Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 12:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe
-
Size
590KB
-
MD5
78e8370ba49ded9f9764a95d677c2539
-
SHA1
8e511abd32684c0de7d5360dec2f36d48e78ebfe
-
SHA256
547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721
-
SHA512
da8ce441aad0f703ec0183a4ba3ff47a78a8a9ec0a1529a42fdba75b94e4386c38e63b8e61f24a753ba7a3e9540ae2a8a4ffde0e0575a03462ec8fb28ba89789
-
SSDEEP
6144:n3C9BRIj+ebjcSbcY+CaQdaFOY4iGFYtRdzzoyYxJAyfgayD:n3C9Lebz+xt4vFeFmgayD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2060-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-36-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2244 rrxrrrr.exe 4624 rlrfxrl.exe 2768 btnnhh.exe 1116 ppjpj.exe 640 rxllxrf.exe 1432 hntnhb.exe 4872 xrfrrfx.exe 4484 rllfrrx.exe 2808 bbtbnh.exe 3016 xfxrllf.exe 2028 lrrxllx.exe 776 vvvpd.exe 4164 pvvdd.exe 1608 btnhhb.exe 4796 ddppd.exe 668 hnnntb.exe 336 xrfxrxx.exe 2600 rlllffx.exe 3484 dpvpj.exe 2300 pdjjd.exe 4076 pvvpd.exe 2868 btbhbh.exe 4712 jjjjj.exe 2180 nnhhbh.exe 1736 xlxxxfl.exe 3660 vdddv.exe 760 fxllllr.exe 2256 3lrxrxx.exe 1908 hnhhtn.exe 3172 dvppp.exe 3928 7pdjj.exe 428 9rfxrxr.exe 4416 nhtbbt.exe 1716 tnhhbb.exe 1760 fflrlxx.exe 2036 3hhhhn.exe 1400 djvvv.exe 4480 fflrxfr.exe 1540 xfllrxf.exe 3316 bbhhhn.exe 1632 5jvvv.exe 112 rlrffxx.exe 2668 frfffll.exe 2620 nnnhtt.exe 3232 ppddd.exe 2260 vpvvv.exe 4912 frllrfl.exe 3704 nthhnn.exe 716 jddvp.exe 4344 lrxrrxx.exe 2040 lrlrrrr.exe 5020 ntttbh.exe 2796 vdddp.exe 1292 5rffxxl.exe 3236 1nhbbt.exe 448 nthnnt.exe 4616 jvdvj.exe 4824 ffflllf.exe 2916 thhhhb.exe 2280 vvppp.exe 404 xrfxrxx.exe 3352 ntttnh.exe 4752 jddpj.exe 4208 ffrrrrx.exe -
resource yara_rule behavioral2/memory/2060-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rrxfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rfxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnntth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2244 2060 547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe 82 PID 2060 wrote to memory of 2244 2060 547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe 82 PID 2060 wrote to memory of 2244 2060 547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe 82 PID 2244 wrote to memory of 4624 2244 rrxrrrr.exe 83 PID 2244 wrote to memory of 4624 2244 rrxrrrr.exe 83 PID 2244 wrote to memory of 4624 2244 rrxrrrr.exe 83 PID 4624 wrote to memory of 2768 4624 rlrfxrl.exe 84 PID 4624 wrote to memory of 2768 4624 rlrfxrl.exe 84 PID 4624 wrote to memory of 2768 4624 rlrfxrl.exe 84 PID 2768 wrote to memory of 1116 2768 btnnhh.exe 85 PID 2768 wrote to memory of 1116 2768 btnnhh.exe 85 PID 2768 wrote to memory of 1116 2768 btnnhh.exe 85 PID 1116 wrote to memory of 640 1116 ppjpj.exe 86 PID 1116 wrote to memory of 640 1116 ppjpj.exe 86 PID 1116 wrote to memory of 640 1116 ppjpj.exe 86 PID 640 wrote to memory of 1432 640 rxllxrf.exe 87 PID 640 wrote to memory of 1432 640 rxllxrf.exe 87 PID 640 wrote to memory of 1432 640 rxllxrf.exe 87 PID 1432 wrote to memory of 4872 1432 hntnhb.exe 88 PID 1432 wrote to memory of 4872 1432 hntnhb.exe 88 PID 1432 wrote to memory of 4872 1432 hntnhb.exe 88 PID 4872 wrote to memory of 4484 4872 xrfrrfx.exe 89 PID 4872 