Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1664e44118fc4de20b92e2ef0369aea0N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
1664e44118fc4de20b92e2ef0369aea0N.exe
-
Size
64KB
-
MD5
1664e44118fc4de20b92e2ef0369aea0
-
SHA1
73ce4e425a322f483aca437eb22c9a23cbb6027a
-
SHA256
871d914e10373c9ad2b0c827d66a10621da58ef5ce451396ba026f6d6c011ce2
-
SHA512
6d81f84e505a686d39d26db75307155aa7b54d058108a418324bd148225d45979daf48deeef81833f514b3aadc3707ee4d103d0a7f73c8eb31ffed0092080775
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNh:ymb3NkkiQ3mdBjFIvlph
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/2660-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/740-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1844-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2872 1ppdv.exe 4328 rxrlfxr.exe 740 1hbnbt.exe 3020 nntbbn.exe 1448 vppjd.exe 1844 5htnhb.exe 4672 tbbbnh.exe 4196 djdvp.exe 736 flrllrl.exe 1708 fxrfxrf.exe 3160 bthbth.exe 1960 pvddp.exe 1376 dpjdp.exe 4156 nntnnh.exe 4852 nbbbtn.exe 1576 frxxlff.exe 4144 rfffxrx.exe 2752 thhhhh.exe 4864 djpjd.exe 2368 ddpvp.exe 3584 lfrfxxx.exe 400 vpvjj.exe 4788 jdpdv.exe 2044 rfxrrxr.exe 64 nhtthn.exe 4280 hhtnhb.exe 1796 dvpjd.exe 2484 xxxrffx.exe 3008 nnttbt.exe 3720 nnnbbt.exe 2724 vvvjv.exe 5072 fxxfrrr.exe 4480 ntnnnn.exe 1080 vjjpv.exe 4780 vddpj.exe 3932 rlfxrrl.exe 4396 9rlfffx.exe 2356 bnnnbh.exe 920 jpvpd.exe 3616 7dvjv.exe 4076 frfrffr.exe 4960 rxrxrff.exe 3776 htnhbb.exe 1128 hhnbtn.exe 1448 1jvpp.exe 3724 pdjvj.exe 3060 flfrxrl.exe 4672 frxxxff.exe 560 btbntt.exe 456 5htnbt.exe 4016 ppvjd.exe 4816 ppdjj.exe 224 1xxrffx.exe 2184 nhnhhh.exe 4444 5jjjv.exe 4916 jppjj.exe 4424 xllxrlf.exe 4524 rlfrfrf.exe 4900 5bnnnb.exe 4132 5ttnbt.exe 1648 jpppj.exe 3996 vvpvp.exe 1496 lffrfxr.exe 4392 tnbtbb.exe -
resource yara_rule behavioral2/memory/2660-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2660-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/740-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1844-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1376-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4144-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffffrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 2872 2660 1664e44118fc4de20b92e2ef0369aea0N.exe 84 PID 2660 wrote to memory of 2872 2660 1664e44118fc4de20b92e2ef0369aea0N.exe 84 PID 2660 wrote to memory of 2872 2660 1664e44118fc4de20b92e2ef0369aea0N.exe 84 PID 2872 wrote to memory of 4328 2872 1ppdv.exe 85 PID 2872 wrote to memory of 4328 2872 1ppdv.exe 85 PID 2872 wrote to memory of 4328 2872 1ppdv.exe 85 PID 4328 wrote to memory of 740 4328 rxrlfxr.exe 86 PID 4328 wrote to memory of 740 4328 rxrlfxr.exe 86 PID 4328 wrote to memory of 740 4328 rxrlfxr.exe 86 PID 740 wrote to memory of 3020 740 1hbnbt.exe 87 PID 740 wrote to memory of 3020 740 1hbnbt.exe 87 PID 740 wrote to memory of 3020 740 1hbnbt.exe 87 PID 3020 wrote to memory of 1448 3020 nntbbn.exe 88 PID 3020 wrote to memory of 1448 3020 nntbbn.exe 88 PID 3020 wrote to memory of 1448 3020 nntbbn.exe 88 PID 1448 wrote to memory of 1844 1448 vppjd.exe 89 PID 1448 wrote to memory of 1844 1448 vppjd.exe 89 PID 1448 wrote to memory of 1844 1448 vppjd.exe 89 PID 1844 wrote