Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
Resource
win7-20240903-en
6 signatures
150 seconds
General
-
Target
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe
-
Size
49KB
-
MD5
64ab0cd8df9d6d027937e65c52b2e498
-
SHA1
52f075d3aed88341b4f4d941eb7e1becdef42f7f
-
SHA256
2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da
-
SHA512
093123d714d2987b28d79cee810c810988c5e2291182707e18cfae48ed69503d75b17b340b900c1be431c307746d4e1871cb7dcba8c301dbac054d2a40046a74
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlU:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3896-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3832-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-222-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-231-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-268-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-272-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-407-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-475-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-504-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-557-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-578-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-666-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-703-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-719-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-819-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-995-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-1146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4572 fxfxrrr.exe 2356 9nnhbb.exe 4252 thnnhn.exe 2032 jvdpp.exe 4116 flxrfxr.exe 4464 lllfxxx.exe 3580 tttnhh.exe 4892 pdvvp.exe 3832 pvdjd.exe 2700 fxxxxrx.exe 1132 btnnhh.exe 1784 vdpvd.exe 4004 5lfxxxr.exe 2736 lfxrllf.exe 1668 hbbtnn.exe 3392 bnnnnn.exe 4000 pjppp.exe 4684 3ppjv.exe 3044 lfflxrx.exe 1536 xrllllf.exe 2848 bbbbbb.exe 1884 vpdvp.exe 1848 fllfrrl.exe 4228 nnnhbh.exe 5104 nhbbtt.exe 1340 jjpjv.exe 1464 rffxrrl.exe 3436 1hnnhb.exe 4652 7vddv.exe 4140 lxffxxx.exe 4664 3llrrxr.exe 3092 7tbbtn.exe 2024 jdddp.exe 2468 pvvpd.exe 5076 rxfxlfx.exe 1008 ttnntt.exe 2728 nbnnnn.exe 4160 ppjdp.exe 3220 pppjv.exe 816 9lxrxfx.exe 1640 hbbnhb.exe 3876 hhntnt.exe 1284 5jdjd.exe 376 lrxxlxr.exe 2372 5lrlrrr.exe 1896 nnbtnn.exe 3508 5nhhtt.exe 2644 1vjjv.exe 3300 5flrfxx.exe 648 bbtnhn.exe 4220 jvvpv.exe 4944 lrrlffx.exe 3964 lrrrllf.exe 5016 nhthbn.exe 4776 ddjjv.exe 2232 dvppj.exe 2104 xflfffl.exe 3104 5btnhh.exe 3040 jjvjv.exe 1448 vdjdd.exe 3984 xxfrfxf.exe 2460 1rxrrfx.exe 1656 hbnhtn.exe 4240 ntbhbh.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rxxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 4572 3896 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 83 PID 3896 wrote to memory of 4572 3896 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 83 PID 3896 wrote to memory of 4572 3896 2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe 83 PID 4572 wrote to memory of 2356 4572 fxfxrrr.exe 84 PID 4572 wrote to memory of 2356 4572 fxfxrrr.exe 84 PID 4572 wrote to memory of 2356 4572 fxfxrrr.exe 84 PID 2356 wrote to memory of 4252 2356 9nnhbb.exe 85 PID 2356 wrote to memory of 4252 2356 9nnhbb.exe 85 PID 2356 wrote to memory of 4252 2356 9nnhbb.exe 85 PID 4252 wrote to memory of 2032 4252 thnnhn.exe 86 PID 4252 wrote to memory of 