Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13/09/2024, 02:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
82bf70fee4f0aa98319c90c7afcc1710N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
82bf70fee4f0aa98319c90c7afcc1710N.exe
-
Size
249KB
-
MD5
82bf70fee4f0aa98319c90c7afcc1710
-
SHA1
43252046ee1c38a93d765ceb03e4824434320d62
-
SHA256
f05a90a3e75924908edf946feaad95c62c6bab996f1116798e5700f222c2365e
-
SHA512
b518d3a4bd941a8d0f4cbcb741ddf6efcbecc367a8d089251a123941559595a75298706575aa4695ca0d11799399717e47ed591053e6de089381b3a3aef5fc74
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRlg:n3C9uD6AUDCa4NYmRy
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/1396-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1112 hhtnbn.exe 3316 djjdv.exe 4120 frfxrrr.exe 3800 5hhttb.exe 1692 frxrfrx.exe 3144 5lrlfff.exe 2268 jpjpj.exe 3060 9rrrxfx.exe 804 pddvj.exe 2484 frfllll.exe 4928 bttbbn.exe 1180 vvpdp.exe 728 btbnbt.exe 4856 pdpdp.exe 684 7rrlxxr.exe 1056 9bbbtn.exe 1220 flxlfrx.exe 4680 3hnbnh.exe 2564 5vvpp.exe 2600 lrrfrll.exe 2616 jdvpj.exe 1672 xxrfxlx.exe 2288 9ffrxrl.exe 2348 1bhbtn.exe 4624 ppjdv.exe 1528 lrfrlxx.exe 2068 bnhtnh.exe 1788 rxfrlfx.exe 4176 9fxxlfx.exe 4740 bnnnhb.exe 3148 9dpjj.exe 3324 nhhbnn.exe 1268 hbbthb.exe 404 jvvjv.exe 4264 1rxlfxl.exe 2100 xllfxlf.exe 116 1hbhbb.exe 3348 vvdpd.exe 4908 3jvpj.exe 2028 lfxrlfr.exe 4708 lxrlxxl.exe 216 9thbnn.exe 3820 dvdjv.exe 3064 dppjd.exe 4240 3flxllx.exe 1176 lrrfrxf.exe 3808 bnntbb.exe 2916 1dvjp.exe 3012 9lxrllf.exe 4900 lffrlxr.exe 1628 btnhtn.exe 4676 9nthtn.exe 2520 vjjdp.exe 3600 lxxlfxr.exe 1540 5xxxlfx.exe 4468 bttnhb.exe 2576 ntthnh.exe 4432 1vjvp.exe 1088 1xlxlfx.exe 2396 tnbtnb.exe 728 5tthnh.exe 2556 jdvjv.exe 1556 1rrlxrr.exe 964 bnnnbh.exe -
resource yara_rule behavioral2/memory/1396-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1396 wrote to memory of 1112 1396 82bf70fee4f0aa98319c90c7afcc1710N.exe 83 PID 1396 wrote to memory of 1112 1396 82bf70fee4f0aa98319c90c7afcc1710N.exe 83 PID 1396 wrote to memory of 1112 1396 82bf70fee4f0aa98319c90c7afcc1710N.exe 83 PID 1112 wrote to memory of 3316 1112 hhtnbn.exe 84 PID 1112 wrote to memory of 3316 1112 hhtnbn.exe 84 PID 1112 wrote to memory of 3316 1112 hhtnbn.exe 84 PID 3316 wrote to memory of 4120 3316 djjdv.exe 85 PID 3316 wrote to memory of 4120 3316 djjdv.exe 85 PID 3316 wrote to memory of 4120 3316 djjdv.exe 85 PID 4120 wrote to memory of 3800 4120 frfxrrr.exe 86 PID 4120 wrote to memory of 3800 4120 frfxrrr.exe 86 PID 4120 wrote to memory of 3800 4120 frfxrrr.exe 86 PID 3800 wrote to memory of 1692 3800 5hhttb.exe 87 PID 3800 wrote to memory of 1692 3800 5hhttb.exe 87 PID 3800 wrote to memory of 1692 3800 5hhttb.exe 87 PID 1692 wrote to memory of 3144 1692 frxrfrx.exe 89 PID 1692 wrote to memory of 3144 1692 frxrfrx.exe 89 PID 1692 wrote to memory of 3144 1692 frxrfrx.exe 89 PID 3144 wrote to memory of 2268 3144 5lrlfff.exe 90 PID 3144 wrote to memory of 2268 3144 5lrlfff.exe 90 PID 3144 wrote to memory of 2268 3144 5lrlfff.exe 90 PID 2268 wrote to memory of 3060 2268 jpjpj.exe 91 PID 2268 wrote to memory of 3060 2268 jpjpj.exe 91 PID 2268 wrote to memory of 3060 2268 jpjpj.exe 91 