Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2024, 07:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe
-
Size
54KB
-
MD5
b811c51873a98c783ac102140f14a5db
-
SHA1
d2e5683d0e1771ce6b79a952bb3c410cd15e4651
-
SHA256
bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f
-
SHA512
69c42f8c50f39d15ef79033152e6fa27d246859b2d1c56d1a680e7b4f1dfb92755b0d63bdb824622d345f3e28117fa078b77d506b7313419d351fce3d59b50b3
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlNJV2:0cdpeeBSHHMHLf9RyIET2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4444-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1264-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-216-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-249-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-259-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-293-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-319-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-329-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-339-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-355-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-384-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-422-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-429-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-436-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-485-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-498-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-562-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-575-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-582-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-786-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-920-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-1086-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-1136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4696-1596-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-1708-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2016 fxrlxrl.exe 3576 xfflfff.exe 3872 nnthhh.exe 3260 jdjdv.exe 3124 vddvp.exe 3232 5xxrxrl.exe 3448 nbnnhb.exe 1576 vjjdp.exe 1892 rrrllfr.exe 1264 lxlfxlr.exe 3864 9hnnbh.exe 3280 jjjjj.exe 3108 rxxrllf.exe 1536 7tbhhn.exe 2812 5vpjd.exe 1628 rlrffrf.exe 4672 1rxxxrx.exe 4488 nnttnn.exe 1692 dvdvd.exe 2008 jdjjj.exe 1664 lfrlrrx.exe 740 hbnhbt.exe 2984 htbtnb.exe 1648 dvvpj.exe 3832 frrfrlx.exe 620 nnhhtt.exe 3640 hntthb.exe 2032 jppjd.exe 1988 xrrfllx.exe 1388 bhtnnh.exe 3612 dddvj.exe 4728 ffxxlrl.exe 3396 lxfxxxr.exe 3796 btthbt.exe 4284 3dvpp.exe 4128 rlrlfxl.exe 1876 btbtnn.exe 1260 7tnhbb.exe 4292 dpppd.exe 4884 xfrlfxx.exe 1068 3lffxxr.exe 4616 bbnhbb.exe 1888 vppjd.exe 4444 fxlfxxf.exe 2880 5xfrfxx.exe 3596 5hhnnh.exe 4972 3jdvj.exe 772 vvvvv.exe 2004 xxfxxff.exe 4524 7nnhhn.exe 3232 djpvp.exe 2744 xlxxxxr.exe 1972 frxxxxx.exe 232 nhttbt.exe 1148 htbthb.exe 1892 jpjjd.exe 1264 rrxrlrr.exe 1512 xxrlrrf.exe 2416 7nnntt.exe 1968 hhhhbt.exe 3108 9vppj.exe 4132 lxffxfx.exe 1536 lrxxrff.exe 4340 tthbtn.