Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe
-
Size
66KB
-
MD5
b11198e1465010c9290fb7efe872e3a9
-
SHA1
3d8f120bcbf2edd336497cef282e066c0e3d2fea
-
SHA256
25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab
-
SHA512
de6841436df8f6252299d56b6c166bd081d2ac16843876289fb8bc1d9717c33d8c57a7a40a40e05cce0979c104a3e6589ee32a3b96340b87c1ef19a7ea47080e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNMM:ymb3NkkiQ3mdBjFIvlpMM
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/216-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-35-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3468 xfrrfrr.exe 3160 9bbbhn.exe 932 vddvv.exe 4532 llrllll.exe 3936 ntbtth.exe 3648 vvjjd.exe 1292 ffxffff.exe 2908 hbhbtn.exe 3968 llfffff.exe 3268 9bhhnt.exe 2440 pvvpv.exe 4360 fffffff.exe 4040 nnnttb.exe 4612 pvvpj.exe 4928 fxlflfx.exe 4348 ntbttb.exe 1596 rrlrrxr.exe 2616 thnhbb.exe 2340 xxlfxfx.exe 1476 lrlfxlf.exe 4856 bnnnhn.exe 1580 ffxrlfx.exe 336 bbnhtn.exe 1768 ttnbnb.exe 4636 5jvpj.exe 2040 flxxxfx.exe 3336 nhnnhn.exe 5052 pvppv.exe 396 flffrrx.exe 4004 lxfflll.exe 2996 hbhbhn.exe 2892 ddppj.exe 4184 llllxxf.exe 4208 xxfrrfr.exe 2464 bbntbb.exe 3196 rlrrrrl.exe 100 xflrlrr.exe 4756 ttbbhh.exe 1552 jjvvv.exe 3668 xfxxrrr.exe 4616 nhhntt.exe 1172 pvddv.exe 1860 rxlllll.exe 3504 hbhhtb.exe 824 pjjjj.exe 3112 fllflxl.exe 2236 thnbbb.exe 2240 hbbbhb.exe 4992 vdjjd.exe 2476 lxxrflr.exe 5076 bhhhnt.exe 3176 1hbbbb.exe 4812 djjjd.exe 1604 lrxlfxf.exe 4112 rrxxxxx.exe 4128 nhnnnt.exe 976 vvvvd.exe 1164 jdddv.exe 2012 xxxxffr.exe 3444 3rrfxfl.exe 3268 nhtttb.exe 1716 btbbbb.exe 4968 ddjjj.exe 4508 xrxxxff.exe -
resource yara_rule behavioral2/memory/216-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bhhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlllfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 3468 216 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 84 PID 216 wrote to memory of 3468 216 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 84 PID 216 wrote to memory of 3468 216 25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe 84 PID 3468 wrote to memory of 3160 3468 xfrrfrr.exe 85 PID 3468 wrote to memory of 3160 3468 xfrrfrr.exe 85 PID 3468 wrote to memory of 3160 3468 xfrrfrr.exe 85 PID 3160 wrote to memory of 932 3160 9bbbhn.exe 86 PID 3160 wrote to memory of 932 3160 9bbbhn.exe 86 PID 3160 wrote to memory of 932 3160 9bbbhn.exe 86 PID 932 wrote to memory of 4532 932 vddvv.exe 87 PID 932 wrote to memory of 4532 932 vddvv.exe 87 PID 932 wrote to memory of 4532 932 vddvv.exe 87 PID 4532 wrote to memory of 3936 4532 llrllll.exe 88 PID 4532 wrote to memory of 3936 4532 llrllll.exe 88 PID 4532 wrote to memory of 3936 4532 llrllll.exe 88 PID 3936 wrote to memory of 3648 3936 ntbtth.exe 89 PID 3936 wrote to memory of 3648 3936 ntbtth.exe 89 PID 3936 wrote to memory of 3648 3936 ntbtth.exe 89 PID 3648 wrote to memory of 1292 3648 vvjjd.exe 90 PID 3648 wrote to memory of 1292 3648 vvjjd.exe 90 PID 3648 wrote to memory of 1292 3648 vvjjd.exe 90 PID 1292 wrote to memory of 2908 1292 ffxffff.exe 91 PID 1292 wrote to memory of 2908 1292 ffxffff.exe 91 PID 1292 wrote