Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08/09/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe
Resource
win7-20240903-en
General
-
Target
1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe
-
Size
82KB
-
MD5
ede0967ff87cc55acdde654977abf7c0
-
SHA1
c5bf62be175da58c387c4ede379e389ca782c85c
-
SHA256
1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6
-
SHA512
473566f480745b9d3b32605b290dafb128377793efd45153f67dee6d8690619ee6953ecf97a09f950cd09d267dace0c6cf59edcc7dac7a7338c2fc41544cc77f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Qc:ymb3NkkiQ3mdBjFIIp9L9QrrA8d
Malware Config
Signatures
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/3636-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3540-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3820-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4452 vdpvj.exe 3540 rxxrxlf.exe 1072 hhbbhh.exe 2252 1bnnhh.exe 4928 9vvpd.exe 1768 rflxrll.exe 4004 bhbhtn.exe 1404 hhnbtt.exe 1156 flfxrff.exe 3632 nnnhbb.exe 2628 dvvvv.exe 948 frxxxxr.exe 2336 rflfxxr.exe 3820 nntnhb.exe 2632 pvddv.exe 4872 llfxrrl.exe 2052 tnnhhh.exe 388 vjdpv.exe 3432 vdjvj.exe 1508 1fxlxrf.exe 3112 9bbtnh.exe 4160 ntbttn.exe 2028 dpjdp.exe 4936 rxlfrlx.exe 3680 ttbthb.exe 556 nhttnh.exe 4264 ppjdp.exe 4796 xflfxrl.exe 4116 9ffxlfr.exe 1804 bnnhtn.exe 3920 ddjvj.exe 3984 vjpdv.exe 2296 7rrlxxr.exe 2144 nhntbt.exe 1440 hnhbbn.exe 4376 vvjvj.exe 4000 pjvvd.exe 4460 rllfxff.exe 2484 nnhhbb.exe 3612 htnbhb.exe 4452 vvdvp.exe 1536 7dvjv.exe 1564 xlrllff.exe 3960 lxfxllf.exe 1496 nhbthh.exe 1900 9hhthh.exe 668 vjjjv.exe 2680 dvjdd.exe 832 xffxlfx.exe 4364 tnhntb.exe 1376 7nhthb.exe 4348 jjjvp.exe 4216 lfllfxx.exe 2412 nbnhbt.exe 3848 bntttb.exe 1436 pjjdp.exe 1400 pjjjp.exe 1596 3xrlxxl.exe 396 fxlfxrl.exe 5072 ttnhbn.exe 2752 nbnhhh.exe 1192 djjjp.exe 4244 3xxlffx.exe 4500 3flxrlf.exe -
resource yara_rule behavioral2/memory/3636-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3540-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3820-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lfrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3636 wrote to memory of 4452 3636 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 85 PID 3636 wrote to memory of 4452 3636 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 85 PID 3636 wrote to memory of 4452 3636 1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe 85 PID 4452 wrote to memory of 3540 4452 vdpvj.exe 86 PID 4452 wrote to memory of 3540 4452 vdpvj.exe 86 PID 4452 wrote to memory of 3540 4452 vdpvj.exe 86 PID 3540 wrote to memory of 1072 3540 rxxrxlf.exe 87 PID 3540 wrote to memory of 1072 3540 rxxrxlf.exe 87 PID 3540 wrote to memory of 1072 3540 rxxrxlf.exe 87 PID 1072 wrote to memory of 2252 1072 hhbbhh.exe 88 PID 1072 wrote to memory of 2252 1072 hhbbhh.exe 88 PID 1072 wrote to memory of 2252 1072 hhbbhh.exe 88 PID 2252 wrote to memory of 4928 2252 1bnnhh.exe 89 PID 2252 wrote to memory of 4928 2252 1bnnhh.exe 89 PID 2252 wrote to memory of 4928 2252 1bnnhh.exe 89 PID 4928 wrote to memory of 1768 4928 9vvpd.exe 90 PID 4928 wrote to memory of 1768 4928 9vvpd.exe 90 PID 4928 wrote to memory of 1768 4928 9vvpd.exe 90 PID 1768 wrote to memory