2032 4252 thnnhn.exe 86 PID 4252 wrote to memory of 2032 4252 thnnhn.exe 86 PID 2032 wrote to memory of 4116 2032 jvdpp.exe 87 PID 2032 wrote to memory of 4116 2032 jvdpp.exe 87 PID 2032 wrote to memory of 4116 2032 jvdpp.exe 87 PID 4116 wrote to memory of 4464 4116 flxrfxr.exe 88 PID 4116 wrote to memory of 4464 4116 flxrfxr.exe 88 PID 4116 wrote to memory of 4464 4116 flxrfxr.exe 88 PID 4464 wrote to memory of 3580 4464 lllfxxx.exe 89 PID 4464 wrote to memory of 3580 4464 lllfxxx.exe 89 PID 4464 wrote to memory of 3580 4464 lllfxxx.exe 89 PID 3580 wrote to memory of 4892 3580 tttnhh.exe 90 PID 3580 wrote to memory of 4892 3580 tttnhh.exe 90 PID 3580 wrote to memory of 4892 3580 tttnhh.exe 90 PID 4892 wrote to memory of 3832 4892 pdvvp.exe 91 PID 4892 wrote to memory of 3832 4892 pdvvp.exe 91 PID 4892 wrote to memory of 3832 4892 pdvvp.exe 91 PID 3832 wrote to memory of 2700 3832 pvdjd.exe 92 PID 3832 wrote to memory of 2700 3832 pvdjd.exe 92 PID 3832 wrote to memory of 2700 3832 pvdjd.exe 92 PID 2700 wrote to memory of 1132 2700 fxxxxrx.exe 93 PID 2700 wrote to memory of 1132 2700 fxxxxrx.exe 93 PID 2700 wrote to memory of 1132 2700 fxxxxrx.exe 93 PID 1132 wrote to memory of 1784 1132 btnnhh.exe 94 PID 1132 wrote to memory of 1784 1132 btnnhh.exe 94 PID 1132 wrote to memory of 1784 1132 btnnhh.exe 94 PID 1784 wrote to memory of 4004 1784 vdpvd.exe 95 PID 1784 wrote to memory of 4004 1784 vdpvd.exe 95 PID 1784 wrote to memory of 4004 1784 vdpvd.exe 95 PID 4004 wrote to memory of 2736 4004 5lfxxxr.exe 96 PID 4004 wrote to memory of 2736 4004 5lfxxxr.exe 96 PID 4004 wrote to memory of 2736 4004 5lfxxxr.exe 96 PID 2736 wrote to memory of 1668 2736 lfxrllf.exe 97 PID 2736 wrote to memory of 1668 2736 lfxrllf.exe 97 PID 2736 wrote to memory of 1668 2736 lfxrllf.exe 97 PID 1668 wrote to memory of 3392 1668 hbbtnn.exe 98 PID 1668 wrote to memory of 3392 1668 hbbtnn.exe 98 PID 1668 wrote to memory of 3392 1668 hbbtnn.exe 98 PID 3392 wrote to memory of 4000 3392 bnnnnn.exe 99 PID 3392 wrote to memory of 4000 3392 bnnnnn.exe 99 PID 3392 wrote to memory of 4000 3392 bnnnnn.exe 99 PID 4000 wrote to memory of 4684 4000 pjppp.exe 100 PID 4000 wrote to memory of 4684 4000 pjppp.exe 100 PID 4000 wrote to memory of 4684 4000 pjppp.exe 100 PID 4684 wrote to memory of 3044 4684 3ppjv.exe 101 PID 4684 wrote to memory of 3044 4684 3ppjv.exe 101 PID 4684 wrote to memory of 3044 4684 3ppjv.exe 101 PID 3044 wrote to memory of 1536 3044 lfflxrx.exe 102 PID 3044 wrote to memory of 1536 3044 lfflxrx.exe 102 PID 3044 wrote to memory of 1536 3044 lfflxrx.exe 102 PID 1536 wrote to memory of 2848 1536 xrllllf.exe 103 PID 1536 wrote to memory of 2848 1536 xrllllf.exe 103 PID 1536 wrote to memory of 2848 1536 xrllllf.exe 103 PID 2848 wrote to memory of 1884 2848 bbbbbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"C:\Users\Admin\AppData\Local\Temp\2d2c68f0dc80b7bfee06d626148f8ac97746723a3d23bf4030cea0a4f6b5f6da.