Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 10:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
afd106fd955c1ebd86a4553e488fdc10N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
afd106fd955c1ebd86a4553e488fdc10N.exe
-
Size
250KB
-
MD5
afd106fd955c1ebd86a4553e488fdc10
-
SHA1
f24c855b50ab0abff082f39afe38dd5609cdabe5
-
SHA256
5d4f62cb3f2b7fa8b4ee0e4105ef3dfe06a36fd2a56f95b65f20baa383c6eaee
-
SHA512
9a3b38fa67ca61b366b064f8dba28f614a0a82a7e69f4d10908810b40f383c61990a553bfa0fd069de37582329e2d79d7ff68667e7b4efec31c492327e3cbabd
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRly:n3C9uD6AUDCa4NYmR0
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/4808-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-38-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4732 xlrxxfl.exe 4004 bntttt.exe 2000 jvddd.exe 3436 xxlfxff.exe 4516 fxlllfr.exe 3296 rrrffrx.exe 1104 1tthbh.exe 1760 vvpdp.exe 1112 xxrlxrf.exe 2032 nbbhhb.exe 752 xflxxrr.exe 3280 ttttnh.exe 1392 nbbhnt.exe 676 bhhnnh.exe 2016 rfxffrr.exe 1504 bbnntb.exe 4740 9jddd.exe 1412 llrrrrr.exe 2236 thbbhh.exe 1944 jpjpv.exe 944 ddppv.exe 4656 hnhntb.exe 1000 vvvdp.exe 1968 tttbhn.exe 2052 nbnhhh.exe 4388 tbbnnn.exe 904 jvppd.exe 3852 lflrxfl.exe 3688 bhnnnn.exe 1232 pvpjj.exe 4028 flxflrx.exe 4352 jppvv.exe 4808 tnbtth.exe 2484 9thbtt.exe 5080 ddjjp.exe 404 lrffllr.exe 3456 7xlllrx.exe 3992 bbtntb.exe 1312 djvjj.exe 1020 ppvpp.exe 2464 flflfrf.exe 2644 bbhhht.exe 2012 thtnht.exe 1964 jvjjv.exe 3712 xrxflrr.exe 1712 hbhnth.exe 1288 dvjjj.exe 2496 pjvdd.exe 2736 lfrxfrx.exe 4068 xfrxrxr.exe 3124 bbtbht.exe 4564 ppddj.exe 2760 jvjpv.exe 3276 flxlllf.exe 1292 5nhhbh.exe 1504 3jppp.exe 4756 vvdjj.exe 4872 flfxlfr.exe 4468 bbtbbh.exe 1012 dpvjd.exe 1984 frfxxll.exe 3084 fflxxxx.exe 3496 hthbbn.exe 2220 dpddd.exe -
resource yara_rule behavioral2/memory/4808-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4388-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxffrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thttbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrfflrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 4732 4808 afd106fd955c1ebd86a4553e488fdc10N.exe 83 PID 4808 wrote to memory of 4732 4808 afd106fd955c1ebd86a4553e488fdc10N.exe 83 PID 4808 wrote to memory of 4732 4808 afd106fd955c1ebd86a4553e488fdc10N.exe 83 PID 4732 wrote to memory of 4004 4732 xlrxxfl.exe 84 PID 4732 wrote to memory of 4004 4732 xlrxxfl.exe 84 PID 4732 wrote to memory of 4004 4732 xlrxxfl.exe 84 PID 4004 wrote to memory of 2000 4004 bntttt.exe 85 PID 4004 wrote to memory of 2000 4004 bntttt.exe 85 PID 4004 wrote to memory of 2000 4004 bntttt.exe 85 PID 2000 wrote to memory of 3436 2000 jvddd.exe 86 PID 2000 wrote to memory of 3436 2000 jvddd.exe 86 PID 2000 wrote to memory of 3436 2000 jvddd.exe 86 PID 3436 wrote to memory of 4516 3436 xxlfxff.exe 87 PID 3436 wrote to memory of 4516 3436 xxlfxff.exe 87 PID 3436 wrote to memory of 4516 3436 xxlfxff.exe 87 PID 4516 wrote to memory of 3296 4516 fxlllfr.exe 89 PID 4516 wrote to memory of 3296 4516 fxlllfr.exe 89 PID 4516 wrote to memory of 3296 4516 fxlllfr.exe 89 PID 3296 wrote to memory of 1104 3296 rrrffrx.exe 90 PID 3296 wrote to memory of 1104 