Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 21:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
585a998d119dd1130129cca5be7993b0N.exe
Resource
win7-20240705-en
6 signatures
120 seconds
General
-
Target
585a998d119dd1130129cca5be7993b0N.exe
-
Size
73KB
-
MD5
585a998d119dd1130129cca5be7993b0
-
SHA1
fccfd93f0f70d78f8306a0012091860d247350a8
-
SHA256
c724adf1366e2ca6ad9212f7273a8755472d5df5a9e43d302dd31eaccaa7cbfa
-
SHA512
46d86e90e147822d1760e5395e9bd1307e42611a36298dd910f1033094851556724fee2197c7819449bb6b9feee5186f6e8cbcf64cfec1fec4b4ff763b65dae1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbYsRgVK3G/w:ymb3NkkiQ3mdBjF0yjcsMsRH/
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2940-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/472-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/644-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5076 vvdvv.exe 2372 xlrfxrr.exe 1920 1hbtbt.exe 4024 vvvpp.exe 2700 flfrffr.exe 388 nttnth.exe 1916 pdjjj.exe 1156 flllrfr.exe 452 hbhhbh.exe 4340 dppjj.exe 2064 xlfrlxr.exe 4700 9tbttt.exe 3956 pvdvd.exe 5012 rffxxrr.exe 2904 1xfxxrl.exe 472 nnntth.exe 2548 vvpjd.exe 4252 rxxxxxf.exe 5068 lflllrl.exe 1720 pddvp.exe 3920 lrrlxxr.exe 4780 ttttnh.exe 3488 dvpdj.exe 1760 djpjp.exe 3456 lfxrrlf.exe 3732 bbbnhb.exe 1460 jjjdv.exe 3428 nbtnhb.exe 1204 djvjp.exe 440 frrxrlx.exe 644 xxxrffr.exe 1736 jjvdp.exe 3664 pjpvd.exe 2824 xxxlxxl.exe 2940 hbnnnb.exe 2372 hbnhhh.exe 2000 pjvjd.exe 1568 frrflfx.exe 1176 nnnnnb.exe 3696 tbbbnh.exe 648 pjdvj.exe 1744 lrrfxrl.exe 2980 llffxrl.exe 728 bbtnhh.exe 1620 jpddp.exe 880 pvpdv.exe 4028 rlrrrrr.exe 628 htttbb.exe 5004 jddvp.exe 3148 jjdjp.exe 4240 1fxrflf.exe 4244 htbnht.exe 5092 hhthth.exe 2328 rxlfxll.exe 1948 xffrlxx.exe 1940 hnhbhh.exe 784 hbbnbb.exe 3172 dvpvd.exe 2200 7lxrlrl.exe 820 rxlxrxl.exe 1252 htbhht.exe 1432 rflrllx.exe 1584 tbhttn.exe 3352 vdvpj.exe -
resource yara_rule behavioral2/memory/2940-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/472-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/644-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rrfrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 5076 2940 585a998d119dd1130129cca5be7993b0N.exe 84 PID 2940 wrote to memory of 5076 2940 585a998d119dd1130129cca5be7993b0N.exe 84 PID 2940 wrote to memory of 5076 2940 585a998d119dd1130129cca5be7993b0N.exe 84 PID 5076 wrote to memory of 2372 5076 vvdvv.exe 85 PID 5076 wrote to memory of 2372 5076 vvdvv.exe 85 PID 5076 wrote to memory of 2372 5076 vvdvv.exe 85 PID 2372 wrote to memory of 1920 2372 xlrfxrr.exe 86 PID 2372 wrote to memory of 1920 2372 xlrfxrr.exe 86 PID 2372 wrote to memory of 1920 2372 xlrfxrr.exe 86 PID 1920 wrote to memory of 4024 1920 1hbtbt.exe 87 PID 1920 wrote to memory of 4024 1920 1hbtbt.exe 87 PID 1920 wrote to memory of 4024 1920 1hbtbt.exe 87 PID 4024 wrote to memory of 2700 4024 vvvpp.exe 88 PID 4024 wrote to memory of 2700 4024 vvvpp.exe 88 PID 4024 wrote to memory of 2700 4024 vvvpp.exe 88 PID 2700 wrote to memory of 388 2700 flfrffr.exe 89 PID 2700 wrote to memory of 388 2700 flfrffr.exe 89 PID 2700 wrote to memory of 388 2700 flfrffr.exe 89 PID 388 wrote to memory of 1916 388 nttnth.exe 90 PID 388 wrote to memory of 1916 388 