PID 3060 wrote to memory of 804 3060 9rrrxfx.exe 92 PID 3060 wrote to memory of 804 3060 9rrrxfx.exe 92 PID 3060 wrote to memory of 804 3060 9rrrxfx.exe 92 PID 804 wrote to memory of 2484 804 pddvj.exe 94 PID 804 wrote to memory of 2484 804 pddvj.exe 94 PID 804 wrote to memory of 2484 804 pddvj.exe 94 PID 2484 wrote to memory of 4928 2484 frfllll.exe 95 PID 2484 wrote to memory of 4928 2484 frfllll.exe 95 PID 2484 wrote to memory of 4928 2484 frfllll.exe 95 PID 4928 wrote to memory of 1180 4928 bttbbn.exe 97 PID 4928 wrote to memory of 1180 4928 bttbbn.exe 97 PID 4928 wrote to memory of 1180 4928 bttbbn.exe 97 PID 1180 wrote to memory of 728 1180 vvpdp.exe 98 PID 1180 wrote to memory of 728 1180 vvpdp.exe 98 PID 1180 wrote to memory of 728 1180 vvpdp.exe 98 PID 728 wrote to memory of 4856 728 btbnbt.exe 99 PID 728 wrote to memory of 4856 728 btbnbt.exe 99 PID 728 wrote to memory of 4856 728 btbnbt.exe 99 PID 4856 wrote to memory of 684 4856 pdpdp.exe 100 PID 4856 wrote to memory of 684 4856 pdpdp.exe 100 PID 4856 wrote to memory of 684 4856 pdpdp.exe 100 PID 684 wrote to memory of 1056 684 7rrlxxr.exe 101 PID 684 wrote to memory of 1056 684 7rrlxxr.exe 101 PID 684 wrote to memory of 1056 684 7rrlxxr.exe 101 PID 1056 wrote to memory of 1220 1056 9bbbtn.exe 102 PID 1056 wrote to memory of 1220 1056 9bbbtn.exe 102 PID 1056 wrote to memory of 1220 1056 9bbbtn.exe 102 PID 1220 wrote to memory of 4680 1220 flxlfrx.exe 103 PID 1220 wrote to memory of 4680 1220 flxlfrx.exe 103 PID 1220 wrote to memory of 4680 1220 flxlfrx.exe 103 PID 4680 wrote to memory of 2564 4680 3hnbnh.exe 104 PID 4680 wrote to memory of 2564 4680 3hnbnh.exe 104 PID 4680 wrote to memory of 2564 4680 3hnbnh.exe 104 PID 2564 wrote to memory of 2600 2564 5vvpp.exe 105 PID 2564 wrote to memory of 2600 2564 5vvpp.exe 105 PID 2564 wrote to memory of 2600 2564 5vvpp.exe 105 PID 2600 wrote to memory of 2616 2600 lrrfrll.exe 106 PID 2600 wrote to memory of 2616 2600 lrrfrll.exe 106 PID 2600 wrote to memory of 2616 2600 lrrfrll.exe 106 PID 2616 wrote to memory of 1672 2616 jdvpj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\82bf70fee4f0aa98319c90c7afcc1710N.exe"C:\Users\Admin\AppData\Local\Temp\82bf70fee4f0aa98319c90c7afcc1710N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\hhtnbn.exec:\hhtnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\djjdv.exec:\djjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\frfxrrr.exec:\frfxrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\5hhttb.exec:\5hhttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\frxrfrx.exec:\frxrfrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5lrlfff.exec:\5lrlfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\jpjpj.exec:\jpjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\9rrrxfx.exec:\9rrrxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pddvj.exec:\pddvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\frfllll.exec:\frfllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\bttbbn.exec:\bttbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\vvpdp.exec:\vvpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\btbnbt.exec:\btbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