3296 rrrffrx.exe 90 PID 3296 wrote to memory of 1104 3296 rrrffrx.exe 90 PID 1104 wrote to memory of 1760 1104 1tthbh.exe 91 PID 1104 wrote to memory of 1760 1104 1tthbh.exe 91 PID 1104 wrote to memory of 1760 1104 1tthbh.exe 91 PID 1760 wrote to memory of 1112 1760 vvpdp.exe 92 PID 1760 wrote to memory of 1112 1760 vvpdp.exe 92 PID 1760 wrote to memory of 1112 1760 vvpdp.exe 92 PID 1112 wrote to memory of 2032 1112 xxrlxrf.exe 93 PID 1112 wrote to memory of 2032 1112 xxrlxrf.exe 93 PID 1112 wrote to memory of 2032 1112 xxrlxrf.exe 93 PID 2032 wrote to memory of 752 2032 nbbhhb.exe 94 PID 2032 wrote to memory of 752 2032 nbbhhb.exe 94 PID 2032 wrote to memory of 752 2032 nbbhhb.exe 94 PID 752 wrote to memory of 3280 752 xflxxrr.exe 96 PID 752 wrote to memory of 3280 752 xflxxrr.exe 96 PID 752 wrote to memory of 3280 752 xflxxrr.exe 96 PID 3280 wrote to memory of 1392 3280 ttttnh.exe 97 PID 3280 wrote to memory of 1392 3280 ttttnh.exe 97 PID 3280 wrote to memory of 1392 3280 ttttnh.exe 97 PID 1392 wrote to memory of 676 1392 nbbhnt.exe 98 PID 1392 wrote to memory of 676 1392 nbbhnt.exe 98 PID 1392 wrote to memory of 676 1392 nbbhnt.exe 98 PID 676 wrote to memory of 2016 676 bhhnnh.exe 99 PID 676 wrote to memory of 2016 676 bhhnnh.exe 99 PID 676 wrote to memory of 2016 676 bhhnnh.exe 99 PID 2016 wrote to memory of 1504 2016 rfxffrr.exe 100 PID 2016 wrote to memory of 1504 2016 rfxffrr.exe 100 PID 2016 wrote to memory of 1504 2016 rfxffrr.exe 100 PID 1504 wrote to memory of 4740 1504 bbnntb.exe 101 PID 1504 wrote to memory of 4740 1504 bbnntb.exe 101 PID 1504 wrote to memory of 4740 1504 bbnntb.exe 101 PID 4740 wrote to memory of 1412 4740 9jddd.exe 103 PID 4740 wrote to memory of 1412 4740 9jddd.exe 103 PID 4740 wrote to memory of 1412 4740 9jddd.exe 103 PID 1412 wrote to memory of 2236 1412 llrrrrr.exe 104 PID 1412 wrote to memory of 2236 1412 llrrrrr.exe 104 PID 1412 wrote to memory of 2236 1412 llrrrrr.exe 104 PID 2236 wrote to memory of 1944 2236 thbbhh.exe 105 PID 2236 wrote to memory of 1944 2236 thbbhh.exe 105 PID 2236 wrote to memory of 1944 2236 thbbhh.exe 105 PID 1944 wrote to memory of 944 1944 jpjpv.exe 106 PID 1944 wrote to memory of 944 1944 jpjpv.exe 106 PID 1944 wrote to memory of 944 1944 jpjpv.exe 106 PID 944 wrote to memory of 4656 944 ddppv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\afd106fd955c1ebd86a4553e488fdc10N.exe"C:\Users\Admin\AppData\Local\Temp\afd106fd955c1ebd86a4553e488fdc10N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\xlrxxfl.exec:\xlrxxfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\bntttt.exec:\bntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\jvddd.exec:\jvddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\xxlfxff.exec:\xxlfxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3436 -
