Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe
-
Size
70KB
-
MD5
5460e8f86f5cb913e24c019de9eaefd0
-
SHA1
c869024f828b4f6a88b5a3199436f7e104a3d5ac
-
SHA256
84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538
-
SHA512
75f0fa202907e462c4539e567db3d30d6086223c6a8d7e927cab0fcf2a3c39b5b28e8925bc1e6ff5b1dc5a4d45c3815619d04c963de1077da77ac7b5560104d6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3Ag:ymb3NkkiQ3mdBjFI46TQg
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/860-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 696 tbbbbt.exe 536 bhhbnb.exe 1236 3vdvd.exe 1876 dpjdv.exe 3212 xrxrxxr.exe 4832 bnnnhh.exe 1968 ddjdv.exe 1580 5rxrlrl.exe 2536 btnhhn.exe 1772 1jvpj.exe 4588 rxlfxxr.exe 3016 hbtnnh.exe 3460 jdjdp.exe 2516 fxfxfff.exe 4356 nnntnn.exe 2200 tnhbtn.exe 3420 5pvpd.exe 4052 9fxrflx.exe 2176 tnhbtt.exe 2388 dppjd.exe 212 fxrlxxx.exe 2100 fxrrrlf.exe 3632 1bnnhh.exe 2420 hhhhbn.exe 1012 jdpjj.exe 4492 frfxxxf.exe 1092 nhtnnn.exe 2840 3hhhnh.exe 648 jpppj.exe 4348 3fxrrlr.exe 4452 hbttnn.exe 1504 btbnnn.exe 1512 5jpvp.exe 2620 xrrrfxr.exe 4872 7nnnhb.exe 4376 httnbb.exe 2696 pjddd.exe 3676 1flxxrx.exe 1292 htbbhh.exe 3532 1jppj.exe 4608 pjvpv.exe 4764 flxrrrx.exe 448 9xxrrxx.exe 1684 tnnhnt.exe 3392 vppjd.exe 4880 nbhnbh.exe 456 9vvpj.exe 4368 dddvp.exe 536 bnnhbb.exe 2760 9hhbtt.exe 224 dvvvj.exe 1576 jvvpd.exe 1532 fxfrllx.exe 4688 xlfxxrl.exe 4672 tnbbth.exe 3364 pvdvp.exe 1160 7pvpp.exe 1644 lxxlfxr.exe 1640 5frxxxr.exe 3828 bnhhtn.exe 2908 7nhbnn.exe 1772 vjjjv.exe 4908 3xrlxxr.exe 3992 llxrffx.exe -
resource yara_rule behavioral2/memory/860-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nbbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 696 860 84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe 83 PID 860 wrote to memory of 696 860 84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe 83 PID 860 wrote to memory of 696 860 84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe 83 PID 696 wrote to memory of 536 696 tbbbbt.exe 84 PID 696 wrote to memory of 536 696 tbbbbt.exe 84 PID 696 wrote to memory of 536 696 tbbbbt.exe 84 PID 536 wrote to memory of 1236 536 bhhbnb.exe 85 PID 536 wrote to memory of 1236 536 bhhbnb.exe 85 PID 536 wrote to memory of 1236 536 bhhbnb.exe 85 PID 1236 wrote to memory of 1876 1236 3vdvd.exe 86 PID 1236 wrote to memory of 1876 1236 3vdvd.exe 86 PID 1236 wrote to memory of 1876 1236 3vdvd.exe 86 PID 1876 wrote to memory of 3212 1876 dpjdv.exe 87 PID 1876 wrote to memory of 3212 1876 dpjdv.exe 87 PID 1876 wrote to memory of 3212 1876 dpjdv.exe 87 PID 3212 wrote to memory of 4832 3212 xrxrxxr.exe 88 PID 3212 wrote to memory of 4832 3212 xrxrxxr.exe 88 PID 3212 wrote to memory of 4832 3212 xrxrxxr.exe 88 PID 4832 wrote to memory of 1968 4832 bnnnhh.exe 89 PID 4832 wrote to memory of 1968 4832 bnnnhh.exe 89 PID 4832 wrote to memory of 1968 4832 bnnnhh.exe 89 PID 1968 wrote to memory of 1580 1968 ddjdv.exe 90 PID 1968 wrote to memory of 1580 1968 ddjdv.exe 90 PID 1968 wrote to memory of 1580 1968 ddjdv.exe 90 PID 1580 wrote to memory of 2536 1580 5rxrlrl.exe 91 PID 1580 