Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe
Resource
win7-20240903-en
General
-
Target
a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe
-
Size
82KB
-
MD5
5c0d0687113b4863627a43034d3eeca0
-
SHA1
4ab3eaeb92de1afe658a28fc6afc5c8d0871633b
-
SHA256
a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4c
-
SHA512
4332589789a80936eeb287867d96b945cbb593dfde45873b7ca345fbc49a8f0ab0c3ba59291f4327b9f6763b718a0c249000f1d1cf2ff30f78dc6b5f30a1f317
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QF:ymb3NkkiQ3mdBjFIIp9L9QrrA8K
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/3548-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4072 xxrffrl.exe 2500 nnhhbh.exe 4376 btttnh.exe 2828 dvdvp.exe 2580 djppp.exe 3520 3fllxxx.exe 2112 rlrrrrl.exe 1832 jjddd.exe 3384 xrxrlll.exe 4360 9hnhhh.exe 4424 5pvpv.exe 1464 9lllfrl.exe 684 rrxxxxx.exe 312 tnhbbb.exe 5104 vdjvd.exe 3492 lxxrllr.exe 2708 tbnttt.exe 3620 dddjd.exe 2712 jjddv.exe 3352 nnnhhb.exe 2820 vvvvv.exe 3460 lfxfxxx.exe 752 bnnnbt.exe 4156 xrrlfxx.exe 1664 3hbnhb.exe 4300 dddvv.exe 2192 lxfxxxr.exe 1964 hbbbtn.exe 4636 hbbthh.exe 4936 vpvpp.exe 3736 xrrlrrx.exe 2812 jjjjd.exe 876 xxlffff.exe 4836 fxlfrlf.exe 2756 bhhnnt.exe 4652 nhbbbb.exe 2316 ddjjp.exe 3316 3lllfff.exe 1676 frxxrrl.exe 2312 hnnnhh.exe 4608 7vddp.exe 1356 7lrrfff.exe 3956 bnbnhb.exe 860 pddvv.exe 1500 llllfll.exe 4352 3xxrlfx.exe 1380 9hhbnh.exe 2024 1dpvv.exe 2132 vvppj.exe 3288 rfffxfx.exe 4044 9xxrlll.exe 2264 1lrrlrr.exe 5072 ppjdp.exe 3016 jdpjv.exe 2656 xlfxlfx.exe 3520 3nttnh.exe 4588 3hhbbt.exe 2764 9dddj.exe 4080 pjdvv.exe 5052 1xlrfxx.exe 3384 bthhtt.exe 1604 3btntn.exe 5084 5ddvp.exe 2904 9flxlfx.exe -
resource yara_rule behavioral2/memory/3548-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3548-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1pvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9httnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1thbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lrllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 4072 3548 a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe 82 PID 3548 wrote to memory of 4072 3548 a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe 82 PID 3548 wrote to memory of 4072 3548 a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe 82 PID 4072 wrote to memory of 2500 4072 xxrffrl.exe 83 PID 4072 wrote to memory of 2500 4072 xxrffrl.exe 83 PID 4072 wrote to memory of 2500 4072 xxrffrl.exe 83 PID 2500 wrote to memory of 4376 2500 nnhhbh.exe 84 PID 2500 wrote to memory of 4376 2500 nnhhbh.exe 84 PID 2500 wrote to memory of 4376 2500 nnhhbh.exe 84 PID 4376 wrote to memory of 2828 4376 btttnh.exe 85 PID 4376 wrote to memory of 2828 4376 btttnh.exe 85 PID 4376 wrote to memory of 2828 4376 btttnh.exe 85 PID 2828 wrote to memory of 2580 2828 dvdvp.exe 86 PID 2828 wrote to memory of 2580 2828 dvdvp.exe 86 PID 2828 wrote to memory of 2580 2828 dvdvp.exe 86 PID 2580 wrote to memory of 3520 2580 djppp.exe 87 PID 2580 wrote to memory of 3520 2580 djppp.exe 87 PID 2580 wrote to memory of 3520 2580 djppp.exe 87 PID 3520 wrote to memory of 2112 3520 3fllxxx.exe 88 PID 3520 wrote to memory of 2112 3520 3fllxxx.exe 88 