822356d2ca06973ddca1c36bc0bc6e3ea0569428d6c097de8eace5f2832198ee5c5ff750f1638539ba284c3c26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMBW9:ymb3NkkiQ3mdBjFIjeu0
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4616-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4288-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/704-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/844-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4440-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4288 vpddj.exe 1708 lfffrrx.exe 704 vpppp.exe 2008 lfffxfx.exe 688 bbtnnh.exe 2716 ddddd.exe 4944 1lfrxxr.exe 1456 hhhbbt.exe 1612 ppvpj.exe 3080 rllxfxl.exe 4124 9bnhnn.exe 2204 5vvpj.exe 2036 llxrffr.exe 4280 btnnhh.exe 516 rlrffxr.exe 1932 hhhbtn.exe 844 htttnh.exe 3588 3djdp.exe 4440 9rrlxrl.exe 2920 5rfrxrx.exe 4428 bnhbtt.exe 4436 jvpdp.exe 2284 jvvjv.exe 1672 bbhntn.exe 2960 jvvjd.exe 916 jvjvd.exe 4760 frlfrff.exe 3136 lxxrllf.exe 744 xffxrxr.exe 4296 lxxrlff.exe 5016 tttttt.exe 880 pvvpp.exe 4248 pjjdp.exe 4744 frrlfff.exe 4540 xxrrffr.exe 2952 3hhhhh.exe 2340 dvpvj.exe 3220 vpjdv.exe 3844 9xrlxrr.exe 220 rfffrrl.exe 3132 bntnbh.exe 3276 thnbnh.exe 4084 djjdp.exe 4624 jddvj.exe 5040 xfxlfxl.exe 3404 1rlllff.exe 1636 ttnhhh.exe 3436 nbbthh.exe 4400 dpjvd.exe 2636 jdpjv.exe 4424 xrfxxrx.exe 2948 bnnnhh.exe 1884 nhnbnn.exe 3596 pddvp.exe 2180 rffxxrx.exe 1708 fxrfxrf.exe 1780 nhhbnh.exe 1748 vddjj.exe 4552 dvdvj.exe 3584 ffllxxx.exe 228 lllfffx.exe 4256 9hhtbb.exe 4944 nnttnh.exe 1380 7pvpp.exe -
resource yara_rule behavioral2/memory/4616-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4288-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/704-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/844-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4440-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-193-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xllrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ffrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 4288 4616 587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe 82 PID 4616 wrote to memory of 4288 4616 587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe 82 PID 4616 wrote to memory of 4288 4616 587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe 82 PID 4288 wrote to memory of 1708 4288 vpddj.exe 83 PID 4288 wrote to memory of 1708 4288 vpddj.exe 83 PID 4288 wrote to memory of 1708 4288 vpddj.exe 83 PID 1708 wrote to memory of 704 1708 lfffrrx.exe 84 PID 1708 wrote to memory of 704 1708 lfffrrx.exe 84 PID 1708 wrote to memory of 704 1708 lfffrrx.exe 84 PID 704 wrote to memory of 2008 704 vpppp.exe 85 PID 704 wrote to memory of 2008 704 vpppp.exe 85 PID 704 wrote to memory of 2008 704 vpppp.exe 85 PID 2008 wrote to memory of 688 2008 lfffxfx.exe 86 PID 2008 wrote to memory of 688 2008 lfffxfx.exe 86 PID 2008 wrote to memory of 688 2008 lfffxfx.exe 86 PID 688 wrote to memory of 2716 688 bbtnnh.exe 87 PID 688 wrote to memory of 2716 688 bbtnnh.exe 87 PID 688 wrote to memory of 2716 688 bbtnnh.exe 87 PID 2716 wrote to memory of 4944 2716 ddddd.exe 88 PID 2716 wrote to memory of 4944 2716 ddddd.exe 88 PID 2716 wrote to memory of 4944 2716 ddddd.exe 88 PID 4944 wrote to