wrote to memory of 2536 1580 5rxrlrl.exe 91 PID 1580 wrote to memory of 2536 1580 5rxrlrl.exe 91 PID 2536 wrote to memory of 1772 2536 btnhhn.exe 92 PID 2536 wrote to memory of 1772 2536 btnhhn.exe 92 PID 2536 wrote to memory of 1772 2536 btnhhn.exe 92 PID 1772 wrote to memory of 4588 1772 1jvpj.exe 93 PID 1772 wrote to memory of 4588 1772 1jvpj.exe 93 PID 1772 wrote to memory of 4588 1772 1jvpj.exe 93 PID 4588 wrote to memory of 3016 4588 rxlfxxr.exe 94 PID 4588 wrote to memory of 3016 4588 rxlfxxr.exe 94 PID 4588 wrote to memory of 3016 4588 rxlfxxr.exe 94 PID 3016 wrote to memory of 3460 3016 hbtnnh.exe 95 PID 3016 wrote to memory of 3460 3016 hbtnnh.exe 95 PID 3016 wrote to memory of 3460 3016 hbtnnh.exe 95 PID 3460 wrote to memory of 2516 3460 jdjdp.exe 96 PID 3460 wrote to memory of 2516 3460 jdjdp.exe 96 PID 3460 wrote to memory of 2516 3460 jdjdp.exe 96 PID 2516 wrote to memory of 4356 2516 fxfxfff.exe 97 PID 2516 wrote to memory of 4356 2516 fxfxfff.exe 97 PID 2516 wrote to memory of 4356 2516 fxfxfff.exe 97 PID 4356 wrote to memory of 2200 4356 nnntnn.exe 98 PID 4356 wrote to memory of 2200 4356 nnntnn.exe 98 PID 4356 wrote to memory of 2200 4356 nnntnn.exe 98 PID 2200 wrote to memory of 3420 2200 tnhbtn.exe 99 PID 2200 wrote to memory of 3420 2200 tnhbtn.exe 99 PID 2200 wrote to memory of 3420 2200 tnhbtn.exe 99 PID 3420 wrote to memory of 4052 3420 5pvpd.exe 100 PID 3420 wrote to memory of 4052 3420 5pvpd.exe 100 PID 3420 wrote to memory of 4052 3420 5pvpd.exe 100 PID 4052 wrote to memory of 2176 4052 9fxrflx.exe 101 PID 4052 wrote to memory of 2176 4052 9fxrflx.exe 101 PID 4052 wrote to memory of 2176 4052 9fxrflx.exe 101 PID 2176 wrote to memory of 2388 2176 tnhbtt.exe 102 PID 2176 wrote to memory of 2388 2176 tnhbtt.exe 102 PID 2176 wrote to memory of 2388 2176 tnhbtt.exe 102 PID 2388 wrote to memory of 212 2388 dppjd.exe 103 PID 2388 wrote to memory of 212 2388 dppjd.exe 103 PID 2388 wrote to memory of 212 2388 dppjd.exe 103 PID 212 wrote to memory of 2100 212 fxrlxxx.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe"C:\Users\Admin\AppData\Local\Temp\84d0f15d3fb2cb31e1c2b24712dcb5c9bd7c1d3231c4349955d1bf3a8c2b7538N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\tbbbbt.exec:\tbbbbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\bhhbnb.exec:\bhhbnb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\3vdvd.exec:\3vdvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\dpjdv.exec:\dpjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\xrxrxxr.exec:\xrxrxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\bnnnhh.exec:\bnnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\ddjdv.exec:\ddjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\5rxrlrl.exec:\5rxrlrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\btnhhn.exec:\btnhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\1jvpj.exec:\1jvpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\hbtnnh.exec:\hbtnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\jdjdp.exec:\jdjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\fxfxfff.exec:\fxfxfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nnntnn.exec:\nnntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\tnhbtn.exec:\tnhbtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\5pvpd.exec:\5pvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\9fxrflx.exec:\9fxrflx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\tnhbtt.exec:\tnhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\dppjd.exec:\dppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\fxrlxxx.exec:\fxrlxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\fxrrrlf.exec:\fxrrrlf.exe23⤵
- Executes dropped EXE
PID:2100 -
\??\c:\1bnnhh.exec:\1bnnhh.exe24⤵
- Executes dropped EXE
PID:3632 -
\??\c:\hhhhbn.exec:\hhhhbn.exe25⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jdpjj.exec:\jdpjj.exe26⤵
- Executes dropped EXE
PID:1012 -
\??\c:\frfxxxf.exec:\frfxxxf.exe27⤵
- Executes dropped EXE
PID:4492 -
\??\c:\nhtnnn.exec:\nhtnnn.exe28⤵
- Executes dropped EXE
PID:1092 -
\??\c:\3hhhnh.exec:\3hhhnh.exe29⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jpppj.exec:\jpppj.exe30⤵
- Executes dropped EXE
PID:648 -
\??\c:\3fxrrlr.exec:\3fxrrlr.exe31⤵
- Executes dropped EXE
PID:4348 -
\??\c:\hbttnn.exec:\hbttnn.exe32⤵
- Executes dropped EXE
PID:4452 -
\??\c:\btbnnn.exec:\btbnnn.exe33⤵
- Executes dropped EXE
PID:1504 -
\??\c:\5jpvp.exec:\5jpvp.exe34⤵
- Executes dropped EXE
PID:1512 -
\??\c:\xrrrfxr.exec:\xrrrfxr.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7nnnhb.exec:\7nnnhb.exe36⤵
- Executes dropped EXE
PID:4872 -
\??\c:\httnbb.exec:\httnbb.exe37⤵
- Executes dropped EXE
PID:4376 -
\??\c:\pjddd.exec:\pjddd.exe38⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1flxxrx.exec:\1flxxrx.exe39⤵
- Executes dropped EXE
PID:3676 -
\??\c:\htbbhh.exec:\htbbhh.exe40⤵
- Executes dropped EXE
PID:1292 -
\??\c:\1jppj.exec:\1jppj.exe41⤵
- Executes dropped EXE
PID:3532 -
\??\c:\pjvpv.exec:\pjvpv.exe42⤵
- Executes dropped EXE
PID:4608 -
\??\c:\flxrrrx.exec:\flxrrrx.exe43⤵
- Executes dropped EXE
PID:4764 -
\??\c:\9xxrrxx.exec:\9xxrrxx.exe44⤵
- Executes dropped EXE
PID:448 -
\??\c:\tnnhnt.exec:\tnnhnt.exe45⤵
- Executes dropped EXE
PID:1684 -
\??\c:\vppjd.exec:\vppjd.exe46⤵
- Executes dropped EXE
PID:3392 -
\??\c:\nbhnbh.exec:\nbhnbh.exe47⤵
- Executes dropped EXE
PID:4880 -
\??\c:\9vvpj.exec:\9vvpj.exe48⤵
- Executes dropped EXE
PID:456 -
\??\c:\dddvp.exec:\dddvp.exe49⤵
- Executes dropped EXE
PID:4368 -
\??\c:\bnnhbb.exec:\bnnhbb.exe50⤵
- Executes dropped EXE
PID:536 -
\??\c:\9hhbtt.exec:\9hhbtt.exe51⤵
- Executes dropped EXE
PID:2760 -
\??\c:\dvvvj.exec:\dvvvj.exe52⤵
- Executes dropped EXE
PID:224 -
\??\c:\jvvpd.exec:\jvvpd.exe53⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxfrllx.exec:\fxfrllx.exe54⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xlfxxrl.exec:\xlfxxrl.exe55⤵
- Executes dropped EXE
PID:4688 -
\??\c:\tnbbth.exec:\tnbbth.exe56⤵
- Executes dropped EXE
PID:4672 -
\??\c:\pvdvp.exec:\pvdvp.exe57⤵
- Executes dropped EXE
PID:3364 -
\??\c:\7pvpp.exec:\7pvpp.exe58⤵
- Executes dropped EXE
PID:1160 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe59⤵
- Executes dropped EXE
PID:1644 -