\??\c:\fxlllfr.exec:\fxlllfr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rrrffrx.exec:\rrrffrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\1tthbh.exec:\1tthbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\vvpdp.exec:\vvpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\xxrlxrf.exec:\xxrlxrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\nbbhhb.exec:\nbbhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xflxxrr.exec:\xflxxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\ttttnh.exec:\ttttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\nbbhnt.exec:\nbbhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\bhhnnh.exec:\bhhnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\rfxffrr.exec:\rfxffrr.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\bbnntb.exec:\bbnntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\9jddd.exec:\9jddd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\llrrrrr.exec:\llrrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\thbbhh.exec:\thbbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\jpjpv.exec:\jpjpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\ddppv.exec:\ddppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\hnhntb.exec:\hnhntb.exe23⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vvvdp.exec:\vvvdp.exe24⤵
- Executes dropped EXE
PID:1000 -
\??\c:\tttbhn.exec:\tttbhn.exe25⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nbnhhh.exec:\nbnhhh.exe26⤵
- Executes dropped EXE
PID:2052 -
\??\c:\tbbnnn.exec:\tbbnnn.exe27⤵
- Executes dropped EXE
PID:4388 -
\??\c:\jvppd.exec:\jvppd.exe28⤵
- Executes dropped EXE
PID:904 -
\??\c:\lflrxfl.exec:\lflrxfl.exe29⤵
- Executes dropped EXE
PID:3852 -
\??\c:\bhnnnn.exec:\bhnnnn.exe30⤵
- Executes dropped EXE
PID:3688 -
\??\c:\pvpjj.exec:\pvpjj.exe31⤵
- Executes dropped EXE
PID:1232 -
\??\c:\flxflrx.exec:\flxflrx.exe32⤵
- Executes dropped EXE
PID:4028 -
\??\c:\jppvv.exec:\jppvv.exe33⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnbtth.exec:\tnbtth.exe34⤵
- Executes dropped EXE
PID:4808 -
\??\c:\9thbtt.exec:\9thbtt.exe35⤵
- Executes dropped EXE
PID:2484 -
\??\c:\ddjjp.exec:\ddjjp.exe36⤵
- Executes dropped EXE
PID:5080 -
\??\c:\lrffllr.exec:\lrffllr.exe37⤵
- Executes dropped EXE
PID:404 -
\??\c:\7xlllrx.exec:\7xlllrx.exe38⤵
- Executes dropped EXE
PID:3456 -
\??\c:\bbtntb.exec:\bbtntb.exe39⤵
- Executes dropped EXE
PID:3992 -
\??\c:\djvjj.exec:\djvjj.exe40⤵
- Executes dropped EXE
PID:1312 -
\??\c:\ppvpp.exec:\ppvpp.exe41⤵
- Executes dropped EXE
PID:1020 -
\??\c:\flflfrf.exec:\flflfrf.exe42⤵
- Executes dropped EXE
PID:2464 -
\??\c:\bbhhht.exec:\bbhhht.exe43⤵
- Executes dropped EXE
PID:2644 -
\??\c:\thtnht.exec:\thtnht.exe44⤵
- Executes dropped EXE
PID:2012 -
\??\c:\jvjjv.exec:\jvjjv.exe45⤵
- Executes dropped EXE
PID:1964 -
\??\c:\xrxflrr.exec:\xrxflrr.exe46⤵
- Executes dropped EXE
PID:3712 -
\??\c:\hbhnth.exec:\hbhnth.exe47⤵
- Executes dropped EXE
PID:1712 -
\??\c:\dvjjj.exec:\dvjjj.exe48⤵
- Executes dropped EXE
PID:1288 -
\??\c:\pjvdd.exec:\pjvdd.exe49⤵
- Executes dropped EXE
PID:2496 -
\??\c:\lfrxfrx.exec:\lfrxfrx.exe50⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xfrxrxr.exec:\xfrxrxr.exe51⤵
- Executes dropped EXE
PID:4068 -
\??\c:\bbtbht.exec:\bbtbht.exe52⤵
- Executes dropped EXE
PID:3124 -
\??\c:\ppddj.exec:\ppddj.exe53⤵
- Executes dropped EXE
PID:4564 -
\??\c:\jvjpv.exec:\jvjpv.exe54⤵
- Executes dropped EXE
PID:2760 -
\??\c:\flxlllf.exec:\flxlllf.exe55⤵
- Executes dropped EXE
PID:3276 -
\??\c:\5nhhbh.exec:\5nhhbh.exe56⤵
- Executes dropped EXE
PID:1292 -
\??\c:\3jppp.exec:\3jppp.exe57⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vvdjj.exec:\vvdjj.exe58⤵