memory of 1456 4944 1lfrxxr.exe 89 PID 4944 wrote to memory of 1456 4944 1lfrxxr.exe 89 PID 4944 wrote to memory of 1456 4944 1lfrxxr.exe 89 PID 1456 wrote to memory of 1612 1456 hhhbbt.exe 90 PID 1456 wrote to memory of 1612 1456 hhhbbt.exe 90 PID 1456 wrote to memory of 1612 1456 hhhbbt.exe 90 PID 1612 wrote to memory of 3080 1612 ppvpj.exe 91 PID 1612 wrote to memory of 3080 1612 ppvpj.exe 91 PID 1612 wrote to memory of 3080 1612 ppvpj.exe 91 PID 3080 wrote to memory of 4124 3080 rllxfxl.exe 92 PID 3080 wrote to memory of 4124 3080 rllxfxl.exe 92 PID 3080 wrote to memory of 4124 3080 rllxfxl.exe 92 PID 4124 wrote to memory of 2204 4124 9bnhnn.exe 93 PID 4124 wrote to memory of 2204 4124 9bnhnn.exe 93 PID 4124 wrote to memory of 2204 4124 9bnhnn.exe 93 PID 2204 wrote to memory of 2036 2204 5vvpj.exe 94 PID 2204 wrote to memory of 2036 2204 5vvpj.exe 94 PID 2204 wrote to memory of 2036 2204 5vvpj.exe 94 PID 2036 wrote to memory of 4280 2036 llxrffr.exe 95 PID 2036 wrote to memory of 4280 2036 llxrffr.exe 95 PID 2036 wrote to memory of 4280 2036 llxrffr.exe 95 PID 4280 wrote to memory of 516 4280 btnnhh.exe 96 PID 4280 wrote to memory of 516 4280 btnnhh.exe 96 PID 4280 wrote to memory of 516 4280 btnnhh.exe 96 PID 516 wrote to memory of 1932 516 rlrffxr.exe 97 PID 516 wrote to memory of 1932 516 rlrffxr.exe 97 PID 516 wrote to memory of 1932 516 rlrffxr.exe 97 PID 1932 wrote to memory of 844 1932 hhhbtn.exe 98 PID 1932 wrote to memory of 844 1932 hhhbtn.exe 98 PID 1932 wrote to memory of 844 1932 hhhbtn.exe 98 PID 844 wrote to memory of 3588 844 htttnh.exe 99 PID 844 wrote to memory of 3588 844 htttnh.exe 99 PID 844 wrote to memory of 3588 844 htttnh.exe 99 PID 3588 wrote to memory of 4440 3588 3djdp.exe 100 PID 3588 wrote to memory of 4440 3588 3djdp.exe 100 PID 3588 wrote to memory of 4440 3588 3djdp.exe 100 PID 4440 wrote to memory of 2920 4440 9rrlxrl.exe 101 PID 4440 wrote to memory of 2920 4440 9rrlxrl.exe 101 PID 4440 wrote to memory of 2920 4440 9rrlxrl.exe 101 PID 2920 wrote to memory of 4428 2920 5rfrxrx.exe 102 PID 2920 wrote to memory of 4428 2920 5rfrxrx.exe 102 PID 2920 wrote to memory of 4428 2920 5rfrxrx.exe 102 PID 4428 wrote to memory of 4436 4428 bnhbtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe"C:\Users\Admin\AppData\Local\Temp\587856e04c5cb030aff137f3fbc4c4d093436c464fd1bb6f8e91336954aeea0cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\vpddj.exec:\vpddj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
\??\c:\lfffrrx.exec:\lfffrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\vpppp.exec:\vpppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:704 -
\??\c:\lfffxfx.exec:\lfffxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bbtnnh.exec:\bbtnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\ddddd.exec:\ddddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\1lfrxxr.exec:\1lfrxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\hhhbbt.exec:\hhhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\ppvpj.exec:\ppvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\rllxfxl.exec:\rllxfxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\9bnhnn.exec:\9bnhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\5vvpj.exec:\5vvