Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04-09-2024 08:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe
-
Size
71KB
-
MD5
97974fbc563d64f86d940a0fee75c901
-
SHA1
0eec5b7a5ce3aac283ac0efd589ea60711550d20
-
SHA256
937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1
-
SHA512
f4978c7dd00829db5972c06975c095c18bfdab0d7e31d727524e3a86815ee52e13bd2f096a3ff5eb0fb04956fbd6a31c9288c1d55f433f3cc406313ea4b114ea
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjg:ymb3NkkiQ3mdBjFI4VQ
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4784-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1280-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2668 frrlfxf.exe 2136 3bnhtn.exe 1900 7vjdv.exe 4120 5lrlffr.exe 1560 xlxrrrx.exe 3688 vjdpj.exe 2900 frrlfxr.exe 2156 3lfxrlf.exe 2220 nhbbtt.exe 3860 jjpjd.exe 1280 lffxrrl.exe 3312 nnhbnn.exe 2312 nnhbtb.exe 4600 vdpjv.exe 5040 frrlxxr.exe 2380 thtbhn.exe 1304 vpvpp.exe 3888 rfrxfrr.exe 1568 nhnhhh.exe 2376 nhnhbb.exe 2124 vvpjv.exe 440 dvpdj.exe 3548 rffrllx.exe 4092 ntbbnn.exe 3308 vdjpv.exe 4840 dvpjd.exe 3468 lfrlllr.exe 3380 ffxxrll.exe 2344 htntnn.exe 4560 pvvpd.exe 1492 5lxlllr.exe 2340 fxxrlfx.exe 4488 nhbthb.exe 2472 5nnhtt.exe 5008 dpvjj.exe 1192 rxxrrrr.exe 4988 fflffxf.exe 2136 hbttbb.exe 2724 hthbnn.exe 2464 5vddd.exe 4928 3ffxlxr.exe 4684 bbhbbb.exe 1944 hbbnhh.exe 3688 1dpjj.exe 1156 frfxrrx.exe 2660 7flfxxr.exe 5080 nnnhbb.exe 1100 vjjpj.exe 3668 1vdjv.exe 1440 lxxxrrx.exe 656 xllfffr.exe 768 hbbthh.exe 1984 bttnhb.exe 4616 jppdv.exe 3364 pddvj.exe 2672 frlxllf.exe 4612 nhntbb.exe 8 bbhhnn.exe 3968 vpjdd.exe 4508 xrrrrfl.exe 968 llxlfll.exe 4576 thhnht.exe 540 ttthtt.exe 3056 9jpdv.exe -
resource yara_rule behavioral2/memory/4784-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1280-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 2668 4784 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 83 PID 4784 wrote to memory of 2668 4784 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 83 PID 4784 wrote to memory of 2668 4784 937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe 83 PID 2668 wrote to memory of 2136 2668 frrlfxf.exe 84 PID 2668 wrote to memory of 2136 2668 frrlfxf.exe 84 PID 2668 wrote to memory of 2136 2668 frrlfxf.exe 84 PID 2136 wrote to memory of 1900 2136 3bnhtn.exe 85 PID 2136 wrote to memory of 1900 2136 3bnhtn.exe 85 PID 2136 wrote to memory of 1900 2136 3bnhtn.exe 85 PID 1900 wrote to memory of 4120 1900 7vjdv.exe 86 PID 1900 wrote to memory of 4120 1900 7vjdv.exe 86 PID 1900 wrote to memory of 4120 1900 7vjdv.exe 86 PID 4120 wrote to memory of 1560 4120 5lrlffr.exe 87 PID 4120 wrote to memory of 1560 4120 5lrlffr.exe 87 PID 4120 wrote to memory of 1560 4120 5lrlffr.exe 87 PID 1560 wrote to memory of 3688 1560 xlxrrrx.exe 88 PID 1560 wrote to memory of 3688 1560 xlxrrrx.exe 88 PID 1560 wrote to memory of 3688 1560 xlxrrrx.exe 88 PID 3688 wrote to memory of 2900 3688 vjdpj.exe 89 PID 3688 wrote to memory of 2900 3688 vjdpj.exe 89 PID 3688 wrote to memory of 2900 3688 vjdpj.exe 89 PID 2900 wrote to memory of 2156 2900 frrlfxr.exe 90 PID 2900 wrote to memory of 2156 