Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 02:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe
-
Size
70KB
-
MD5
583e8424ce92cc09d4f807e1c6dc8881
-
SHA1
7a3e72677111ee7720852771c150e27691b7fc46
-
SHA256
c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8
-
SHA512
a35586c393f0218192893b98ddad6de07e0d4b65a2cee16cee4ddbd670d2f9f85dab7936fbdbbb17898806ffb77d5a988babe32ff28aa250176de3651671e338
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj2:ymb3NkkiQ3mdBjFI4Vm
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3772-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/968-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3452 bhnbtn.exe 3000 pddvj.exe 1332 bthnhb.exe 5052 vpjdd.exe 2368 rlxxrlf.exe 4808 nnnnht.exe 4428 vdvvd.exe 2356 rfrxlrf.exe 316 fxxrrrr.exe 4272 bnntnn.exe 2000 bnhhbb.exe 4000 jdjjd.exe 4544 lfxxxrl.exe 4356 tbtttb.exe 1540 jpppj.exe 2540 fxlfrfx.exe 1064 btnnhh.exe 968 pjpvd.exe 5068 vdjdd.exe 2876 flrlffx.exe 3948 nbbhbb.exe 8 dvvjv.exe 4192 9xxfrfl.exe 4456 thhnhn.exe 1084 hhnhhh.exe 1924 pvddv.exe 1684 frfxxxx.exe 2984 1btntt.exe 4388 dvdvv.exe 732 7jdvj.exe 3392 nnnnnt.exe 2208 pjdvj.exe 1972 htthbb.exe 920 hbbbtt.exe 1456 rfrlfrr.exe 452 tntbtt.exe 1088 ddjdj.exe 1184 ddvvp.exe 2704 lrxxxff.exe 1648 lrxffll.exe 3892 bttbtb.exe 3740 vppvv.exe 3776 rxxrlxr.exe 4056 rrlfrrx.exe 4784 bthnbt.exe 3160 dvppd.exe 1568 rffxxxr.exe 3772 flrrllf.exe 4268 bbhhhn.exe 4256 ddvpp.exe 3260 xxffllr.exe 1992 fxfffff.exe 840 btbbtb.exe 3200 vpdvj.exe 3256 9jddv.exe 3352 fxxrfff.exe 1188 nhbbtt.exe 4680 tbnntt.exe 4780 vvvdv.exe 4328 rlrrllf.exe 2356 bbhbhh.exe 3132 hhtntt.exe 3016 pjjdv.exe 1912 lxlfrrl.exe -
resource yara_rule behavioral2/memory/3772-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/968-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fllfll.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3772 wrote to memory of 3452 3772 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 82 PID 3772 wrote to memory of 3452 3772 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 82 PID 3772 wrote to memory of 3452 3772 c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe 82 PID 3452 wrote to memory of 3000 3452 bhnbtn.exe 83 PID 3452 wrote to memory of 3000 3452 bhnbtn.exe 83 PID 3452 wrote to memory of 3000 3452 bhnbtn.exe 83 PID 3000 wrote to memory of 1332 3000 pddvj.exe 84 PID 3000 wrote to memory of 1332 3000 pddvj.exe 84 PID 3000 wrote to memory of 1332 3000 pddvj.exe 84 PID 1332 wrote to memory of 5052 1332 bthnhb.exe 85 PID 1332 wrote to memory of 5052 1332 bthnhb.exe 85 PID 1332 wrote to memory of 5052 1332 bthnhb.exe 85 PID 5052 wrote to memory of 2368 5052 vpjdd.exe 86 PID 5052 wrote to memory of 2368 5052 vpjdd.exe 86 PID 5052 wrote to memory of 2368 5052 vpjdd.exe 86 PID 2368 wrote to memory of 4808 2368 rlxxrlf.exe 87 PID 2368 wrote to memory of 4808 2368 rlxxrlf.exe 87 PID 2368 wrote to memory of 4808 2368 rlxxrlf.exe 87 PID 4808 wrote to memory of 4428 4808 nnnnht.exe 88 PID 4808 wrote to memory of 4428 4808 nnnnht.exe 88 PID 4808 wrote to memory of 4428 4808 nnnnht.exe 88 PID 4428 wrote to memory of 2356 4428 vdvvd.exe 89 PID 4428 wrote to