Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 00:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe
-
Size
911KB
-
MD5
a7c13c67f5de73babde428bc0e05dbf4
-
SHA1
3d8a9529529ec44fc8ab1efa76f28423f6353f8a
-
SHA256
6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071
-
SHA512
6e1a7836076bc960a0d1d204f0cf3e03658ca19aecf1d93ea22601edd7b4f097c869e12dbe42992544c341bf5d9208b87e30dceb4fa2625a97068392da23948c
-
SSDEEP
24576:OY+UB5TsjZ03clghyKm1QgRHYKPUQ4U3yzZy5gFxopB:OUbAjZ035mMOyDFxon
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2440-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4012-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1948-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4312-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3392-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2636-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2152-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4016-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2504-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-618-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-732-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-997-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-1045-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 208 vvdvv.exe 2996 bhtnbn.exe 3080 vpppp.exe 4332 3xxxxff.exe 4012 bbbntn.exe 4644 nhntnt.exe 628 xlrrlff.exe 1604 dddvp.exe 4776 vdpjd.exe 2864 9ffxxxx.exe 5028 tbbbbb.exe 2756 bbntnt.exe 4360 nnnntb.exe 2928 9jvvp.exe 2800 xxfxflr.exe 4484 bnbbbb.exe 3144 jvvpd.exe 1636 fxrrrrr.exe 4560 3rffxxr.exe 5032 nnhhht.exe 1948 rfffxll.exe 2720 7rlffrr.exe 4312 vvddv.exe 4136 ffrxrrx.exe 5016 jvppp.exe 3040 pvvpd.exe 1676 fxfrrrr.exe 3392 nnbnhh.exe 2712 xrrlflf.exe 3676 hbbbtb.exe 1028 9thbth.exe 4596 vdjdv.exe 1664 vdvvv.exe 1120 7rrlllf.exe 3624 hhnbbb.exe 3816 dvvdj.exe 436 llffllr.exe 64 jddvv.exe 1036 lrrrlrr.exe 4432 tnnnnn.exe 392 ddvpp.exe 4000 1fxrxfl.exe 2900 hbbbtt.exe 4416 dppvd.exe 2992 frlfxrr.exe 3316 ppvvd.exe 2020 rlxxxxr.exe 3892 5hthhn.exe 2636 pjjjd.exe 4580 llffxxr.exe 4644 nhhbtt.exe 1052 jvdvj.exe 216 flrrffr.exe 4900 jvjjv.exe 3060 ddddj.exe 4248 hhtttt.exe 3960 vjpjp.exe 1884 rrxxfff.exe 3132 htbtnh.exe 3200 vdjpv.exe 1892 hhbnhh.exe 4784 vjdjj.exe 3588 frflrll.exe 3916 jvvvp.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xfxxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xlrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxflfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2440 wrote to memory of 208 2440 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 83 PID 2440 wrote to memory of 208 2440 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 83 PID 2440 wrote to memory of 208 2440 6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe 83 PID 208 wrote to memory of 2996 208 vvdvv.exe 84 PID 208 wrote to memory of 2996 208 vvdvv.exe 84 PID 208 wrote to memory of 2996 208 vvdvv.exe 84 PID 2996 wrote to memory of 3080 2996 bhtnbn.exe 85 PID 2996 wrote to memory of 3080 2996 bhtnbn.exe 85 PID 2996 wrote to memory of 3080 2996 bhtnbn.exe 85 PID 3080 wrote to memory of 4332 3080 vpppp.exe 86 PID 3080 wrote to memory of 4332 3080 vpppp.exe 86 PID 3080 wrote to memory of 4332 3080 vpppp.exe 86 PID 4332 wrote to memory of 4012 4332 3xxxxff.exe 87 