Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-09-2024 21:30
Static task
static1
Behavioral task
behavioral1
Sample
6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe
Resource
win7-20240903-en
General
-
Target
6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe
-
Size
79KB
-
MD5
f80cfb91ff24007a8869eaeb5a423900
-
SHA1
0d301c578e0ec5e4dce34d3e3f3b81c0f4cb4dd2
-
SHA256
6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6
-
SHA512
b5549713a5e94d5a74034144acff3c214876d5de9276c6ac995e29172a6c19f613651bce60794d3f99715839bf11da139401341bc4ba4a66371037b163f5d63c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeF:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4i
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/2144-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3564 tttbhh.exe 4752 7vddd.exe 3852 7xxrlll.exe 3088 xlllfff.exe 3084 9tnnhh.exe 2140 ntbtnn.exe 116 pjvpj.exe 4228 rrllfff.exe 2116 rllllrr.exe 2188 bthhbt.exe 1232 dvddv.exe 1532 dvddv.exe 916 xrflfxf.exe 2228 nhtbtb.exe 3976 vppjd.exe 2688 pvddj.exe 4488 lrrlffx.exe 4292 tnbtnn.exe 1508 pjjdd.exe 4216 flrlrrl.exe 5084 9lrrxxf.exe 436 ttnnnt.exe 1936 1pppd.exe 1648 9rxrlff.exe 4188 rffxrrr.exe 972 htbttt.exe 4204 jjdjj.exe 4088 jjvpd.exe 2220 fxxrllf.exe 1452 bbbbtt.exe 4664 dvdvd.exe 3664 lxrrrxx.exe 4776 tthtth.exe 1836 jdvvp.exe 1132 vvdpv.exe 4800 xrrllll.exe 2844 rlrllll.exe 2920 vdddv.exe 3860 pdjdv.exe 2968 rrxrflr.exe 4328 9xrrllf.exe 5008 ntbhbb.exe 4272 vdpjd.exe 2712 rlrlllr.exe 1640 xrrrrrr.exe 4760 jddpj.exe 2556 frxrrrr.exe 1572 nnnntb.exe 4092 ddpjd.exe 2140 nbhttn.exe 3420 rlfxffx.exe 2672 pdddd.exe 868 1rffllf.exe 1652 9fflfrr.exe 4732 1ttttt.exe 4828 nnhtnb.exe 3096 pjjjj.exe 4556 rxrlfrl.exe 4656 5rrllxr.exe 4476 bthbtt.exe 400 3vppd.exe 2228 pjjdv.exe 3884 xrrrlll.exe 2104 bttttt.exe -
resource yara_rule behavioral2/memory/2144-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1508-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nthtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 3564 2144 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 82 PID 2144 wrote to memory of 3564 2144 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 82 PID 2144 wrote to memory of 3564 2144 6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe 82 PID 3564 wrote to memory of 4752 3564 tttbhh.exe 83 PID 3564 wrote to memory of 4752 3564 tttbhh.exe 83 PID 3564 wrote to memory of 4752 3564 tttbhh.exe 83 PID 4752 wrote to memory of 3852 4752 7vddd.exe 84 PID 4752 wrote to memory of 3852 4752 7vddd.exe 84 PID 4752 wrote to memory of 3852 4752 7vddd.exe 84 PID 3852 wrote to memory of 3088 3852 7xxrlll.exe 85 PID 3852 wrote to memory of 3088 3852 7xxrlll.exe 85 PID 3852 wrote to memory of 3088 3852 7xxrlll.exe 85 PID 3088 wrote to memory of 3084 3088 xlllfff.exe 86 PID 3088 wrote to memory of 3084 3088 xlllfff.exe 86 PID 3088 wrote to memory of 3084 3088 xlllfff.exe 86 PID 3084 wrote to memory of 2140 3084 9tnnhh.exe 87 PID 3084 wrote to memory of 2140 3084 9tnnhh.exe 87 PID 3084 wrote to memory of 2140 3084 9tnnhh.exe 87 PID 2140 wrote to memory of 116 2140 ntbtnn.exe 88 PID 2140 wrote to memory of 116 2140 ntbtnn.exe 88 PID 2140 wrote to memory of 116 2140 ntbtnn.exe 88 