to memory of 2908 1292 ffxffff.exe 91 PID 2908 wrote to memory of 3968 2908 hbhbtn.exe 92 PID 2908 wrote to memory of 3968 2908 hbhbtn.exe 92 PID 2908 wrote to memory of 3968 2908 hbhbtn.exe 92 PID 3968 wrote to memory of 3268 3968 llfffff.exe 93 PID 3968 wrote to memory of 3268 3968 llfffff.exe 93 PID 3968 wrote to memory of 3268 3968 llfffff.exe 93 PID 3268 wrote to memory of 2440 3268 9bhhnt.exe 94 PID 3268 wrote to memory of 2440 3268 9bhhnt.exe 94 PID 3268 wrote to memory of 2440 3268 9bhhnt.exe 94 PID 2440 wrote to memory of 4360 2440 pvvpv.exe 95 PID 2440 wrote to memory of 4360 2440 pvvpv.exe 95 PID 2440 wrote to memory of 4360 2440 pvvpv.exe 95 PID 4360 wrote to memory of 4040 4360 fffffff.exe 96 PID 4360 wrote to memory of 4040 4360 fffffff.exe 96 PID 4360 wrote to memory of 4040 4360 fffffff.exe 96 PID 4040 wrote to memory of 4612 4040 nnnttb.exe 97 PID 4040 wrote to memory of 4612 4040 nnnttb.exe 97 PID 4040 wrote to memory of 4612 4040 nnnttb.exe 97 PID 4612 wrote to memory of 4928 4612 pvvpj.exe 98 PID 4612 wrote to memory of 4928 4612 pvvpj.exe 98 PID 4612 wrote to memory of 4928 4612 pvvpj.exe 98 PID 4928 wrote to memory of 4348 4928 fxlflfx.exe 99 PID 4928 wrote to memory of 4348 4928 fxlflfx.exe 99 PID 4928 wrote to memory of 4348 4928 fxlflfx.exe 99 PID 4348 wrote to memory of 1596 4348 ntbttb.exe 100 PID 4348 wrote to memory of 1596 4348 ntbttb.exe 100 PID 4348 wrote to memory of 1596 4348 ntbttb.exe 100 PID 1596 wrote to memory of 2616 1596 rrlrrxr.exe 101 PID 1596 wrote to memory of 2616 1596 rrlrrxr.exe 101 PID 1596 wrote to memory of 2616 1596 rrlrrxr.exe 101 PID 2616 wrote to memory of 2340 2616 thnhbb.exe 102 PID 2616 wrote to memory of 2340 2616 thnhbb.exe 102 PID 2616 wrote to memory of 2340 2616 thnhbb.exe 102 PID 2340 wrote to memory of 1476 2340 xxlfxfx.exe 103 PID 2340 wrote to memory of 1476 2340 xxlfxfx.exe 103 PID 2340 wrote to memory of 1476 2340 xxlfxfx.exe 103 PID 1476 wrote to memory of 4856 1476 lrlfxlf.exe 104 PID 1476 wrote to memory of 4856 1476 lrlfxlf.exe 104 PID 1476 wrote to memory of 4856 1476 lrlfxlf.exe 104 PID 4856 wrote to memory of 1580 4856 bnnnhn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe"C:\Users\Admin\AppData\Local\Temp\25eadaafcd29d39f4f3dbb529ed24077050069d75b6dfe32293cc8d307db7fab.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\xfrrfrr.exec:\xfrrfrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\9bbbhn.exec:\9bbbhn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\vddvv.exec:\vddvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\llrllll.exec:\llrllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\ntbtth.exec:\ntbtth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vvjjd.exec:\vvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\ffxffff.exec:\ffxffff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\hbhbtn.exec:\hbhbtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\llfffff.exec:\llfffff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\9bhhnt.exec:\9bhhnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\pvvpv.exec:\pvvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\fffffff.exec