PID 4332 wrote to memory of 4012 4332 3xxxxff.exe 87 PID 4332 wrote to memory of 4012 4332 3xxxxff.exe 87 PID 4012 wrote to memory of 4644 4012 bbbntn.exe 88 PID 4012 wrote to memory of 4644 4012 bbbntn.exe 88 PID 4012 wrote to memory of 4644 4012 bbbntn.exe 88 PID 4644 wrote to memory of 628 4644 nhntnt.exe 89 PID 4644 wrote to memory of 628 4644 nhntnt.exe 89 PID 4644 wrote to memory of 628 4644 nhntnt.exe 89 PID 628 wrote to memory of 1604 628 xlrrlff.exe 90 PID 628 wrote to memory of 1604 628 xlrrlff.exe 90 PID 628 wrote to memory of 1604 628 xlrrlff.exe 90 PID 1604 wrote to memory of 4776 1604 dddvp.exe 91 PID 1604 wrote to memory of 4776 1604 dddvp.exe 91 PID 1604 wrote to memory of 4776 1604 dddvp.exe 91 PID 4776 wrote to memory of 2864 4776 vdpjd.exe 92 PID 4776 wrote to memory of 2864 4776 vdpjd.exe 92 PID 4776 wrote to memory of 2864 4776 vdpjd.exe 92 PID 2864 wrote to memory of 5028 2864 9ffxxxx.exe 93 PID 2864 wrote to memory of 5028 2864 9ffxxxx.exe 93 PID 2864 wrote to memory of 5028 2864 9ffxxxx.exe 93 PID 5028 wrote to memory of 2756 5028 tbbbbb.exe 94 PID 5028 wrote to memory of 2756 5028 tbbbbb.exe 94 PID 5028 wrote to memory of 2756 5028 tbbbbb.exe 94 PID 2756 wrote to memory of 4360 2756 bbntnt.exe 95 PID 2756 wrote to memory of 4360 2756 bbntnt.exe 95 PID 2756 wrote to memory of 4360 2756 bbntnt.exe 95 PID 4360 wrote to memory of 2928 4360 nnnntb.exe 96 PID 4360 wrote to memory of 2928 4360 nnnntb.exe 96 PID 4360 wrote to memory of 2928 4360 nnnntb.exe 96 PID 2928 wrote to memory of 2800 2928 9jvvp.exe 97 PID 2928 wrote to memory of 2800 2928 9jvvp.exe 97 PID 2928 wrote to memory of 2800 2928 9jvvp.exe 97 PID 2800 wrote to memory of 4484 2800 xxfxflr.exe 98 PID 2800 wrote to memory of 4484 2800 xxfxflr.exe 98 PID 2800 wrote to memory of 4484 2800 xxfxflr.exe 98 PID 4484 wrote to memory of 3144 4484 bnbbbb.exe 99 PID 4484 wrote to memory of 3144 4484 bnbbbb.exe 99 PID 4484 wrote to memory of 3144 4484 bnbbbb.exe 99 PID 3144 wrote to memory of 1636 3144 jvvpd.exe 100 PID 3144 wrote to memory of 1636 3144 jvvpd.exe 100 PID 3144 wrote to memory of 1636 3144 jvvpd.exe 100 PID 1636 wrote to memory of 4560 1636 fxrrrrr.exe 101 PID 1636 wrote to memory of 4560 1636 fxrrrrr.exe 101 PID 1636 wrote to memory of 4560 1636 fxrrrrr.exe 101 PID 4560 wrote to memory of 5032 4560 3rffxxr.exe 102 PID 4560 wrote to memory of 5032 4560 3rffxxr.exe 102 PID 4560 wrote to memory of 5032 4560 3rffxxr.exe 102 PID 5032 wrote to memory of 1948 5032 nnhhht.exe 103 PID 5032 wrote to memory of 1948 5032 nnhhht.exe 103 PID 5032 wrote to memory of 1948 5032 nnhhht.exe 103 PID 1948 wrote to memory of 2720 1948 rfffxll.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe"C:\Users\Admin\AppData\Local\Temp\6cb5817145e539d8e22d632c146932537bb6f10faaa84ac6f742a64a72af1071.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\vvdvv.exec:\vvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\bhtnbn.exec:\bhtnbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\vpppp.exec:\vpppp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\3xxxxff.exec:\3xxxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\bbbntn.exec:\bbbntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\nhntnt.exec:\nhntnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\xlrrlff.exec:\xlrrlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\dddvp.exec:\dddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\vdpjd.exec:\vdpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\9ffxxxx.exec:\9ffxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\tbbbbb.exec:\tbbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\bbntnt.exec:\bbntnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nnnntb.exec:\nnnntb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\9jvvp.exec:\9jvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xxfxflr.exec:\xxfxflr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bnbbbb.exec:\bnbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\jvvpd.exec:\jvvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3rffxxr.exec:\3rffxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\nnhhht.exec:\nnhhht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\rfffxll.exec:\rfffxll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\7rlffrr.exec:\7rlffrr.exe23⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vvddv.exec:\vvddv.exe24⤵
- Executes dropped EXE
PID:4312 -
\??\c:\ffrxrrx.exec:\ffrxrrx.exe25⤵
- Executes dropped EXE
PID:4136 -
\??\c:\jvppp.exec:\jvppp.exe26⤵
- Executes dropped EXE
PID:5016 -
\??\c:\pvvpd.exec:\pvvpd.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\fxfrrrr.exec:\fxfrrrr.exe28⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nnbnhh.exec:\nnbnhh.exe29⤵
- Executes dropped EXE
PID:3392 -
\??\c:\xrrlflf.exec:\xrrlflf.exe30⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hbbbtb.exec:\hbbbtb.exe31⤵
- Executes dropped EXE
PID:3676 -
\??\c:\9thbth.exec:\9thbth.exe32⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vdjdv.exec:\vdjdv.exe33⤵
- Executes dropped EXE
PID:4596 -
\??\c:\vdvvv.exec:\vdvvv.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7rrlllf.exec:\7rrlllf.exe35⤵
- Executes dropped EXE
PID:1120 -
\??\c:\hhnbbb.exec:\hhnbbb.exe36⤵
- Executes dropped EXE
PID:3624 -
\??\c:\dvvdj.exec:\dvvdj.exe37⤵
- Executes dropped EXE
PID:3816 -
\??\c:\llffllr.exec:\llffllr.exe38⤵
- Executes dropped EXE
PID:436 -
\??\c:\jddvv.exec:\jddvv.exe39⤵
- Executes dropped EXE
PID:64 -
\??\c:\lrrrlrr.exec:\lrrrlrr.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\tnnnnn.exec:\tnnnnn.exe41⤵
- Executes dropped EXE
PID:4432 -
\??\c:\ddvpp.exec:\ddvpp.exe42⤵
- Executes dropped EXE
PID:392 -
\??\c:\1fxrxfl.exec:\1fxrxfl.exe43⤵
- Executes dropped EXE
PID:4000 -
\??\c:\hbbbtt.exec:\hbbbtt.exe44⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dppvd.exec:\dppvd.exe45⤵
- Executes dropped EXE
PID:4416 -
\??\c:\frlfxrr.exec:\frlfxrr.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2992 -
\??\c:\ppvvd.exec:\ppvvd.exe47⤵
- Executes dropped EXE
PID:3316 -
\??\c:\rlxxxxr.exec:\rlxxxxr.exe48⤵
- Executes dropped EXE
PID:2020 -
\??\c:\5hthhn.exec:\5hthhn.exe49⤵
- Executes dropped EXE
PID:3892 -
\??\c:\pjjjd.exec:\pjjjd.exe50⤵
- Executes dropped EXE
PID:2636 -
\??\c:\llffxxr.exec:\llffxxr.exe51⤵
- Executes dropped EXE
PID:4580 -
\??\c:\nhhbtt.exec:\nhhbtt.exe52⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jvdvj.exec:\jvdvj.exe53⤵
- Executes dropped EXE
PID:1052 -
\??\c:\flrrffr.exec:\flrrffr.exe54⤵
- Executes dropped EXE
PID:216 -
\??\c:\jvjjv.exec:\jvjjv.exe55⤵
- Executes dropped EXE
PID:4900 -
