Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 23:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a2d9e4c5aec7b050a505295f7bffe10N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
1a2d9e4c5aec7b050a505295f7bffe10N.exe
-
Size
65KB
-
MD5
1a2d9e4c5aec7b050a505295f7bffe10
-
SHA1
cbc9869b86cbcacb3056382a1cb53ccda6c783c3
-
SHA256
2e2d4fe800919a2bfe1cfb7b6853a1fb1580467b3e0d05e900a7c18ec1fac99c
-
SHA512
a98a596a5699048593eb782318343352b9f2b4279e177039cf57c3dc4eca4f68aabda329fc8284f1a02a8534104d6c238d023e5e6824cb76c2bdeff5adb1950b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B5QL:ymb3NkkiQ3mdBjFI9c+L
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2820 bthbnn.exe 2328 nhhhbb.exe 4016 pvvpd.exe 1524 vpjdp.exe 3264 xfffxxr.exe 2920 3htttb.exe 4088 pjjpp.exe 3740 xxllrrx.exe 1748 hthbtn.exe 1072 9dppj.exe 2216 ppdvj.exe 4996 5lllfxx.exe 4716 nhbbbb.exe 4496 vjpjd.exe 2348 dpvvd.exe 4748 rllfxrl.exe 2476 httbtt.exe 4760 nbtnhh.exe 1056 5vvvp.exe 3384 lxxrfxx.exe 1220 xlrrrrl.exe 432 bttnhh.exe 2116 bhnhnh.exe 1120 jpvpj.exe 2208 lfffxfl.exe 364 xrrrlff.exe 3744 nhbnth.exe 4504 bhbbth.exe 3604 vvpjd.exe 3032 xrrlffx.exe 4008 1xffxlf.exe 2388 ttthbb.exe 2976 bhbttt.exe 4384 jvddv.exe 3464 dvpvp.exe 3708 fxrlxxr.exe 1760 llfxlfx.exe 2328 tnhbtn.exe 1248 hntnbb.exe 1440 9djvp.exe 2816 5jddp.exe 4660 pjjdj.exe 4148 flrfrrl.exe 1368 tbhhhn.exe 3740 7bthtn.exe 2716 pvdvj.exe 1272 ppdvp.exe 1748 lffxxxr.exe 4068 tntnhh.exe 1684 btnbtt.exe 4080 jddvp.exe 5060 jddvp.exe 3120 xxxrrrl.exe 2036 frrlffx.exe 2136 thbtnt.exe 2480 xrxlfff.exe 4764 9xxxrrl.exe 1484 jjpjd.exe 4760 jdvpj.exe 3560 rlrrlll.exe 224 fflffff.exe 5112 bbbtnh.exe 4840 bbtnhh.exe 872 pdjdv.exe -
resource yara_rule behavioral2/memory/332-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 332 wrote to memory of 2820 332 1a2d9e4c5aec7b050a505295f7bffe10N.exe 82 PID 332 wrote to memory of 2820 332 1a2d9e4c5aec7b050a505295f7bffe10N.exe 82 PID 332 wrote to memory of 2820 332 1a2d9e4c5aec7b050a505295f7bffe10N.exe 82 PID 2820 wrote to memory of 2328 2820 bthbnn.exe 83 PID 2820 wrote to memory of 2328 2820 bthbnn.exe 83 PID 2820 wrote to memory of 2328 2820 bthbnn.exe 83 PID 2328 wrote to memory of 4016 2328 nhhhbb.exe 84 PID 2328 wrote to memory of 4016 2328 nhhhbb.exe 84 PID 2328 wrote to memory of 4016 2328 nhhhbb.exe 84 PID 4016 wrote to memory of 1524 4016 pvvpd.exe 85 PID 4016 wrote to memory of 1524 4016 pvvpd.exe 85 PID 4016 wrote to memory of 1524 4016 pvvpd.exe 85 PID 1524 wrote to memory of 3264 1524 vpjdp.exe 86 PID 1524 wrote to memory of 3264 1524 vpjdp.exe 86 PID 1524 wrote to memory of 3264 1524 vpjdp.exe 86 PID 3264 wrote to memory of 2920 3264 xfffxxr.exe 87 PID 3264 wrote to memory of 2920 3264 xfffxxr.exe 87 PID 3264 wrote to memory of 2920 3264 xfffxxr.exe 87 PID 2920 wrote to memory of 4088 2920 3htttb.exe 89 PID 2920 wrote to memory of 4088 2920 3htttb.exe 89 PID 2920 wrote to memory of 4088 2920 3htttb.exe 89 PID 4088 wrote to memory of 3740 4088 pjjpp.exe 90 PID 4088 wrote to memory of 3740 4088 pjjpp.exe 90 PID 4088 wrote to memory of 3740 4088 pjjpp.exe 90 PID 3740 wrote to memory of 1748 3740 