Analysis
-
max time kernel
117s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 20:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe
-
Size
80KB
-
MD5
5e53a307d9279384ffed6086ed77e4f0
-
SHA1
e8ec49e3c3817f374bdb22e37333e3c339e6cdd8
-
SHA256
93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9
-
SHA512
814d330c33729fd048cc3e61c6a3e9bef0cc120b373ed53a3780928dbac648a258f5cde096dd3b84dff5758e1876e1c68f5acd2ab665747265da25e00691942e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLU1gxmcK8kZOt:ymb3NkkiQ3mdBjFoLkmW8ky
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1124-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4216 jvpvv.exe 1516 rrxxrxx.exe 4784 bbbbnt.exe 3388 fxxxrrr.exe 4912 tbnnbb.exe 2720 htnntb.exe 2224 1ppdd.exe 2408 5xffxxx.exe 3904 pvjpd.exe 3064 rxfxxrr.exe 5004 hhthth.exe 320 vvddd.exe 5036 3pddd.exe 624 tnnntb.exe 3504 hhnnnt.exe 3580 dvvvv.exe 4424 btbbhh.exe 3936 ntnnnn.exe 1140 dvjjp.exe 4308 llffffr.exe 4844 lxrrrxx.exe 5108 bhbnhh.exe 2676 5dddd.exe 4836 xlflflx.exe 1188 nttnhn.exe 2156 vpjdv.exe 3964 rxrlxxl.exe 4496 bttttt.exe 2160 ppdjj.exe 1316 9ddvv.exe 2416 1ffxxff.exe 3268 htbhbn.exe 3324 ppjjv.exe 868 lrllfrl.exe 4724 fflllll.exe 2332 tnttnb.exe 748 9pdvp.exe 3240 1lffrrl.exe 808 fxrrxxx.exe 3524 nnbtnb.exe 1124 fxrrrrr.exe 1556 nhhbbb.exe 3596 thhtth.exe 1528 vppjd.exe 2016 lrxfxrx.exe 2728 btttht.exe 4840 nbhbnt.exe 4396 djvjd.exe 1860 vvddd.exe 3224 vpdvp.exe 2804 xlrlllf.exe 1012 hbtttt.exe 4980 tntnnn.exe 628 vvddv.exe 2568 frllfff.exe 2792 rfflfrf.exe 3860 tbhttt.exe 1640 hbhtnn.exe 2480 pvddp.exe 4612 9rlrxlr.exe 1888 dddvj.exe 4856 1lxfrrf.exe 4236 hbbbbb.exe 4336 vpvjv.exe -
resource yara_rule behavioral2/memory/1124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1124 wrote to memory of 4216 1124 93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe 84 PID 1124 wrote to memory of 4216 1124 93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe 84 PID 1124 wrote to memory of 4216 1124 93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe 84 PID 4216 wrote to memory of 1516 4216 jvpvv.exe 85 PID 4216 wrote to memory of 1516 4216 jvpvv.exe 85 PID 4216 wrote to memory of 1516 4216 jvpvv.exe 85 PID 1516 wrote to memory of 4784 1516 rrxxrxx.exe 86 PID 1516 wrote to memory of 4784 1516 rrxxrxx.exe 86 PID 1516 wrote to memory of 4784 1516 rrxxrxx.exe 86 PID 4784 wrote to memory of 3388 4784 bbbbnt.exe 87 PID 4784 wrote to memory of 3388 4784 bbbbnt.exe 87 PID 4784 wrote to memory of 3388 4784 bbbbnt.exe 87 PID 3388 wrote to memory of 4912 3388 fxxxrrr.exe 88 PID 3388 wrote to memory of 4912 3388 fxxxrrr.exe 88 PID 3388 wrote to memory of 4912 3388 fxxxrrr.exe 88 PID 4912 wrote to memory of 2720 4912 tbnnbb.exe 89 PID 4912 wrote to memory of 2720 4912 tbnnbb.exe 89 PID 4912 wrote to memory of 2720 4912 tbnnbb.exe 89 PID 2720 wrote to memory of 2224 2720 htnntb.exe 90 PID 2720 wrote to memory of 2224 2720 htnntb.exe 90 PID 2720 wrote to memory of 2224 2720 htnntb.exe 90 PID 2224 wrote to memory of 2408 2224 1ppdd.exe 91 PID 2224 wrote to memory of 2408 2224 1ppdd.exe 91 PID 2224 wrote to memory of 2408 2224 1ppdd.exe 91 PID 