PID 3520 wrote to memory of 2112 3520 3fllxxx.exe 88 PID 2112 wrote to memory of 1832 2112 rlrrrrl.exe 89 PID 2112 wrote to memory of 1832 2112 rlrrrrl.exe 89 PID 2112 wrote to memory of 1832 2112 rlrrrrl.exe 89 PID 1832 wrote to memory of 3384 1832 jjddd.exe 90 PID 1832 wrote to memory of 3384 1832 jjddd.exe 90 PID 1832 wrote to memory of 3384 1832 jjddd.exe 90 PID 3384 wrote to memory of 4360 3384 xrxrlll.exe 91 PID 3384 wrote to memory of 4360 3384 xrxrlll.exe 91 PID 3384 wrote to memory of 4360 3384 xrxrlll.exe 91 PID 4360 wrote to memory of 4424 4360 9hnhhh.exe 92 PID 4360 wrote to memory of 4424 4360 9hnhhh.exe 92 PID 4360 wrote to memory of 4424 4360 9hnhhh.exe 92 PID 4424 wrote to memory of 1464 4424 5pvpv.exe 93 PID 4424 wrote to memory of 1464 4424 5pvpv.exe 93 PID 4424 wrote to memory of 1464 4424 5pvpv.exe 93 PID 1464 wrote to memory of 684 1464 9lllfrl.exe 94 PID 1464 wrote to memory of 684 1464 9lllfrl.exe 94 PID 1464 wrote to memory of 684 1464 9lllfrl.exe 94 PID 684 wrote to memory of 312 684 rrxxxxx.exe 95 PID 684 wrote to memory of 312 684 rrxxxxx.exe 95 PID 684 wrote to memory of 312 684 rrxxxxx.exe 95 PID 312 wrote to memory of 5104 312 tnhbbb.exe 96 PID 312 wrote to memory of 5104 312 tnhbbb.exe 96 PID 312 wrote to memory of 5104 312 tnhbbb.exe 96 PID 5104 wrote to memory of 3492 5104 vdjvd.exe 97 PID 5104 wrote to memory of 3492 5104 vdjvd.exe 97 PID 5104 wrote to memory of 3492 5104 vdjvd.exe 97 PID 3492 wrote to memory of 2708 3492 lxxrllr.exe 98 PID 3492 wrote to memory of 2708 3492 lxxrllr.exe 98 PID 3492 wrote to memory of 2708 3492 lxxrllr.exe 98 PID 2708 wrote to memory of 3620 2708 tbnttt.exe 99 PID 2708 wrote to memory of 3620 2708 tbnttt.exe 99 PID 2708 wrote to memory of 3620 2708 tbnttt.exe 99 PID 3620 wrote to memory of 2712 3620 dddjd.exe 100 PID 3620 wrote to memory of 2712 3620 dddjd.exe 100 PID 3620 wrote to memory of 2712 3620 dddjd.exe 100 PID 2712 wrote to memory of 3352 2712 jjddv.exe 101 PID 2712 wrote to memory of 3352 2712 jjddv.exe 101 PID 2712 wrote to memory of 3352 2712 jjddv.exe 101 PID 3352 wrote to memory of 2820 3352 nnnhhb.exe 102 PID 3352 wrote to memory of 2820 3352 nnnhhb.exe 102 PID 3352 wrote to memory of 2820 3352 nnnhhb.exe 102 PID 2820 wrote to memory of 3460 2820 vvvvv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe"C:\Users\Admin\AppData\Local\Temp\a646cb4b5e2f58cbcb83b7bf29201da77f225aeddbc4d88c3aa9c912139e6c4cN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\xxrffrl.exec:\xxrffrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\nnhhbh.exec:\nnhhbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\btttnh.exec:\btttnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\dvdvp.exec:\dvdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\djppp.exec:\djppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\3fllxxx.exec:\3fllxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\jjddd.exec:\jjddd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\xrxrlll.exec:\xrxrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3384 -