memory of 2356 4428 vdvvd.exe 89 PID 4428 wrote to memory of 2356 4428 vdvvd.exe 89 PID 2356 wrote to memory of 316 2356 rfrxlrf.exe 90 PID 2356 wrote to memory of 316 2356 rfrxlrf.exe 90 PID 2356 wrote to memory of 316 2356 rfrxlrf.exe 90 PID 316 wrote to memory of 4272 316 fxxrrrr.exe 91 PID 316 wrote to memory of 4272 316 fxxrrrr.exe 91 PID 316 wrote to memory of 4272 316 fxxrrrr.exe 91 PID 4272 wrote to memory of 2000 4272 bnntnn.exe 92 PID 4272 wrote to memory of 2000 4272 bnntnn.exe 92 PID 4272 wrote to memory of 2000 4272 bnntnn.exe 92 PID 2000 wrote to memory of 4000 2000 bnhhbb.exe 93 PID 2000 wrote to memory of 4000 2000 bnhhbb.exe 93 PID 2000 wrote to memory of 4000 2000 bnhhbb.exe 93 PID 4000 wrote to memory of 4544 4000 jdjjd.exe 94 PID 4000 wrote to memory of 4544 4000 jdjjd.exe 94 PID 4000 wrote to memory of 4544 4000 jdjjd.exe 94 PID 4544 wrote to memory of 4356 4544 lfxxxrl.exe 95 PID 4544 wrote to memory of 4356 4544 lfxxxrl.exe 95 PID 4544 wrote to memory of 4356 4544 lfxxxrl.exe 95 PID 4356 wrote to memory of 1540 4356 tbtttb.exe 96 PID 4356 wrote to memory of 1540 4356 tbtttb.exe 96 PID 4356 wrote to memory of 1540 4356 tbtttb.exe 96 PID 1540 wrote to memory of 2540 1540 jpppj.exe 97 PID 1540 wrote to memory of 2540 1540 jpppj.exe 97 PID 1540 wrote to memory of 2540 1540 jpppj.exe 97 PID 2540 wrote to memory of 1064 2540 fxlfrfx.exe 98 PID 2540 wrote to memory of 1064 2540 fxlfrfx.exe 98 PID 2540 wrote to memory of 1064 2540 fxlfrfx.exe 98 PID 1064 wrote to memory of 968 1064 btnnhh.exe 99 PID 1064 wrote to memory of 968 1064 btnnhh.exe 99 PID 1064 wrote to memory of 968 1064 btnnhh.exe 99 PID 968 wrote to memory of 5068 968 pjpvd.exe 100 PID 968 wrote to memory of 5068 968 pjpvd.exe 100 PID 968 wrote to memory of 5068 968 pjpvd.exe 100 PID 5068 wrote to memory of 2876 5068 vdjdd.exe 101 PID 5068 wrote to memory of 2876 5068 vdjdd.exe 101 PID 5068 wrote to memory of 2876 5068 vdjdd.exe 101 PID 2876 wrote to memory of 3948 2876 flrlffx.exe 102 PID 2876 wrote to memory of 3948 2876 flrlffx.exe 102 PID 2876 wrote to memory of 3948 2876 flrlffx.exe 102 PID 3948 wrote to memory of 8 3948 nbbhbb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe"C:\Users\Admin\AppData\Local\Temp\c6690191a5890dcae91980931b6ca26385d88be6b25fd272454ab66acfbed6a8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\bhnbtn.exec:\bhnbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\pddvj.exec:\pddvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\bthnhb.exec:\bthnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\vpjdd.exec:\vpjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\rlxxrlf.exec:\rlxxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nnnnht.exec:\nnnnht.