to memory of 4672 1844 5htnhb.exe 90 PID 1844 wrote to memory of 4672 1844 5htnhb.exe 90 PID 1844 wrote to memory of 4672 1844 5htnhb.exe 90 PID 4672 wrote to memory of 4196 4672 tbbbnh.exe 91 PID 4672 wrote to memory of 4196 4672 tbbbnh.exe 91 PID 4672 wrote to memory of 4196 4672 tbbbnh.exe 91 PID 4196 wrote to memory of 736 4196 djdvp.exe 92 PID 4196 wrote to memory of 736 4196 djdvp.exe 92 PID 4196 wrote to memory of 736 4196 djdvp.exe 92 PID 736 wrote to memory of 1708 736 flrllrl.exe 93 PID 736 wrote to memory of 1708 736 flrllrl.exe 93 PID 736 wrote to memory of 1708 736 flrllrl.exe 93 PID 1708 wrote to memory of 3160 1708 fxrfxrf.exe 94 PID 1708 wrote to memory of 3160 1708 fxrfxrf.exe 94 PID 1708 wrote to memory of 3160 1708 fxrfxrf.exe 94 PID 3160 wrote to memory of 1960 3160 bthbth.exe 95 PID 3160 wrote to memory of 1960 3160 bthbth.exe 95 PID 3160 wrote to memory of 1960 3160 bthbth.exe 95 PID 1960 wrote to memory of 1376 1960 pvddp.exe 96 PID 1960 wrote to memory of 1376 1960 pvddp.exe 96 PID 1960 wrote to memory of 1376 1960 pvddp.exe 96 PID 1376 wrote to memory of 4156 1376 dpjdp.exe 97 PID 1376 wrote to memory of 4156 1376 dpjdp.exe 97 PID 1376 wrote to memory of 4156 1376 dpjdp.exe 97 PID 4156 wrote to memory of 4852 4156 nntnnh.exe 98 PID 4156 wrote to memory of 4852 4156 nntnnh.exe 98 PID 4156 wrote to memory of 4852 4156 nntnnh.exe 98 PID 4852 wrote to memory of 1576 4852 nbbbtn.exe 99 PID 4852 wrote to memory of 1576 4852 nbbbtn.exe 99 PID 4852 wrote to memory of 1576 4852 nbbbtn.exe 99 PID 1576 wrote to memory of 4144 1576 frxxlff.exe 100 PID 1576 wrote to memory of 4144 1576 frxxlff.exe 100 PID 1576 wrote to memory of 4144 1576 frxxlff.exe 100 PID 4144 wrote to memory of 2752 4144 rfffxrx.exe 101 PID 4144 wrote to memory of 2752 4144 rfffxrx.exe 101 PID 4144 wrote to memory of 2752 4144 rfffxrx.exe 101 PID 2752 wrote to memory of 4864 2752 thhhhh.exe 102 PID 2752 wrote to memory of 4864 2752 thhhhh.exe 102 PID 2752 wrote to memory of 4864 2752 thhhhh.exe 102 PID 4864 wrote to memory of 2368 4864 djpjd.exe 104 PID 4864 wrote to memory of 2368 4864 djpjd.exe 104 PID 4864 wrote to memory of 2368 4864 djpjd.exe 104 PID 2368 wrote to memory of 3584 2368 ddpvp.exe 105 PID 2368 wrote to memory of 3584 2368 ddpvp.exe 105 PID 2368 wrote to memory of 3584 2368 ddpvp.exe 105 PID 3584 wrote to memory of 400 3584 lfrfxxx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1664e44118fc4de20b92e2ef0369aea0N.exe"C:\Users\Admin\AppData\Local\Temp\1664e44118fc4de20b92e2ef0369aea0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\1ppdv.exec:\1ppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\1hbnbt.exec:\1hbnbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\nntbbn.exec:\nntbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vppjd.exec:\vppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\5htnhb.exec:\5htnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\tbbbnh.exec:\tbbbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\djdvp.exec:\djdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\flrllrl.exec:\flrllrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\fxrfxrf.exec:\fxrfxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\bthbth.exec:\bthbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\pvddp.exec:\pvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\dpjdp.exec:\dpjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\nntnnh.exec:\nntnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\nbbbtn.exec:\nbbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\frxxlff.exec:\frxxlff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\rfffxrx.exec:\rfffxrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\thhhhh.exec:\thhhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\djpjd.exec:\djpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\ddpvp.exec:\ddpvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\lfrfxxx.exec:\lfrfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\vpvjj.exec:\vpvjj.exe23⤵
- Executes dropped EXE
PID:400 -
\??\c:\jdpdv.exec:\jdpdv.exe24⤵
- Executes dropped EXE
PID:4788 -
\??\c:\rfxrrxr.exec:\rfxrrxr.exe25⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nhtthn.exec:\nhtthn.exe26⤵
- Executes dropped EXE
PID:64 -
\??\c:\hhtnhb.exec:\hhtnhb.exe27⤵
- Executes dropped EXE
PID:4280 -
\??\c:\dvpjd.exec:\dvpjd.exe28⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xxxrffx.exec:\xxxrffx.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\nnttbt.exec:\nnttbt.exe30⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nnnbbt.exec:\nnnbbt.exe31⤵
- Executes dropped EXE
PID:3720 -
\??\c:\vvvjv.exec:\vvvjv.exe32⤵
- Executes dropped EXE
PID:2724 -
\??\c:\fxxfrrr.exec:\fxxfrrr.exe33⤵
- Executes dropped EXE
PID:5072 -
\??\c:\ntnnnn.exec:\ntnnnn.exe34⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vjjpv.exec:\vjjpv.exe35⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vddpj.exec:\vddpj.exe36⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe37⤵
- Executes dropped EXE
PID:3932 -
\??\c:\9rlfffx.exec:\9rlfffx.exe38⤵
- Executes dropped EXE
PID:4396 -
\??\c:\bnnnbh.exec:\bnnnbh.exe39⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jpvpd.exec:\jpvpd.exe40⤵
- Executes dropped EXE
PID:920 -
\??\c:\7dvjv.exec:\7dvjv.exe41⤵
- Executes dropped EXE
PID:3616 -
\??\c:\frfrffr.exec:\frfrffr.exe42⤵
- Executes dropped EXE
PID:4076 -
\??\c:\rxrxrff.exec:\rxrxrff.exe43⤵
- Executes dropped EXE
PID:4960 -
\??\c:\htnhbb.exec:\htnhbb.exe44⤵
- Executes dropped EXE
PID:3776 -
\??\c:\hhnbtn.exec:\hhnbtn.exe45⤵
- Executes dropped EXE
PID:1128 -
\??\c:\1jvpp.exec:\1jvpp.exe46⤵
- Executes dropped EXE
PID:1448 -
\??\c:\pdjvj.exec:\pdjvj.exe47⤵
- Executes dropped EXE
PID:3724 -
\??\c:\flfrxrl.exec:\flfrxrl.exe48⤵
- Executes dropped EXE
PID:3060 -
\??\c:\frxxxff.exec:\frxxxff.exe49⤵
- Executes dropped EXE
PID:4672 -
\??\c:\btbntt.exec:\btbntt.exe50⤵
- Executes dropped EXE
PID:560 -
\??\c:\5htnbt.exec:\5htnbt.exe51⤵
- Executes dropped EXE
PID:456 -
\??\c:\ppvjd.exec:\ppvjd.exe52⤵
- Executes dropped EXE
PID:4016 -
\??\c:\ppdjj.exec:\ppdjj.exe53⤵
- Executes dropped EXE
PID:4816 -
\??\c:\1xxrffx.exec:\1xxrffx.exe54⤵
- Executes dropped EXE
PID:224 -
\??\c:\nhnhhh.exec:\nhnhhh.exe55⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5jjjv.exec:\5jjjv.exe56⤵
- Executes dropped EXE
PID:4444 -
\??\c:\jppjj.exec:\jppjj.exe57⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xllxrlf.exec:\xllxrlf.exe58⤵
- Executes dropped EXE