of 4004 1768 rflxrll.exe 91 PID 1768 wrote to memory of 4004 1768 rflxrll.exe 91 PID 1768 wrote to memory of 4004 1768 rflxrll.exe 91 PID 4004 wrote to memory of 1404 4004 bhbhtn.exe 93 PID 4004 wrote to memory of 1404 4004 bhbhtn.exe 93 PID 4004 wrote to memory of 1404 4004 bhbhtn.exe 93 PID 1404 wrote to memory of 1156 1404 hhnbtt.exe 94 PID 1404 wrote to memory of 1156 1404 hhnbtt.exe 94 PID 1404 wrote to memory of 1156 1404 hhnbtt.exe 94 PID 1156 wrote to memory of 3632 1156 flfxrff.exe 95 PID 1156 wrote to memory of 3632 1156 flfxrff.exe 95 PID 1156 wrote to memory of 3632 1156 flfxrff.exe 95 PID 3632 wrote to memory of 2628 3632 nnnhbb.exe 97 PID 3632 wrote to memory of 2628 3632 nnnhbb.exe 97 PID 3632 wrote to memory of 2628 3632 nnnhbb.exe 97 PID 2628 wrote to memory of 948 2628 dvvvv.exe 98 PID 2628 wrote to memory of 948 2628 dvvvv.exe 98 PID 2628 wrote to memory of 948 2628 dvvvv.exe 98 PID 948 wrote to memory of 2336 948 frxxxxr.exe 99 PID 948 wrote to memory of 2336 948 frxxxxr.exe 99 PID 948 wrote to memory of 2336 948 frxxxxr.exe 99 PID 2336 wrote to memory of 3820 2336 rflfxxr.exe 100 PID 2336 wrote to memory of 3820 2336 rflfxxr.exe 100 PID 2336 wrote to memory of 3820 2336 rflfxxr.exe 100 PID 3820 wrote to memory of 2632 3820 nntnhb.exe 101 PID 3820 wrote to memory of 2632 3820 nntnhb.exe 101 PID 3820 wrote to memory of 2632 3820 nntnhb.exe 101 PID 2632 wrote to memory of 4872 2632 pvddv.exe 102 PID 2632 wrote to memory of 4872 2632 pvddv.exe 102 PID 2632 wrote to memory of 4872 2632 pvddv.exe 102 PID 4872 wrote to memory of 2052 4872 llfxrrl.exe 103 PID 4872 wrote to memory of 2052 4872 llfxrrl.exe 103 PID 4872 wrote to memory of 2052 4872 llfxrrl.exe 103 PID 2052 wrote to memory of 388 2052 tnnhhh.exe 105 PID 2052 wrote to memory of 388 2052 tnnhhh.exe 105 PID 2052 wrote to memory of 388 2052 tnnhhh.exe 105 PID 388 wrote to memory of 3432 388 vjdpv.exe 106 PID 388 wrote to memory of 3432 388 vjdpv.exe 106 PID 388 wrote to memory of 3432 388 vjdpv.exe 106 PID 3432 wrote to memory of 1508 3432 vdjvj.exe 107 PID 3432 wrote to memory of 1508 3432 vdjvj.exe 107 PID 3432 wrote to memory of 1508 3432 vdjvj.exe 107 PID 1508 wrote to memory of 3112 1508 1fxlxrf.exe 108 PID 1508 wrote to memory of 3112 1508 1fxlxrf.exe 108 PID 1508 wrote to memory of 3112 1508 1fxlxrf.exe 108 PID 3112 wrote to memory of 4160 3112 9bbtnh.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe"C:\Users\Admin\AppData\Local\Temp\1227009ad34adcf3881c869a05f1859a3ff95e9368897260200864a172d9e5f6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\vdpvj.exec:\vdpvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\rxxrxlf.exec:\rxxrxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\hhbbhh.exec:\hhbbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\1bnnhh.exec:\1bnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\9vvpd.exec:\9vvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\rflxrll.exec:\rflxrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\bhbhtn.exec:\bhbhtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\hhnbtt.exec:\hhnbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\flfxrff.exec:\flfxrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\nnnhbb.