Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb28ecf427da115085b7cad20763b5e0N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
General
-
Target
eb28ecf427da115085b7cad20763b5e0N.exe
-
Size
721KB
-
MD5
eb28ecf427da115085b7cad20763b5e0
-
SHA1
5384ff16eb1103b83352583807c5e909b31c2c40
-
SHA256
32c9b385f3ab08273229135f14fe5c7f153ea8c6e03e97b4a8c8874605708f18
-
SHA512
ac7845b121f481f67589b71e5e201bccfccbbe421d574adbe827d5020c48a44f6e750b68090e464cec38a40d378d67fc3ac01b1dacc25c4e35f1b4f880131e7a
-
SSDEEP
12288:n3C9yMCxqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsxPJp6aasUdlH7t:Sg5qYLS7w4O
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4604-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/324-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2276 jvdvp.exe 4012 btnhbb.exe 4476 rlxrrxx.exe 4916 rrfxrlr.exe 4980 vjvdd.exe 1916 vppjj.exe 1512 xrffxxr.exe 1940 pdvjj.exe 2396 lflxrrr.exe 2364 7ntbth.exe 4684 rxxrlff.exe 2892 dpvvp.exe 4548 ffxrlll.exe 3636 hthbtn.exe 2196 rffrllx.exe 1120 nhbnnb.exe 4196 9rllfff.exe 4540 nbbtnb.exe 2440 bbbbtb.exe 3476 hnnttb.exe 324 vjvpp.exe 928 htbtnh.exe 4512 dvjvd.exe 3004 tbbtnh.exe 4828 pdjdv.exe 3616 fxxrlff.exe 4572 1hbthh.exe 4256 vjjdv.exe 4536 3fxrlll.exe 1788 rlrlrrx.exe 2312 pdjjd.exe 4800 lllxrlf.exe 1084 ntnhtt.exe 404 3rlfxxx.exe 4428 hbnhhh.exe 3824 jvvdd.exe 700 pddvj.exe 4668 bntnhb.exe 1252 7bbtnn.exe 2180 pjjdv.exe 1068 hhtnbh.exe 4884 nbhtnn.exe 2924 djdpv.exe 1376 rxffxrf.exe 3012 5bbtth.exe 3504 dvdpj.exe 3864 flllfff.exe 1912 tntnhn.exe 412 dvdpv.exe 1764 9lxrllf.exe 3736 btbbbb.exe 5044 dvdvv.exe 2200 5dvpd.exe 2644 3rrlxxr.exe 3172 1bbnnh.exe 1556 dvdvd.exe 1804 1llfxxx.exe 4192 lfxrllf.exe 3056 nhhbhb.exe 3508 pjdvp.exe 1488 rffxxxx.exe 2440 nnhhbt.exe 3476 djjdd.exe 2736 vpvvj.exe -
resource yara_rule behavioral2/memory/4604-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/324-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btthtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4604 wrote to memory of 2276 4604 eb28ecf427da115085b7cad20763b5e0N.exe 84 PID 4604 wrote to memory of 2276 4604 eb28ecf427da115085b7cad20763b5e0N.exe 84 PID 4604 wrote to memory of 2276 4604 eb28ecf427da115085b7cad20763b5e0N.exe 84 PID 2276 wrote to memory of 4012 2276 jvdvp.exe 85 PID 2276 wrote to memory of 4012 2276 jvdvp.exe 85 PID 2276 wrote to memory of 4012 2276 jvdvp.exe 85 PID 4012 wrote to memory of 4476 4012 btnhbb.exe 86 PID 4012 wrote to memory of 4476 4012 btnhbb.exe 86 PID 4012 wrote to memory of 4476 4012 btnhbb.exe 86 PID 4476 wrote to memory of 4916 4476 rlxrrxx.exe 87 PID 4476 wrote to memory of 4916 4476 rlxrrxx.exe 87 PID 4476 wrote to memory of 4916 4476 rlxrrxx.exe 87 PID 4916 wrote to memory of 4980 4916 rrfxrlr.exe 88 PID 4916 wrote to memory of 4980 4916 rrfxrlr.exe 88 PID 4916 wrote to memory of 4980 4916 rrfxrlr.exe 88 PID 4980 wrote to memory of 1916 4980 vjvdd.exe 89 PID 4980 wrote to memory of 1916 4980 vjvdd.exe 89 PID 4980 wrote to memory of 1916 4980 vjvdd.exe 89 PID 1916 wrote to memory of 1512 1916 vppjj.exe 90 PID 1916 wrote to memory of 1512 1916 vppjj.exe 90 PID 1916 wrote to memory of 1512 1916 vppjj.exe 90 PID 1512 wrote to memory of 1940 1512 xrffxxr.exe 91 PID 1512 wrote to