Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 00:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe
-
Size
67KB
-
MD5
b8df8ab5e74c7f3180a39bc20e494500
-
SHA1
7a9c37dd4101eefe5edc6af3555dec1a7e0fd23c
-
SHA256
9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55
-
SHA512
52dce267475be44e7098478ebcfede3420646c780f02886edc5c9125f4e2af1ce919242616a9feef9756e0dbbd1e860a260a4f90c5304559fdf96595d6d94caa
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27B5QcS:ymb3NkkiQ3mdBjFI9c+h
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4204-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2808-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2292-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/620-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 372 btthbt.exe 804 dvjjp.exe 4656 dppjv.exe 2808 fxfxllf.exe 2224 hbtnhh.exe 2816 3nnhbb.exe 2104 flllxxl.exe 2292 tntnhh.exe 1172 pdjdp.exe 2840 fxxxrlf.exe 3080 3thbbt.exe 452 hbbthh.exe 2216 3dpvj.exe 4996 rrlfrxx.exe 4712 btbtbt.exe 2700 lffxrll.exe 3516 tnnhtn.exe 1532 1vvdv.exe 3256 lxxrllf.exe 2636 nnhbnn.exe 2052 bhbthb.exe 5020 vpppp.exe 2356 rxxrfxr.exe 2428 nhtnnh.exe 4568 vvdvj.exe 1728 lflxxrx.exe 3448 xrxrfff.exe 3780 ntnhbb.exe 2228 7vdvv.exe 620 pdvpd.exe 4100 frrlfxr.exe 4948 xfrlffx.exe 3232 bthhtt.exe 3648 vvvpj.exe 864 rllfrrl.exe 3688 hbbthh.exe 3904 btnthn.exe 2640 pjvpj.exe 4972 vvjvp.exe 3272 rlfrlfr.exe 4384 rxffxxr.exe 3580 nnnbtn.exe 424 7nnhtt.exe 372 vjjdp.exe 1520 ppvpv.exe 2720 rlrlfxx.exe 4124 hbhhbb.exe 3436 1hnbnh.exe 3640 bnnhbb.exe 3264 pjdvp.exe 2112 dvjvd.exe 1480 fxrlllf.exe 3040 rxxlflf.exe 3028 hbnhbt.exe 2292 9ttnbb.exe 1828 3jpjj.exe 4108 jdjdd.exe 460 lfxrxxx.exe 4896 tntnhh.exe 4368 hhhhtn.exe 4068 7dpjd.exe 4128 9xfrxrx.exe 4396 nhhbtn.exe 4080 tbbthh.exe -
resource yara_rule behavioral2/memory/4204-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2808-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2292-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/620-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4204 wrote to memory of 372 4204 9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe 82 PID 4204 wrote to memory of 372 4204 9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe 82 PID 4204 wrote to memory of 372 4204 9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe 82 PID 372 wrote to memory of 804 372 btthbt.exe 83 PID 372 wrote to memory of 804 372 btthbt.exe 83 PID 372 wrote to memory of 804 372 btthbt.exe 83 PID 804 wrote to memory of 4656 804 dvjjp.exe 84 PID 804 wrote to memory of 4656 804 dvjjp.exe 84 PID 804 wrote to memory of 4656 804 dvjjp.exe 84 PID 4656 wrote to memory of 2808 4656 dppjv.exe 85 PID 4656 wrote to memory of 2808 4656 dppjv.exe 85 PID 4656 wrote to memory of 2808 4656 dppjv.exe 85 PID 2808 wrote to memory of 2224 2808 fxfxllf.exe 86 PID 2808 wrote to memory of 2224 2808 fxfxllf.exe 86 PID 2808 wrote to memory of 2224 2808 fxfxllf.exe 86 PID 2224 wrote to memory of 2816 2224 hbtnhh.exe 87 PID 2224 wrote to memory of 2816 2224 hbtnhh.exe 87 PID 2224 wrote to memory of 2816 2224 hbtnhh.exe 87 PID 2816 wrote to memory of 2104 2816 3nnhbb.exe 88 PID 2816 wrote to memory