nttnth.exe 90 PID 388 wrote to memory of 1916 388 nttnth.exe 90 PID 1916 wrote to memory of 1156 1916 pdjjj.exe 91 PID 1916 wrote to memory of 1156 1916 pdjjj.exe 91 PID 1916 wrote to memory of 1156 1916 pdjjj.exe 91 PID 1156 wrote to memory of 452 1156 flllrfr.exe 92 PID 1156 wrote to memory of 452 1156 flllrfr.exe 92 PID 1156 wrote to memory of 452 1156 flllrfr.exe 92 PID 452 wrote to memory of 4340 452 hbhhbh.exe 93 PID 452 wrote to memory of 4340 452 hbhhbh.exe 93 PID 452 wrote to memory of 4340 452 hbhhbh.exe 93 PID 4340 wrote to memory of 2064 4340 dppjj.exe 94 PID 4340 wrote to memory of 2064 4340 dppjj.exe 94 PID 4340 wrote to memory of 2064 4340 dppjj.exe 94 PID 2064 wrote to memory of 4700 2064 xlfrlxr.exe 95 PID 2064 wrote to memory of 4700 2064 xlfrlxr.exe 95 PID 2064 wrote to memory of 4700 2064 xlfrlxr.exe 95 PID 4700 wrote to memory of 3956 4700 9tbttt.exe 96 PID 4700 wrote to memory of 3956 4700 9tbttt.exe 96 PID 4700 wrote to memory of 3956 4700 9tbttt.exe 96 PID 3956 wrote to memory of 5012 3956 pvdvd.exe 97 PID 3956 wrote to memory of 5012 3956 pvdvd.exe 97 PID 3956 wrote to memory of 5012 3956 pvdvd.exe 97 PID 5012 wrote to memory of 2904 5012 rffxxrr.exe 98 PID 5012 wrote to memory of 2904 5012 rffxxrr.exe 98 PID 5012 wrote to memory of 2904 5012 rffxxrr.exe 98 PID 2904 wrote to memory of 472 2904 1xfxxrl.exe 99 PID 2904 wrote to memory of 472 2904 1xfxxrl.exe 99 PID 2904 wrote to memory of 472 2904 1xfxxrl.exe 99 PID 472 wrote to memory of 2548 472 nnntth.exe 100 PID 472 wrote to memory of 2548 472 nnntth.exe 100 PID 472 wrote to memory of 2548 472 nnntth.exe 100 PID 2548 wrote to memory of 4252 2548 vvpjd.exe 101 PID 2548 wrote to memory of 4252 2548 vvpjd.exe 101 PID 2548 wrote to memory of 4252 2548 vvpjd.exe 101 PID 4252 wrote to memory of 5068 4252 rxxxxxf.exe 102 PID 4252 wrote to memory of 5068 4252 rxxxxxf.exe 102 PID 4252 wrote to memory of 5068 4252 rxxxxxf.exe 102 PID 5068 wrote to memory of 1720 5068 lflllrl.exe 103 PID 5068 wrote to memory of 1720 5068 lflllrl.exe 103 PID 5068 wrote to memory of 1720 5068 lflllrl.exe 103 PID 1720 wrote to memory of 3920 1720 pddvp.exe 104 PID 1720 wrote to memory of 3920 1720 pddvp.exe 104 PID 1720 wrote to memory of 3920 1720 pddvp.exe 104 PID 3920 wrote to memory of 4780 3920 lrrlxxr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\585a998d119dd1130129cca5be7993b0N.exe"C:\Users\Admin\AppData\Local\Temp\585a998d119dd1130129cca5be7993b0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\vvdvv.exec:\vvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\xlrfxrr.exec:\xlrfxrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\1hbtbt.exec:\1hbtbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vvvpp.exec:\vvvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\flfrffr.exec:\flfrffr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\nttnth.exec:\nttnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\pdjjj.exec:\pdjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\flllrfr.exec:\flllrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\hbhhbh.exec:\hbhhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\dppjj.exec:\dppjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\xlfrlxr.exec:\xlfrlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\9tbttt.exec:\9tbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\pvdvd.exec:\pvdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\rffxxrr.exec:\rffxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\1xfxxrl.exec:\1xfxxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nnntth.exec:\nnntth.