\??\c:\5frxxxr.exec:\5frxxxr.exe60⤵
- Executes dropped EXE
PID:1640 -
\??\c:\bnhhtn.exec:\bnhhtn.exe61⤵
- Executes dropped EXE
PID:3828 -
\??\c:\7nhbnn.exec:\7nhbnn.exe62⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vjjjv.exec:\vjjjv.exe63⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3xrlxxr.exec:\3xrlxxr.exe64⤵
- Executes dropped EXE
PID:4908 -
\??\c:\llxrffx.exec:\llxrffx.exe65⤵
- Executes dropped EXE
PID:3992 -
\??\c:\nnnhhh.exec:\nnnhhh.exe66⤵PID:2992
-
\??\c:\nthhbb.exec:\nthhbb.exe67⤵PID:4708
-
\??\c:\pjpdv.exec:\pjpdv.exe68⤵PID:1528
-
\??\c:\pvvpd.exec:\pvvpd.exe69⤵PID:3936
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe70⤵PID:1500
-
\??\c:\rfffrrr.exec:\rfffrrr.exe71⤵PID:3328
-
\??\c:\nnnnnn.exec:\nnnnnn.exe72⤵PID:4612
-
\??\c:\rlrrlll.exec:\rlrrlll.exe73⤵PID:3664
-
\??\c:\rflfxrl.exec:\rflfxrl.exe74⤵PID:2832
-
\??\c:\tbhhhh.exec:\tbhhhh.exe75⤵PID:2108
-
\??\c:\pjddp.exec:\pjddp.exe76⤵PID:1320
-
\??\c:\vpjdd.exec:\vpjdd.exe77⤵PID:4156
-
\??\c:\rflrlrr.exec:\rflrlrr.exe78⤵PID:5088
-
\??\c:\xrrrflf.exec:\xrrrflf.exe79⤵PID:4568
-
\??\c:\nnnnnn.exec:\nnnnnn.exe80⤵PID:5060
-
\??\c:\tnnhnn.exec:\tnnhnn.exe81⤵PID:2420
-
\??\c:\dpdjv.exec:\dpdjv.exe82⤵PID:4420
-
\??\c:\9xxlxxr.exec:\9xxlxxr.exe83⤵PID:4856
-
\??\c:\fxxrllf.exec:\fxxrllf.exe84⤵PID:4384
-
\??\c:\bnnhtt.exec:\bnnhtt.exe85⤵PID:2296
-
\??\c:\nnnnnn.exec:\nnnnnn.exe86⤵PID:648
-
\??\c:\ppdjj.exec:\ppdjj.exe87⤵PID:1440
-
\??\c:\xffxrxr.exec:\xffxrxr.exe88⤵PID:572
-
\??\c:\1llfxfx.exec:\1llfxfx.exe89⤵PID:412
-
\??\c:\7tnhhh.exec:\7tnhhh.exe90⤵PID:2020
-
\??\c:\dvvpp.exec:\dvvpp.exe91⤵PID:1420
-
\??\c:\vpvjd.exec:\vpvjd.exe92⤵PID:1436
-
\??\c:\flrfrfx.exec:\flrfrfx.exe93⤵PID:2248
-
\??\c:\nhbtnh.exec:\nhbtnh.exe94⤵PID:3780
-
\??\c:\9ddpj.exec:\9ddpj.exe95⤵PID:1700
-
\??\c:\jjvvp.exec:\jjvvp.exe96⤵PID:5008
-
\??\c:\tnnnhb.exec:\tnnnhb.exe97⤵PID:3224
-
\??\c:\3tnhtn.exec:\3tnhtn.exe98⤵PID:2512
-
\??\c:\jdvpd.exec:\jdvpd.exe99⤵PID:3656
-
\??\c:\ddddv.exec:\ddddv.exe100⤵PID:4424
-
\??\c:\lrrlxlx.exec:\lrrlxlx.exe101⤵PID:4020
-
\??\c:\llxrllx.exec:\llxrllx.exe102⤵PID:5092
-
\??\c:\hntnhh.exec:\hntnhh.exe103⤵PID:4480
-
\??\c:\1hnnhn.exec:\1hnnhn.exe104⤵PID:4328
-
\??\c:\9bhhbh.exec:\9bhhbh.exe105⤵PID:892
-
\??\c:\dvdpj.exec:\dvdpj.exe106⤵PID:1236
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe107⤵PID:2040
-
\??\c:\flrxxxx.exec:\flrxxxx.exe108⤵PID:3212
-
\??\c:\tnhnhn.exec:\tnhnhn.exe109⤵
- System Location Discovery: System Language Discovery
PID:844 -
\??\c:\dppjd.exec:\dppjd.exe110⤵PID:2220
-
\??\c:\jdjdp.exec:\jdjdp.exe111⤵PID:1104
-
\??\c:\jjpvp.exec:\jjpvp.exe112⤵PID:1220
-
\??\c:\xlrfxxr.exec:\xlrfxxr.exe113⤵PID:2616
-
\??\c:\hhhhhn.exec:\hhhhhn.exe114⤵PID:1860
-
\??\c:\nnbtbb.exec:\nnbtbb.exe115⤵PID:1496
-
\??\c:\dvjdv.exec:\dvjdv.exe116⤵PID:2552
-
\??\c:\pdjdp.exec:\pdjdp.exe117⤵PID:3876
-
\??\c:\lfxrfxf.exec:\lfxrfxf.exe118⤵PID:3984
-
\??\c:\hnntnn.exec:\hnntnn.exe119⤵PID:3084
-
\??\c:\9thbnn.exec:\9thbnn.exe120⤵PID:3992
-
\??\c:\jvvpp.exec:\jvvpp.exe121⤵PID:2992
-
\??\c:\5xrllxr.exec:\5xrllxr.exe122⤵PID:3604
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-