Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 17:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe
-
Size
106KB
-
MD5
933f7e97eeabbfdf493fc152e9367520
-
SHA1
ca0a816229de59000020991464ebe6958b8d1b0a
-
SHA256
9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5e
-
SHA512
0934231e464855d7c827f7074b45c84e19389d67a8f8092e772be765432852734be7c5f2a92d9ca15859639e4775f610b9a03276b9d8aa0e8ab1f95af5568d23
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CmB:n3C9BRo7MlrWKVT+buBGu3PHB
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3160-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3756 xrxxffr.exe 3764 tbbbbb.exe 540 hnttbb.exe 1840 vdvdv.exe 2376 ttnnhh.exe 3104 bttttn.exe 1116 1rlfxxx.exe 728 rlrrxrr.exe 1816 btbbbh.exe 3676 jdvpp.exe 2032 fxrlffx.exe 2880 nhhhbh.exe 860 dvppv.exe 4844 frrllrx.exe 2088 bbnhnh.exe 4040 vpvpj.exe 3780 rrrllll.exe 2296 nnnnbt.exe 640 dvvpj.exe 1312 3llllrl.exe 452 5thbhb.exe 712 nhhhbh.exe 1584 vdvvp.exe 4364 xrfrflf.exe 3612 hbtbnn.exe 4032 dvjdp.exe 1912 9jppj.exe 1164 fflrrxr.exe 2276 9tbbnn.exe 5056 vvvpp.exe 2352 frrlfff.exe 1480 3rrxxxx.exe 2244 fflxrxx.exe 1808 5bbbbt.exe 2536 pjjdd.exe 512 rllfxxx.exe 4960 bntnnt.exe 1532 7nhhhh.exe 680 5frxxll.exe 4744 5tbtnn.exe 396 3jppv.exe 4100 3hnhbb.exe 556 pdppd.exe 628 jvvvv.exe 1524 ffrrxxf.exe 2852 jjvpp.exe 4336 hhttbh.exe 4576 ppvdd.exe 4304 lllfxxx.exe 3756 7hnhnn.exe 4788 vpjdd.exe 3984 7fxrllf.exe 4600 9xxrlll.exe 1484 nhhhhh.exe 1840 hbttnb.exe 2376 vvppd.exe 380 5lrfxxr.exe 2312 rrllllf.exe 4548 htttnh.exe 4916 jjjdv.exe 3248 3pvvv.exe 1816 5nhbth.exe 3676 tnhhhh.exe 772 9pvvp.exe -
resource yara_rule behavioral2/memory/3160-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/712-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrlflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbbt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3160 wrote to memory of 3756 3160 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 82 PID 3160 wrote to memory of 3756 3160 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 82 PID 3160 wrote to memory of 3756 3160 9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe 82 PID 3756 wrote to memory of 3764 3756 xrxxffr.exe 83 PID 3756 wrote to memory of 3764 3756 xrxxffr.exe 83 PID 3756 wrote to memory of 3764 3756 xrxxffr.exe 83 PID 3764 wrote to memory of 540 3764 tbbbbb.exe 84 PID 3764 wrote to memory of 540 3764 tbbbbb.exe 84 PID 3764 wrote to memory of 540 3764 tbbbbb.exe 84 PID 540 wrote to memory of 1840 540 hnttbb.exe 85 PID 540 wrote to memory of 1840 540 hnttbb.exe 85 PID 540 wrote to memory of 1840 540 hnttbb.exe 85 PID 1840 wrote to memory of 2376 1840 vdvdv.exe 86 PID 1840 wrote to memory of 2376 1840 vdvdv.exe 86 PID 1840 wrote to memory of 2376 1840 vdvdv.exe 86 PID 2376 wrote to memory of 3104 2376 ttnnhh.exe 87 PID 2376 wrote to memory of 3104 2376 ttnnhh.exe 87 PID 2376 wrote to memory of 3104 2376 ttnnhh.exe 87 PID 3104 wrote to memory of 1116 3104 bttttn.exe 88 PID 3104 wrote to memory of 1116 3104 bttttn.exe 88 PID 3104 wrote to memory of 1116 3104 bttttn.exe 88 PID 1116 wrote to memory of 728 1116 1rlfxxx.exe 89 PID 1116 wrote to memory of 