memory of 1940 1512 xrffxxr.exe 91 PID 1512 wrote to memory of 1940 1512 xrffxxr.exe 91 PID 1940 wrote to memory of 2396 1940 pdvjj.exe 92 PID 1940 wrote to memory of 2396 1940 pdvjj.exe 92 PID 1940 wrote to memory of 2396 1940 pdvjj.exe 92 PID 2396 wrote to memory of 2364 2396 lflxrrr.exe 93 PID 2396 wrote to memory of 2364 2396 lflxrrr.exe 93 PID 2396 wrote to memory of 2364 2396 lflxrrr.exe 93 PID 2364 wrote to memory of 4684 2364 7ntbth.exe 95 PID 2364 wrote to memory of 4684 2364 7ntbth.exe 95 PID 2364 wrote to memory of 4684 2364 7ntbth.exe 95 PID 4684 wrote to memory of 2892 4684 rxxrlff.exe 96 PID 4684 wrote to memory of 2892 4684 rxxrlff.exe 96 PID 4684 wrote to memory of 2892 4684 rxxrlff.exe 96 PID 2892 wrote to memory of 4548 2892 dpvvp.exe 97 PID 2892 wrote to memory of 4548 2892 dpvvp.exe 97 PID 2892 wrote to memory of 4548 2892 dpvvp.exe 97 PID 4548 wrote to memory of 3636 4548 ffxrlll.exe 98 PID 4548 wrote to memory of 3636 4548 ffxrlll.exe 98 PID 4548 wrote to memory of 3636 4548 ffxrlll.exe 98 PID 3636 wrote to memory of 2196 3636 hthbtn.exe 99 PID 3636 wrote to memory of 2196 3636 hthbtn.exe 99 PID 3636 wrote to memory of 2196 3636 hthbtn.exe 99 PID 2196 wrote to memory of 1120 2196 rffrllx.exe 100 PID 2196 wrote to memory of 1120 2196 rffrllx.exe 100 PID 2196 wrote to memory of 1120 2196 rffrllx.exe 100 PID 1120 wrote to memory of 4196 1120 nhbnnb.exe 101 PID 1120 wrote to memory of 4196 1120 nhbnnb.exe 101 PID 1120 wrote to memory of 4196 1120 nhbnnb.exe 101 PID 4196 wrote to memory of 4540 4196 9rllfff.exe 102 PID 4196 wrote to memory of 4540 4196 9rllfff.exe 102 PID 4196 wrote to memory of 4540 4196 9rllfff.exe 102 PID 4540 wrote to memory of 2440 4540 nbbtnb.exe 103 PID 4540 wrote to memory of 2440 4540 nbbtnb.exe 103 PID 4540 wrote to memory of 2440 4540 nbbtnb.exe 103 PID 2440 wrote to memory of 3476 2440 bbbbtb.exe 105 PID 2440 wrote to memory of 3476 2440 bbbbtb.exe 105 PID 2440 wrote to memory of 3476 2440 bbbbtb.exe 105 PID 3476 wrote to memory of 324 3476 hnnttb.exe 106 PID 3476 wrote to memory of 324 3476 hnnttb.exe 106 PID 3476 wrote to memory of 324 3476 hnnttb.exe 106 PID 324 wrote to memory of 928 324 vjvpp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb28ecf427da115085b7cad20763b5e0N.exe"C:\Users\Admin\AppData\Local\Temp\eb28ecf427da115085b7cad20763b5e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\jvdvp.exec:\jvdvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\btnhbb.exec:\btnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rlxrrxx.exec:\rlxrrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\rrfxrlr.exec:\rrfxrlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\vjvdd.exec:\vjvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\vppjj.exec:\vppjj.exe7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\xrffxxr.exec:\xrffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\pdvjj.exec:\pdvjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\lflxrrr.exec:\lflxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\7ntbth.exec:\7ntbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rxxrlff.exec:\rxxrlff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\dpvvp.exec:\dpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\ffxrlll.exec:\ffxrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\hthbtn.exec:\hthbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\rffrllx.exec:\rffrllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\nhbnnb.exec:\nhbnnb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\9rllfff.exec:\9rllfff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\nbbtnb.exec:\nbbtnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\bbbbtb.exec:\bbbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\hnnttb.exec:\hnnttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\vjvpp.exec:\vjvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:324 -
\??\c:\htbtnh.exec:\htbtnh.exe23⤵
- Executes dropped EXE
PID:928 -
\??\c:\dvjvd.exec:\dvjvd.exe24⤵
- Executes dropped EXE
PID:4512 -
\??\c:\tbbtnh.exec:\tbbtnh.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\pdjdv.exec:\pdjdv.exe26⤵
- Executes dropped EXE
PID:4828 -
\??\c:\fxxrlff.exec:\fxxrlff.exe27⤵
- Executes dropped EXE
PID:3616 -
\??\c:\1hbthh.exec:\1hbthh.exe28⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vjjdv.exec:\vjjdv.exe29⤵
- Executes dropped EXE
PID:4256 -
\??\c:\3fxrlll.exec:\3fxrlll.exe30⤵
- Executes dropped EXE
PID:4536 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe31⤵
- Executes dropped EXE
PID:1788 -
\??\c:\pdjjd.exec:\pdjjd.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lllxrlf.exec:\lllxrlf.exe33⤵
- Executes dropped EXE
PID:4800 -
\??\c:\ntnhtt.exec:\ntnhtt.exe34⤵
- Executes dropped EXE
PID:1084 -
\??\c:\3rlfxxx.exec:\3rlfxxx.exe35⤵
- Executes dropped EXE
PID:404 -
\??\c:\hbnhhh.exec:\hbnhhh.exe36⤵
- Executes dropped EXE
PID:4428 -
\??\c:\jvvdd.exec:\jvvdd.exe37⤵
- Executes dropped EXE
PID:3824 -
\??\c:\pddvj.exec:\pddvj.exe38⤵
- Executes dropped EXE
PID:700 -
\??\c:\bntnhb.exec:\bntnhb.exe39⤵
- Executes dropped EXE
PID:4668 -
\??\c:\7bbtnn.exec:\7bbtnn.exe40⤵
- Executes dropped EXE
PID:1252 -
\??\c:\pjjdv.exec:\pjjdv.exe41⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hhtnbh.exec:\hhtnbh.exe42⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nbhtnn.exec:\nbhtnn.exe43⤵
- Executes dropped EXE
PID:4884 -
\??\c:\djdpv.exec:\djdpv.exe44⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rxffxrf.exec:\rxffxrf.exe45⤵
- Executes dropped EXE
PID:1376 -
\??\c:\5bbtth.exec:\5bbtth.exe46⤵
- Executes dropped EXE
PID:3012 -
\??\c:\dvdpj.exec:\dvdpj.exe47⤵
- Executes dropped EXE
PID:3504 -
\??\c:\flllfff.exec:\flllfff.exe48⤵
- Executes dropped EXE
PID:3864 -
\??\c:\tntnhn.exec:\tntnhn.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\dvdpv.exec:\dvdpv.exe50⤵
- Executes dropped EXE
PID:412 -
\??\c:\9lxrllf.exec:\9lxrllf.exe51⤵
- Executes dropped EXE
PID:1764 -
\??\c:\btbbbb.exec:\btbbbb.exe52⤵
- Executes dropped EXE
PID:3736 -
\??\c:\dvdvv.exec:\dvdvv.exe53⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5dvpd.exec:\5dvpd.exe54⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3rrlxxr.exec:\3rrlxxr.exe55⤵
- Executes dropped EXE
PID:2644 -
\??\c:\1bbnnh.exec:\1bbnnh.exe56⤵
- Executes dropped EXE
PID:3172 -
\??\c:\dvdvd.exec:\dvdvd.exe57⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1llfxxx.exec:\1llfxxx.exe58⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lfxrllf.exec:\lfxrllf.exe59⤵