:\fffffff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\nnnttb.exec:\nnnttb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\pvvpj.exec:\pvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\fxlflfx.exec:\fxlflfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\ntbttb.exec:\ntbttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\thnhbb.exec:\thnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\lrlfxlf.exec:\lrlfxlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\bnnnhn.exec:\bnnnhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe23⤵
- Executes dropped EXE
PID:1580 -
\??\c:\bbnhtn.exec:\bbnhtn.exe24⤵
- Executes dropped EXE
PID:336 -
\??\c:\ttnbnb.exec:\ttnbnb.exe25⤵
- Executes dropped EXE
PID:1768 -
\??\c:\5jvpj.exec:\5jvpj.exe26⤵
- Executes dropped EXE
PID:4636 -
\??\c:\flxxxfx.exec:\flxxxfx.exe27⤵
- Executes dropped EXE
PID:2040 -
\??\c:\nhnnhn.exec:\nhnnhn.exe28⤵
- Executes dropped EXE
PID:3336 -
\??\c:\pvppv.exec:\pvppv.exe29⤵
- Executes dropped EXE
PID:5052 -
\??\c:\flffrrx.exec:\flffrrx.exe30⤵
- Executes dropped EXE
PID:396 -
\??\c:\lxfflll.exec:\lxfflll.exe31⤵
- Executes dropped EXE
PID:4004 -
\??\c:\hbhbhn.exec:\hbhbhn.exe32⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddppj.exec:\ddppj.exe33⤵
- Executes dropped EXE
PID:2892 -
\??\c:\llllxxf.exec:\llllxxf.exe34⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xxfrrfr.exec:\xxfrrfr.exe35⤵
- Executes dropped EXE
PID:4208 -
\??\c:\bbntbb.exec:\bbntbb.exe36⤵
- Executes dropped EXE
PID:2464 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe37⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xflrlrr.exec:\xflrlrr.exe38⤵
- Executes dropped EXE
PID:100 -
\??\c:\ttbbhh.exec:\ttbbhh.exe39⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jjvvv.exec:\jjvvv.exe40⤵
- Executes dropped EXE
PID:1552 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe41⤵
- Executes dropped EXE
PID:3668 -
\??\c:\nhhntt.exec:\nhhntt.exe42⤵
- Executes dropped EXE
PID:4616 -
\??\c:\pvddv.exec:\pvddv.exe43⤵
- Executes dropped EXE
PID:1172 -
\??\c:\rxlllll.exec:\rxlllll.exe44⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hbhhtb.exec:\hbhhtb.exe45⤵
- Executes dropped EXE
PID:3504 -
\??\c:\pjjjj.exec:\pjjjj.exe46⤵
- Executes dropped EXE
PID:824 -
\??\c:\fllflxl.exec:\fllflxl.exe47⤵
- Executes dropped EXE
PID:3112 -
\??\c:\thnbbb.exec:\thnbbb.exe48⤵
- Executes dropped EXE
PID:2236 -
\??\c:\hbbbhb.exec:\hbbbhb.exe49⤵
- Executes dropped EXE
PID:2240 -
\??\c:\vdjjd.exec:\vdjjd.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\lxxrflr.exec:\lxxrflr.exe51⤵
- Executes dropped EXE
PID:2476 -
\??\c:\bhhhnt.exec:\bhhhnt.exe52⤵
- Executes dropped EXE
PID:5076 -
\??\c:\1hbbbb.exec:\1hbbbb.exe53⤵
- Executes dropped EXE
PID:3176 -
\??\c:\djjjd.exec:\djjjd.exe54⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lrxlfxf.exec:\lrxlfxf.exe55⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe56⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhnnnt.exec:\nhnnnt.exe57⤵
- Executes dropped EXE
PID:4128 -
\??\c:\vvvvd.exec:\vvvvd.exe58⤵
- Executes dropped EXE
PID:976 -
\??\c:\jdddv.exec:\jdddv.exe59⤵
- Executes dropped EXE