\??\c:\9hnhhh.exec:\9hnhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\5pvpv.exec:\5pvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\9lllfrl.exec:\9lllfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\tnhbbb.exec:\tnhbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\vdjvd.exec:\vdjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\lxxrllr.exec:\lxxrllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\tbnttt.exec:\tbnttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\dddjd.exec:\dddjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\jjddv.exec:\jjddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\nnnhhb.exec:\nnnhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\vvvvv.exec:\vvvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\lfxfxxx.exec:\lfxfxxx.exe23⤵
- Executes dropped EXE
PID:3460 -
\??\c:\bnnnbt.exec:\bnnnbt.exe24⤵
- Executes dropped EXE
PID:752 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe25⤵
- Executes dropped EXE
PID:4156 -
\??\c:\3hbnhb.exec:\3hbnhb.exe26⤵
- Executes dropped EXE
PID:1664 -
\??\c:\dddvv.exec:\dddvv.exe27⤵
- Executes dropped EXE
PID:4300 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe28⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hbbbtn.exec:\hbbbtn.exe29⤵
- Executes dropped EXE
PID:1964 -
\??\c:\hbbthh.exec:\hbbthh.exe30⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vpvpp.exec:\vpvpp.exe31⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xrrlrrx.exec:\xrrlrrx.exe32⤵
- Executes dropped EXE
PID:3736 -
\??\c:\jjjjd.exec:\jjjjd.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xxlffff.exec:\xxlffff.exe34⤵
- Executes dropped EXE
PID:876 -
\??\c:\fxlfrlf.exec:\fxlfrlf.exe35⤵
- Executes dropped EXE
PID:4836 -
\??\c:\bhhnnt.exec:\bhhnnt.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nhbbbb.exec:\nhbbbb.exe37⤵
- Executes dropped EXE
PID:4652 -
\??\c:\ddjjp.exec:\ddjjp.exe38⤵
- Executes dropped EXE
PID:2316 -
\??\c:\3lllfff.exec:\3lllfff.exe39⤵
- Executes dropped EXE
PID:3316 -
\??\c:\frxxrrl.exec:\frxxrrl.exe40⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hnnnhh.exec:\hnnnhh.exe41⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7vddp.exec:\7vddp.exe42⤵
- Executes dropped EXE
PID:4608 -
\??\c:\7lrrfff.exec:\7lrrfff.exe43⤵
- Executes dropped EXE
PID:1356 -
\??\c:\bnbnhb.exec:\bnbnhb.exe44⤵
- Executes dropped EXE
PID:3956 -
\??\c:\pddvv.exec:\pddvv.exe45⤵
- Executes dropped EXE
PID:860 -
\??\c:\llllfll.exec:\llllfll.exe46⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3xxrlfx.exec:\3xxrlfx.exe47⤵
- Executes dropped EXE
PID:4352 -
\??\c:\9hhbnh.exec:\9hhbnh.exe48⤵
- Executes dropped EXE
PID:1380 -
\??\c:\1dpvv.exec:\1dpvv.exe49⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vvppj.exec:\vvppj.exe50⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rfffxfx.exec:\rfffxfx.exe51⤵
- Executes dropped EXE
PID:3288 -
\??\c:\9xxrlll.exec:\9xxrlll.exe52⤵
- Executes dropped EXE
PID:4044 -
\??\c:\1lrrlrr.exec:\1lrrlrr.exe53⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ppjdp.exec:\ppjdp.exe54⤵
- Executes dropped EXE
PID:5072 -
\??\c:\jdpjv.exec:\jdpjv.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe56⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3nttnh.exec:\3nttnh.exe57⤵
- Executes dropped EXE
PID:3520 -
\??\c:\3hhbbt.exec:\3hhbbt.exe58⤵
- Executes dropped EXE