xxllrrx.exe 91 PID 3740 wrote to memory of 1748 3740 xxllrrx.exe 91 PID 3740 wrote to memory of 1748 3740 xxllrrx.exe 91 PID 1748 wrote to memory of 1072 1748 hthbtn.exe 92 PID 1748 wrote to memory of 1072 1748 hthbtn.exe 92 PID 1748 wrote to memory of 1072 1748 hthbtn.exe 92 PID 1072 wrote to memory of 2216 1072 9dppj.exe 93 PID 1072 wrote to memory of 2216 1072 9dppj.exe 93 PID 1072 wrote to memory of 2216 1072 9dppj.exe 93 PID 2216 wrote to memory of 4996 2216 ppdvj.exe 94 PID 2216 wrote to memory of 4996 2216 ppdvj.exe 94 PID 2216 wrote to memory of 4996 2216 ppdvj.exe 94 PID 4996 wrote to memory of 4716 4996 5lllfxx.exe 95 PID 4996 wrote to memory of 4716 4996 5lllfxx.exe 95 PID 4996 wrote to memory of 4716 4996 5lllfxx.exe 95 PID 4716 wrote to memory of 4496 4716 nhbbbb.exe 97 PID 4716 wrote to memory of 4496 4716 nhbbbb.exe 97 PID 4716 wrote to memory of 4496 4716 nhbbbb.exe 97 PID 4496 wrote to memory of 2348 4496 vjpjd.exe 98 PID 4496 wrote to memory of 2348 4496 vjpjd.exe 98 PID 4496 wrote to memory of 2348 4496 vjpjd.exe 98 PID 2348 wrote to memory of 4748 2348 dpvvd.exe 99 PID 2348 wrote to memory of 4748 2348 dpvvd.exe 99 PID 2348 wrote to memory of 4748 2348 dpvvd.exe 99 PID 4748 wrote to memory of 2476 4748 rllfxrl.exe 100 PID 4748 wrote to memory of 2476 4748 rllfxrl.exe 100 PID 4748 wrote to memory of 2476 4748 rllfxrl.exe 100 PID 2476 wrote to memory of 4760 2476 httbtt.exe 101 PID 2476 wrote to memory of 4760 2476 httbtt.exe 101 PID 2476 wrote to memory of 4760 2476 httbtt.exe 101 PID 4760 wrote to memory of 1056 4760 nbtnhh.exe 102 PID 4760 wrote to memory of 1056 4760 nbtnhh.exe 102 PID 4760 wrote to memory of 1056 4760 nbtnhh.exe 102 PID 1056 wrote to memory of 3384 1056 5vvvp.exe 103 PID 1056 wrote to memory of 3384 1056 5vvvp.exe 103 PID 1056 wrote to memory of 3384 1056 5vvvp.exe 103 PID 3384 wrote to memory of 1220 3384 lxxrfxx.exe 104 PID 3384 wrote to memory of 1220 3384 lxxrfxx.exe 104 PID 3384 wrote to memory of 1220 3384 lxxrfxx.exe 104 PID 1220 wrote to memory of 432 1220 xlrrrrl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a2d9e4c5aec7b050a505295f7bffe10N.exe"C:\Users\Admin\AppData\Local\Temp\1a2d9e4c5aec7b050a505295f7bffe10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:332 -
\??\c:\bthbnn.exec:\bthbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\nhhhbb.exec:\nhhhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\pvvpd.exec:\pvvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\vpjdp.exec:\vpjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\xfffxxr.exec:\xfffxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\3htttb.exec:\3htttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\pjjpp.exec:\pjjpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\xxllrrx.exec:\xxllrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\hthbtn.exec:\hthbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\9dppj.exec:\9dppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\ppdvj.exec:\ppdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\5lllfxx.exec:\5lllfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\nhbbbb.exec:\nhbbbb.