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ttttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4444 wrote to memory of 2016 4444 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 83 PID 4444 wrote to memory of 2016 4444 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 83 PID 4444 wrote to memory of 2016 4444 bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe 83 PID 2016 wrote to memory of 3576 2016 fxrlxrl.exe 84 PID 2016 wrote to memory of 3576 2016 fxrlxrl.exe 84 PID 2016 wrote to memory of 3576 2016 fxrlxrl.exe 84 PID 3576 wrote to memory of 3872 3576 xfflfff.exe 85 PID 3576 wrote to memory of 3872 3576 xfflfff.exe 85 PID 3576 wrote to memory of 3872 3576 xfflfff.exe 85 PID 3872 wrote to memory of 3260 3872 nnthhh.exe 86 PID 3872 wrote to memory of 3260 3872 nnthhh.exe 86 PID 3872 wrote to memory of 3260 3872 nnthhh.exe 86 PID 3260 wrote to memory of 3124 3260 jdjdv.exe 87 PID 3260 wrote to memory of 3124 3260 jdjdv.exe 87 PID 3260 wrote to memory of 3124 3260 jdjdv.exe 87 PID 3124 wrote to memory of 3232 3124 vddvp.exe 88 PID 3124 wrote to memory of 3232 3124 vddvp.exe 88 PID 3124 wrote to memory of 3232 3124 vddvp.exe 88 PID 3232 wrote to memory of 3448 3232 5xxrxrl.exe 89 PID 3232 wrote to memory of 3448 3232 5xxrxrl.exe 89 PID 3232 wrote to memory of 3448 3232 5xxrxrl.exe 89 PID 3448 wrote to memory of 1576 3448 nbnnhb.exe 90 PID 3448 wrote to memory of 1576 3448 nbnnhb.exe 90 PID 3448 wrote to memory of 1576 3448 nbnnhb.exe 90 PID 1576 wrote to memory of 1892 1576 vjjdp.exe 91 PID 1576 wrote to memory of 1892 1576 vjjdp.exe 91 PID 1576 wrote to memory of 1892 1576 vjjdp.exe 91 PID 1892 wrote to memory of 1264 1892 rrrllfr.exe 92 PID 1892 wrote to memory of 1264 1892 rrrllfr.exe 92 PID 1892 wrote to memory of 1264 1892 rrrllfr.exe 92 PID 1264 wrote to memory of 3864 1264 lxlfxlr.exe 93 PID 1264 wrote to memory of 3864 1264 lxlfxlr.exe 93 PID 1264 wrote to memory of 3864 1264 lxlfxlr.exe 93 PID 3864 wrote to memory of 3280 3864 9hnnbh.exe 94 PID 3864 wrote to memory of 3280 3864 9hnnbh.exe 94 PID 3864 wrote to memory of 3280 3864 9hnnbh.exe 94 PID 3280 wrote to memory of 3108 3280 jjjjj.exe 95 PID 3280 wrote to memory of 3108 3280 jjjjj.exe 95 PID 3280 wrote to memory of 3108 3280 jjjjj.exe 95 PID 3108 wrote to memory of 1536 3108 rxxrllf.exe 96 PID 3108 wrote to memory of 1536 3108 rxxrllf.exe 96 PID 3108 wrote to memory of 1536 3108 rxxrllf.exe 96 PID 1536 wrote to memory of 2812 1536 7tbhhn.exe 97 PID 1536 wrote to memory of 2812 1536 7tbhhn.exe 97 PID 1536 wrote to memory of 2812 1536 7tbhhn.exe 97 PID 2812 wrote to memory of 1628 2812 5vpjd.exe 98 PID 2812 wrote to memory of 1628 2812 5vpjd.exe 98 PID 2812 wrote to memory of 1628 2812 5vpjd.exe 98 PID 1628 wrote to memory of 4672 1628 rlrffrf.exe 99 PID 1628 wrote to memory of 4672 1628 rlrffrf.exe 99 PID 1628 wrote to memory of 4672 1628 rlrffrf.exe 99 PID 4672 wrote to memory of 4488 4672 1rxxxrx.exe 100 PID 4672 wrote to memory of 4488 4672 1rxxxrx.exe 100 PID 4672 wrote to memory of 4488 4672 1rxxxrx.exe 100 PID 4488 wrote to memory of 1692 4488 nnttnn.exe 101 PID 4488 wrote to memory of 1692 4488 nnttnn.exe 101 PID 4488 wrote to memory of 1692 4488 nnttnn.exe 101 PID 1692 wrote to memory of 2008 1692 dvdvd.exe 102 PID 1692 wrote to memory of 2008 1692 dvdvd.exe 102 PID 1692 wrote to memory of 2008 1692 dvdvd.exe 102 PID 2008 wrote to memory of 1664 2008 jdjjj.exe 103 PID 2008 wrote to memory of 1664 2008 jdjjj.exe 103 PID 2008 wrote to memory of 1664 2008 jdjjj.exe 103 PID 1664 wrote to memory of 740 1664 lfrlrrx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"C:\Users\Admin\AppData\Local\Temp\bd701f5de0b7b5bfa06088d76f868e944858a57141b977d0e079836635037f6f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\xfflfff.exec:\xfflfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\nnthhh.exec:\nnthhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\jdjdv.exec:\jdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\vddvp.exec:\vddvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\5xxrxrl.exec:\5xxrxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\nbnnhb.exec:\nbnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\vjjdp.exec:\vjjdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\rrrllfr.exec:\rrrllfr.