728 1116 1rlfxxx.exe 89 PID 1116 wrote to memory of 728 1116 1rlfxxx.exe 89 PID 728 wrote to memory of 1816 728 rlrrxrr.exe 90 PID 728 wrote to memory of 1816 728 rlrrxrr.exe 90 PID 728 wrote to memory of 1816 728 rlrrxrr.exe 90 PID 1816 wrote to memory of 3676 1816 btbbbh.exe 91 PID 1816 wrote to memory of 3676 1816 btbbbh.exe 91 PID 1816 wrote to memory of 3676 1816 btbbbh.exe 91 PID 3676 wrote to memory of 2032 3676 jdvpp.exe 92 PID 3676 wrote to memory of 2032 3676 jdvpp.exe 92 PID 3676 wrote to memory of 2032 3676 jdvpp.exe 92 PID 2032 wrote to memory of 2880 2032 fxrlffx.exe 93 PID 2032 wrote to memory of 2880 2032 fxrlffx.exe 93 PID 2032 wrote to memory of 2880 2032 fxrlffx.exe 93 PID 2880 wrote to memory of 860 2880 nhhhbh.exe 94 PID 2880 wrote to memory of 860 2880 nhhhbh.exe 94 PID 2880 wrote to memory of 860 2880 nhhhbh.exe 94 PID 860 wrote to memory of 4844 860 dvppv.exe 95 PID 860 wrote to memory of 4844 860 dvppv.exe 95 PID 860 wrote to memory of 4844 860 dvppv.exe 95 PID 4844 wrote to memory of 2088 4844 frrllrx.exe 96 PID 4844 wrote to memory of 2088 4844 frrllrx.exe 96 PID 4844 wrote to memory of 2088 4844 frrllrx.exe 96 PID 2088 wrote to memory of 4040 2088 bbnhnh.exe 97 PID 2088 wrote to memory of 4040 2088 bbnhnh.exe 97 PID 2088 wrote to memory of 4040 2088 bbnhnh.exe 97 PID 4040 wrote to memory of 3780 4040 vpvpj.exe 98 PID 4040 wrote to memory of 3780 4040 vpvpj.exe 98 PID 4040 wrote to memory of 3780 4040 vpvpj.exe 98 PID 3780 wrote to memory of 2296 3780 rrrllll.exe 99 PID 3780 wrote to memory of 2296 3780 rrrllll.exe 99 PID 3780 wrote to memory of 2296 3780 rrrllll.exe 99 PID 2296 wrote to memory of 640 2296 nnnnbt.exe 100 PID 2296 wrote to memory of 640 2296 nnnnbt.exe 100 PID 2296 wrote to memory of 640 2296 nnnnbt.exe 100 PID 640 wrote to memory of 1312 640 dvvpj.exe 101 PID 640 wrote to memory of 1312 640 dvvpj.exe 101 PID 640 wrote to memory of 1312 640 dvvpj.exe 101 PID 1312 wrote to memory of 452 1312 3llllrl.exe 102 PID 1312 wrote to memory of 452 1312 3llllrl.exe 102 PID 1312 wrote to memory of 452 1312 3llllrl.exe 102 PID 452 wrote to memory of 712 452 5thbhb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe"C:\Users\Admin\AppData\Local\Temp\9ee9a53c48d67c6a8991dcb1be1fc7c96ad1f17756828090af3ce186a426af5eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\xrxxffr.exec:\xrxxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\tbbbbb.exec:\tbbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\hnttbb.exec:\hnttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\vdvdv.exec:\vdvdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\ttnnhh.exec:\ttnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\bttttn.exec:\bttttn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\1rlfxxx.exec:\1rlfxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\rlrrxrr.exec:\rlrrxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:728 -