2900 frrlfxr.exe 90 PID 2900 wrote to memory of 2156 2900 frrlfxr.exe 90 PID 2156 wrote to memory of 2220 2156 3lfxrlf.exe 91 PID 2156 wrote to memory of 2220 2156 3lfxrlf.exe 91 PID 2156 wrote to memory of 2220 2156 3lfxrlf.exe 91 PID 2220 wrote to memory of 3860 2220 nhbbtt.exe 92 PID 2220 wrote to memory of 3860 2220 nhbbtt.exe 92 PID 2220 wrote to memory of 3860 2220 nhbbtt.exe 92 PID 3860 wrote to memory of 1280 3860 jjpjd.exe 93 PID 3860 wrote to memory of 1280 3860 jjpjd.exe 93 PID 3860 wrote to memory of 1280 3860 jjpjd.exe 93 PID 1280 wrote to memory of 3312 1280 lffxrrl.exe 94 PID 1280 wrote to memory of 3312 1280 lffxrrl.exe 94 PID 1280 wrote to memory of 3312 1280 lffxrrl.exe 94 PID 3312 wrote to memory of 2312 3312 nnhbnn.exe 95 PID 3312 wrote to memory of 2312 3312 nnhbnn.exe 95 PID 3312 wrote to memory of 2312 3312 nnhbnn.exe 95 PID 2312 wrote to memory of 4600 2312 nnhbtb.exe 96 PID 2312 wrote to memory of 4600 2312 nnhbtb.exe 96 PID 2312 wrote to memory of 4600 2312 nnhbtb.exe 96 PID 4600 wrote to memory of 5040 4600 vdpjv.exe 98 PID 4600 wrote to memory of 5040 4600 vdpjv.exe 98 PID 4600 wrote to memory of 5040 4600 vdpjv.exe 98 PID 5040 wrote to memory of 2380 5040 frrlxxr.exe 99 PID 5040 wrote to memory of 2380 5040 frrlxxr.exe 99 PID 5040 wrote to memory of 2380 5040 frrlxxr.exe 99 PID 2380 wrote to memory of 1304 2380 thtbhn.exe 100 PID 2380 wrote to memory of 1304 2380 thtbhn.exe 100 PID 2380 wrote to memory of 1304 2380 thtbhn.exe 100 PID 1304 wrote to memory of 3888 1304 vpvpp.exe 101 PID 1304 wrote to memory of 3888 1304 vpvpp.exe 101 PID 1304 wrote to memory of 3888 1304 vpvpp.exe 101 PID 3888 wrote to memory of 1568 3888 rfrxfrr.exe 103 PID 3888 wrote to memory of 1568 3888 rfrxfrr.exe 103 PID 3888 wrote to memory of 1568 3888 rfrxfrr.exe 103 PID 1568 wrote to memory of 2376 1568 nhnhhh.exe 104 PID 1568 wrote to memory of 2376 1568 nhnhhh.exe 104 PID 1568 wrote to memory of 2376 1568 nhnhhh.exe 104 PID 2376 wrote to memory of 2124 2376 nhnhbb.exe 105 PID 2376 wrote to memory of 2124 2376 nhnhbb.exe 105 PID 2376 wrote to memory of 2124 2376 nhnhbb.exe 105 PID 2124 wrote to memory of 440 2124 vvpjv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe"C:\Users\Admin\AppData\Local\Temp\937b4b29dd0859d9595228a8f1f42e924264e12766b506f4b43a6df8af6b94a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\frrlfxf.exec:\frrlfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\3bnhtn.exec:\3bnhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\7vjdv.exec:\7vjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\5lrlffr.exec:\5lrlffr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\vjdpj.exec:\vjdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\frrlfxr.exec:\frrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\3lfxrlf.exec:\3lfxrlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\nhbbtt.exec:\nhbbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\jjpjd.exec:\jjpjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\lffxrrl.exec:\lffxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\nnhbnn.exec:\nnhbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