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\9nnhbb.exec:\9nnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\thnnhn.exec:\thnnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\jvdpp.exec:\jvdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\flxrfxr.exec:\flxrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\lllfxxx.exec:\lllfxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\tttnhh.exec:\tttnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\pdvvp.exec:\pdvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\pvdjd.exec:\pvdjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\fxxxxrx.exec:\fxxxxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\btnnhh.exec:\btnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\vdpvd.exec:\vdpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\5lfxxxr.exec:\5lfxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\lfxrllf.exec:\lfxrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\hbbtnn.exec:\hbbtnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\bnnnnn.exec:\bnnnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\pjppp.exec:\pjppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\3ppjv.exec:\3ppjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\lfflxrx.exec:\lfflxrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\xrllllf.exec:\xrllllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\bbbbbb.exec:\bbbbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\vpdvp.exec:\vpdvp.exe23⤵
- Executes dropped EXE
PID:1884 -
\??\c:\fllfrrl.exec:\fllfrrl.exe24⤵
- Executes dropped EXE
PID:1848 -
\??\c:\nnnhbh.exec:\nnnhbh.exe25⤵
- Executes dropped EXE
PID:4228 -
\??\c:\nhbbtt.exec:\nhbbtt.exe26⤵
- Executes dropped EXE
PID:5104 -
\??\c:\jjpjv.exec:\jjpjv.exe27⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rffxrrl.exec:\rffxrrl.exe28⤵
- Executes dropped EXE
PID:1464 -
\??\c:\1hnnhb.exec:\1hnnhb.exe29⤵
- Executes dropped EXE
PID:3436 -
\??\c:\7vddv.exec:\7vddv.exe30⤵
- Executes dropped EXE
PID:4652 -
\??\c:\lxffxxx.exec:\lxffxxx.exe31⤵
- Executes dropped EXE
PID:4140 -
\??\c:\3llrrxr.exec:\3llrrxr.exe32⤵
- Executes dropped EXE
PID:4664 -
\??\c:\7tbbtn.exec:\7tbbtn.exe33⤵
- Executes dropped EXE
PID:3092 -
\??\c:\jdddp.exec:\jdddp.exe34⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pvvpd.exec:\pvvpd.exe35⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe36⤵
- Executes dropped EXE
PID:5076 -
\??\c:\ttnntt.exec:\ttnntt.exe37⤵
- Executes dropped EXE
PID:1008 -
\??\c:\nbnnnn.exec:\nbnnnn.exe38⤵
- Executes dropped EXE
PID:2728 -
\??\c:\ppjdp.exec:\ppjdp.exe39⤵
- Executes dropped EXE
PID:4160 -
\??\c:\pppjv.exec:\pppjv.exe40⤵
- Executes dropped EXE
PID:3220 -
\??\c:\9lxrxfx.exec:\9lxrxfx.exe41⤵
- Executes dropped EXE
PID:816 -
\??\c:\hbbnhb.exec:\hbbnhb.exe42⤵
- Executes dropped EXE
PID:1640 -
\??\c:\hhntnt.exec:\hhntnt.exe43⤵
- Executes dropped EXE
PID:3876 -
\??\c:\5jdjd.exec:\5jdjd.exe44⤵
- Executes dropped EXE
PID:1284 -
\??\c:\lrxxlxr.exec:\lrxxlxr.exe45⤵
- Executes dropped EXE
PID:376 -
\??\c:\5lrlrrr.exec:\5lrlrrr.exe46⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nnbtnn.exec:\nnbtnn.exe47⤵
- Executes dropped EXE
PID:1896 -
\??\c:\5nhhtt.exec:\5nhhtt.exe48⤵
- Executes dropped EXE
PID:3508 -
\??\c:\1vjjv.exec:\1vjjv.exe49⤵
- Executes dropped EXE
PID:2644 -
\??\c:\5flrfxx.exec:\5flrfxx.exe50⤵
- Executes dropped EXE
PID:3300 -
\??\c:\bbtnhn.exec:\bbtnhn.exe51⤵
- Executes dropped EXE
PID:648 -
\??\c:\httnbt.exec:\httnbt.exe52⤵PID:4896
-
\??\c:\jvvpv.exec:\jvvpv.exe53⤵
- Executes dropped EXE
PID:4220 -
\??\c:\lrrlffx.exec:\lrrlffx.exe54⤵
- Executes dropped EXE
PID:4944 -
\??\c:\lrrrllf.exec:\lrrrllf.exe55⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nhthbn.exec:\nhthbn.exe56⤵
- Executes dropped EXE