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\vvpjd.exec:\vvpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\rxxxxxf.exec:\rxxxxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\lflllrl.exec:\lflllrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\pddvp.exec:\pddvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\lrrlxxr.exec:\lrrlxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\ttttnh.exec:\ttttnh.exe23⤵
- Executes dropped EXE
PID:4780 -
\??\c:\dvpdj.exec:\dvpdj.exe24⤵
- Executes dropped EXE
PID:3488 -
\??\c:\djpjp.exec:\djpjp.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe26⤵
- Executes dropped EXE
PID:3456 -
\??\c:\bbbnhb.exec:\bbbnhb.exe27⤵
- Executes dropped EXE
PID:3732 -
\??\c:\jjjdv.exec:\jjjdv.exe28⤵
- Executes dropped EXE
PID:1460 -
\??\c:\nbtnhb.exec:\nbtnhb.exe29⤵
- Executes dropped EXE
PID:3428 -
\??\c:\djvjp.exec:\djvjp.exe30⤵
- Executes dropped EXE
PID:1204 -
\??\c:\frrxrlx.exec:\frrxrlx.exe31⤵
- Executes dropped EXE
PID:440 -
\??\c:\xxxrffr.exec:\xxxrffr.exe32⤵
- Executes dropped EXE
PID:644 -
\??\c:\jjvdp.exec:\jjvdp.exe33⤵
- Executes dropped EXE
PID:1736 -
\??\c:\pjpvd.exec:\pjpvd.exe34⤵
- Executes dropped EXE
PID:3664 -
\??\c:\xxxlxxl.exec:\xxxlxxl.exe35⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hbnnnb.exec:\hbnnnb.exe36⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hbnhhh.exec:\hbnhhh.exe37⤵
- Executes dropped EXE
PID:2372 -
\??\c:\pjvjd.exec:\pjvjd.exe38⤵
- Executes dropped EXE
PID:2000 -
\??\c:\frrflfx.exec:\frrflfx.exe39⤵
- Executes dropped EXE
PID:1568 -
\??\c:\nnnnnb.exec:\nnnnnb.exe40⤵
- Executes dropped EXE
PID:1176 -
\??\c:\tbbbnh.exec:\tbbbnh.exe41⤵
- Executes dropped EXE
PID:3696 -
\??\c:\pjdvj.exec:\pjdvj.exe42⤵
- Executes dropped EXE
PID:648 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe43⤵
- Executes dropped EXE
PID:1744 -
\??\c:\llffxrl.exec:\llffxrl.exe44⤵
- Executes dropped EXE
PID:2980 -
\??\c:\bbtnhh.exec:\bbtnhh.exe45⤵
- Executes dropped EXE
PID:728 -
\??\c:\jpddp.exec:\jpddp.exe46⤵
- Executes dropped EXE
PID:1620 -
\??\c:\pvpdv.exec:\pvpdv.exe47⤵
- Executes dropped EXE
PID:880 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe48⤵
- Executes dropped EXE
PID:4028 -
\??\c:\htttbb.exec:\htttbb.exe49⤵
- Executes dropped EXE
PID:628 -
\??\c:\jddvp.exec:\jddvp.exe50⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jjdjp.exec:\jjdjp.exe51⤵
- Executes dropped EXE
PID:3148 -
\??\c:\1fxrflf.exec:\1fxrflf.exe52⤵
- Executes dropped EXE
PID:4240 -
\??\c:\htbnht.exec:\htbnht.exe53⤵
- Executes dropped EXE
PID:4244 -
\??\c:\hhthth.exec:\hhthth.exe54⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rxlfxll.exec:\rxlfxll.exe55⤵
- Executes dropped EXE
PID:2328 -
\??\c:\xffrlxx.exec:\xffrlxx.exe56⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hnhbhh.exec:\hnhbhh.exe57⤵
- Executes dropped EXE
PID:1940 -
\??\c:\hbbnbb.exec:\hbbnbb.exe58⤵