wrote to memory of 4484 4872 xrfrrfx.exe 89 PID 4872 wrote to memory of 4484 4872 xrfrrfx.exe 89 PID 4484 wrote to memory of 2808 4484 rllfrrx.exe 90 PID 4484 wrote to memory of 2808 4484 rllfrrx.exe 90 PID 4484 wrote to memory of 2808 4484 rllfrrx.exe 90 PID 2808 wrote to memory of 3016 2808 bbtbnh.exe 91 PID 2808 wrote to memory of 3016 2808 bbtbnh.exe 91 PID 2808 wrote to memory of 3016 2808 bbtbnh.exe 91 PID 3016 wrote to memory of 2028 3016 xfxrllf.exe 92 PID 3016 wrote to memory of 2028 3016 xfxrllf.exe 92 PID 3016 wrote to memory of 2028 3016 xfxrllf.exe 92 PID 2028 wrote to memory of 776 2028 lrrxllx.exe 93 PID 2028 wrote to memory of 776 2028 lrrxllx.exe 93 PID 2028 wrote to memory of 776 2028 lrrxllx.exe 93 PID 776 wrote to memory of 4164 776 vvvpd.exe 94 PID 776 wrote to memory of 4164 776 vvvpd.exe 94 PID 776 wrote to memory of 4164 776 vvvpd.exe 94 PID 4164 wrote to memory of 1608 4164 pvvdd.exe 95 PID 4164 wrote to memory of 1608 4164 pvvdd.exe 95 PID 4164 wrote to memory of 1608 4164 pvvdd.exe 95 PID 1608 wrote to memory of 4796 1608 btnhhb.exe 96 PID 1608 wrote to memory of 4796 1608 btnhhb.exe 96 PID 1608 wrote to memory of 4796 1608 btnhhb.exe 96 PID 4796 wrote to memory of 668 4796 ddppd.exe 97 PID 4796 wrote to memory of 668 4796 ddppd.exe 97 PID 4796 wrote to memory of 668 4796 ddppd.exe 97 PID 668 wrote to memory of 336 668 hnnntb.exe 98 PID 668 wrote to memory of 336 668 hnnntb.exe 98 PID 668 wrote to memory of 336 668 hnnntb.exe 98 PID 336 wrote to memory of 2600 336 xrfxrxx.exe 99 PID 336 wrote to memory of 2600 336 xrfxrxx.exe 99 PID 336 wrote to memory of 2600 336 xrfxrxx.exe 99 PID 2600 wrote to memory of 3484 2600 rlllffx.exe 100 PID 2600 wrote to memory of 3484 2600 rlllffx.exe 100 PID 2600 wrote to memory of 3484 2600 rlllffx.exe 100 PID 3484 wrote to memory of 2300 3484 dpvpj.exe 101 PID 3484 wrote to memory of 2300 3484 dpvpj.exe 101 PID 3484 wrote to memory of 2300 3484 dpvpj.exe 101 PID 2300 wrote to memory of 4076 2300 pdjjd.exe 102 PID 2300 wrote to memory of 4076 2300 pdjjd.exe 102 PID 2300 wrote to memory of 4076 2300 pdjjd.exe 102 PID 4076 wrote to memory of 2868 4076 pvvpd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe"C:\Users\Admin\AppData\Local\Temp\547100c1b96bcfafc8adfe7be1ed18f9d3e04159018e65ca13ecfe53e6c67721.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\rrxrrrr.exec:\rrxrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\rlrfxrl.exec:\rlrfxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\btnnhh.exec:\btnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\ppjpj.exec:\ppjpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\rxllxrf.exec:\rxllxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\hntnhb.exec:\hntnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\xrfrrfx.exec:\xrfrrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\rllfrrx.exec:\rllfrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\bbtbnh.exec:\bbtbnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xfxrllf.exec:\xfxrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\lrrxllx.exec:\lrrxllx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\vvvpd.exec:\vvvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\pvvdd