PID 116 wrote to memory of 4228 116 pjvpj.exe 89 PID 116 wrote to memory of 4228 116 pjvpj.exe 89 PID 116 wrote to memory of 4228 116 pjvpj.exe 89 PID 4228 wrote to memory of 2116 4228 rrllfff.exe 90 PID 4228 wrote to memory of 2116 4228 rrllfff.exe 90 PID 4228 wrote to memory of 2116 4228 rrllfff.exe 90 PID 2116 wrote to memory of 2188 2116 rllllrr.exe 91 PID 2116 wrote to memory of 2188 2116 rllllrr.exe 91 PID 2116 wrote to memory of 2188 2116 rllllrr.exe 91 PID 2188 wrote to memory of 1232 2188 bthhbt.exe 92 PID 2188 wrote to memory of 1232 2188 bthhbt.exe 92 PID 2188 wrote to memory of 1232 2188 bthhbt.exe 92 PID 1232 wrote to memory of 1532 1232 dvddv.exe 93 PID 1232 wrote to memory of 1532 1232 dvddv.exe 93 PID 1232 wrote to memory of 1532 1232 dvddv.exe 93 PID 1532 wrote to memory of 916 1532 dvddv.exe 94 PID 1532 wrote to memory of 916 1532 dvddv.exe 94 PID 1532 wrote to memory of 916 1532 dvddv.exe 94 PID 916 wrote to memory of 2228 916 xrflfxf.exe 95 PID 916 wrote to memory of 2228 916 xrflfxf.exe 95 PID 916 wrote to memory of 2228 916 xrflfxf.exe 95 PID 2228 wrote to memory of 3976 2228 nhtbtb.exe 96 PID 2228 wrote to memory of 3976 2228 nhtbtb.exe 96 PID 2228 wrote to memory of 3976 2228 nhtbtb.exe 96 PID 3976 wrote to memory of 2688 3976 vppjd.exe 97 PID 3976 wrote to memory of 2688 3976 vppjd.exe 97 PID 3976 wrote to memory of 2688 3976 vppjd.exe 97 PID 2688 wrote to memory of 4488 2688 pvddj.exe 98 PID 2688 wrote to memory of 4488 2688 pvddj.exe 98 PID 2688 wrote to memory of 4488 2688 pvddj.exe 98 PID 4488 wrote to memory of 4292 4488 lrrlffx.exe 99 PID 4488 wrote to memory of 4292 4488 lrrlffx.exe 99 PID 4488 wrote to memory of 4292 4488 lrrlffx.exe 99 PID 4292 wrote to memory of 1508 4292 tnbtnn.exe 100 PID 4292 wrote to memory of 1508 4292 tnbtnn.exe 100 PID 4292 wrote to memory of 1508 4292 tnbtnn.exe 100 PID 1508 wrote to memory of 4216 1508 pjjdd.exe 101 PID 1508 wrote to memory of 4216 1508 pjjdd.exe 101 PID 1508 wrote to memory of 4216 1508 pjjdd.exe 101 PID 4216 wrote to memory of 5084 4216 flrlrrl.exe 102 PID 4216 wrote to memory of 5084 4216 flrlrrl.exe 102 PID 4216 wrote to memory of 5084 4216 flrlrrl.exe 102 PID 5084 wrote to memory of 436 5084 9lrrxxf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe"C:\Users\Admin\AppData\Local\Temp\6d20f1f8a985af185a9e837bae43c42ba865a1996094a8df6803728e16026fa6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\tttbhh.exec:\tttbhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\7vddd.exec:\7vddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\7xxrlll.exec:\7xxrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\xlllfff.exec:\xlllfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\9tnnhh.exec:\9tnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\ntbtnn.exec:\ntbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pjvpj.exec:\pjvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rrllfff.exec:\rrllfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\rllllrr.exec:\rllllrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\bthhbt.exec:\bthhbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\dvddv.exec:\dvddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\dvddv.exec:\dvddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\xrflfxf.exec:\xrflfxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\nhtbtb.exec:\nhtbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\vppjd.exec:\vppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\pvddj.exec:\pvddj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\lrrlffx.exec:\lrrlffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\tnbtnn.exec:\tnbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\pjjdd.exec:\pjjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\flrlrrl.exec:\flrlrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\9lrrxxf.exec:\9lrrxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\ttnnnt.exec:\ttnnnt.exe23⤵
- Executes dropped EXE
PID:436 -
\??\c:\1pppd.exec:\1pppd.exe24⤵
- Executes dropped EXE
PID:1936 -
\??\c:\9rxrlff.exec:\9rxrlff.exe25⤵
- Executes dropped EXE
PID:1648 -
\??\c:\rffxrrr.exec:\rffxrrr.exe26⤵
- Executes dropped EXE
PID:4188 -
\??\c:\htbttt.exec:\htbttt.exe27⤵
- Executes dropped EXE
PID:972 -
\??\c:\jjdjj.exec:\jjdjj.exe28⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jjvpd.exec:\jjvpd.exe29⤵
- Executes dropped EXE
PID:4088 -
\??\c:\fxxrllf.exec:\fxxrllf.exe30⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bbbbtt.exec:\bbbbtt.exe31⤵
- Executes dropped EXE
PID:1452 -
\??\c:\dvdvd.exec:\dvdvd.exe32⤵
- Executes dropped EXE
PID:4664 -
\??\c:\lxrrrxx.exec:\lxrrrxx.exe33⤵
- Executes dropped EXE
PID:3664 -
\??\c:\tthtth.exec:\tthtth.exe34⤵
- Executes dropped EXE
PID:4776 -
\??\c:\jdvvp.exec:\jdvvp.exe35⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vvdpv.exec:\vvdpv.exe36⤵
- Executes dropped EXE
PID:1132 -
\??\c:\xrrllll.exec:\xrrllll.exe37⤵
- Executes dropped EXE
PID:4800 -
\??\c:\rlrllll.exec:\rlrllll.exe38⤵
- Executes dropped EXE
PID:2844 -
\??\c:\vdddv.exec:\vdddv.exe39⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdjdv.exec:\pdjdv.exe40⤵
- Executes dropped EXE
PID:3860 -
\??\c:\rrxrflr.exec:\rrxrflr.exe41⤵
- Executes dropped EXE
PID:2968 -
\??\c:\9xrrllf.exec:\9xrrllf.exe42⤵
- Executes dropped EXE
PID:4328 -
\??\c:\ntbhbb.exec:\ntbhbb.exe43⤵
- Executes dropped EXE
PID:5008 -
\??\c:\vdpjd.exec:\vdpjd.exe44⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rlrlllr.exec:\rlrlllr.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2712 -
\??\c:\xrrrrrr.exec:\xrrrrrr.exe46⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jddpj.exec:\jddpj.exe47⤵
- Executes dropped EXE
PID:4760 -
\??\c:\frxrrrr.exec:\frxrrrr.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nnnntb.exec:\nnnntb.exe49⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ddpjd.exec:\ddpjd.exe50⤵
- Executes dropped EXE
PID:4092 -
\??\c:\nbhttn.exec:\nbhttn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2140 -
\??\c:\rlfxffx.exec:\rlfxffx.exe52⤵
- Executes dropped EXE
PID:3420 -
\??\c:\pdddd.exec:\pdddd.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\1rffllf.exec:\1rffllf.exe54⤵
- Executes dropped EXE
PID:868 -
\??\c:\9fflfrr.exec:\9fflfrr.exe55⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1ttttt.exec:\1ttttt.exe56⤵
- Executes dropped EXE
PID:4732 -
\??\c:\nnhtnb.exec:\nnhtnb.exe57⤵
- Executes dropped EXE
PID:4828 -
\??\c:\pjjjj.exec:\pjjjj.exe58⤵