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\lxlfxlr.exec:\lxlfxlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\9hnnbh.exec:\9hnnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\jjjjj.exec:\jjjjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\rxxrllf.exec:\rxxrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\7tbhhn.exec:\7tbhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\5vpjd.exec:\5vpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\rlrffrf.exec:\rlrffrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\1rxxxrx.exec:\1rxxxrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\nnttnn.exec:\nnttnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\dvdvd.exec:\dvdvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\jdjjj.exec:\jdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
\??\c:\hbnhbt.exec:\hbnhbt.exe23⤵
- Executes dropped EXE
PID:740 -
\??\c:\htbtnb.exec:\htbtnb.exe24⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvvpj.exec:\dvvpj.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\frrfrlx.exec:\frrfrlx.exe26⤵
- Executes dropped EXE
PID:3832 -
\??\c:\nnhhtt.exec:\nnhhtt.exe27⤵
- Executes dropped EXE
PID:620 -
\??\c:\hntthb.exec:\hntthb.exe28⤵
- Executes dropped EXE
PID:3640 -
\??\c:\jppjd.exec:\jppjd.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\xrrfllx.exec:\xrrfllx.exe30⤵
- Executes dropped EXE
PID:1988 -
\??\c:\bhtnnh.exec:\bhtnnh.exe31⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dddvj.exec:\dddvj.exe32⤵
- Executes dropped EXE
PID:3612 -
\??\c:\ffxxlrl.exec:\ffxxlrl.exe33⤵
- Executes dropped EXE
PID:4728 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe34⤵
- Executes dropped EXE
PID:3396 -
\??\c:\btthbt.exec:\btthbt.exe35⤵
- Executes dropped EXE
PID:3796 -
\??\c:\3dvpp.exec:\3dvpp.exe36⤵
- Executes dropped EXE
PID:4284 -
\??\c:\rlrlfxl.exec:\rlrlfxl.exe37⤵
- Executes dropped EXE
PID:4128 -
\??\c:\btbtnn.exec:\btbtnn.exe38⤵
- Executes dropped EXE
PID:1876 -
\??\c:\7tnhbb.exec:\7tnhbb.exe39⤵
- Executes dropped EXE
PID:1260 -
\??\c:\dpppd.exec:\dpppd.exe40⤵
- Executes dropped EXE
PID:4292 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe41⤵
- Executes dropped EXE
PID:4884 -
\??\c:\3lffxxr.exec:\3lffxxr.exe42⤵
- Executes dropped EXE
PID:1068 -
\??\c:\bbnhbb.exec:\bbnhbb.exe43⤵
- Executes dropped EXE
PID:4616 -
\??\c:\vppjd.exec:\vppjd.exe44⤵
- Executes dropped EXE
PID:1888 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe45⤵
- Executes dropped EXE
PID:4444 -
\??\c:\5xfrfxx.exec:\5xfrfxx.exe46⤵
- Executes dropped EXE
PID:2880 -
\??\c:\5hhnnh.exec:\5hhnnh.exe47⤵
- Executes dropped EXE
PID:3596 -
\??\c:\3jdvj.exec:\3jdvj.exe48⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vvvvv.exec:\vvvvv.exe49⤵
- Executes dropped EXE
PID:772 -
\??\c:\xxfxxff.exec:\xxfxxff.exe50⤵
- Executes dropped EXE
PID:2004 -
\??\c:\7nnhhn.exec:\7nnhhn.exe51⤵
- Executes dropped EXE
PID:4524 -
\??\c:\djpvp.exec:\djpvp.exe52⤵
- Executes dropped EXE
PID:3232 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe53⤵
- Executes dropped EXE
PID:2744 -
\??\c:\frxxxxx.exec:\frxxxxx.exe54⤵
- Executes dropped EXE
PID:1972 -