- Executes dropped EXE
PID:784 -
\??\c:\dvpvd.exec:\dvpvd.exe59⤵
- Executes dropped EXE
PID:3172 -
\??\c:\7lxrlrl.exec:\7lxrlrl.exe60⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rxlxrxl.exec:\rxlxrxl.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\htbhht.exec:\htbhht.exe62⤵
- Executes dropped EXE
PID:1252 -
\??\c:\rflrllx.exec:\rflrllx.exe63⤵
- Executes dropped EXE
PID:1432 -
\??\c:\tbhttn.exec:\tbhttn.exe64⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vdvpj.exec:\vdvpj.exe65⤵
- Executes dropped EXE
PID:3352 -
\??\c:\lxrxfxr.exec:\lxrxfxr.exe66⤵PID:4524
-
\??\c:\frlffxr.exec:\frlffxr.exe67⤵PID:4444
-
\??\c:\hnntth.exec:\hnntth.exe68⤵PID:4920
-
\??\c:\vddvp.exec:\vddvp.exe69⤵PID:3096
-
\??\c:\jjjpp.exec:\jjjpp.exe70⤵PID:3428
-
\??\c:\flxlfxr.exec:\flxlfxr.exe71⤵PID:5032
-
\??\c:\rxfffrr.exec:\rxfffrr.exe72⤵PID:3896
-
\??\c:\tnbhhh.exec:\tnbhhh.exe73⤵PID:4424
-
\??\c:\djddd.exec:\djddd.exe74⤵PID:4964
-
\??\c:\xrlxxll.exec:\xrlxxll.exe75⤵PID:4988
-
\??\c:\xxrxlrr.exec:\xxrxlrr.exe76⤵PID:3196
-
\??\c:\bbtbtn.exec:\bbtbtn.exe77⤵PID:4000
-
\??\c:\9ppdp.exec:\9ppdp.exe78⤵PID:2148
-
\??\c:\rrlfxfr.exec:\rrlfxfr.exe79⤵PID:1740
-
\??\c:\rrlfrlr.exec:\rrlfrlr.exe80⤵PID:3492
-
\??\c:\hntbnn.exec:\hntbnn.exe81⤵PID:4024
-
\??\c:\dvpvv.exec:\dvpvv.exe82⤵PID:3444
-
\??\c:\xxlrxfl.exec:\xxlrxfl.exe83⤵PID:4276
-
\??\c:\nhhthb.exec:\nhhthb.exe84⤵PID:4020
-
\??\c:\hnntbt.exec:\hnntbt.exe85⤵PID:3372
-
\??\c:\vpppv.exec:\vpppv.exe86⤵PID:1364
-
\??\c:\vjjvj.exec:\vjjvj.exe87⤵PID:4364
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe88⤵PID:2936
-
\??\c:\tthnbh.exec:\tthnbh.exe89⤵PID:1424
-
\??\c:\bttnbb.exec:\bttnbb.exe90⤵PID:452
-
\??\c:\dvpdp.exec:\dvpdp.exe91⤵PID:3692
-
\??\c:\flrrlfx.exec:\flrrlfx.exe92⤵PID:1268
-
\??\c:\xfxlflx.exec:\xfxlflx.exe93⤵PID:4332
-
\??\c:\thbhth.exec:\thbhth.exe94⤵PID:4784
-
\??\c:\jdpdd.exec:\jdpdd.exe95⤵PID:4244
-
\??\c:\jvvpj.exec:\jvvpj.exe96⤵PID:1936
-
\??\c:\xlrlxxl.exec:\xlrlxxl.exe97⤵PID:3108
-
\??\c:\htthnh.exec:\htthnh.exe98⤵PID:4456
-
\??\c:\hthnnt.exec:\hthnnt.exe99⤵PID:1668
-
\??\c:\jvvpv.exec:\jvvpv.exe100⤵PID:3620
-
\??\c:\xffxxxr.exec:\xffxxxr.exe101⤵PID:5000
-
\??\c:\rxllxff.exec:\rxllxff.exe102⤵PID:2200
-
\??\c:\7ttnnn.exec:\7ttnnn.exe103⤵PID:984
-
\??\c:\tbthbb.exec:\tbthbb.exe104⤵PID:1304
-
\??\c:\llfrxrl.exec:\llfrxrl.exe105⤵PID:316
-
\??\c:\ttnhtt.exec:\ttnhtt.exe106⤵PID:3180
-
\??\c:\jjvpp.exec:\jjvpp.exe107⤵PID:3368
-
\??\c:\vjpdv.exec:\vjpdv.exe108⤵PID:3176
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe109⤵PID:788
-
\??\c:\rfxrlff.exec:\rfxrlff.exe110⤵PID:2100
-
\??\c:\ththnh.exec:\ththnh.exe111⤵PID:548
-
\??\c:\nttntn.exec:\nttntn.exe112⤵PID:3992
-
\??\c:\vpvjd.exec:\vpvjd.exe113⤵PID:3008
-
\??\c:\fllrrrr.exec:\fllrrrr.exe114⤵PID:440
-
\??\c:\ttbnbt.exec:\ttbnbt.exe115⤵PID:4424
-
\??\c:\jvvvp.exec:\jvvvp.exe116⤵
- System Location Discovery: System Language Discovery
PID:232 -
\??\c:\dpjdv.exec:\dpjdv.exe117⤵PID:4388
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe118⤵PID:1144
-
\??\c:\hhttnn.exec:\hhttnn.exe119⤵PID:4704
-
\??\c:\hhnbnn.exec:\hhnbnn.exe120⤵PID:3872
-
\??\c:\djjvd.exec:\djjvd.exe121⤵PID:3720
-
\??\c:\lfrllfx.exec:\lfrllfx.exe122⤵PID:4196
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-