\??\c:\ddddj.exec:\ddddj.exe56⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhtttt.exec:\hhtttt.exe57⤵
- Executes dropped EXE
PID:4248 -
\??\c:\vjpjp.exec:\vjpjp.exe58⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rrxxfff.exec:\rrxxfff.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1884 -
\??\c:\htbtnh.exec:\htbtnh.exe60⤵
- Executes dropped EXE
PID:3132 -
\??\c:\vdjpv.exec:\vdjpv.exe61⤵
- Executes dropped EXE
PID:3200 -
\??\c:\hhbnhh.exec:\hhbnhh.exe62⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vjdjj.exec:\vjdjj.exe63⤵
- Executes dropped EXE
PID:4784 -
\??\c:\frflrll.exec:\frflrll.exe64⤵
- Executes dropped EXE
PID:3588 -
\??\c:\jvvvp.exec:\jvvvp.exe65⤵
- Executes dropped EXE
PID:3916 -
\??\c:\rxffrxf.exec:\rxffrxf.exe66⤵PID:4016
-
\??\c:\9hhhhh.exec:\9hhhhh.exe67⤵PID:1156
-
\??\c:\djvjv.exec:\djvjv.exe68⤵PID:4936
-
\??\c:\frlffff.exec:\frlffff.exe69⤵PID:1632
-
\??\c:\tbbbbh.exec:\tbbbbh.exe70⤵PID:4052
-
\??\c:\dpppp.exec:\dpppp.exe71⤵PID:4300
-
\??\c:\rrxrllf.exec:\rrxrllf.exe72⤵PID:3660
-
\??\c:\hbbbtt.exec:\hbbbtt.exe73⤵PID:4820
-
\??\c:\7djdd.exec:\7djdd.exe74⤵PID:2152
-
\??\c:\bhhhtb.exec:\bhhhtb.exe75⤵PID:4560
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe76⤵PID:2244
-
\??\c:\bbbbtn.exec:\bbbbtn.exe77⤵PID:804
-
\??\c:\1ddvv.exec:\1ddvv.exe78⤵PID:2416
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe79⤵PID:4148
-
\??\c:\hntntt.exec:\hntntt.exe80⤵PID:4160
-
\??\c:\jjpdv.exec:\jjpdv.exe81⤵PID:2792
-
\??\c:\lxfllll.exec:\lxfllll.exe82⤵PID:3496
-
\??\c:\btbbbh.exec:\btbbbh.exe83⤵PID:936
-
\??\c:\djddj.exec:\djddj.exe84⤵PID:3788
-
\??\c:\frffxrx.exec:\frffxrx.exe85⤵PID:3500
-
\??\c:\tnnhtt.exec:\tnnhtt.exe86⤵PID:1872
-
\??\c:\3jjjv.exec:\3jjjv.exe87⤵PID:2404
-
\??\c:\nnnhbb.exec:\nnnhbb.exe88⤵PID:5040
-
\??\c:\pdddp.exec:\pdddp.exe89⤵PID:3592
-
\??\c:\3fflfll.exec:\3fflfll.exe90⤵PID:3972
-
\??\c:\bbtnhb.exec:\bbtnhb.exe91⤵PID:2932
-
\??\c:\7vdvp.exec:\7vdvp.exe92⤵PID:4860
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe93⤵PID:1492
-
\??\c:\ttnhnn.exec:\ttnhnn.exe94⤵PID:1476
-
\??\c:\7dvpj.exec:\7dvpj.exe95⤵PID:2828
-
\??\c:\xrrlffx.exec:\xrrlffx.exe96⤵PID:3564
-
\??\c:\nnbbtb.exec:\nnbbtb.exe97⤵PID:1184
-
\??\c:\djppp.exec:\djppp.exe98⤵PID:1868
-
\??\c:\1lllllx.exec:\1lllllx.exe99⤵PID:4568
-
\??\c:\5vppj.exec:\5vppj.exe100⤵PID:4196
-
\??\c:\xxlllrf.exec:\xxlllrf.exe101⤵PID:2920
-
\??\c:\bntthh.exec:\bntthh.exe102⤵PID:4480
-
\??\c:\jdddd.exec:\jdddd.exe103⤵PID:1576
-
\??\c:\lrffrxr.exec:\lrffrxr.exe104⤵PID:1928
-
\??\c:\ntnnnb.exec:\ntnnnb.exe105⤵PID:208
-
\??\c:\pvvvv.exec:\pvvvv.exe106⤵PID:5084
-
\??\c:\flrlfxf.exec:\flrlfxf.exe107⤵PID:2900
-
\??\c:\nttnnn.exec:\nttnnn.exe108⤵PID:4416
-
\??\c:\vdvdd.exec:\vdvdd.exe109⤵PID:4620
-
\??\c:\xflfxlf.exec:\xflfxlf.exe110⤵PID:2548
-
\??\c:\tthhtt.exec:\tthhtt.exe111⤵PID:3784
-
\??\c:\pjppp.exec:\pjppp.exe112⤵PID:2636
-
\??\c:\lxfflll.exec:\lxfflll.exe113⤵PID:1044
-
\??\c:\nnbbbb.exec:\nnbbbb.exe114⤵PID:852
-
\??\c:\ddjvp.exec:\ddjvp.exe115⤵PID:1880
-
\??\c:\xflfffx.exec:\xflfffx.exe116⤵PID:3872
-
\??\c:\hnnhhn.exec:\hnnhhn.exe117⤵PID:1884
-
\??\c:\ddjjj.exec:\ddjjj.exe118⤵PID:2928
-
\??\c:\ffxllrl.exec:\ffxllrl.exe119⤵PID:960
-
\??\c:\thtntt.exec:\thtntt.exe120⤵PID:2368
-
\??\c:\jpppd.exec:\jpppd.exe121⤵PID:3588
-
\??\c:\fflffff.exec:\fflffff.exe122⤵PID:1540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-