- Executes dropped EXE
PID:4192 -
\??\c:\nhhbhb.exec:\nhhbhb.exe60⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjdvp.exec:\pjdvp.exe61⤵
- Executes dropped EXE
PID:3508 -
\??\c:\rffxxxx.exec:\rffxxxx.exe62⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nnhhbt.exec:\nnhhbt.exe63⤵
- Executes dropped EXE
PID:2440 -
\??\c:\djjdd.exec:\djjdd.exe64⤵
- Executes dropped EXE
PID:3476 -
\??\c:\vpvvj.exec:\vpvvj.exe65⤵
- Executes dropped EXE
PID:2736 -
\??\c:\hbhtbt.exec:\hbhtbt.exe66⤵PID:4496
-
\??\c:\dppjd.exec:\dppjd.exe67⤵PID:3596
-
\??\c:\fllllrx.exec:\fllllrx.exe68⤵PID:1932
-
\??\c:\nhbtbh.exec:\nhbtbh.exe69⤵PID:5052
-
\??\c:\vpvpp.exec:\vpvpp.exe70⤵PID:1776
-
\??\c:\lffxfxx.exec:\lffxfxx.exe71⤵PID:1964
-
\??\c:\tbbtnh.exec:\tbbtnh.exe72⤵PID:4572
-
\??\c:\djdvd.exec:\djdvd.exe73⤵PID:1568
-
\??\c:\frrfxrl.exec:\frrfxrl.exe74⤵PID:3236
-
\??\c:\tnbhth.exec:\tnbhth.exe75⤵PID:2912
-
\??\c:\7vvpj.exec:\7vvpj.exe76⤵PID:4380
-
\??\c:\rrfxrlf.exec:\rrfxrlf.exe77⤵PID:4976
-
\??\c:\httnhh.exec:\httnhh.exe78⤵PID:4952
-
\??\c:\jjvpj.exec:\jjvpj.exe79⤵PID:1392
-
\??\c:\1lffxfx.exec:\1lffxfx.exe80⤵PID:1708
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe81⤵PID:2320
-
\??\c:\hhhbtt.exec:\hhhbtt.exe82⤵PID:3560
-
\??\c:\jdvvv.exec:\jdvvv.exe83⤵PID:3036
-
\??\c:\lrrllff.exec:\lrrllff.exe84⤵PID:4136
-
\??\c:\bntbth.exec:\bntbth.exe85⤵PID:2020
-
\??\c:\vdddv.exec:\vdddv.exe86⤵PID:1008
-
\??\c:\1xfxxfx.exec:\1xfxxfx.exe87⤵
- System Location Discovery: System Language Discovery
PID:4156 -
\??\c:\3fxlffx.exec:\3fxlffx.exe88⤵PID:4956
-
\??\c:\htbhbb.exec:\htbhbb.exe89⤵PID:2068
-
\??\c:\9jpjd.exec:\9jpjd.exe90⤵PID:2456
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe91⤵PID:976
-
\??\c:\1bttnn.exec:\1bttnn.exe92⤵PID:1896
-
\??\c:\jjjdp.exec:\jjjdp.exe93⤵PID:3808
-
\??\c:\rffflrl.exec:\rffflrl.exe94⤵PID:2604
-
\??\c:\jdvpv.exec:\jdvpv.exe95⤵PID:1940
-
\??\c:\pvvpj.exec:\pvvpj.exe96⤵PID:4584
-
\??\c:\lfxrrll.exec:\lfxrrll.exe97⤵
- System Location Discovery: System Language Discovery
PID:4648 -
\??\c:\btthtt.exec:\btthtt.exe98⤵
- System Location Discovery: System Language Discovery
PID:2896 -
\??\c:\ppjdv.exec:\ppjdv.exe99⤵PID:2696
-
\??\c:\flxllfx.exec:\flxllfx.exe100⤵PID:3104
-
\??\c:\thhbnn.exec:\thhbnn.exe101⤵PID:5104
-
\??\c:\pvdvd.exec:\pvdvd.exe102⤵PID:4560
-
\??\c:\rxffxfx.exec:\rxffxfx.exe103⤵PID:3408
-
\??\c:\1btnnh.exec:\1btnnh.exe104⤵PID:3476
-
\??\c:\ththth.exec:\ththth.exe105⤵PID:3428
-
\??\c:\3ppjd.exec:\3ppjd.exe106⤵PID:2064
-
\??\c:\flrflfr.exec:\flrflfr.exe107⤵PID:3596
-
\??\c:\hbbbtn.exec:\hbbbtn.exe108⤵PID:2100
-
\??\c:\vdpjj.exec:\vdpjj.exe109⤵PID:1928
-
\??\c:\rflfxxr.exec:\rflfxxr.exe110⤵PID:4764
-
\??\c:\bbhnth.exec:\bbhnth.exe111⤵PID:5048
-
\??\c:\jjdjj.exec:\jjdjj.exe112⤵PID:3396
-
\??\c:\lxlfllx.exec:\lxlfllx.exe113⤵PID:4460
-
\??\c:\3ntnhn.exec:\3ntnhn.exe114⤵PID:1924
-
\??\c:\lrfxfxf.exec:\lrfxfxf.exe115⤵PID:3800
-
\??\c:\nnhhhh.exec:\nnhhhh.exe116⤵PID:2224
-
\??\c:\pjdpj.exec:\pjdpj.exe117⤵PID:4588
-
\??\c:\xxrrlrl.exec:\xxrrlrl.exe118⤵PID:2536
-
\??\c:\bnhbtt.exec:\bnhbtt.exe119⤵PID:4424
-
\??\c:\vppjd.exec:\vppjd.exe120⤵PID:668
-
\??\c:\rlllffx.exec:\rlllffx.exe121⤵PID:3824
-
\??\c:\btbbtn.exec:\btbbtn.exe122⤵PID:4964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-