PID:4588 -
\??\c:\9dddj.exec:\9dddj.exe59⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pjdvv.exec:\pjdvv.exe60⤵
- Executes dropped EXE
PID:4080 -
\??\c:\1xlrfxx.exec:\1xlrfxx.exe61⤵
- Executes dropped EXE
PID:5052 -
\??\c:\bthhtt.exec:\bthhtt.exe62⤵
- Executes dropped EXE
PID:3384 -
\??\c:\3btntn.exec:\3btntn.exe63⤵
- Executes dropped EXE
PID:1604 -
\??\c:\5ddvp.exec:\5ddvp.exe64⤵
- Executes dropped EXE
PID:5084 -
\??\c:\9flxlfx.exec:\9flxlfx.exe65⤵
- Executes dropped EXE
PID:2904 -
\??\c:\fxlxrrl.exec:\fxlxrrl.exe66⤵PID:4280
-
\??\c:\9nnnbt.exec:\9nnnbt.exe67⤵PID:708
-
\??\c:\vvpjv.exec:\vvpjv.exe68⤵PID:5080
-
\??\c:\5pjdj.exec:\5pjdj.exe69⤵PID:3740
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe70⤵PID:5088
-
\??\c:\7rlxrxl.exec:\7rlxrxl.exe71⤵PID:400
-
\??\c:\htttnn.exec:\htttnn.exe72⤵PID:216
-
\??\c:\ttthbb.exec:\ttthbb.exe73⤵PID:4032
-
\??\c:\vvvvp.exec:\vvvvp.exe74⤵PID:3580
-
\??\c:\1rfrfrl.exec:\1rfrfrl.exe75⤵PID:3196
-
\??\c:\llxfffx.exec:\llxfffx.exe76⤵PID:1520
-
\??\c:\xlffxxr.exec:\xlffxxr.exe77⤵PID:2484
-
\??\c:\nnhttb.exec:\nnhttb.exe78⤵PID:1124
-
\??\c:\pjppd.exec:\pjppd.exe79⤵PID:5032
-
\??\c:\dvpjd.exec:\dvpjd.exe80⤵PID:2804
-
\??\c:\fxxrfff.exec:\fxxrfff.exe81⤵PID:1672
-
\??\c:\nbhbnh.exec:\nbhbnh.exe82⤵PID:2240
-
\??\c:\nhhhnn.exec:\nhhhnn.exe83⤵PID:1376
-
\??\c:\hthbnn.exec:\hthbnn.exe84⤵PID:3348
-
\??\c:\jjjdv.exec:\jjjdv.exe85⤵PID:3468
-
\??\c:\5lxrfxf.exec:\5lxrfxf.exe86⤵PID:2192
-
\??\c:\lffrrxx.exec:\lffrrxx.exe87⤵PID:4992
-
\??\c:\1nbbhh.exec:\1nbbhh.exe88⤵PID:2744
-
\??\c:\bhbnbb.exec:\bhbnbb.exe89⤵PID:2784
-
\??\c:\pjvpv.exec:\pjvpv.exe90⤵PID:3952
-
\??\c:\vpjdp.exec:\vpjdp.exe91⤵PID:2964
-
\??\c:\llfrrrl.exec:\llfrrrl.exe92⤵PID:428
-
\??\c:\9rrrrrr.exec:\9rrrrrr.exe93⤵PID:3640
-
\??\c:\htbbbb.exec:\htbbbb.exe94⤵
- System Location Discovery: System Language Discovery
PID:4836 -
\??\c:\jvpdp.exec:\jvpdp.exe95⤵PID:1020
-
\??\c:\jpjdv.exec:\jpjdv.exe96⤵PID:4896
-
\??\c:\3llxlfr.exec:\3llxlfr.exe97⤵PID:4772
-
\??\c:\1nnhhh.exec:\1nnhhh.exe98⤵PID:4368
-
\??\c:\hbbtnn.exec:\hbbtnn.exe99⤵PID:2228
-
\??\c:\pjdvj.exec:\pjdvj.exe100⤵PID:1456
-
\??\c:\5frlxxr.exec:\5frlxxr.exe101⤵PID:1204
-
\??\c:\bbttnt.exec:\bbttnt.exe102⤵PID:4564
-
\??\c:\5pvjd.exec:\5pvjd.exe103⤵PID:800
-
\??\c:\dvppd.exec:\dvppd.exe104⤵PID:2504
-
\??\c:\xxxrllf.exec:\xxxrllf.exe105⤵PID:2236
-
\??\c:\5rfxfxr.exec:\5rfxfxr.exe106⤵PID:3116
-
\??\c:\hbbtnh.exec:\hbbtnh.exe107⤵PID:1228
-
\??\c:\7pjdp.exec:\7pjdp.exe108⤵PID:3708
-
\??\c:\jjdpv.exec:\jjdpv.exe109⤵PID:4036
-
\??\c:\xrllffr.exec:\xrllffr.exe110⤵PID:2500
-
\??\c:\5flrrxx.exec:\5flrrxx.exe111⤵PID:3672
-
\??\c:\7bhhbb.exec:\7bhhbb.exe112⤵PID:1332
-
\??\c:\hnbbnh.exec:\hnbbnh.exe113⤵PID:984
-
\??\c:\1pvdv.exec:\1pvdv.exe114⤵PID:2088
-
\??\c:\1xrfrlf.exec:\1xrfrlf.exe115⤵PID:1408
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe116⤵PID:4572
-
\??\c:\tnnhbn.exec:\tnnhbn.exe117⤵PID:1036
-
\??\c:\htbthh.exec:\htbthh.exe118⤵PID:1832
-
\??\c:\pjdpd.exec:\pjdpd.exe119⤵PID:1064
-
\??\c:\3lxrrrr.exec:\3lxrrrr.exe120⤵PID:1564
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe121⤵PID:1460
-
\??\c:\3bhhhn.exec:\3bhhhn.exe122⤵PID:892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-