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\vdvvd.exec:\vdvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\rfrxlrf.exec:\rfrxlrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\bnntnn.exec:\bnntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\bnhhbb.exec:\bnhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\jdjjd.exec:\jdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\lfxxxrl.exec:\lfxxxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\tbtttb.exec:\tbtttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\jpppj.exec:\jpppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\fxlfrfx.exec:\fxlfrfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\btnnhh.exec:\btnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\pjpvd.exec:\pjpvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\vdjdd.exec:\vdjdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\flrlffx.exec:\flrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\nbbhbb.exec:\nbbhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\dvvjv.exec:\dvvjv.exe23⤵
- Executes dropped EXE
PID:8 -
\??\c:\9xxfrfl.exec:\9xxfrfl.exe24⤵
- Executes dropped EXE
PID:4192 -
\??\c:\thhnhn.exec:\thhnhn.exe25⤵
- Executes dropped EXE
PID:4456 -
\??\c:\hhnhhh.exec:\hhnhhh.exe26⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pvddv.exec:\pvddv.exe27⤵
- Executes dropped EXE
PID:1924 -
\??\c:\frfxxxx.exec:\frfxxxx.exe28⤵
- Executes dropped EXE
PID:1684 -
\??\c:\1btntt.exec:\1btntt.exe29⤵
- Executes dropped EXE
PID:2984 -
\??\c:\dvdvv.exec:\dvdvv.exe30⤵
- Executes dropped EXE
PID:4388 -
\??\c:\7jdvj.exec:\7jdvj.exe31⤵
- Executes dropped EXE
PID:732 -
\??\c:\nnnnnt.exec:\nnnnnt.exe32⤵
- Executes dropped EXE
PID:3392 -
\??\c:\pjdvj.exec:\pjdvj.exe33⤵
- Executes dropped EXE
PID:2208 -
\??\c:\htthbb.exec:\htthbb.exe34⤵
- Executes dropped EXE
PID:1972 -
\??\c:\hbbbtt.exec:\hbbbtt.exe35⤵
- Executes dropped EXE
PID:920 -
\??\c:\rfrlfrr.exec:\rfrlfrr.exe36⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tntbtt.exec:\tntbtt.exe37⤵
- Executes dropped EXE
PID:452 -
\??\c:\ddjdj.exec:\ddjdj.exe38⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ddvvp.exec:\ddvvp.exe39⤵
- Executes dropped EXE
PID:1184 -
\??\c:\lrxxxff.exec:\lrxxxff.exe40⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lrxffll.exec:\lrxffll.exe41⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bttbtb.exec:\bttbtb.exe42⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vppvv.exec:\vppvv.exe43⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rxxrlxr.exec:\rxxrlxr.exe44⤵
- Executes dropped EXE
PID:3776 -
\??\c:\rrlfrrx.exec:\rrlfrrx.exe45⤵
- Executes dropped EXE
PID:4056 -
\??\c:\bthnbt.exec:\bthnbt.exe46⤵
- Executes dropped EXE
PID:4784 -
\??\c:\dvppd.exec:\dvppd.exe47⤵
- Executes dropped EXE
PID:3160 -
\??\c:\rffxxxr.exec:\rffxxxr.exe48⤵
- Executes dropped EXE
PID:1568 -
\??\c:\flrrllf.exec:\flrrllf.exe49⤵
- Executes dropped EXE
PID:3772 -
\??\c:\bbhhhn.exec:\bbhhhn.exe50⤵
- Executes dropped EXE
PID:4268 -
\??\c:\ddvpp.exec:\ddvpp.exe51⤵
- Executes dropped EXE
PID:4256 -
\??\c:\xxffllr.exec:\xxffllr.exe52⤵
- Executes dropped EXE
PID:3260 -
\??\c:\fxfffff.exec:\fxfffff.exe53⤵
- Executes dropped EXE
PID:1992 -
\??\c:\btbbtb.exec:\btbbtb.exe54⤵
- Executes dropped EXE
PID:840 -
\??\c:\vpdvj.exec:\vpdvj.exe55⤵
- Executes dropped EXE
PID:3200 -
\??\c:\9jddv.exec:\9jddv.exe56⤵
- Executes dropped EXE
PID:3256 -
\??\c:\fxxrfff.exec:\fxxrfff.exe57⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nhbbtt.exec:\nhbbtt.exe58⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tbnntt.exec:\tbnntt.exe59⤵