exec:\nnnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\dvvvv.exec:\dvvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\frxxxxr.exec:\frxxxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\rflfxxr.exec:\rflfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\nntnhb.exec:\nntnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\pvddv.exec:\pvddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\llfxrrl.exec:\llfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\tnnhhh.exec:\tnnhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vjdpv.exec:\vjdpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\vdjvj.exec:\vdjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\1fxlxrf.exec:\1fxlxrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\9bbtnh.exec:\9bbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\ntbttn.exec:\ntbttn.exe23⤵
- Executes dropped EXE
PID:4160 -
\??\c:\dpjdp.exec:\dpjdp.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rxlfrlx.exec:\rxlfrlx.exe25⤵
- Executes dropped EXE
PID:4936 -
\??\c:\ttbthb.exec:\ttbthb.exe26⤵
- Executes dropped EXE
PID:3680 -
\??\c:\nhttnh.exec:\nhttnh.exe27⤵
- Executes dropped EXE
PID:556 -
\??\c:\ppjdp.exec:\ppjdp.exe28⤵
- Executes dropped EXE
PID:4264 -
\??\c:\xflfxrl.exec:\xflfxrl.exe29⤵
- Executes dropped EXE
PID:4796 -
\??\c:\9ffxlfr.exec:\9ffxlfr.exe30⤵
- Executes dropped EXE
PID:4116 -
\??\c:\bnnhtn.exec:\bnnhtn.exe31⤵
- Executes dropped EXE
PID:1804 -
\??\c:\ddjvj.exec:\ddjvj.exe32⤵
- Executes dropped EXE
PID:3920 -
\??\c:\vjpdv.exec:\vjpdv.exe33⤵
- Executes dropped EXE
PID:3984 -
\??\c:\7rrlxxr.exec:\7rrlxxr.exe34⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nhntbt.exec:\nhntbt.exe35⤵
- Executes dropped EXE
PID:2144 -
\??\c:\hnhbbn.exec:\hnhbbn.exe36⤵
- Executes dropped EXE
PID:1440 -
\??\c:\vvjvj.exec:\vvjvj.exe37⤵
- Executes dropped EXE
PID:4376 -
\??\c:\pjvvd.exec:\pjvvd.exe38⤵
- Executes dropped EXE
PID:4000 -
\??\c:\rllfxff.exec:\rllfxff.exe39⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nnhhbb.exec:\nnhhbb.exe40⤵
- Executes dropped EXE
PID:2484 -
\??\c:\htnbhb.exec:\htnbhb.exe41⤵
- Executes dropped EXE
PID:3612 -
\??\c:\vvdvp.exec:\vvdvp.exe42⤵
- Executes dropped EXE
PID:4452 -
\??\c:\7dvjv.exec:\7dvjv.exe43⤵
- Executes dropped EXE
PID:1536 -
\??\c:\xlrllff.exec:\xlrllff.exe44⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lxfxllf.exec:\lxfxllf.exe45⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nhbthh.exec:\nhbthh.exe46⤵
- Executes dropped EXE
PID:1496 -
\??\c:\9hhthh.exec:\9hhthh.exe47⤵
- Executes dropped EXE
PID:1900 -
\??\c:\vjjjv.exec:\vjjjv.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:668 -
\??\c:\dvjdd.exec:\dvjdd.exe49⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xffxlfx.exec:\xffxlfx.exe50⤵
- Executes dropped EXE
PID:832 -
\??\c:\tnhntb.exec:\tnhntb.exe51⤵
- Executes dropped EXE
PID:4364 -
\??\c:\7nhthb.exec:\7nhthb.exe52⤵
- Executes dropped EXE
PID:1376 -
\??\c:\jjjvp.exec:\jjjvp.exe53⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lfllfxx.exec:\lfllfxx.exe54⤵
- Executes dropped EXE
PID:4216 -
\??\c:\nbnhbt.exec:\nbnhbt.exe55⤵
- Executes dropped EXE
PID:2412 -
\??\c:\bntttb.exec:\bntttb.exe56⤵
- Executes dropped EXE
PID:3848 -