.exec:\pvvdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\btnhhb.exec:\btnhhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\ddppd.exec:\ddppd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\hnnntb.exec:\hnnntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\rlllffx.exec:\rlllffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\dpvpj.exec:\dpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\pdjjd.exec:\pdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\pvvpd.exec:\pvvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\btbhbh.exec:\btbhbh.exe23⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jjjjj.exec:\jjjjj.exe24⤵
- Executes dropped EXE
PID:4712 -
\??\c:\nnhhbh.exec:\nnhhbh.exe25⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xlxxxfl.exec:\xlxxxfl.exe26⤵
- Executes dropped EXE
PID:1736 -
\??\c:\vdddv.exec:\vdddv.exe27⤵
- Executes dropped EXE
PID:3660 -
\??\c:\fxllllr.exec:\fxllllr.exe28⤵
- Executes dropped EXE
PID:760 -
\??\c:\3lrxrxx.exec:\3lrxrxx.exe29⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hnhhtn.exec:\hnhhtn.exe30⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvppp.exec:\dvppp.exe31⤵
- Executes dropped EXE
PID:3172 -
\??\c:\7pdjj.exec:\7pdjj.exe32⤵
- Executes dropped EXE
PID:3928 -
\??\c:\9rfxrxr.exec:\9rfxrxr.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:428 -
\??\c:\nhtbbt.exec:\nhtbbt.exe34⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tnhhbb.exec:\tnhhbb.exe35⤵
- Executes dropped EXE
PID:1716 -
\??\c:\fflrlxx.exec:\fflrlxx.exe36⤵
- Executes dropped EXE
PID:1760 -
\??\c:\3hhhhn.exec:\3hhhhn.exe37⤵
- Executes dropped EXE
PID:2036 -
\??\c:\djvvv.exec:\djvvv.exe38⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fflrxfr.exec:\fflrxfr.exe39⤵
- Executes dropped EXE
PID:4480 -
\??\c:\xfllrxf.exec:\xfllrxf.exe40⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bbhhhn.exec:\bbhhhn.exe41⤵
- Executes dropped EXE
PID:3316 -
\??\c:\5jvvv.exec:\5jvvv.exe42⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rlrffxx.exec:\rlrffxx.exe43⤵
- Executes dropped EXE
PID:112 -
\??\c:\frfffll.exec:\frfffll.exe44⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nnnhtt.exec:\nnnhtt.exe45⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ppddd.exec:\ppddd.exe46⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vpvvv.exec:\vpvvv.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\frllrfl.exec:\frllrfl.exe48⤵
- Executes dropped EXE
PID:4912 -
\??\c:\nthhnn.exec:\nthhnn.exe49⤵
- Executes dropped EXE
PID:3704 -
\??\c:\jddvp.exec:\jddvp.exe50⤵
- Executes dropped EXE
PID:716 -
\??\c:\lrxrrxx.exec:\lrxrrxx.exe51⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lrlrrrr.exec:\lrlrrrr.exe52⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ntttbh.exec:\ntttbh.exe53⤵
- Executes dropped EXE
PID:5020 -
\??\c:\vdddp.exec:\vdddp.exe54⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5rffxxl.exec:\5rffxxl.exe55⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1nhbbt.exec:\1nhbbt.exe56⤵
- Executes dropped EXE
PID:3236 -
\??\c:\nthnnt.exec:\nthnnt.exe57⤵
- Executes dropped EXE
PID:448 -
\??\c:\jvdvj.exec:\jvdvj.exe58⤵
- Executes dropped EXE
PID:4616 -
\??\c:\ffflllf.exec:\ffflllf.exe59⤵