- Executes dropped EXE
PID:4680 -
\??\c:\vvvdv.exec:\vvvdv.exe60⤵
- Executes dropped EXE
PID:4780 -
\??\c:\rlrrllf.exec:\rlrrllf.exe61⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bbhbhh.exec:\bbhbhh.exe62⤵
- Executes dropped EXE
PID:2356 -
\??\c:\hhtntt.exec:\hhtntt.exe63⤵
- Executes dropped EXE
PID:3132 -
\??\c:\pjjdv.exec:\pjjdv.exe64⤵
- Executes dropped EXE
PID:3016 -
\??\c:\lxlfrrl.exec:\lxlfrrl.exe65⤵
- Executes dropped EXE
PID:1912 -
\??\c:\7bhnnt.exec:\7bhnnt.exe66⤵PID:4084
-
\??\c:\1tnnnt.exec:\1tnnnt.exe67⤵PID:2888
-
\??\c:\7nnttt.exec:\7nnttt.exe68⤵PID:692
-
\??\c:\pjvvd.exec:\pjvvd.exe69⤵
- System Location Discovery: System Language Discovery
PID:220 -
\??\c:\3rlrfxl.exec:\3rlrfxl.exe70⤵PID:4356
-
\??\c:\nhtnnt.exec:\nhtnnt.exe71⤵PID:4976
-
\??\c:\bhhttb.exec:\bhhttb.exe72⤵PID:2188
-
\??\c:\vpppp.exec:\vpppp.exe73⤵PID:868
-
\??\c:\xxrlfrr.exec:\xxrlfrr.exe74⤵PID:1812
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe75⤵PID:3568
-
\??\c:\nnttnt.exec:\nnttnt.exe76⤵PID:4168
-
\??\c:\dpvpd.exec:\dpvpd.exe77⤵PID:2900
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe78⤵PID:1764
-
\??\c:\bbnnhn.exec:\bbnnhn.exe79⤵PID:608
-
\??\c:\vvjdj.exec:\vvjdj.exe80⤵PID:3184
-
\??\c:\vpppp.exec:\vpppp.exe81⤵PID:4192
-
\??\c:\llfllrx.exec:\llfllrx.exe82⤵PID:2172
-
\??\c:\rxrrlfr.exec:\rxrrlfr.exe83⤵PID:3832
-
\??\c:\bnnnnn.exec:\bnnnnn.exe84⤵PID:1480
-
\??\c:\tntntt.exec:\tntntt.exe85⤵PID:3576
-
\??\c:\3nnhtb.exec:\3nnhtb.exe86⤵PID:1656
-
\??\c:\vjpjd.exec:\vjpjd.exe87⤵PID:3404
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe88⤵PID:1988
-
\??\c:\rfrrlrr.exec:\rfrrlrr.exe89⤵PID:3820
-
\??\c:\ntttbh.exec:\ntttbh.exe90⤵PID:4892
-
\??\c:\jdjjj.exec:\jdjjj.exe91⤵PID:4768
-
\??\c:\vpppj.exec:\vpppj.exe92⤵PID:2208
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe93⤵PID:1848
-
\??\c:\rrllffx.exec:\rrllffx.exe94⤵PID:1068
-
\??\c:\nntthh.exec:\nntthh.exe95⤵PID:436
-
\??\c:\5bbbnn.exec:\5bbbnn.exe96⤵PID:4112
-
\??\c:\9jppj.exec:\9jppj.exe97⤵PID:2580
-
\??\c:\xrfxllf.exec:\xrfxllf.exe98⤵PID:3008
-
\??\c:\hhhnnt.exec:\hhhnnt.exe99⤵PID:4868
-
\??\c:\vdddd.exec:\vdddd.exe100⤵PID:3660
-
\??\c:\pjppj.exec:\pjppj.exe101⤵PID:4856
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe102⤵PID:2928
-
\??\c:\btttnt.exec:\btttnt.exe103⤵PID:2692
-
\??\c:\tttnbb.exec:\tttnbb.exe104⤵PID:4752
-
\??\c:\pjdjp.exec:\pjdjp.exe105⤵PID:4424
-
\??\c:\vvvvp.exec:\vvvvp.exe106⤵PID:3384
-
\??\c:\lrfllfl.exec:\lrfllfl.exe107⤵PID:3188
-
\??\c:\5rxxlxx.exec:\5rxxlxx.exe108⤵PID:4744
-
\??\c:\bnbttt.exec:\bnbttt.exe109⤵PID:3976
-
\??\c:\jdjdd.exec:\jdjdd.exe110⤵PID:2312
-
\??\c:\pjjdv.exec:\pjjdv.exe111⤵PID:4568
-
\??\c:\3xxrlll.exec:\3xxrlll.exe112⤵PID:5080
-
\??\c:\btttnt.exec:\btttnt.exe113⤵PID:5052
-
\??\c:\hhttnt.exec:\hhttnt.exe114⤵PID:2676
-
\??\c:\djvjp.exec:\djvjp.exe115⤵PID:4140
-
\??\c:\fxrlllx.exec:\fxrlllx.exe116⤵PID:4072
-
\??\c:\thhntt.exec:\thhntt.exe117⤵PID:4924
-
\??\c:\7pppd.exec:\7pppd.exe118⤵PID:3084
-
\??\c:\vppjj.exec:\vppjj.exe119⤵PID:5012
-
\??\c:\xlrrxll.exec:\xlrrxll.exe120⤵PID:2412
-
\??\c:\bntttn.exec:\bntttn.exe121⤵PID:4536
-
\??\c:\thnnbb.exec:\thnnbb.exe122⤵PID:316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-