\??\c:\pjjdp.exec:\pjjdp.exe57⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pjjjp.exec:\pjjjp.exe58⤵
- Executes dropped EXE
PID:1400 -
\??\c:\3xrlxxl.exec:\3xrlxxl.exe59⤵
- Executes dropped EXE
PID:1596 -
\??\c:\fxlfxrl.exec:\fxlfxrl.exe60⤵
- Executes dropped EXE
PID:396 -
\??\c:\ttnhbn.exec:\ttnhbn.exe61⤵
- Executes dropped EXE
PID:5072 -
\??\c:\nbnhhh.exec:\nbnhhh.exe62⤵
- Executes dropped EXE
PID:2752 -
\??\c:\djjjp.exec:\djjjp.exe63⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3xxlffx.exec:\3xxlffx.exe64⤵
- Executes dropped EXE
PID:4244 -
\??\c:\3flxrlf.exec:\3flxrlf.exe65⤵
- Executes dropped EXE
PID:4500 -
\??\c:\tnnhbt.exec:\tnnhbt.exe66⤵PID:696
-
\??\c:\tththt.exec:\tththt.exe67⤵PID:1872
-
\??\c:\vppjv.exec:\vppjv.exe68⤵PID:4764
-
\??\c:\xrrflxx.exec:\xrrflxx.exe69⤵PID:2124
-
\??\c:\rllxrrl.exec:\rllxrrl.exe70⤵PID:4848
-
\??\c:\bbbttt.exec:\bbbttt.exe71⤵PID:4968
-
\??\c:\7tnhnh.exec:\7tnhnh.exe72⤵PID:4972
-
\??\c:\5pjdp.exec:\5pjdp.exe73⤵PID:860
-
\??\c:\jjvjv.exec:\jjvjv.exe74⤵PID:4568
-
\??\c:\ffxlxrl.exec:\ffxlxrl.exe75⤵PID:1680
-
\??\c:\1xllrxf.exec:\1xllrxf.exe76⤵PID:3472
-
\??\c:\bhbtnh.exec:\bhbtnh.exe77⤵PID:2372
-
\??\c:\pjjvp.exec:\pjjvp.exe78⤵PID:2996
-
\??\c:\vjjvp.exec:\vjjvp.exe79⤵PID:4324
-
\??\c:\xffrrlx.exec:\xffrrlx.exe80⤵PID:2268
-
\??\c:\1bbhnt.exec:\1bbhnt.exe81⤵PID:4116
-
\??\c:\pdvpj.exec:\pdvpj.exe82⤵PID:2220
-
\??\c:\pjdpd.exec:\pjdpd.exe83⤵PID:2676
-
\??\c:\xlxlxlf.exec:\xlxlxlf.exe84⤵PID:3116
-
\??\c:\bnnhnh.exec:\bnnhnh.exe85⤵PID:3200
-
\??\c:\1nnbnh.exec:\1nnbnh.exe86⤵PID:2416
-
\??\c:\7pdpd.exec:\7pdpd.exe87⤵PID:2908
-
\??\c:\9pvjv.exec:\9pvjv.exe88⤵PID:1440
-
\??\c:\fxlxrlf.exec:\fxlxrlf.exe89⤵PID:4376
-
\??\c:\5bttht.exec:\5bttht.exe90⤵PID:4272
-
\??\c:\3bhtth.exec:\3bhtth.exe91⤵PID:3636
-
\??\c:\dvpjv.exec:\dvpjv.exe92⤵PID:2484
-
\??\c:\3flxfxr.exec:\3flxfxr.exe93⤵PID:3608
-
\??\c:\hntnbt.exec:\hntnbt.exe94⤵PID:4876
-
\??\c:\djdvp.exec:\djdvp.exe95⤵PID:1184
-
\??\c:\rxxflxf.exec:\rxxflxf.exe96⤵PID:1072
-
\??\c:\3ntnnh.exec:\3ntnnh.exe97⤵PID:2252
-
\??\c:\pvpvv.exec:\pvpvv.exe98⤵PID:1040
-
\??\c:\vjdpd.exec:\vjdpd.exe99⤵PID:4820
-
\??\c:\rllfllx.exec:\rllfllx.exe100⤵PID:4904
-
\??\c:\nbhbtt.exec:\nbhbtt.exe101⤵PID:716
-
\??\c:\thhbtn.exec:\thhbtn.exe102⤵PID:3028
-
\??\c:\dvpjv.exec:\dvpjv.exe103⤵PID:736
-
\??\c:\jdvpj.exec:\jdvpj.exe104⤵PID:3852
-
\??\c:\lfrlxrl.exec:\lfrlxrl.exe105⤵PID:2840
-
\??\c:\1nbthb.exec:\1nbthb.exe106⤵PID:3812
-
\??\c:\vjvpd.exec:\vjvpd.exe107⤵PID:2412
-
\??\c:\xrrllxf.exec:\xrrllxf.exe108⤵PID:1096
-
\??\c:\5bnhbt.exec:\5bnhbt.exe109⤵PID:1436
-
\??\c:\jdvpd.exec:\jdvpd.exe110⤵PID:2744
-
\??\c:\pdpjv.exec:\pdpjv.exe111⤵PID:4476
-
\??\c:\rrflfff.exec:\rrflfff.exe112⤵PID:2072
-
\??\c:\ffxlflx.exec:\ffxlflx.exe113⤵PID:908
-
\??\c:\7tbnhn.exec:\7tbnhn.exe114⤵PID:3640
-
\??\c:\tnnhtn.exec:\tnnhtn.exe115⤵PID:4620
-
\??\c:\jvpdv.exec:\jvpdv.exe116⤵PID:1760
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe117⤵PID:3432
-
\??\c:\nbnnnn.exec:\nbnnnn.exe118⤵PID:5080
-
\??\c:\vppjj.exec:\vppjj.exe119⤵PID:868
-
\??\c:\djdvj.exec:\djdvj.exe120⤵PID:3112
-
\??\c:\rffxxrr.exec:\rffxxrr.exe121⤵PID:804
-
\??\c:\1xrlffx.exec:\1xrlffx.exe122⤵PID:4488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-