\??\c:\btbbbh.exec:\btbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jdvpp.exec:\jdvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\fxrlffx.exec:\fxrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\nhhhbh.exec:\nhhhbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\dvppv.exec:\dvppv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\frrllrx.exec:\frrllrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\bbnhnh.exec:\bbnhnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vpvpj.exec:\vpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\rrrllll.exec:\rrrllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\nnnnbt.exec:\nnnnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\dvvpj.exec:\dvvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\3llllrl.exec:\3llllrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\5thbhb.exec:\5thbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\nhhhbh.exec:\nhhhbh.exe23⤵
- Executes dropped EXE
PID:712 -
\??\c:\vdvvp.exec:\vdvvp.exe24⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrfrflf.exec:\xrfrflf.exe25⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hbtbnn.exec:\hbtbnn.exe26⤵
- Executes dropped EXE
PID:3612 -
\??\c:\dvjdp.exec:\dvjdp.exe27⤵
- Executes dropped EXE
PID:4032 -
\??\c:\9jppj.exec:\9jppj.exe28⤵
- Executes dropped EXE
PID:1912 -
\??\c:\fflrrxr.exec:\fflrrxr.exe29⤵
- Executes dropped EXE
PID:1164 -
\??\c:\9tbbnn.exec:\9tbbnn.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\vvvpp.exec:\vvvpp.exe31⤵
- Executes dropped EXE
PID:5056 -
\??\c:\frrlfff.exec:\frrlfff.exe32⤵
- Executes dropped EXE
PID:2352 -
\??\c:\3rrxxxx.exec:\3rrxxxx.exe33⤵
- Executes dropped EXE
PID:1480 -
\??\c:\fflxrxx.exec:\fflxrxx.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\5bbbbt.exec:\5bbbbt.exe35⤵
- Executes dropped EXE
PID:1808 -
\??\c:\pjjdd.exec:\pjjdd.exe36⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rllfxxx.exec:\rllfxxx.exe37⤵
- Executes dropped EXE
PID:512 -
\??\c:\bntnnt.exec:\bntnnt.exe38⤵
- Executes dropped EXE
PID:4960 -
\??\c:\7nhhhh.exec:\7nhhhh.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1532 -
\??\c:\5frxxll.exec:\5frxxll.exe40⤵
- Executes dropped EXE
PID:680 -
\??\c:\5tbtnn.exec:\5tbtnn.exe41⤵
- Executes dropped EXE
PID:4744 -
\??\c:\3jppv.exec:\3jppv.exe42⤵
- Executes dropped EXE
PID:396 -
\??\c:\3hnhbb.exec:\3hnhbb.exe43⤵
- Executes dropped EXE
PID:4100 -
\??\c:\pdppd.exec:\pdppd.exe44⤵
- Executes dropped EXE
PID:556 -
\??\c:\jvvvv.exec:\jvvvv.exe45⤵
- Executes dropped EXE
PID:628 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe46⤵
- Executes dropped EXE
PID:1524 -
\??\c:\jjvpp.exec:\jjvpp.exe47⤵
- Executes dropped EXE
PID:2852 -
\??\c:\hhttbh.exec:\hhttbh.exe48⤵
- Executes dropped EXE
PID:4336 -
\??\c:\ppvdd.exec:\ppvdd.exe49⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lllfxxx.exec:\lllfxxx.exe50⤵
- Executes dropped EXE
PID:4304 -
\??\c:\7hnhnn.exec:\7hnhnn.exe51⤵
- Executes dropped EXE
PID:3756 -
\??\c:\vpjdd.exec:\vpjdd.exe52⤵
- Executes dropped EXE
PID:4788 -
\??\c:\7fxrllf.exec:\7fxrllf.exe53⤵
- Executes dropped EXE
PID:3984 -
\??\c:\9xxrlll.exec:\9xxrlll.exe54⤵
- Executes dropped EXE
PID:4600 -
\??\c:\nhhhhh.exec:\nhhhhh.exe55⤵
- Executes dropped EXE
PID:1484 -
\??\c:\hbttnb.exec:\hbttnb.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vvppd.exec:\vvppd.exe57⤵
- Executes dropped EXE
PID:2376 -
\??\c:\5lrfxxr.exec:\5lrfxxr.exe58⤵