\nnhbtb.exec:\nnhbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\vdpjv.exec:\vdpjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\frrlxxr.exec:\frrlxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\thtbhn.exec:\thtbhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\vpvpp.exec:\vpvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\rfrxfrr.exec:\rfrxfrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\nhnhhh.exec:\nhnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\nhnhbb.exec:\nhnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vvpjv.exec:\vvpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\dvpdj.exec:\dvpdj.exe23⤵
- Executes dropped EXE
PID:440 -
\??\c:\rffrllx.exec:\rffrllx.exe24⤵
- Executes dropped EXE
PID:3548 -
\??\c:\ntbbnn.exec:\ntbbnn.exe25⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vdjpv.exec:\vdjpv.exe26⤵
- Executes dropped EXE
PID:3308 -
\??\c:\dvpjd.exec:\dvpjd.exe27⤵
- Executes dropped EXE
PID:4840 -
\??\c:\lfrlllr.exec:\lfrlllr.exe28⤵
- Executes dropped EXE
PID:3468 -
\??\c:\ffxxrll.exec:\ffxxrll.exe29⤵
- Executes dropped EXE
PID:3380 -
\??\c:\htntnn.exec:\htntnn.exe30⤵
- Executes dropped EXE
PID:2344 -
\??\c:\pvvpd.exec:\pvvpd.exe31⤵
- Executes dropped EXE
PID:4560 -
\??\c:\5lxlllr.exec:\5lxlllr.exe32⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nhbthb.exec:\nhbthb.exe34⤵
- Executes dropped EXE
PID:4488 -
\??\c:\5nnhtt.exec:\5nnhtt.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dpvjj.exec:\dpvjj.exe36⤵
- Executes dropped EXE
PID:5008 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe37⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fflffxf.exec:\fflffxf.exe38⤵
- Executes dropped EXE
PID:4988 -
\??\c:\hbttbb.exec:\hbttbb.exe39⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hthbnn.exec:\hthbnn.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\5vddd.exec:\5vddd.exe41⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3ffxlxr.exec:\3ffxlxr.exe42⤵
- Executes dropped EXE
PID:4928 -
\??\c:\bbhbbb.exec:\bbhbbb.exe43⤵
- Executes dropped EXE
PID:4684 -
\??\c:\hbbnhh.exec:\hbbnhh.exe44⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1dpjj.exec:\1dpjj.exe45⤵
- Executes dropped EXE
PID:3688 -
\??\c:\frfxrrx.exec:\frfxrrx.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1156 -
\??\c:\7flfxxr.exec:\7flfxxr.exe47⤵
- Executes dropped EXE
PID:2660 -
\??\c:\nnnhbb.exec:\nnnhbb.exe48⤵
- Executes dropped EXE
PID:5080 -
\??\c:\vjjpj.exec:\vjjpj.exe49⤵
- Executes dropped EXE
PID:1100 -
\??\c:\1vdjv.exec:\1vdjv.exe50⤵
- Executes dropped EXE
PID:3668 -
\??\c:\lxxxrrx.exec:\lxxxrrx.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\xllfffr.exec:\xllfffr.exe52⤵
- Executes dropped EXE
PID:656 -
\??\c:\hbbthh.exec:\hbbthh.exe53⤵
- Executes dropped EXE
PID:768 -
\??\c:\bttnhb.exec:\bttnhb.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\jppdv.exec:\jppdv.exe55⤵
- Executes dropped EXE
PID:4616 -
\??\c:\pddvj.exec:\pddvj.exe56⤵
- Executes dropped EXE
PID:3364 -
\??\c:\frlxllf.exec:\frlxllf.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2672 -