- Executes dropped EXE
PID:4824 -
\??\c:\thhhhb.exec:\thhhhb.exe60⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vvppp.exec:\vvppp.exe61⤵
- Executes dropped EXE
PID:2280 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe62⤵
- Executes dropped EXE
PID:404 -
\??\c:\ntttnh.exec:\ntttnh.exe63⤵
- Executes dropped EXE
PID:3352 -
\??\c:\jddpj.exec:\jddpj.exe64⤵
- Executes dropped EXE
PID:4752 -
\??\c:\ffrrrrx.exec:\ffrrrrx.exe65⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rrffffr.exec:\rrffffr.exe66⤵PID:4520
-
\??\c:\bhttbb.exec:\bhttbb.exe67⤵PID:3676
-
\??\c:\djpjd.exec:\djpjd.exe68⤵PID:4064
-
\??\c:\3lfrrxr.exec:\3lfrrxr.exe69⤵PID:2388
-
\??\c:\7nbbhn.exec:\7nbbhn.exe70⤵PID:3256
-
\??\c:\bnnnnn.exec:\bnnnnn.exe71⤵PID:1276
-
\??\c:\jjvvv.exec:\jjvvv.exe72⤵PID:4164
-
\??\c:\xllrrfx.exec:\xllrrfx.exe73⤵PID:736
-
\??\c:\hhbnnb.exec:\hhbnnb.exe74⤵PID:4268
-
\??\c:\vpvvv.exec:\vpvvv.exe75⤵PID:4832
-
\??\c:\dvddd.exec:\dvddd.exe76⤵PID:3496
-
\??\c:\9xxxxfx.exec:\9xxxxfx.exe77⤵PID:780
-
\??\c:\hhhhhh.exec:\hhhhhh.exe78⤵PID:1288
-
\??\c:\dvdvp.exec:\dvdvp.exe79⤵PID:4468
-
\??\c:\xxxlffx.exec:\xxxlffx.exe80⤵
- System Location Discovery: System Language Discovery
PID:3484 -
\??\c:\bbttbn.exec:\bbttbn.exe81⤵PID:1120
-
\??\c:\vvdvv.exec:\vvdvv.exe82⤵PID:4076
-
\??\c:\xrxxrlx.exec:\xrxxrlx.exe83⤵PID:2484
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe84⤵PID:1932
-
\??\c:\nhhbbt.exec:\nhhbbt.exe85⤵PID:928
-
\??\c:\pvddv.exec:\pvddv.exe86⤵PID:1968
-
\??\c:\rllrxxx.exec:\rllrxxx.exe87⤵PID:2912
-
\??\c:\5httnt.exec:\5httnt.exe88⤵PID:4924
-
\??\c:\pdpjd.exec:\pdpjd.exe89⤵PID:5028
-
\??\c:\fflffff.exec:\fflffff.exe90⤵PID:4232
-
\??\c:\1bhhht.exec:\1bhhht.exe91⤵PID:3076
-
\??\c:\pjdvv.exec:\pjdvv.exe92⤵PID:3292
-
\??\c:\lxllrll.exec:\lxllrll.exe93⤵PID:2324
-
\??\c:\nhnnnt.exec:\nhnnnt.exe94⤵PID:428
-
\??\c:\jdvpp.exec:\jdvpp.exe95⤵PID:1600
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe96⤵PID:1644
-
\??\c:\thbbbh.exec:\thbbbh.exe97⤵PID:3664
-
\??\c:\tnbbbh.exec:\tnbbbh.exe98⤵PID:3696
-
\??\c:\ppvdd.exec:\ppvdd.exe99⤵PID:4588
-
\??\c:\9rrxxrl.exec:\9rrxxrl.exe100⤵PID:4644
-
\??\c:\hnnbbt.exec:\hnnbbt.exe101⤵PID:1668
-
\??\c:\5pjjp.exec:\5pjjp.exe102⤵PID:2624
-
\??\c:\frrrlfx.exec:\frrrlfx.exe103⤵PID:312
-
\??\c:\ffffffl.exec:\ffffffl.exe104⤵PID:4844
-
\??\c:\bhntnn.exec:\bhntnn.exe105⤵PID:3476
-
\??\c:\vvvvv.exec:\vvvvv.exe106⤵PID:3012
-
\??\c:\xxrlfrl.exec:\xxrlfrl.exe107⤵PID:3896
-
\??\c:\lfllfxx.exec:\lfllfxx.exe108⤵PID:4528
-
\??\c:\hbhbbb.exec:\hbhbbb.exe109⤵PID:4596
-
\??\c:\9djjp.exec:\9djjp.exe110⤵PID:4192
-
\??\c:\xllfflf.exec:\xllfflf.exe111⤵PID:4308
-
\??\c:\1hhhbh.exec:\1hhhbh.exe112⤵
- System Location Discovery: System Language Discovery
PID:3916 -
\??\c:\jvdpj.exec:\jvdpj.exe113⤵PID:2060
-
\??\c:\xxxrllf.exec:\xxxrllf.exe114⤵PID:2080
-
\??\c:\lrxrlxr.exec:\lrxrlxr.exe115⤵PID:4560
-
\??\c:\jjddv.exec:\jjddv.exe116⤵PID:3848
-
\??\c:\xxllrrx.exec:\xxllrrx.exe117⤵PID:4964
-
\??\c:\ffrfrrx.exec:\ffrfrrx.exe118⤵PID:4948
-
\??\c:\tnhhhn.exec:\tnhhhn.exe119⤵PID:2152
-
\??\c:\7dvpp.exec:\7dvpp.exe120⤵PID:4936
-
\??\c:\llxrrlx.exec:\llxrrlx.exe121⤵PID:4904
-
\??\c:\bbhbbb.exec:\bbhbbb.exe122⤵PID:1000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-