\pdpdp.exec:\pdpdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\7rrlxxr.exec:\7rrlxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\9bbbtn.exec:\9bbbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\flxlfrx.exec:\flxlfrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\3hnbnh.exec:\3hnbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\5vvpp.exec:\5vvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\lrrfrll.exec:\lrrfrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\jdvpj.exec:\jdvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xxrfxlx.exec:\xxrfxlx.exe23⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9ffrxrl.exec:\9ffrxrl.exe24⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1bhbtn.exec:\1bhbtn.exe25⤵
- Executes dropped EXE
PID:2348 -
\??\c:\ppjdv.exec:\ppjdv.exe26⤵
- Executes dropped EXE
PID:4624 -
\??\c:\lrfrlxx.exec:\lrfrlxx.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bnhtnh.exec:\bnhtnh.exe28⤵
- Executes dropped EXE
PID:2068 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe29⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9fxxlfx.exec:\9fxxlfx.exe30⤵
- Executes dropped EXE
PID:4176 -
\??\c:\bnnnhb.exec:\bnnnhb.exe31⤵
- Executes dropped EXE
PID:4740 -
\??\c:\9dpjj.exec:\9dpjj.exe32⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nhhbnn.exec:\nhhbnn.exe33⤵
- Executes dropped EXE
PID:3324 -
\??\c:\hbbthb.exec:\hbbthb.exe34⤵
- Executes dropped EXE
PID:1268 -
\??\c:\jvvjv.exec:\jvvjv.exe35⤵
- Executes dropped EXE
PID:404 -
\??\c:\1rxlfxl.exec:\1rxlfxl.exe36⤵
- Executes dropped EXE
PID:4264 -
\??\c:\xllfxlf.exec:\xllfxlf.exe37⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1hbhbb.exec:\1hbhbb.exe38⤵
- Executes dropped EXE
PID:116 -
\??\c:\vvdpd.exec:\vvdpd.exe39⤵
- Executes dropped EXE
PID:3348 -
\??\c:\3jvpj.exec:\3jvpj.exe40⤵
- Executes dropped EXE
PID:4908 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe41⤵
- Executes dropped EXE
PID:2028 -
\??\c:\lxrlxxl.exec:\lxrlxxl.exe42⤵
- Executes dropped EXE
PID:4708 -
\??\c:\9thbnn.exec:\9thbnn.exe43⤵
- Executes dropped EXE
PID:216 -
\??\c:\dvdjv.exec:\dvdjv.exe44⤵
- Executes dropped EXE
PID:3820 -
\??\c:\dppjd.exec:\dppjd.exe45⤵
- Executes dropped EXE
PID:3064 -
\??\c:\3flxllx.exec:\3flxllx.exe46⤵
- Executes dropped EXE
PID:4240 -
\??\c:\lrrfrxf.exec:\lrrfrxf.exe47⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bnntbb.exec:\bnntbb.exe48⤵
- Executes dropped EXE
PID:3808 -
\??\c:\1dvjp.exec:\1dvjp.exe49⤵
- Executes dropped EXE
PID:2916 -
\??\c:\9lxrllf.exec:\9lxrllf.exe50⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lffrlxr.exec:\lffrlxr.exe51⤵
- Executes dropped EXE
PID:4900 -
\??\c:\btnhtn.exec:\btnhtn.exe52⤵
- Executes dropped EXE
PID:1628 -
\??\c:\9nthtn.exec:\9nthtn.exe53⤵
- Executes dropped EXE
PID:4676 -
\??\c:\vjjdp.exec:\vjjdp.exe54⤵
- Executes dropped EXE
PID:2520 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe55⤵
- Executes dropped EXE
PID:3600 -
\??\c:\5xxxlfx.exec:\5xxxlfx.exe56⤵
- Executes dropped EXE
PID:1540 -
\??\c:\bttnhb.exec:\bttnhb.exe57⤵
- Executes dropped EXE
PID:4468 -
\??\c:\ntthnh.exec:\ntthnh.exe58⤵
- Executes dropped EXE
PID:2576 -
\??\c:\1vjvp.exec:\1vjvp.exe59⤵
- Executes dropped EXE
PID:4432 -
\??\c:\1xlxlfx.exec:\1xlxlfx.exe60⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tnbtnb.exec:\tnbtnb.exe61⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5tthnh.exec:\5tthnh.exe62⤵
- Executes dropped EXE
PID:728 -
\??\c:\jdvjv.exec:\jdvjv.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\1rrlxrr.exec:\1rrlxrr.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\bnnnbh.exec:\bnnnbh.exe65⤵
- Executes dropped EXE
PID:964 -
\??\c:\tbtnbt.exec:\tbtnbt.exe66⤵PID:4672
-
\??\c:\7ppjj.exec:\7ppjj.exe67⤵PID:1220
-
\??\c:\dddpp.exec:\dddpp.exe68⤵PID:2636
-
\??\c:\lxxrxrl.exec:\lxxrxrl.exe69⤵PID:3272
-
\??\c:\1lfxrrl.exec:\1lfxrrl.exe70⤵PID:664
-
\??\c:\tbtnbt.exec:\tbtnbt.exe71⤵PID:1624
-
\??\c:\7tthbt.exec:\7tthbt.exe72⤵PID:3848
-
\??\c:\vddpd.exec:\vddpd.exe73⤵PID:4124
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe74⤵PID:4228
-
\??\c:\3llxllx.exec:\3llxllx.exe75⤵PID:3152
-
\??\c:\1nnnbt.exec:\1nnnbt.exe76⤵PID:2348
-
\??\c:\ppjvd.exec:\ppjvd.exe77⤵PID:1036
-
\??\c:\dpppj.exec:\dpppj.exe78⤵PID:2528
-
\??\c:\xffrfxr.exec:\xffrfxr.exe79⤵PID:2024
-
\??\c:\rflrlfx.exec:\rflrlfx.exe80⤵PID:1844
-
\??\c:\tbhbbb.exec:\tbhbbb.exe81⤵PID:1748
-
\??\c:\vjvjd.exec:\vjvjd.exe82⤵PID:1952
-
\??\c:\fllfxrl.exec:\fllfxrl.exe83⤵PID:3576
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe84⤵PID:4164
-
\??\c:\tbhtht.exec:\tbhtht.exe85⤵PID:1900
-
\??\c:\9vdvp.exec:\9vdvp.exe86⤵PID:4744
-
\??\c:\1jvpd.exec:\1jvpd.exe87⤵PID:2416
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe88⤵PID:1428
-
\??\c:\lxxxrlx.exec:\lxxxrlx.exe89⤵PID:3464
-
\??\c:\7hnbnb.exec:\7hnbnb.exe90⤵PID:3548
-
\??\c:\vjjjv.exec:\vjjjv.exe91⤵PID:1256
-
\??\c:\5vvjp.exec:\5vvjp.exe92⤵PID:1396
-
\??\c:\xxxxlfr.exec:\xxxxlfr.exe93⤵PID:2948
-
\??\c:\3fxrffr.exec:\3fxrffr.exe94⤵PID:2480
-
\??\c:\bththb.exec:\bththb.exe95⤵PID:1276
-
\??\c:\ppvpj.exec:\ppvpj.exe96⤵PID:1064
-
\??\c:\7jvpd.exec:\7jvpd.exe97⤵PID:4804
-
\??\c:\xffrfxr.exec:\xffrfxr.exe98⤵PID:4240
-
\??\c:\5flfrll.exec:\5flfrll.exe99⤵PID:1176
-
\??\c:\bbnnbh.exec:\bbnnbh.exe100⤵PID:3808
-
\??\c:\vdvdj.exec:\vdvdj.exe101⤵
- System Location Discovery: System Language Discovery
PID:2104 -
\??\c:\dppdv.exec:\dppdv.exe102⤵PID:2224
-
\??\c:\xfxlxrf.exec:\xfxlxrf.exe103⤵PID:4568
-
\??\c:\fxrffxr.exec:\fxrffxr.exe104⤵PID:1628
-
\??\c:\7bbtbb.exec:\7bbtbb.exe105⤵PID:4956
-
\??\c:\ttnnbt.exec:\ttnnbt.exe106⤵PID:2520
-
\??\c:\3jdpj.exec:\3jdpj.exe107⤵PID:4140
-
\??\c:\vpvpp.exec:\vpvpp.exe108⤵PID:388
-
\??\c:\lrfrfxr.exec:\lrfrfxr.exe109⤵PID:3892
-
\??\c:\nbtnnt.exec:\nbtnnt.exe110⤵PID:2112
-
\??\c:\pdvdd.exec:\pdvdd.exe111⤵PID:1384
-
\??\c:\pppdp.exec:\pppdp.exe112⤵PID:3844
-
\??\c:\3xxlxrl.exec:\3xxlxrl.exe113⤵PID:2396
-
\??\c:\3bbbtt.exec:\3bbbtt.exe114⤵PID:728
-
\??\c:\bnbntb.exec:\bnbntb.exe115⤵PID:684
-
\??\c:\jdddp.exec:\jdddp.exe116⤵PID:1556
-
\??\c:\fllfxrl.exec:\fllfxrl.exe117⤵PID:4004
-
\??\c:\xxxxrlf.exec:\xxxxrlf.exe118⤵PID:1560
-
\??\c:\bnbhbh.exec:\bnbhbh.exe119⤵PID:3936
-
\??\c:\jjvpv.exec:\jjvpv.exe120⤵PID:1520
-
\??\c:\vvvvd.exec:\vvvvd.exe121⤵PID:924
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe122⤵PID:4108
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-