2408 wrote to memory of 3904 2408 5xffxxx.exe 92 PID 2408 wrote to memory of 3904 2408 5xffxxx.exe 92 PID 2408 wrote to memory of 3904 2408 5xffxxx.exe 92 PID 3904 wrote to memory of 3064 3904 pvjpd.exe 94 PID 3904 wrote to memory of 3064 3904 pvjpd.exe 94 PID 3904 wrote to memory of 3064 3904 pvjpd.exe 94 PID 3064 wrote to memory of 5004 3064 rxfxxrr.exe 95 PID 3064 wrote to memory of 5004 3064 rxfxxrr.exe 95 PID 3064 wrote to memory of 5004 3064 rxfxxrr.exe 95 PID 5004 wrote to memory of 320 5004 hhthth.exe 96 PID 5004 wrote to memory of 320 5004 hhthth.exe 96 PID 5004 wrote to memory of 320 5004 hhthth.exe 96 PID 320 wrote to memory of 5036 320 vvddd.exe 97 PID 320 wrote to memory of 5036 320 vvddd.exe 97 PID 320 wrote to memory of 5036 320 vvddd.exe 97 PID 5036 wrote to memory of 624 5036 3pddd.exe 98 PID 5036 wrote to memory of 624 5036 3pddd.exe 98 PID 5036 wrote to memory of 624 5036 3pddd.exe 98 PID 624 wrote to memory of 3504 624 tnnntb.exe 99 PID 624 wrote to memory of 3504 624 tnnntb.exe 99 PID 624 wrote to memory of 3504 624 tnnntb.exe 99 PID 3504 wrote to memory of 3580 3504 hhnnnt.exe 100 PID 3504 wrote to memory of 3580 3504 hhnnnt.exe 100 PID 3504 wrote to memory of 3580 3504 hhnnnt.exe 100 PID 3580 wrote to memory of 4424 3580 dvvvv.exe 101 PID 3580 wrote to memory of 4424 3580 dvvvv.exe 101 PID 3580 wrote to memory of 4424 3580 dvvvv.exe 101 PID 4424 wrote to memory of 3936 4424 btbbhh.exe 102 PID 4424 wrote to memory of 3936 4424 btbbhh.exe 102 PID 4424 wrote to memory of 3936 4424 btbbhh.exe 102 PID 3936 wrote to memory of 1140 3936 ntnnnn.exe 103 PID 3936 wrote to memory of 1140 3936 ntnnnn.exe 103 PID 3936 wrote to memory of 1140 3936 ntnnnn.exe 103 PID 1140 wrote to memory of 4308 1140 dvjjp.exe 104 PID 1140 wrote to memory of 4308 1140 dvjjp.exe 104 PID 1140 wrote to memory of 4308 1140 dvjjp.exe 104 PID 4308 wrote to memory of 4844 4308 llffffr.exe 105 PID 4308 wrote to memory of 4844 4308 llffffr.exe 105 PID 4308 wrote to memory of 4844 4308 llffffr.exe 105 PID 4844 wrote to memory of 5108 4844 lxrrrxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe"C:\Users\Admin\AppData\Local\Temp\93148fbc09b4f0113fbce0c0b229f9bc287487fe25bd3760a43a5abf9eaec1c9N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\jvpvv.exec:\jvpvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bbbbnt.exec:\bbbbnt.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\tbnnbb.exec:\tbnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\htnntb.exec:\htnntb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1ppdd.exec:\1ppdd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\5xffxxx.exec:\5xffxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pvjpd.exec:\pvjpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\rxfxxrr.exec:\rxfxxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hhthth.exec:\hhthth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\vvddd.exec:\vvddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\3pddd.exec:\3pddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\tnnntb.exec:\tnnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\hhnnnt.exec:\hhnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\dvvvv.exec:\dvvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\btbbhh.exec:\btbbhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\ntnnnn.exec:\ntnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\dvjjp.exec:\dvjjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\llffffr.exec:\llffffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\lxrrrxx.exec:\lxrrrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\bhbnhh.exec:\bhbnhh.exe23⤵
- Executes dropped EXE
PID:5108 -
\??\c:\5dddd.exec:\5dddd.exe24⤵
- Executes dropped EXE
PID:2676 -
\??\c:\xlflflx.exec:\xlflflx.exe25⤵
- Executes dropped EXE
PID:4836 -
\??\c:\nttnhn.exec:\nttnhn.exe26⤵
- Executes dropped EXE
PID:1188 -
\??\c:\vpjdv.exec:\vpjdv.exe27⤵
- Executes dropped EXE
PID:2156 -
\??\c:\rxrlxxl.exec:\rxrlxxl.exe28⤵
- Executes dropped EXE
PID:3964 -
\??\c:\bttttt.exec:\bttttt.exe29⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ppdjj.exec:\ppdjj.exe30⤵
- Executes dropped EXE
PID:2160 -
\??\c:\9ddvv.exec:\9ddvv.exe31⤵
- Executes dropped EXE
PID:1316 -
\??\c:\1ffxxff.exec:\1ffxxff.exe32⤵
- Executes dropped EXE
PID:2416 -
\??\c:\htbhbn.exec:\htbhbn.exe33⤵
- Executes dropped EXE
PID:3268 -
\??\c:\ppjjv.exec:\ppjjv.exe34⤵
- Executes dropped EXE
PID:3324 -
\??\c:\lrllfrl.exec:\lrllfrl.exe35⤵
- Executes dropped EXE
PID:868 -
\??\c:\fflllll.exec:\fflllll.exe36⤵
- Executes dropped EXE
PID:4724 -
\??\c:\tnttnb.exec:\tnttnb.exe37⤵
- Executes dropped EXE
PID:2332 -
\??\c:\9pdvp.exec:\9pdvp.exe38⤵
- Executes dropped EXE
PID:748 -
\??\c:\1lffrrl.exec:\1lffrrl.exe39⤵
- Executes dropped EXE
PID:3240 -
\??\c:\fxrrxxx.exec:\fxrrxxx.exe40⤵
- Executes dropped EXE
PID:808 -
\??\c:\nnbtnb.exec:\nnbtnb.exe41⤵
- Executes dropped EXE
PID:3524 -
\??\c:\vvvdv.exec:\vvvdv.exe42⤵PID:924
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe43⤵
- Executes dropped EXE
PID:1124 -
\??\c:\nhhbbb.exec:\nhhbbb.exe44⤵
- Executes dropped EXE
PID:1556 -
\??\c:\thhtth.exec:\thhtth.exe45⤵
- Executes dropped EXE
PID:3596 -
\??\c:\vppjd.exec:\vppjd.exe46⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lrxfxrx.exec:\lrxfxrx.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\btttht.exec:\btttht.exe48⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nbhbnt.exec:\nbhbnt.exe49⤵
- Executes dropped EXE
PID:4840 -
\??\c:\djvjd.exec:\djvjd.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\vvddd.exec:\vvddd.exe51⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vpdvp.exec:\vpdvp.exe52⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xlrlllf.exec:\xlrlllf.exe53⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbtttt.exec:\hbtttt.exe54⤵
- Executes dropped EXE
PID:1012 -
\??\c:\tntnnn.exec:\tntnnn.exe55⤵
- Executes dropped EXE
PID:4980 -
\??\c:\vvddv.exec:\vvddv.exe56⤵
- Executes dropped EXE
PID:628 -
\??\c:\frllfff.exec:\frllfff.exe57⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rfflfrf.exec:\rfflfrf.exe58⤵
- Executes dropped EXE
PID:2792 -
\??\c:\tbhttt.exec:\tbhttt.exe59⤵
- Executes dropped EXE
PID:3860 -
\??\c:\hbhtnn.exec:\hbhtnn.exe60⤵
- Executes dropped EXE
PID:1640 -