- Executes dropped EXE
PID:3096 -
\??\c:\rxrlfrl.exec:\rxrlfrl.exe59⤵
- Executes dropped EXE
PID:4556 -
\??\c:\5rrllxr.exec:\5rrllxr.exe60⤵
- Executes dropped EXE
PID:4656 -
\??\c:\bthbtt.exec:\bthbtt.exe61⤵
- Executes dropped EXE
PID:4476 -
\??\c:\3vppd.exec:\3vppd.exe62⤵
- Executes dropped EXE
PID:400 -
\??\c:\pjjdv.exec:\pjjdv.exe63⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xrrrlll.exec:\xrrrlll.exe64⤵
- Executes dropped EXE
PID:3884 -
\??\c:\bttttt.exec:\bttttt.exe65⤵
- Executes dropped EXE
PID:2104 -
\??\c:\tthtnn.exec:\tthtnn.exe66⤵PID:4040
-
\??\c:\7ddjv.exec:\7ddjv.exe67⤵
- System Location Discovery: System Language Discovery
PID:928 -
\??\c:\5bhhbh.exec:\5bhhbh.exe68⤵PID:1472
-
\??\c:\ppvpd.exec:\ppvpd.exe69⤵PID:3080
-
\??\c:\pdddj.exec:\pdddj.exe70⤵PID:4028
-
\??\c:\xfxfrfl.exec:\xfxfrfl.exe71⤵PID:3468
-
\??\c:\fxffxxx.exec:\fxffxxx.exe72⤵PID:2448
-
\??\c:\ntttnn.exec:\ntttnn.exe73⤵PID:4720
-
\??\c:\vpvdj.exec:\vpvdj.exe74⤵PID:1480
-
\??\c:\jdpjd.exec:\jdpjd.exe75⤵PID:1164
-
\??\c:\flllllr.exec:\flllllr.exe76⤵PID:456
-
\??\c:\ffxfrrx.exec:\ffxfrrx.exe77⤵PID:4704
-
\??\c:\tnbthb.exec:\tnbthb.exe78⤵PID:1564
-
\??\c:\5jjjd.exec:\5jjjd.exe79⤵PID:632
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe80⤵PID:3980
-
\??\c:\7rxrlrr.exec:\7rxrlrr.exe81⤵PID:440
-
\??\c:\5ttnbh.exec:\5ttnbh.exe82⤵PID:3172
-
\??\c:\9hhbtt.exec:\9hhbtt.exe83⤵PID:1784
-
\??\c:\jpvvj.exec:\jpvvj.exe84⤵PID:2276
-
\??\c:\3rllxff.exec:\3rllxff.exe85⤵PID:2052
-
\??\c:\httbbb.exec:\httbbb.exe86⤵PID:840
-
\??\c:\nhbhtb.exec:\nhbhtb.exe87⤵PID:4552
-
\??\c:\vdddv.exec:\vdddv.exe88⤵PID:1044
-
\??\c:\vjdpj.exec:\vjdpj.exe89⤵PID:4484
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe90⤵PID:3104
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe91⤵PID:2528
-
\??\c:\1ntnth.exec:\1ntnth.exe92⤵PID:1836
-
\??\c:\3nnhbb.exec:\3nnhbb.exe93⤵PID:3448
-
\??\c:\5dvvj.exec:\5dvvj.exe94⤵PID:4184
-
\??\c:\flfxrll.exec:\flfxrll.exe95⤵PID:1420
-
\??\c:\nnttbb.exec:\nnttbb.exe96⤵PID:4876
-
\??\c:\hhtnnn.exec:\hhtnnn.exe97⤵PID:908
-
\??\c:\vpdvd.exec:\vpdvd.exe98⤵PID:3860
-
\??\c:\vvpvd.exec:\vvpvd.exe99⤵PID:2968
-
\??\c:\rlfxffl.exec:\rlfxffl.exe100⤵PID:3028
-
\??\c:\nhnnnt.exec:\nhnnnt.exe101⤵PID:4832
-
\??\c:\3ttttb.exec:\3ttttb.exe102⤵PID:2444
-
\??\c:\dvvvv.exec:\dvvvv.exe103⤵PID:3056
-
\??\c:\7pddp.exec:\7pddp.exe104⤵PID:4864
-
\??\c:\lrxrlll.exec:\lrxrlll.exe105⤵PID:3116
-
\??\c:\flxffll.exec:\flxffll.exe106⤵PID:3088
-
\??\c:\9ttbtt.exec:\9ttbtt.exe107⤵PID:2556
-
\??\c:\hbhbtb.exec:\hbhbtb.exe108⤵PID:1572
-
\??\c:\vpvpp.exec:\vpvpp.exe109⤵PID:2972
-
\??\c:\lfxrrll.exec:\lfxrrll.exe110⤵PID:960
-
\??\c:\3lxxffr.exec:\3lxxffr.exe111⤵PID:2140
-
\??\c:\hhhttt.exec:\hhhttt.exe112⤵PID:2064
-
\??\c:\7ttttn.exec:\7ttttn.exe113⤵PID:1488
-
\??\c:\1vddv.exec:\1vddv.exe114⤵PID:1976
-
\??\c:\ntbttt.exec:\ntbttt.exe115⤵PID:4696
-
\??\c:\bhbtnn.exec:\bhbtnn.exe116⤵PID:2244
-
\??\c:\vvvpp.exec:\vvvpp.exe117⤵PID:1484
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe118⤵PID:2964
-
\??\c:\lffxrrl.exec:\lffxrrl.exe119⤵PID:1532
-
\??\c:\bthbbb.exec:\bthbbb.exe120⤵PID:4176
-
\??\c:\tbhbbh.exec:\tbhbbh.exe121⤵PID:1332
-
\??\c:\djdjj.exec:\djdjj.exe122⤵PID:4140
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-