PID:4424 -
\??\c:\rlfrfrf.exec:\rlfrfrf.exe59⤵
- Executes dropped EXE
PID:4524 -
\??\c:\5bnnnb.exec:\5bnnnb.exe60⤵
- Executes dropped EXE
PID:4900 -
\??\c:\5ttnbt.exec:\5ttnbt.exe61⤵
- Executes dropped EXE
PID:4132 -
\??\c:\jpppj.exec:\jpppj.exe62⤵
- Executes dropped EXE
PID:1648 -
\??\c:\vvpvp.exec:\vvpvp.exe63⤵
- Executes dropped EXE
PID:3996 -
\??\c:\lffrfxr.exec:\lffrfxr.exe64⤵
- Executes dropped EXE
PID:1496 -
\??\c:\tnbtbb.exec:\tnbtbb.exe65⤵
- Executes dropped EXE
PID:4392 -
\??\c:\thtnhb.exec:\thtnhb.exe66⤵PID:4068
-
\??\c:\jvvjp.exec:\jvvjp.exe67⤵PID:3584
-
\??\c:\dpdjp.exec:\dpdjp.exe68⤵PID:5108
-
\??\c:\3llxrlx.exec:\3llxrlx.exe69⤵PID:3368
-
\??\c:\lfxrllx.exec:\lfxrllx.exe70⤵PID:2068
-
\??\c:\5btnhb.exec:\5btnhb.exe71⤵PID:4164
-
\??\c:\tnbnbt.exec:\tnbnbt.exe72⤵PID:4252
-
\??\c:\vdvvp.exec:\vdvvp.exe73⤵
- System Location Discovery: System Language Discovery
PID:1540 -
\??\c:\vpvpd.exec:\vpvpd.exe74⤵PID:4928
-
\??\c:\5lxllff.exec:\5lxllff.exe75⤵PID:4280
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe76⤵PID:5088
-
\??\c:\5ffxrlf.exec:\5ffxrlf.exe77⤵PID:1912
-
\??\c:\ntbtnn.exec:\ntbtnn.exe78⤵PID:4352
-
\??\c:\bbhbnh.exec:\bbhbnh.exe79⤵PID:3540
-
\??\c:\1vvjj.exec:\1vvjj.exe80⤵PID:1452
-
\??\c:\lxfrllx.exec:\lxfrllx.exe81⤵PID:1204
-
\??\c:\7dpdp.exec:\7dpdp.exe82⤵PID:3124
-
\??\c:\1dvjv.exec:\1dvjv.exe83⤵PID:4356
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe84⤵PID:2040
-
\??\c:\rllfxrl.exec:\rllfxrl.exe85⤵PID:5060
-
\??\c:\tthhbt.exec:\tthhbt.exe86⤵PID:216
-
\??\c:\hnthtt.exec:\hnthtt.exe87⤵PID:4384
-
\??\c:\ddpjp.exec:\ddpjp.exe88⤵PID:3700
-
\??\c:\vpdpd.exec:\vpdpd.exe89⤵PID:2492
-
\??\c:\lxrrfll.exec:\lxrrfll.exe90⤵PID:4188
-
\??\c:\lrlxfxx.exec:\lrlxfxx.exe91⤵PID:4220
-
\??\c:\htnbnh.exec:\htnbnh.exe92⤵PID:672
-
\??\c:\tbttnh.exec:\tbttnh.exe93⤵PID:1260
-
\??\c:\vjpdj.exec:\vjpdj.exe94⤵PID:3776
-
\??\c:\pjjjp.exec:\pjjjp.exe95⤵PID:3656
-
\??\c:\fxxrllf.exec:\fxxrllf.exe96⤵PID:220
-
\??\c:\bnhtbn.exec:\bnhtbn.exe97⤵PID:4828
-
\??\c:\hbbnbt.exec:\hbbnbt.exe98⤵PID:228
-
\??\c:\7vdpp.exec:\7vdpp.exe99⤵PID:2216
-
\??\c:\ffllxfr.exec:\ffllxfr.exe100⤵PID:208
-
\??\c:\rfxfxlr.exec:\rfxfxlr.exe101⤵PID:2516
-
\??\c:\tntthh.exec:\tntthh.exe102⤵PID:3440
-
\??\c:\jdvvj.exec:\jdvvj.exe103⤵PID:3168
-
\??\c:\3jjdp.exec:\3jjdp.exe104⤵PID:4568
-
\??\c:\9ffrxrl.exec:\9ffrxrl.exe105⤵PID:2920
-
\??\c:\tbttnh.exec:\tbttnh.exe106⤵PID:4156
-
\??\c:\btnhnh.exec:\btnhnh.exe107⤵
- System Location Discovery: System Language Discovery
PID:4916 -
\??\c:\dpjdj.exec:\dpjdj.exe108⤵PID:3964
-
\??\c:\vpdvp.exec:\vpdvp.exe109⤵PID:1896
-
\??\c:\rffrrlf.exec:\rffrrlf.exe110⤵PID:3156
-
\??\c:\btbbnh.exec:\btbbnh.exe111⤵PID:4132
-
\??\c:\ttbtnh.exec:\ttbtnh.exe112⤵PID:1700
-
\??\c:\jvdvd.exec:\jvdvd.exe113⤵PID:3708
-
\??\c:\xffrllf.exec:\xffrllf.exe114⤵PID:2052
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe115⤵PID:4392
-
\??\c:\tttbtn.exec:\tttbtn.exe116⤵PID:2628
-
\??\c:\bbbnhb.exec:\bbbnhb.exe117⤵PID:3040
-
\??\c:\5jjdj.exec:\5jjdj.exe118⤵PID:4304
-
\??\c:\pjpdv.exec:\pjpdv.exe119⤵PID:3436
-
\??\c:\rlrfrlx.exec:\rlrfrlx.exe120⤵PID:1360
-
\??\c:\lfxlxxr.exec:\lfxlxxr.exe121⤵PID:3044
-
\??\c:\ttbthn.exec:\ttbthn.exe122⤵PID:64
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-