\??\c:\pvddp.exec:\pvddp.exe61⤵
- Executes dropped EXE
PID:2480 -
\??\c:\9rlrxlr.exec:\9rlrxlr.exe62⤵
- Executes dropped EXE
PID:4612 -
\??\c:\dddvj.exec:\dddvj.exe63⤵
- Executes dropped EXE
PID:1888 -
\??\c:\1lxfrrf.exec:\1lxfrrf.exe64⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hbbbbb.exec:\hbbbbb.exe65⤵
- Executes dropped EXE
PID:4236 -
\??\c:\vpvjv.exec:\vpvjv.exe66⤵
- Executes dropped EXE
PID:4336 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe67⤵PID:2020
-
\??\c:\llffrxl.exec:\llffrxl.exe68⤵PID:2888
-
\??\c:\nnttht.exec:\nnttht.exe69⤵PID:2504
-
\??\c:\pjpjj.exec:\pjpjj.exe70⤵PID:5096
-
\??\c:\ffffxxx.exec:\ffffxxx.exe71⤵PID:5008
-
\??\c:\1lrrrrr.exec:\1lrrrrr.exe72⤵PID:4516
-
\??\c:\nhhhbh.exec:\nhhhbh.exe73⤵PID:1148
-
\??\c:\jvvpv.exec:\jvvpv.exe74⤵PID:4764
-
\??\c:\jdpjp.exec:\jdpjp.exe75⤵PID:1608
-
\??\c:\lfrfllf.exec:\lfrfllf.exe76⤵PID:3964
-
\??\c:\nhttbt.exec:\nhttbt.exe77⤵PID:4496
-
\??\c:\5nbbtb.exec:\5nbbtb.exe78⤵PID:3924
-
\??\c:\ddddd.exec:\ddddd.exe79⤵PID:5032
-
\??\c:\lrrlrlr.exec:\lrrlrlr.exe80⤵PID:1316
-
\??\c:\ttnttn.exec:\ttnttn.exe81⤵PID:876
-
\??\c:\jpddd.exec:\jpddd.exe82⤵PID:2764
-
\??\c:\vjvdj.exec:\vjvdj.exe83⤵PID:2560
-
\??\c:\ntttbt.exec:\ntttbt.exe84⤵PID:3500
-
\??\c:\bhhtnt.exec:\bhhtnt.exe85⤵PID:4760
-
\??\c:\llfxxlf.exec:\llfxxlf.exe86⤵PID:3260
-
\??\c:\bbbhnn.exec:\bbbhnn.exe87⤵PID:4316
-
\??\c:\3lllfrl.exec:\3lllfrl.exe88⤵PID:1444
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe89⤵PID:4920
-
\??\c:\tnbhbb.exec:\tnbhbb.exe90⤵PID:4248
-
\??\c:\dvddv.exec:\dvddv.exe91⤵PID:4160
-
\??\c:\1flfxxx.exec:\1flfxxx.exe92⤵PID:776
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe93⤵PID:4144
-
\??\c:\bnttbb.exec:\bnttbb.exe94⤵PID:1692
-
\??\c:\nhtttb.exec:\nhtttb.exe95⤵PID:3700
-
\??\c:\ppppp.exec:\ppppp.exe96⤵PID:5068
-
\??\c:\dpjjj.exec:\dpjjj.exe97⤵PID:2376
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe98⤵PID:1348
-
\??\c:\pdddp.exec:\pdddp.exe99⤵PID:1764
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe100⤵PID:2408
-
\??\c:\nhnhbt.exec:\nhnhbt.exe101⤵PID:4512
-
\??\c:\pppjj.exec:\pppjj.exe102⤵PID:1748
-
\??\c:\ppdvp.exec:\ppdvp.exe103⤵PID:372
-
\??\c:\rlrllrr.exec:\rlrllrr.exe104⤵PID:3976
-
\??\c:\hnnbnt.exec:\hnnbnt.exe105⤵
- System Location Discovery: System Language Discovery
PID:4048 -
\??\c:\jjpdj.exec:\jjpdj.exe106⤵PID:1960
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:4852
-
\??\c:\xrffllf.exec:\xrffllf.exe108⤵PID:5064
-
\??\c:\tbnttb.exec:\tbnttb.exe109⤵PID:2712
-
\??\c:\vdpvj.exec:\vdpvj.exe110⤵PID:3632
-
\??\c:\jdpvd.exec:\jdpvd.exe111⤵PID:4416
-
\??\c:\xxfllrr.exec:\xxfllrr.exe112⤵PID:1328
-
\??\c:\thnhhb.exec:\thnhhb.exe113⤵PID:3360
-
\??\c:\btnbht.exec:\btnbht.exe114⤵PID:4336
-
\??\c:\9vdjj.exec:\9vdjj.exe115⤵PID:4788
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵PID:2440
-
\??\c:\flxlxrx.exec:\flxlxrx.exe117⤵PID:3396
-
\??\c:\hhbhhh.exec:\hhbhhh.exe118⤵PID:1356
-
\??\c:\hnbbbb.exec:\hnbbbb.exe119⤵PID:2244
-
\??\c:\ddvvv.exec:\ddvvv.exe120⤵PID:3296
-
\??\c:\9jvvv.exec:\9jvvv.exe121⤵PID:1644
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe122⤵PID:708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-