- Executes dropped EXE
PID:380 -
\??\c:\rrllllf.exec:\rrllllf.exe59⤵
- Executes dropped EXE
PID:2312 -
\??\c:\htttnh.exec:\htttnh.exe60⤵
- Executes dropped EXE
PID:4548 -
\??\c:\jjjdv.exec:\jjjdv.exe61⤵
- Executes dropped EXE
PID:4916 -
\??\c:\3pvvv.exec:\3pvvv.exe62⤵
- Executes dropped EXE
PID:3248 -
\??\c:\5nhbth.exec:\5nhbth.exe63⤵
- Executes dropped EXE
PID:1816 -
\??\c:\tnhhhh.exec:\tnhhhh.exe64⤵
- Executes dropped EXE
PID:3676 -
\??\c:\9pvvp.exec:\9pvvp.exe65⤵
- Executes dropped EXE
PID:772 -
\??\c:\fxffffl.exec:\fxffffl.exe66⤵
- System Location Discovery: System Language Discovery
PID:3140 -
\??\c:\9ffxrll.exec:\9ffxrll.exe67⤵PID:4860
-
\??\c:\9nnhbb.exec:\9nnhbb.exe68⤵PID:1520
-
\??\c:\vvjjj.exec:\vvjjj.exe69⤵PID:1848
-
\??\c:\9djdv.exec:\9djdv.exe70⤵PID:3004
-
\??\c:\frxxrxr.exec:\frxxrxr.exe71⤵
- System Location Discovery: System Language Discovery
PID:2456 -
\??\c:\nnhbhh.exec:\nnhbhh.exe72⤵PID:1616
-
\??\c:\5thhtb.exec:\5thhtb.exe73⤵PID:3196
-
\??\c:\pjjdd.exec:\pjjdd.exe74⤵PID:1976
-
\??\c:\pvjdj.exec:\pvjdj.exe75⤵PID:5092
-
\??\c:\1rxxffl.exec:\1rxxffl.exe76⤵PID:4924
-
\??\c:\hnbbbb.exec:\hnbbbb.exe77⤵PID:4556
-
\??\c:\hhtnbb.exec:\hhtnbb.exe78⤵PID:2528
-
\??\c:\dvddd.exec:\dvddd.exe79⤵PID:1060
-
\??\c:\3xlffll.exec:\3xlffll.exe80⤵PID:4624
-
\??\c:\frrrllf.exec:\frrrllf.exe81⤵PID:1568
-
\??\c:\hbhnnn.exec:\hbhnnn.exe82⤵PID:692
-
\??\c:\djjpj.exec:\djjpj.exe83⤵PID:2696
-
\??\c:\pjjjj.exec:\pjjjj.exe84⤵PID:4272
-
\??\c:\xffrflf.exec:\xffrflf.exe85⤵PID:3456
-
\??\c:\lxlxlxl.exec:\lxlxlxl.exe86⤵PID:3948
-
\??\c:\bbnhbb.exec:\bbnhbb.exe87⤵PID:1100
-
\??\c:\pjjdp.exec:\pjjdp.exe88⤵PID:2692
-
\??\c:\5pjdp.exec:\5pjdp.exe89⤵PID:4428
-
\??\c:\rxxrffr.exec:\rxxrffr.exe90⤵PID:468
-
\??\c:\flrlxxr.exec:\flrlxxr.exe91⤵PID:2972
-
\??\c:\bhbbbb.exec:\bhbbbb.exe92⤵PID:4372
-
\??\c:\bbbttt.exec:\bbbttt.exe93⤵PID:2364
-
\??\c:\1vvvp.exec:\1vvvp.exe94⤵PID:856
-
\??\c:\pppdv.exec:\pppdv.exe95⤵PID:3292
-
\??\c:\3rxrrlr.exec:\3rxrrlr.exe96⤵PID:3988
-
\??\c:\3nhnnn.exec:\3nhnnn.exe97⤵PID:512
-
\??\c:\btthbb.exec:\btthbb.exe98⤵PID:4884
-
\??\c:\9vvpp.exec:\9vvpp.exe99⤵PID:4244
-
\??\c:\5rxrxxx.exec:\5rxrxxx.exe100⤵PID:4832
-
\??\c:\thnhhb.exec:\thnhhb.exe101⤵PID:4824
-
\??\c:\tnnhtt.exec:\tnnhtt.exe102⤵PID:3200
-
\??\c:\jjjjj.exec:\jjjjj.exe103⤵PID:3368
-
\??\c:\lffxllx.exec:\lffxllx.exe104⤵PID:3636
-
\??\c:\fxlffrx.exec:\fxlffrx.exe105⤵PID:1456
-
\??\c:\7bbbbt.exec:\7bbbbt.exe106⤵PID:4028
-
\??\c:\ttthhb.exec:\ttthhb.exe107⤵PID:4324
-
\??\c:\vpvjv.exec:\vpvjv.exe108⤵PID:4996
-
\??\c:\ddjdv.exec:\ddjdv.exe109⤵PID:1240
-
\??\c:\ffffrrl.exec:\ffffrrl.exe110⤵PID:4532
-
\??\c:\thhhbb.exec:\thhhbb.exe111⤵PID:4484
-
\??\c:\hbbhbb.exec:\hbbhbb.exe112⤵PID:3044
-
\??\c:\dvpjv.exec:\dvpjv.exe113⤵PID:4212
-
\??\c:\9llfrrl.exec:\9llfrrl.exe114⤵PID:3624
-
\??\c:\rfxfxxr.exec:\rfxfxxr.exe115⤵PID:3992
-
\??\c:\hbtnbn.exec:\hbtnbn.exe116⤵PID:2208
-
\??\c:\vpppj.exec:\vpppj.exe117⤵PID:1676
-
\??\c:\jpppj.exec:\jpppj.exe118⤵PID:1292
-
\??\c:\fxffxfr.exec:\fxffxfr.exe119⤵PID:3216
-
\??\c:\1hbttt.exec:\1hbttt.exe120⤵PID:3524
-
\??\c:\nnhbtb.exec:\nnhbtb.exe121⤵PID:228
-
\??\c:\pdpjd.exec:\pdpjd.exe122⤵PID:392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-