\??\c:\nhntbb.exec:\nhntbb.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\bbhhnn.exec:\bbhhnn.exe59⤵
- Executes dropped EXE
PID:8 -
\??\c:\vpjdd.exec:\vpjdd.exe60⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xrrrrfl.exec:\xrrrrfl.exe61⤵
- Executes dropped EXE
PID:4508 -
\??\c:\llxlfll.exec:\llxlfll.exe62⤵
- Executes dropped EXE
PID:968 -
\??\c:\thhnht.exec:\thhnht.exe63⤵
- Executes dropped EXE
PID:4576 -
\??\c:\ttthtt.exec:\ttthtt.exe64⤵
- Executes dropped EXE
PID:540 -
\??\c:\9jpdv.exec:\9jpdv.exe65⤵
- Executes dropped EXE
PID:3056 -
\??\c:\jddpj.exec:\jddpj.exe66⤵PID:3356
-
\??\c:\lllfrrl.exec:\lllfrrl.exe67⤵PID:3132
-
\??\c:\ffxxrrl.exec:\ffxxrrl.exe68⤵PID:2100
-
\??\c:\hntnnn.exec:\hntnnn.exe69⤵PID:2448
-
\??\c:\dvjdv.exec:\dvjdv.exe70⤵PID:1516
-
\??\c:\flfrlff.exec:\flfrlff.exe71⤵PID:1652
-
\??\c:\frrlffx.exec:\frrlffx.exe72⤵PID:4924
-
\??\c:\bhbhbt.exec:\bhbhbt.exe73⤵PID:2700
-
\??\c:\bnnhhb.exec:\bnnhhb.exe74⤵PID:3792
-
\??\c:\jdvpd.exec:\jdvpd.exe75⤵PID:2992
-
\??\c:\vdjdv.exec:\vdjdv.exe76⤵PID:4764
-
\??\c:\rxffxxl.exec:\rxffxxl.exe77⤵PID:4560
-
\??\c:\flfffxx.exec:\flfffxx.exe78⤵PID:4492
-
\??\c:\pvvpp.exec:\pvvpp.exe79⤵PID:5020
-
\??\c:\vddvp.exec:\vddvp.exe80⤵PID:4488
-
\??\c:\fxrfxxr.exec:\fxrfxxr.exe81⤵PID:4816
-
\??\c:\lfxrlll.exec:\lfxrlll.exe82⤵PID:100
-
\??\c:\hbbthh.exec:\hbbthh.exe83⤵PID:3560
-
\??\c:\dvvpp.exec:\dvvpp.exe84⤵PID:3368
-
\??\c:\3vvpd.exec:\3vvpd.exe85⤵PID:940
-
\??\c:\ffxrffx.exec:\ffxrffx.exe86⤵PID:2724
-
\??\c:\3btbtt.exec:\3btbtt.exe87⤵PID:4032
-
\??\c:\hbthbb.exec:\hbthbb.exe88⤵PID:948
-
\??\c:\1ddpv.exec:\1ddpv.exe89⤵PID:2756
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe90⤵PID:2928
-
\??\c:\xxlfxlf.exec:\xxlfxlf.exe91⤵PID:3688
-
\??\c:\5ttttn.exec:\5ttttn.exe92⤵PID:4892
-
\??\c:\jpvvj.exec:\jpvvj.exe93⤵PID:1884
-
\??\c:\rxlxlxl.exec:\rxlxlxl.exe94⤵PID:844
-
\??\c:\rrffllx.exec:\rrffllx.exe95⤵PID:3664
-
\??\c:\tbtnhb.exec:\tbtnhb.exe96⤵PID:3668
-
\??\c:\ddjvp.exec:\ddjvp.exe97⤵PID:2972
-
\??\c:\xrrfxrx.exec:\xrrfxrx.exe98⤵PID:3312
-
\??\c:\fxxfrrl.exec:\fxxfrrl.exe99⤵PID:2024
-
\??\c:\bnhbnn.exec:\bnhbnn.exe100⤵PID:2188
-
\??\c:\dpvpj.exec:\dpvpj.exe101⤵PID:848
-
\??\c:\xxflrlr.exec:\xxflrlr.exe102⤵PID:4632
-
\??\c:\lxfxxff.exec:\lxfxxff.exe103⤵PID:3360
-
\??\c:\tnbhbb.exec:\tnbhbb.exe104⤵PID:2208
-
\??\c:\ppdpj.exec:\ppdpj.exe105⤵PID:4760
-
\??\c:\5dvvj.exec:\5dvvj.exe106⤵PID:4836
-
\??\c:\xlrfrlf.exec:\xlrfrlf.exe107⤵PID:2716
-
\??\c:\bbnhbt.exec:\bbnhbt.exe108⤵PID:1204
-
\??\c:\nhhbtn.exec:\nhhbtn.exe109⤵PID:2512
-
\??\c:\jjdvv.exec:\jjdvv.exe110⤵PID:4328
-
\??\c:\vvppj.exec:\vvppj.exe111⤵PID:3772
-
\??\c:\xlllxxr.exec:\xlllxxr.exe112⤵PID:572
-
\??\c:\nbtnhh.exec:\nbtnhh.exe113⤵PID:1220
-
\??\c:\btbttt.exec:\btbttt.exe114⤵PID:3316
-
\??\c:\vjjdv.exec:\vjjdv.exe115⤵PID:4056
-
\??\c:\ppdvj.exec:\ppdvj.exe116⤵PID:1048
-
\??\c:\lffrfxr.exec:\lffrfxr.exe117⤵PID:2356
-
\??\c:\fllxrlf.exec:\fllxrlf.exe118⤵PID:4936
-
\??\c:\ntttnh.exec:\ntttnh.exe119⤵PID:1092
-
\??\c:\tnhbnn.exec:\tnhbnn.exe120⤵PID:4464
-
\??\c:\7vppp.exec:\7vppp.exe121⤵PID:4484
-
\??\c:\1vpdv.exec:\1vpdv.exe122⤵PID:4560
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-