of 2104 2816 3nnhbb.exe 88 PID 2816 wrote to memory of 2104 2816 3nnhbb.exe 88 PID 2104 wrote to memory of 2292 2104 flllxxl.exe 89 PID 2104 wrote to memory of 2292 2104 flllxxl.exe 89 PID 2104 wrote to memory of 2292 2104 flllxxl.exe 89 PID 2292 wrote to memory of 1172 2292 tntnhh.exe 90 PID 2292 wrote to memory of 1172 2292 tntnhh.exe 90 PID 2292 wrote to memory of 1172 2292 tntnhh.exe 90 PID 1172 wrote to memory of 2840 1172 pdjdp.exe 91 PID 1172 wrote to memory of 2840 1172 pdjdp.exe 91 PID 1172 wrote to memory of 2840 1172 pdjdp.exe 91 PID 2840 wrote to memory of 3080 2840 fxxxrlf.exe 92 PID 2840 wrote to memory of 3080 2840 fxxxrlf.exe 92 PID 2840 wrote to memory of 3080 2840 fxxxrlf.exe 92 PID 3080 wrote to memory of 452 3080 3thbbt.exe 93 PID 3080 wrote to memory of 452 3080 3thbbt.exe 93 PID 3080 wrote to memory of 452 3080 3thbbt.exe 93 PID 452 wrote to memory of 2216 452 hbbthh.exe 94 PID 452 wrote to memory of 2216 452 hbbthh.exe 94 PID 452 wrote to memory of 2216 452 hbbthh.exe 94 PID 2216 wrote to memory of 4996 2216 3dpvj.exe 95 PID 2216 wrote to memory of 4996 2216 3dpvj.exe 95 PID 2216 wrote to memory of 4996 2216 3dpvj.exe 95 PID 4996 wrote to memory of 4712 4996 rrlfrxx.exe 96 PID 4996 wrote to memory of 4712 4996 rrlfrxx.exe 96 PID 4996 wrote to memory of 4712 4996 rrlfrxx.exe 96 PID 4712 wrote to memory of 2700 4712 btbtbt.exe 97 PID 4712 wrote to memory of 2700 4712 btbtbt.exe 97 PID 4712 wrote to memory of 2700 4712 btbtbt.exe 97 PID 2700 wrote to memory of 3516 2700 lffxrll.exe 98 PID 2700 wrote to memory of 3516 2700 lffxrll.exe 98 PID 2700 wrote to memory of 3516 2700 lffxrll.exe 98 PID 3516 wrote to memory of 1532 3516 tnnhtn.exe 99 PID 3516 wrote to memory of 1532 3516 tnnhtn.exe 99 PID 3516 wrote to memory of 1532 3516 tnnhtn.exe 99 PID 1532 wrote to memory of 3256 1532 1vvdv.exe 100 PID 1532 wrote to memory of 3256 1532 1vvdv.exe 100 PID 1532 wrote to memory of 3256 1532 1vvdv.exe 100 PID 3256 wrote to memory of 2636 3256 lxxrllf.exe 101 PID 3256 wrote to memory of 2636 3256 lxxrllf.exe 101 PID 3256 wrote to memory of 2636 3256 lxxrllf.exe 101 PID 2636 wrote to memory of 2052 2636 nnhbnn.exe 102 PID 2636 wrote to memory of 2052 2636 nnhbnn.exe 102 PID 2636 wrote to memory of 2052 2636 nnhbnn.exe 102 PID 2052 wrote to memory of 5020 2052 bhbthb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe"C:\Users\Admin\AppData\Local\Temp\9063fae6561fb7a36c58ff4cbeae9f8918e49b16b07d5c63fc604092aefc1a55N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\btthbt.exec:\btthbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\dvjjp.exec:\dvjjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\dppjv.exec:\dppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\fxfxllf.exec:\fxfxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\hbtnhh.exec:\hbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\3nnhbb.exec:\3nnhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\flllxxl.exec:\flllxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\tntnhh.exec:\tntnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\pdjdp.exec:\pdjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\fxxxrlf.exec:\fxxxrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\3thbbt.exec:\3thbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\hbbthh.exec:\hbbthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\3dpvj.exec:\3dpvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\rrlfrxx.exec:\rrlfrxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\btbtbt.exec:\btbtbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\lffxrll.exec:\lffxrll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\tnnhtn.exec:\tnnhtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\1vvdv.exec:\1vvdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\lxxrllf.exec:\lxxrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\nnhbnn.exec:\nnhbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\bhbthb.exec:\bhbthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vpppp.exec:\vpppp.exe23⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\nhtnnh.exec:\nhtnnh.exe25⤵
- Executes dropped EXE
PID:2428 -
\??\c:\vvdvj.exec:\vvdvj.exe26⤵
- Executes dropped EXE
PID:4568 -
\??\c:\lflxxrx.exec:\lflxxrx.exe27⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xrxrfff.exec:\xrxrfff.exe28⤵
- Executes dropped EXE
PID:3448 -
\??\c:\ntnhbb.exec:\ntnhbb.exe29⤵
- Executes dropped EXE
PID:3780 -
\??\c:\7vdvv.exec:\7vdvv.exe30⤵
- Executes dropped EXE
PID:2228 -
\??\c:\pdvpd.exec:\pdvpd.exe31⤵
- Executes dropped EXE
PID:620 -
\??\c:\frrlfxr.exec:\frrlfxr.exe32⤵
- Executes dropped EXE
PID:4100 -
\??\c:\xfrlffx.exec:\xfrlffx.exe33⤵
- Executes dropped EXE
PID:4948 -
\??\c:\bthhtt.exec:\bthhtt.exe34⤵
- Executes dropped EXE
PID:3232 -
\??\c:\vvvpj.exec:\vvvpj.exe35⤵
- Executes dropped EXE
PID:3648 -
\??\c:\rllfrrl.exec:\rllfrrl.exe36⤵
- Executes dropped EXE
PID:864 -
\??\c:\hbbthh.exec:\hbbthh.exe37⤵
- Executes dropped EXE
PID:3688 -
\??\c:\btnthn.exec:\btnthn.exe38⤵
- Executes dropped EXE
PID:3904 -
\??\c:\pjvpj.exec:\pjvpj.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\vvjvp.exec:\vvjvp.exe40⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rlfrlfr.exec:\rlfrlfr.exe41⤵
- Executes dropped EXE
PID:3272 -
\??\c:\rxffxxr.exec:\rxffxxr.exe42⤵
- Executes dropped EXE
PID:4384 -
\??\c:\nnnbtn.exec:\nnnbtn.exe43⤵
- Executes dropped EXE
PID:3580 -
\??\c:\7nnhtt.exec:\7nnhtt.exe44⤵
- Executes dropped EXE
PID:424 -
\??\c:\vjjdp.exec:\vjjdp.exe45⤵
- Executes dropped EXE
PID:372 -
\??\c:\ppvpv.exec:\ppvpv.exe46⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rlrlfxx.exec:\rlrlfxx.exe47⤵
- Executes dropped EXE
PID:2720 -
\??\c:\hbhhbb.exec:\hbhhbb.exe48⤵
- Executes dropped EXE
PID:4124 -
\??\c:\1hnbnh.exec:\1hnbnh.exe49⤵
- Executes dropped EXE
PID:3436 -
\??\c:\bnnhbb.exec:\bnnhbb.exe50⤵
- Executes dropped EXE
PID:3640 -
\??\c:\pjdvp.exec:\pjdvp.exe51⤵
- Executes dropped EXE
PID:3264 -
\??\c:\dvjvd.exec:\dvjvd.exe52⤵
- Executes dropped EXE
PID:2112 -
\??\c:\fxrlllf.exec:\fxrlllf.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rxxlflf.exec:\rxxlflf.exe54⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hbnhbt.exec:\hbnhbt.exe55⤵
- Executes dropped EXE
PID:3028 -
\??\c:\9ttnbb.exec:\9ttnbb.exe56⤵
- Executes dropped EXE
PID:2292 -
\??\c:\3jpjj.exec:\3jpjj.exe57⤵
- Executes dropped EXE
PID:1828 -