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\vjpjd.exec:\vjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\dpvvd.exec:\dpvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rllfxrl.exec:\rllfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\httbtt.exec:\httbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\nbtnhh.exec:\nbtnhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\5vvvp.exec:\5vvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\lxxrfxx.exec:\lxxrfxx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\bttnhh.exec:\bttnhh.exe23⤵
- Executes dropped EXE
PID:432 -
\??\c:\bhnhnh.exec:\bhnhnh.exe24⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jpvpj.exec:\jpvpj.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\lfffxfl.exec:\lfffxfl.exe26⤵
- Executes dropped EXE
PID:2208 -
\??\c:\xrrrlff.exec:\xrrrlff.exe27⤵
- Executes dropped EXE
PID:364 -
\??\c:\nhbnth.exec:\nhbnth.exe28⤵
- Executes dropped EXE
PID:3744 -
\??\c:\bhbbth.exec:\bhbbth.exe29⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vvpjd.exec:\vvpjd.exe30⤵
- Executes dropped EXE
PID:3604 -
\??\c:\xrrlffx.exec:\xrrlffx.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\1xffxlf.exec:\1xffxlf.exe32⤵
- Executes dropped EXE
PID:4008 -
\??\c:\ttthbb.exec:\ttthbb.exe33⤵
- Executes dropped EXE
PID:2388 -
\??\c:\bhbttt.exec:\bhbttt.exe34⤵
- Executes dropped EXE
PID:2976 -
\??\c:\jvddv.exec:\jvddv.exe35⤵
- Executes dropped EXE
PID:4384 -
\??\c:\dvpvp.exec:\dvpvp.exe36⤵
- Executes dropped EXE
PID:3464 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe37⤵
- Executes dropped EXE
PID:3708 -
\??\c:\llfxlfx.exec:\llfxlfx.exe38⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnhbtn.exec:\tnhbtn.exe39⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hntnbb.exec:\hntnbb.exe40⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9djvp.exec:\9djvp.exe41⤵
- Executes dropped EXE
PID:1440 -
\??\c:\5jddp.exec:\5jddp.exe42⤵
- Executes dropped EXE
PID:2816 -
\??\c:\pjjdj.exec:\pjjdj.exe43⤵
- Executes dropped EXE
PID:4660 -
\??\c:\flrfrrl.exec:\flrfrrl.exe44⤵
- Executes dropped EXE
PID:4148 -
\??\c:\tbhhhn.exec:\tbhhhn.exe45⤵
- Executes dropped EXE
PID:1368 -
\??\c:\7bthtn.exec:\7bthtn.exe46⤵
- Executes dropped EXE
PID:3740 -
\??\c:\pvdvj.exec:\pvdvj.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\ppdvp.exec:\ppdvp.exe48⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lffxxxr.exec:\lffxxxr.exe49⤵
- Executes dropped EXE
PID:1748 -
\??\c:\tntnhh.exec:\tntnhh.exe50⤵
- Executes dropped EXE
PID:4068 -
\??\c:\btnbtt.exec:\btnbtt.exe51⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jddvp.exec:\jddvp.exe52⤵
- Executes dropped EXE
PID:4080 -
\??\c:\jddvp.exec:\jddvp.exe53⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe54⤵
- Executes dropped EXE
PID:3120 -
\??\c:\frrlffx.exec:\frrlffx.exe55⤵
- Executes dropped EXE
PID:2036 -
\??\c:\thbtnt.exec:\thbtnt.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xrxlfff.exec:\xrxlfff.exe57⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9xxxrrl.exec:\9xxxrrl.exe58⤵
- Executes dropped EXE
PID:4764 -