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\llxrffr.exec:\llxrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\btnnhh.exec:\btnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\rlrffxr.exec:\rlrffxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\hhhbtn.exec:\hhhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\htttnh.exec:\htttnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\3djdp.exec:\3djdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\9rrlxrl.exec:\9rrlxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\5rfrxrx.exec:\5rfrxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\bnhbtt.exec:\bnhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\jvpdp.exec:\jvpdp.exe23⤵
- Executes dropped EXE
PID:4436 -
\??\c:\jvvjv.exec:\jvvjv.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\bbhntn.exec:\bbhntn.exe25⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jvvjd.exec:\jvvjd.exe26⤵
- Executes dropped EXE
PID:2960 -
\??\c:\jvjvd.exec:\jvjvd.exe27⤵
- Executes dropped EXE
PID:916 -
\??\c:\frlfrff.exec:\frlfrff.exe28⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lxxrllf.exec:\lxxrllf.exe29⤵
- Executes dropped EXE
PID:3136 -
\??\c:\xffxrxr.exec:\xffxrxr.exe30⤵
- Executes dropped EXE
PID:744 -
\??\c:\lxxrlff.exec:\lxxrlff.exe31⤵
- Executes dropped EXE
PID:4296 -
\??\c:\tttttt.exec:\tttttt.exe32⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pvvpp.exec:\pvvpp.exe33⤵
- Executes dropped EXE
PID:880 -
\??\c:\pjjdp.exec:\pjjdp.exe34⤵
- Executes dropped EXE
PID:4248 -
\??\c:\frrlfff.exec:\frrlfff.exe35⤵
- Executes dropped EXE
PID:4744 -
\??\c:\xxrrffr.exec:\xxrrffr.exe36⤵
- Executes dropped EXE
PID:4540 -
\??\c:\3hhhhh.exec:\3hhhhh.exe37⤵
- Executes dropped EXE
PID:2952 -
\??\c:\dvpvj.exec:\dvpvj.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2340 -
\??\c:\vpjdv.exec:\vpjdv.exe39⤵
- Executes dropped EXE
PID:3220 -
\??\c:\9xrlxrr.exec:\9xrlxrr.exe40⤵
- Executes dropped EXE
PID:3844 -
\??\c:\rfffrrl.exec:\rfffrrl.exe41⤵
- Executes dropped EXE
PID:220 -
\??\c:\bntnbh.exec:\bntnbh.exe42⤵
- Executes dropped EXE
PID:3132 -
\??\c:\thnbnh.exec:\thnbnh.exe43⤵
- Executes dropped EXE
PID:3276 -
\??\c:\djjdp.exec:\djjdp.exe44⤵
- Executes dropped EXE
PID:4084 -
\??\c:\jddvj.exec:\jddvj.exe45⤵
- Executes dropped EXE
PID:4624 -
\??\c:\xfxlfxl.exec:\xfxlfxl.exe46⤵
- Executes dropped EXE
PID:5040 -
\??\c:\1rlllff.exec:\1rlllff.exe47⤵
- Executes dropped EXE
PID:3404 -
\??\c:\ttnhhh.exec:\ttnhhh.exe48⤵
- Executes dropped EXE
PID:1636 -
\??\c:\nbbthh.exec:\nbbthh.exe49⤵
- Executes dropped EXE
PID:3436 -
\??\c:\dpjvd.exec:\dpjvd.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\jdpjv.exec:\jdpjv.exe51⤵
- Executes dropped EXE
PID:2636 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe52⤵
- Executes dropped EXE
PID:4424 -
\??\c:\bnnnhh.exec:\bnnnhh.exe53⤵
- Executes dropped EXE
PID:2948 -
\??\c:\nhnbnn.exec:\nhnbnn.exe54⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pddvp.exec:\pddvp.exe55⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rffxxrx.exec:\rffxxrx.exe56⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe57⤵
- Executes dropped EXE
PID:1708 -
\??\c:\nhhbnh.exec:\nhhbnh.exe58⤵
- Executes dropped EXE
PID:1780 -