\??\c:\jdjdd.exec:\jdjdd.exe58⤵
- Executes dropped EXE
PID:4108 -
\??\c:\lfxrxxx.exec:\lfxrxxx.exe59⤵
- Executes dropped EXE
PID:460 -
\??\c:\tntnhh.exec:\tntnhh.exe60⤵
- Executes dropped EXE
PID:4896 -
\??\c:\hhhhtn.exec:\hhhhtn.exe61⤵
- Executes dropped EXE
PID:4368 -
\??\c:\7dpjd.exec:\7dpjd.exe62⤵
- Executes dropped EXE
PID:4068 -
\??\c:\9xfrxrx.exec:\9xfrxrx.exe63⤵
- Executes dropped EXE
PID:4128 -
\??\c:\nhhbtn.exec:\nhhbtn.exe64⤵
- Executes dropped EXE
PID:4396 -
\??\c:\tbbthh.exec:\tbbthh.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4080 -
\??\c:\jppjd.exec:\jppjd.exe66⤵PID:1992
-
\??\c:\lrfxxff.exec:\lrfxxff.exe67⤵PID:4372
-
\??\c:\xxlflff.exec:\xxlflff.exe68⤵PID:2700
-
\??\c:\tbbtnh.exec:\tbbtnh.exe69⤵PID:4748
-
\??\c:\5pddd.exec:\5pddd.exe70⤵PID:4740
-
\??\c:\djdvv.exec:\djdvv.exe71⤵PID:2032
-
\??\c:\xlrxrfx.exec:\xlrxrfx.exe72⤵PID:1484
-
\??\c:\3llfxxx.exec:\3llfxxx.exe73⤵PID:2636
-
\??\c:\1hnhbt.exec:\1hnhbt.exe74⤵PID:4596
-
\??\c:\hhnhbt.exec:\hhnhbt.exe75⤵PID:4916
-
\??\c:\dvjpv.exec:\dvjpv.exe76⤵PID:4860
-
\??\c:\ffrfffl.exec:\ffrfffl.exe77⤵PID:224
-
\??\c:\tnttnh.exec:\tnttnh.exe78⤵PID:2116
-
\??\c:\dvjdd.exec:\dvjdd.exe79⤵PID:2672
-
\??\c:\rxrfrlf.exec:\rxrfrlf.exe80⤵PID:3524
-
\??\c:\7xxrrxl.exec:\7xxrrxl.exe81⤵PID:1756
-
\??\c:\bhbtnn.exec:\bhbtnn.exe82⤵PID:3992
-
\??\c:\btthhh.exec:\btthhh.exe83⤵PID:4040
-
\??\c:\dppjj.exec:\dppjj.exe84⤵PID:3068
-
\??\c:\9ppjp.exec:\9ppjp.exe85⤵PID:620
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe86⤵PID:3700
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe87⤵PID:3432
-
\??\c:\thtnbb.exec:\thtnbb.exe88⤵PID:4032
-
\??\c:\nhhbnn.exec:\nhhbnn.exe89⤵PID:3584
-
\??\c:\jvvpd.exec:\jvvpd.exe90⤵PID:4720
-
\??\c:\ppddj.exec:\ppddj.exe91⤵PID:208
-
\??\c:\3frflfx.exec:\3frflfx.exe92⤵PID:3024
-
\??\c:\nnttnn.exec:\nnttnn.exe93⤵PID:2248
-
\??\c:\nbbthh.exec:\nbbthh.exe94⤵PID:4516
-
\??\c:\7vvpj.exec:\7vvpj.exe95⤵PID:4480
-
\??\c:\pjpjd.exec:\pjpjd.exe96⤵PID:4472
-
\??\c:\xrfxffx.exec:\xrfxffx.exe97⤵PID:4204
-
\??\c:\nhnhhn.exec:\nhnhhn.exe98⤵PID:3672
-
\??\c:\1nbttt.exec:\1nbttt.exe99⤵PID:804
-
\??\c:\ppjdv.exec:\ppjdv.exe100⤵PID:1520
-
\??\c:\pjpdv.exec:\pjpdv.exe101⤵PID:4648
-
\??\c:\7ddjv.exec:\7ddjv.exe102⤵PID:1244
-
\??\c:\xrrlxff.exec:\xrrlxff.exe103⤵PID:2808
-
\??\c:\xxrxxxl.exec:\xxrxxxl.exe104⤵PID:676
-
\??\c:\hhnhht.exec:\hhnhht.exe105⤵PID:2224
-
\??\c:\5hbbbb.exec:\5hbbbb.exe106⤵PID:2296
-
\??\c:\dppjj.exec:\dppjj.exe107⤵PID:896
-
\??\c:\xxrlxxx.exec:\xxrlxxx.exe108⤵PID:2104
-
\??\c:\lflfffl.exec:\lflfffl.exe109⤵PID:2992
-
\??\c:\hntnhh.exec:\hntnhh.exe110⤵PID:5088
-
\??\c:\vvdvd.exec:\vvdvd.exe111⤵PID:4004
-
\??\c:\vpvpv.exec:\vpvpv.exe112⤵PID:3452
-
\??\c:\jddvd.exec:\jddvd.exe113⤵PID:436
-
\??\c:\5xxlfxr.exec:\5xxlfxr.exe114⤵PID:2192
-
\??\c:\frxrrll.exec:\frxrrll.exe115⤵PID:3512
-
\??\c:\hbbhhh.exec:\hbbhhh.exe116⤵PID:1488
-
\??\c:\hnbbnh.exec:\hnbbnh.exe117⤵PID:2832
-
\??\c:\1ddvp.exec:\1ddvp.exe118⤵PID:4496
-
\??\c:\5jvpp.exec:\5jvpp.exe119⤵PID:2036
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe120⤵PID:2348
-
\??\c:\3ffxxxx.exec:\3ffxxxx.exe121⤵PID:2604
-
\??\c:\btbbbb.exec:\btbbbb.exe122⤵PID:3112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-