\??\c:\nhttbt.exec:\nhttbt.exe55⤵
- Executes dropped EXE
PID:232 -
\??\c:\htbthb.exec:\htbthb.exe56⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jpjjd.exec:\jpjjd.exe57⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rrxrlrr.exec:\rrxrlrr.exe58⤵
- Executes dropped EXE
PID:1264 -
\??\c:\xxrlrrf.exec:\xxrlrrf.exe59⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7nnntt.exec:\7nnntt.exe60⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hhhhbt.exec:\hhhhbt.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\9vppj.exec:\9vppj.exe62⤵
- Executes dropped EXE
PID:3108 -
\??\c:\lxffxfx.exec:\lxffxfx.exe63⤵
- Executes dropped EXE
PID:4132 -
\??\c:\lrxxrff.exec:\lrxxrff.exe64⤵
- Executes dropped EXE
PID:1536 -
\??\c:\tthbtn.exec:\tthbtn.exe65⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jvvpj.exec:\jvvpj.exe66⤵PID:4232
-
\??\c:\rlrlrlr.exec:\rlrlrlr.exe67⤵PID:5036
-
\??\c:\ntbbth.exec:\ntbbth.exe68⤵PID:3276
-
\??\c:\jvdvj.exec:\jvdvj.exe69⤵PID:4424
-
\??\c:\jjppp.exec:\jjppp.exe70⤵PID:1600
-
\??\c:\1fxrlff.exec:\1fxrlff.exe71⤵PID:2288
-
\??\c:\jdjjd.exec:\jdjjd.exe72⤵PID:2684
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe73⤵PID:3464
-
\??\c:\hbbtbb.exec:\hbbtbb.exe74⤵PID:2428
-
\??\c:\bntnhn.exec:\bntnhn.exe75⤵PID:1520
-
\??\c:\jpppd.exec:\jpppd.exe76⤵PID:4772
-
\??\c:\dpvvp.exec:\dpvvp.exe77⤵PID:4244
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe78⤵PID:3948
-
\??\c:\nnnhtn.exec:\nnnhtn.exe79⤵PID:1488
-
\??\c:\bbtnhb.exec:\bbtnhb.exe80⤵PID:1728
-
\??\c:\9vdvp.exec:\9vdvp.exe81⤵PID:4908
-
\??\c:\1llfxll.exec:\1llfxll.exe82⤵PID:2480
-
\??\c:\7bbnhh.exec:\7bbnhh.exe83⤵PID:1040
-
\??\c:\httnbb.exec:\httnbb.exe84⤵PID:3080
-
\??\c:\vvdpd.exec:\vvdpd.exe85⤵PID:2668
-
\??\c:\fxxxxrr.exec:\fxxxxrr.exe86⤵PID:1388
-
\??\c:\llrlrlr.exec:\llrlrlr.exe87⤵PID:1884
-
\??\c:\nbbbbb.exec:\nbbbbb.exe88⤵PID:3064
-
\??\c:\tttnhh.exec:\tttnhh.exe89⤵PID:4452
-
\??\c:\dvjjj.exec:\dvjjj.exe90⤵PID:3796
-
\??\c:\9rrllxx.exec:\9rrllxx.exe91⤵PID:3824
-
\??\c:\hhtnnh.exec:\hhtnnh.exe92⤵PID:4964
-
\??\c:\htbbtn.exec:\htbbtn.exe93⤵PID:4288
-
\??\c:\ppdvj.exec:\ppdvj.exe94⤵PID:3848
-
\??\c:\rrrllxx.exec:\rrrllxx.exe95⤵PID:4292
-
\??\c:\nhhhnb.exec:\nhhhnb.exe96⤵PID:548
-
\??\c:\ddpdp.exec:\ddpdp.exe97⤵PID:4532
-
\??\c:\frllxlr.exec:\frllxlr.exe98⤵PID:3820
-
\??\c:\nnttbb.exec:\nnttbb.exe99⤵PID:648
-
\??\c:\3tttnb.exec:\3tttnb.exe100⤵PID:3456
-
\??\c:\9pppv.exec:\9pppv.exe101⤵PID:3504
-
\??\c:\3xrfxrl.exec:\3xrfxrl.exe102⤵PID:2848
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe103⤵PID:3944
-
\??\c:\nbbbbn.exec:\nbbbbn.exe104⤵PID:4156
-
\??\c:\pjjdv.exec:\pjjdv.exe105⤵PID:4932
-
\??\c:\jjpjv.exec:\jjpjv.exe106⤵PID:2364
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe107⤵PID:3888
-
\??\c:\lfrfrfr.exec:\lfrfrfr.exe108⤵PID:3488
-
\??\c:\htbttt.exec:\htbttt.exe109⤵PID:1108
-
\??\c:\jddpd.exec:\jddpd.exe110⤵PID:4588
-
\??\c:\jddvj.exec:\jddvj.exe111⤵PID:4724
-
\??\c:\5lfxrlx.exec:\5lfxrlx.exe112⤵PID:4464
-
\??\c:\xrlxfxx.exec:\xrlxfxx.exe113⤵PID:2776
-
\??\c:\nbbnhh.exec:\nbbnhh.exe114⤵PID:1416
-
\??\c:\pppdp.exec:\pppdp.exe115⤵PID:4172
-
\??\c:\ppdvj.exec:\ppdvj.exe116⤵PID:2416
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe117⤵PID:1968
-
\??\c:\thhnnb.exec:\thhnnb.exe118⤵PID:4348
-
\??\c:\vjvpd.exec:\vjvpd.exe119⤵PID:4132
-
\??\c:\jdjjv.exec:\jdjjv.exe120⤵PID:1536
-
\??\c:\frxlflf.exec:\frxlflf.exe121⤵PID:4340
-
\??\c:\xlxfxll.exec:\xlxfxll.exe122⤵PID:4824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-