PID:1164 -
\??\c:\xxxxffr.exec:\xxxxffr.exe60⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3rrfxfl.exec:\3rrfxfl.exe61⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nhtttb.exec:\nhtttb.exe62⤵
- Executes dropped EXE
PID:3268 -
\??\c:\btbbbb.exec:\btbbbb.exe63⤵
- Executes dropped EXE
PID:1716 -
\??\c:\ddjjj.exec:\ddjjj.exe64⤵
- Executes dropped EXE
PID:4968 -
\??\c:\xrxxxff.exec:\xrxxxff.exe65⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ffxxxrl.exec:\ffxxxrl.exe66⤵PID:1448
-
\??\c:\3htthn.exec:\3htthn.exe67⤵PID:4104
-
\??\c:\ppvdd.exec:\ppvdd.exe68⤵PID:4996
-
\??\c:\9ppjj.exec:\9ppjj.exe69⤵PID:3776
-
\??\c:\xrrrrxf.exec:\xrrrrxf.exe70⤵PID:3420
-
\??\c:\htbbbh.exec:\htbbbh.exe71⤵PID:1784
-
\??\c:\ntthhh.exec:\ntthhh.exe72⤵PID:3904
-
\??\c:\vvdjd.exec:\vvdjd.exe73⤵PID:4908
-
\??\c:\dvddd.exec:\dvddd.exe74⤵PID:4340
-
\??\c:\ffrrllf.exec:\ffrrllf.exe75⤵PID:2764
-
\??\c:\bhnntb.exec:\bhnntb.exe76⤵PID:1444
-
\??\c:\bnhttb.exec:\bnhttb.exe77⤵PID:5060
-
\??\c:\7dvpp.exec:\7dvpp.exe78⤵PID:4168
-
\??\c:\lrfxrlr.exec:\lrfxrlr.exe79⤵PID:4932
-
\??\c:\xfrrfrr.exec:\xfrrfrr.exe80⤵PID:3188
-
\??\c:\1nbbbh.exec:\1nbbbh.exe81⤵PID:1428
-
\??\c:\jpvvd.exec:\jpvvd.exe82⤵PID:3604
-
\??\c:\rrlllll.exec:\rrlllll.exe83⤵
- System Location Discovery: System Language Discovery
PID:4108 -
\??\c:\nbnnhh.exec:\nbnnhh.exe84⤵PID:2124
-
\??\c:\vpddp.exec:\vpddp.exe85⤵PID:516
-
\??\c:\ppddd.exec:\ppddd.exe86⤵PID:5052
-
\??\c:\xxlffll.exec:\xxlffll.exe87⤵PID:5100
-
\??\c:\lllfffx.exec:\lllfffx.exe88⤵PID:3116
-
\??\c:\jpddp.exec:\jpddp.exe89⤵PID:692
-
\??\c:\vvvvp.exec:\vvvvp.exe90⤵PID:3868
-
\??\c:\xxfffff.exec:\xxfffff.exe91⤵PID:2892
-
\??\c:\lrfffll.exec:\lrfffll.exe92⤵PID:2480
-
\??\c:\nntntb.exec:\nntntb.exe93⤵PID:2348
-
\??\c:\pdvjv.exec:\pdvjv.exe94⤵PID:3264
-
\??\c:\dpvvv.exec:\dpvvv.exe95⤵PID:1820
-
\??\c:\xfflfll.exec:\xfflfll.exe96⤵PID:1424
-
\??\c:\bbbbbh.exec:\bbbbbh.exe97⤵PID:904
-
\??\c:\ppjjj.exec:\ppjjj.exe98⤵PID:900
-
\??\c:\ppppp.exec:\ppppp.exe99⤵PID:1032
-
\??\c:\flrrlrx.exec:\flrrlrx.exe100⤵PID:1500
-
\??\c:\llxxrff.exec:\llxxrff.exe101⤵PID:1376
-
\??\c:\3bnntb.exec:\3bnntb.exe102⤵PID:2936
-
\??\c:\pdvdd.exec:\pdvdd.exe103⤵PID:1488
-
\??\c:\5jddj.exec:\5jddj.exe104⤵PID:4420
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe105⤵PID:4016
-
\??\c:\httttb.exec:\httttb.exe106⤵PID:2412
-
\??\c:\dvvvp.exec:\dvvvp.exe107⤵PID:1756
-
\??\c:\1vdjj.exec:\1vdjj.exe108⤵PID:2848
-
\??\c:\xlllfxr.exec:\xlllfxr.exe109⤵
- System Location Discovery: System Language Discovery
PID:4764 -
\??\c:\bhttbh.exec:\bhttbh.exe110⤵PID:4788
-
\??\c:\pvvpp.exec:\pvvpp.exe111⤵PID:4592
-
\??\c:\vvvvv.exec:\vvvvv.exe112⤵PID:2768
-
\??\c:\ffxxxff.exec:\ffxxxff.exe113⤵PID:4540
-
\??\c:\9tnnnt.exec:\9tnnnt.exe114⤵PID:2664
-
\??\c:\ppvpd.exec:\ppvpd.exe115⤵PID:3588
-
\??\c:\vvvvp.exec:\vvvvp.exe116⤵PID:1292
-
\??\c:\lxflllr.exec:\lxflllr.exe117⤵PID:4560
-
\??\c:\1fffxfx.exec:\1fffxfx.exe118⤵PID:3496
-
\??\c:\nbhhhb.exec:\nbhhhb.exe119⤵PID:3596
-
\??\c:\jpdpp.exec:\jpdpp.exe120⤵PID:1388
-
\??\c:\pdddd.exec:\pdddd.exe121⤵PID:4520
-
\??\c:\lxxxxfl.exec:\lxxxxfl.exe122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-