PID:5016 -
\??\c:\ddjjv.exec:\ddjjv.exe57⤵
- Executes dropped EXE
PID:4776 -
\??\c:\dvppj.exec:\dvppj.exe58⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xflfffl.exec:\xflfffl.exe59⤵
- Executes dropped EXE
PID:2104 -
\??\c:\5btnhh.exec:\5btnhh.exe60⤵
- Executes dropped EXE
PID:3104 -
\??\c:\jjvjv.exec:\jjvjv.exe61⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vdjdd.exec:\vdjdd.exe62⤵
- Executes dropped EXE
PID:1448 -
\??\c:\xxfrfxf.exec:\xxfrfxf.exe63⤵
- Executes dropped EXE
PID:3984 -
\??\c:\1rxrrfx.exec:\1rxrrfx.exe64⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hbnhtn.exec:\hbnhtn.exe65⤵
- Executes dropped EXE
PID:1656 -
\??\c:\ntbhbh.exec:\ntbhbh.exe66⤵
- Executes dropped EXE
PID:4240 -
\??\c:\pjjvj.exec:\pjjvj.exe67⤵
- System Location Discovery: System Language Discovery
PID:3976 -
\??\c:\5rllxfx.exec:\5rllxfx.exe68⤵PID:3728
-
\??\c:\rffxxrl.exec:\rffxxrl.exe69⤵PID:1748
-
\??\c:\bnnbnt.exec:\bnnbnt.exe70⤵PID:444
-
\??\c:\vjpdv.exec:\vjpdv.exe71⤵PID:3152
-
\??\c:\vvdjd.exec:\vvdjd.exe72⤵PID:2532
-
\??\c:\rxrlxrl.exec:\rxrlxrl.exe73⤵PID:3556
-
\??\c:\1lxrfrl.exec:\1lxrfrl.exe74⤵PID:4744
-
\??\c:\3bbtnn.exec:\3bbtnn.exe75⤵PID:3720
-
\??\c:\tnnhtb.exec:\tnnhtb.exe76⤵PID:3196
-
\??\c:\dvvvj.exec:\dvvvj.exe77⤵PID:4564
-
\??\c:\xxxffrr.exec:\xxxffrr.exe78⤵PID:2408
-
\??\c:\rfffffx.exec:\rfffffx.exe79⤵PID:4888
-
\??\c:\tttnhh.exec:\tttnhh.exe80⤵PID:1652
-
\??\c:\nhnhtn.exec:\nhnhtn.exe81⤵PID:4608
-
\??\c:\vdvvp.exec:\vdvvp.exe82⤵PID:3924
-
\??\c:\7pppd.exec:\7pppd.exe83⤵PID:2596
-
\??\c:\5vpjv.exec:\5vpjv.exe84⤵PID:3988
-
\??\c:\5pvjp.exec:\5pvjp.exe85⤵PID:2172
-
\??\c:\rrrxllf.exec:\rrrxllf.exe86⤵PID:3612
-
\??\c:\rlfxrll.exec:\rlfxrll.exe87⤵PID:2452
-
\??\c:\5nbthb.exec:\5nbthb.exe88⤵PID:1580
-
\??\c:\bbbbnh.exec:\bbbbnh.exe89⤵PID:5056
-
\??\c:\jdvvp.exec:\jdvvp.exe90⤵PID:224
-
\??\c:\9ddvj.exec:\9ddvj.exe91⤵PID:4384
-
\??\c:\1fxrllr.exec:\1fxrllr.exe92⤵PID:4956
-
\??\c:\nhhbth.exec:\nhhbth.exe93⤵PID:4904
-
\??\c:\9vpjj.exec:\9vpjj.exe94⤵PID:2044
-
\??\c:\djdpd.exec:\djdpd.exe95⤵PID:4784
-
\??\c:\fxfrfrl.exec:\fxfrfrl.exe96⤵PID:2868
-
\??\c:\7tbnnh.exec:\7tbnnh.exe97⤵PID:3708
-
\??\c:\5hnhtt.exec:\5hnhtt.exe98⤵PID:1720
-
\??\c:\jpvdd.exec:\jpvdd.exe99⤵PID:2404
-
\??\c:\dpjdp.exec:\dpjdp.exe100⤵PID:5028
-
\??\c:\rffrfxl.exec:\rffrfxl.exe101⤵PID:3504
-
\??\c:\rlxllxl.exec:\rlxllxl.exe102⤵PID:748
-
\??\c:\thnbnb.exec:\thnbnb.exe103⤵PID:5092
-
\??\c:\9hnbnn.exec:\9hnbnn.exe104⤵PID:2772
-
\??\c:\pvvjv.exec:\pvvjv.exe105⤵PID:5040
-
\??\c:\3flffxf.exec:\3flffxf.exe106⤵PID:2448
-
\??\c:\3tthbh.exec:\3tthbh.exe107⤵PID:4192
-
\??\c:\nhhtnh.exec:\nhhtnh.exe108⤵PID:4672
-
\??\c:\djpjv.exec:\djpjv.exe109⤵PID:2072
-
\??\c:\fxrlrlf.exec:\fxrlrlf.exe110⤵PID:4772
-
\??\c:\fllxxxl.exec:\fllxxxl.exe111⤵PID:4232
-
\??\c:\1ntnhh.exec:\1ntnhh.exe112⤵PID:4488
-
\??\c:\dddvj.exec:\dddvj.exe113⤵PID:5068
-
\??\c:\pvvpd.exec:\pvvpd.exe114⤵PID:4472
-
\??\c:\lffxfxr.exec:\lffxfxr.exe115⤵PID:4936
-
\??\c:\9fllllf.exec:\9fllllf.exe116⤵PID:2356
-
\??\c:\3bbbtn.exec:\3bbbtn.exe117⤵PID:3596
-
\??\c:\3nnhhb.exec:\3nnhhb.exe118⤵PID:5016
-
\??\c:\jvvvj.exec:\jvvvj.exe119⤵PID:1864
-
\??\c:\jpvvj.exec:\jpvvj.exe120⤵PID:3048
-
\??\c:\rlfxllx.exec:\rlfxllx.exe121⤵PID:768
-
\??\c:\btnhtt.exec:\btnhtt.exe122⤵
- System Location Discovery: System Language Discovery
PID:3944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-