\??\c:\jjpjd.exec:\jjpjd.exe59⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jdvpj.exec:\jdvpj.exe60⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rlrrlll.exec:\rlrrlll.exe61⤵
- Executes dropped EXE
PID:3560 -
\??\c:\fflffff.exec:\fflffff.exe62⤵
- Executes dropped EXE
PID:224 -
\??\c:\bbbtnh.exec:\bbbtnh.exe63⤵
- Executes dropped EXE
PID:5112 -
\??\c:\bbtnhh.exec:\bbtnhh.exe64⤵
- Executes dropped EXE
PID:4840 -
\??\c:\pdjdv.exec:\pdjdv.exe65⤵
- Executes dropped EXE
PID:872 -
\??\c:\rlfxllf.exec:\rlfxllf.exe66⤵PID:1756
-
\??\c:\tntnnn.exec:\tntnnn.exe67⤵PID:2120
-
\??\c:\vdddv.exec:\vdddv.exe68⤵PID:3068
-
\??\c:\dpjjd.exec:\dpjjd.exe69⤵PID:832
-
\??\c:\fxlfffx.exec:\fxlfffx.exe70⤵
- System Location Discovery: System Language Discovery
PID:2376 -
\??\c:\lfxrrrl.exec:\lfxrrrl.exe71⤵PID:3424
-
\??\c:\bnhbbn.exec:\bnhbbn.exe72⤵PID:3432
-
\??\c:\hhbtnt.exec:\hhbtnt.exe73⤵PID:3700
-
\??\c:\vvvpj.exec:\vvvpj.exe74⤵PID:3196
-
\??\c:\pdvvv.exec:\pdvvv.exe75⤵PID:3904
-
\??\c:\3hnnhh.exec:\3hnnhh.exe76⤵PID:4316
-
\??\c:\btnbbt.exec:\btnbbt.exe77⤵PID:3380
-
\??\c:\pjjdd.exec:\pjjdd.exe78⤵PID:4672
-
\??\c:\pjvvp.exec:\pjvvp.exe79⤵PID:4376
-
\??\c:\flrlxxr.exec:\flrlxxr.exe80⤵PID:3580
-
\??\c:\lxfffff.exec:\lxfffff.exe81⤵PID:332
-
\??\c:\7tbtbb.exec:\7tbtbb.exe82⤵PID:868
-
\??\c:\jdvpj.exec:\jdvpj.exe83⤵PID:1244
-
\??\c:\pdpjj.exec:\pdpjj.exe84⤵PID:3640
-
\??\c:\lrxxrfl.exec:\lrxxrfl.exe85⤵PID:4044
-
\??\c:\vjjdv.exec:\vjjdv.exe86⤵PID:3856
-
\??\c:\rlxxfff.exec:\rlxxfff.exe87⤵PID:1044
-
\??\c:\hnnnhh.exec:\hnnnhh.exe88⤵PID:2840
-
\??\c:\dpdpd.exec:\dpdpd.exe89⤵PID:1368
-
\??\c:\rfxlrlf.exec:\rfxlrlf.exe90⤵PID:5036
-
\??\c:\frxrrll.exec:\frxrrll.exe91⤵PID:4484
-
\??\c:\nnnnhb.exec:\nnnnhb.exe92⤵PID:2320
-
\??\c:\hbbttn.exec:\hbbttn.exe93⤵
- System Location Discovery: System Language Discovery
PID:1748 -
\??\c:\7pdvj.exec:\7pdvj.exe94⤵PID:2232
-
\??\c:\1vdvj.exec:\1vdvj.exe95⤵PID:4888
-
\??\c:\fxfrrrl.exec:\fxfrrrl.exe96⤵PID:1820
-
\??\c:\rlrlffr.exec:\rlrlffr.exe97⤵PID:4400
-
\??\c:\nnbhnn.exec:\nnbhnn.exe98⤵PID:5032
-
\??\c:\nhtnbb.exec:\nhtnbb.exe99⤵PID:2032
-
\??\c:\9vjpd.exec:\9vjpd.exe100⤵PID:2348
-
\??\c:\xrxlfff.exec:\xrxlfff.exe101⤵PID:3412
-
\??\c:\rflfxxx.exec:\rflfxxx.exe102⤵PID:1864
-
\??\c:\llxrlrl.exec:\llxrlrl.exe103⤵PID:4072
-
\??\c:\3ntnhh.exec:\3ntnhh.exe104⤵PID:1000
-
\??\c:\7ddvj.exec:\7ddvj.exe105⤵PID:4860
-
\??\c:\lrxrllf.exec:\lrxrllf.exe106⤵PID:2944
-
\??\c:\rfrlfxl.exec:\rfrlfxl.exe107⤵PID:4568
-
\??\c:\btnhtt.exec:\btnhtt.exe108⤵PID:4168
-
\??\c:\btnhtt.exec:\btnhtt.exe109⤵PID:2116
-
\??\c:\5vjdp.exec:\5vjdp.exe110⤵PID:872
-
\??\c:\pjvvv.exec:\pjvvv.exe111⤵PID:1980
-
\??\c:\7xxrxxl.exec:\7xxrxxl.exe112⤵PID:2240
-
\??\c:\lrrrfrx.exec:\lrrrfrx.exe113⤵PID:364
-
\??\c:\nttthh.exec:\nttthh.exe114⤵PID:3492
-
\??\c:\jddpp.exec:\jddpp.exe115⤵PID:4360
-
\??\c:\3pvvv.exec:\3pvvv.exe116⤵PID:3584
-
\??\c:\xrlrfff.exec:\xrlrfff.exe117⤵PID:3000
-
\??\c:\nhbtnn.exec:\nhbtnn.exe118⤵PID:4000
-
\??\c:\hbhbhb.exec:\hbhbhb.exe119⤵PID:3196
-
\??\c:\3dpdv.exec:\3dpdv.exe120⤵PID:4580
-
\??\c:\vdpjd.exec:\vdpjd.exe121⤵PID:1580
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:5004
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-