- Executes dropped EXE
PID:4756 -
\??\c:\flfxlfr.exec:\flfxlfr.exe59⤵
- Executes dropped EXE
PID:4872 -
\??\c:\bbtbbh.exec:\bbtbbh.exe60⤵
- Executes dropped EXE
PID:4468 -
\??\c:\dpvjd.exec:\dpvjd.exe61⤵
- Executes dropped EXE
PID:1012 -
\??\c:\frfxxll.exec:\frfxxll.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fflxxxx.exec:\fflxxxx.exe63⤵
- Executes dropped EXE
PID:3084 -
\??\c:\hthbbn.exec:\hthbbn.exe64⤵
- Executes dropped EXE
PID:3496 -
\??\c:\dpddd.exec:\dpddd.exe65⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xrxrrll.exec:\xrxrrll.exe66⤵PID:3596
-
\??\c:\ntbtbt.exec:\ntbtbt.exe67⤵PID:5088
-
\??\c:\thbbtb.exec:\thbbtb.exe68⤵PID:3936
-
\??\c:\xrllffx.exec:\xrllffx.exe69⤵PID:3920
-
\??\c:\hbttth.exec:\hbttth.exe70⤵PID:4524
-
\??\c:\ntttnt.exec:\ntttnt.exe71⤵PID:4484
-
\??\c:\jvddv.exec:\jvddv.exe72⤵PID:4664
-
\??\c:\rlrlxll.exec:\rlrlxll.exe73⤵PID:1928
-
\??\c:\bnhtbn.exec:\bnhtbn.exe74⤵PID:4192
-
\??\c:\djpjp.exec:\djpjp.exe75⤵
- System Location Discovery: System Language Discovery
PID:3988 -
\??\c:\rlxfxll.exec:\rlxfxll.exe76⤵PID:4356
-
\??\c:\tnhbtn.exec:\tnhbtn.exe77⤵PID:4576
-
\??\c:\7ppvp.exec:\7ppvp.exe78⤵PID:3060
-
\??\c:\vpppp.exec:\vpppp.exe79⤵PID:1864
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe80⤵PID:3692
-
\??\c:\thnhtt.exec:\thnhtt.exe81⤵PID:4620
-
\??\c:\vvppp.exec:\vvppp.exe82⤵PID:3872
-
\??\c:\djddd.exec:\djddd.exe83⤵PID:548
-
\??\c:\llxxfff.exec:\llxxfff.exe84⤵PID:4788
-
\??\c:\ddjjv.exec:\ddjjv.exe85⤵PID:2004
-
\??\c:\rfxlrxl.exec:\rfxlrxl.exe86⤵PID:3296
-
\??\c:\nbhbtt.exec:\nbhbtt.exe87⤵PID:1104
-
\??\c:\nbhhhn.exec:\nbhhhn.exe88⤵PID:4988
-
\??\c:\3pvvv.exec:\3pvvv.exe89⤵PID:4440
-
\??\c:\llrllfl.exec:\llrllfl.exe90⤵PID:2556
-
\??\c:\xxrxxlr.exec:\xxrxxlr.exe91⤵PID:1964
-
\??\c:\9btnbn.exec:\9btnbn.exe92⤵PID:3712
-
\??\c:\jjpjj.exec:\jjpjj.exe93⤵PID:4000
-
\??\c:\llxrllr.exec:\llxrllr.exe94⤵PID:1100
-
\??\c:\xxrlxfl.exec:\xxrlxfl.exe95⤵PID:752
-
\??\c:\nhhbbh.exec:\nhhbbh.exe96⤵PID:1916
-
\??\c:\vvdjp.exec:\vvdjp.exe97⤵PID:4020
-
\??\c:\lxlfxff.exec:\lxlfxff.exe98⤵PID:3384
-
\??\c:\1xlfxxl.exec:\1xlfxxl.exe99⤵PID:2956
-
\??\c:\hhhnth.exec:\hhhnth.exe100⤵PID:1120
-
\??\c:\vvjjd.exec:\vvjjd.exe101⤵PID:1500
-
\??\c:\xflllff.exec:\xflllff.exe102⤵PID:3272
-
\??\c:\lllllxl.exec:\lllllxl.exe103⤵PID:2988
-
\??\c:\nnttnn.exec:\nnttnn.exe104⤵PID:4804
-
\??\c:\1jvvd.exec:\1jvvd.exe105⤵PID:2508
-
\??\c:\jjdjv.exec:\jjdjv.exe106⤵PID:3248
-
\??\c:\1fllflx.exec:\1fllflx.exe107⤵PID:3164
-
\??\c:\bbhbht.exec:\bbhbht.exe108⤵PID:4204
-
\??\c:\hhnnnn.exec:\hhnnnn.exe109⤵PID:3084
-
\??\c:\5jpjj.exec:\5jpjj.exe110⤵PID:4136
-
\??\c:\rxxllrr.exec:\rxxllrr.exe111⤵PID:2872
-
\??\c:\hnnntt.exec:\hnnntt.exe112⤵PID:4300
-
\??\c:\bhtnbn.exec:\bhtnbn.exe113⤵PID:3332
-
\??\c:\pjpjj.exec:\pjpjj.exe114⤵PID:3852
-
\??\c:\lrfflrx.exec:\lrfflrx.exe115⤵PID:984
-
\??\c:\fxflfll.exec:\fxflfll.exe116⤵PID:4456
-
\??\c:\7nnnnh.exec:\7nnnnh.exe117⤵PID:1084
-
\??\c:\thnnnt.exec:\thnnnt.exe118⤵PID:2116
-
\??\c:\pjpjj.exec:\pjpjj.exe119⤵PID:5104
-
\??\c:\llfffll.exec:\llfffll.exe120⤵PID:2124
-
\??\c:\tnnbth.exec:\tnnbth.exe121⤵PID:404
-
\??\c:\pjppp.exec:\pjppp.exe122⤵PID:3436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-