\??\c:\vddjj.exec:\vddjj.exe59⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvdvj.exec:\dvdvj.exe60⤵
- Executes dropped EXE
PID:4552 -
\??\c:\ffllxxx.exec:\ffllxxx.exe61⤵
- Executes dropped EXE
PID:3584 -
\??\c:\lllfffx.exec:\lllfffx.exe62⤵
- Executes dropped EXE
PID:228 -
\??\c:\9hhtbb.exec:\9hhtbb.exe63⤵
- Executes dropped EXE
PID:4256 -
\??\c:\nnttnh.exec:\nnttnh.exe64⤵
- Executes dropped EXE
PID:4944 -
\??\c:\7pvpp.exec:\7pvpp.exe65⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xlxlxxr.exec:\xlxlxxr.exe66⤵PID:3320
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe67⤵PID:2796
-
\??\c:\nthhbt.exec:\nthhbt.exe68⤵PID:3376
-
\??\c:\bhhtnn.exec:\bhhtnn.exe69⤵PID:2176
-
\??\c:\vdpdp.exec:\vdpdp.exe70⤵PID:4368
-
\??\c:\llrlxrr.exec:\llrlxrr.exe71⤵PID:1816
-
\??\c:\nhnhhh.exec:\nhnhhh.exe72⤵PID:1068
-
\??\c:\rffxllf.exec:\rffxllf.exe73⤵PID:2148
-
\??\c:\rfffffx.exec:\rfffffx.exe74⤵PID:3936
-
\??\c:\hthnbn.exec:\hthnbn.exe75⤵PID:4280
-
\??\c:\3tbhnn.exec:\3tbhnn.exe76⤵PID:5004
-
\??\c:\vpjdv.exec:\vpjdv.exe77⤵PID:1640
-
\??\c:\jvjjv.exec:\jvjjv.exe78⤵PID:1576
-
\??\c:\frrlxlx.exec:\frrlxlx.exe79⤵PID:4728
-
\??\c:\flfrlfx.exec:\flfrlfx.exe80⤵PID:3588
-
\??\c:\nbhhbt.exec:\nbhhbt.exe81⤵PID:628
-
\??\c:\9jddv.exec:\9jddv.exe82⤵PID:1252
-
\??\c:\dpjdp.exec:\dpjdp.exe83⤵
- System Location Discovery: System Language Discovery
PID:1880 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe84⤵PID:4008
-
\??\c:\bbttnt.exec:\bbttnt.exe85⤵PID:4736
-
\??\c:\hnnbtn.exec:\hnnbtn.exe86⤵PID:4472
-
\??\c:\jddvv.exec:\jddvv.exe87⤵PID:2760
-
\??\c:\jdvpj.exec:\jdvpj.exe88⤵PID:4544
-
\??\c:\7lfxfxf.exec:\7lfxfxf.exe89⤵PID:1180
-
\??\c:\9xrrrrf.exec:\9xrrrrf.exe90⤵PID:1364
-
\??\c:\djjdv.exec:\djjdv.exe91⤵PID:4276
-
\??\c:\vdjvj.exec:\vdjvj.exe92⤵PID:4308
-
\??\c:\fllfrrl.exec:\fllfrrl.exe93⤵PID:3424
-
\??\c:\hnthbh.exec:\hnthbh.exe94⤵PID:4296
-
\??\c:\3hbbtn.exec:\3hbbtn.exe95⤵PID:2244
-
\??\c:\dvvvp.exec:\dvvvp.exe96⤵PID:4040
-
\??\c:\lxxllfx.exec:\lxxllfx.exe97⤵
- System Location Discovery: System Language Discovery
PID:4404 -
\??\c:\frrrlfx.exec:\frrrlfx.exe98⤵PID:3004
-
\??\c:\btnnbt.exec:\btnnbt.exe99⤵PID:2164
-
\??\c:\thhbtt.exec:\thhbtt.exe100⤵PID:320
-
\??\c:\bnttnn.exec:\bnttnn.exe101⤵PID:4396
-
\??\c:\jdvpj.exec:\jdvpj.exe102⤵PID:2112
-
\??\c:\rfxlllf.exec:\rfxlllf.exe103⤵PID:2200
-
\??\c:\rlffxxx.exec:\rlffxxx.exe104⤵PID:3964
-
\??\c:\htnnnh.exec:\htnnnh.exe105⤵PID:5112
-
\??\c:\bhhtnh.exec:\bhhtnh.exe106⤵PID:3444
-
\??\c:\pjpjj.exec:\pjpjj.exe107⤵PID:5104
-
\??\c:\rxrlfxr.exec:\rxrlfxr.exe108⤵PID:1796
-
\??\c:\rxxrllf.exec:\rxxrllf.exe109⤵PID:4648
-
\??\c:\nhnhbh.exec:\nhnhbh.exe110⤵PID:1836
-
\??\c:\bhnnhh.exec:\bhnnhh.exe111⤵PID:1716
-
\??\c:\jpjdd.exec:\jpjdd.exe112⤵PID:3364
-
\??\c:\xllxlff.exec:\xllxlff.exe113⤵PID:2472
-
\??\c:\xxrlfff.exec:\xxrlfff.exe114⤵PID:4352
-
\??\c:\xrrlffx.exec:\xrrlffx.exe115⤵PID:3580
-
\??\c:\ttbhbb.exec:\ttbhbb.exe116⤵PID:4616
-
\??\c:\dvjdp.exec:\dvjdp.exe117⤵PID:2648
-
\??\c:\vjpdp.exec:\vjpdp.exe118⤵PID:740
-
\??\c:\flxxrlf.exec:\flxxrlf.exe119⤵PID:3336
-
\??\c:\7xxxrrl.exec:\7xxxrrl.exe120⤵PID:4768
-
\??\c:\btbbtb.exec:\btbbtb.exe121⤵PID:868
-
\??\c:\tbbtnn.exec:\tbbtnn.exe122⤵PID:4032
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-