Analysis
-
max time kernel
120s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 11:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe
-
Size
66KB
-
MD5
7dc2efe69bce3e7b63a16301849e3114
-
SHA1
ae2ba113fca0dfab484e570cb7f6682aff94846f
-
SHA256
f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72
-
SHA512
66a36f6ea9106c5aa220f78b3da9dcc535f6f351364b8275c898ffe17d4b984736ffd065977ef79ad8ccd3ebf994bba8b75782808f10870ee5cd4c3f7704d55f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzkzNM+:ymb3NkkiQ3mdBjFIvlpM+
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2328-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4748-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3420-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4476 thnnnn.exe 3416 flxffff.exe 3300 xrxrlfx.exe 1932 1tbbhh.exe 4108 pvpdv.exe 1324 lxxxrrr.exe 2616 flxllll.exe 4748 hbnbnn.exe 5024 jddvj.exe 1460 frrllll.exe 1928 bttnhn.exe 2020 ddvvp.exe 1920 3vdvp.exe 2272 lxxxlrl.exe 4952 thnnhh.exe 3420 frxrlrl.exe 1040 tbbbnn.exe 4956 pjvjd.exe 3088 lllfrrr.exe 808 hhbbbb.exe 4376 jvdvp.exe 2116 vpppp.exe 2632 lfxxrrl.exe 3012 bnhhbh.exe 4688 httbtt.exe 1528 pddvp.exe 5060 lxffrrf.exe 3984 tbhhbh.exe 4188 pvpdp.exe 2600 rxlfffx.exe 208 tttnhn.exe 1704 1vvvj.exe 372 djpdp.exe 3144 xlrffxf.exe 4828 lfxrxfx.exe 2920 9nnbtt.exe 224 vpdvp.exe 4568 pdvjv.exe 4772 fxlxrrr.exe 404 bntbbb.exe 4948 9tbhnh.exe 2436 9pddp.exe 2456 flxrfxr.exe 2936 fxrlfxl.exe 3020 bttnbh.exe 4476 nbbhtb.exe 2512 dppjv.exe 3300 xrxrrlr.exe 4752 nhbthh.exe 2192 nntnhh.exe 5076 dpjpd.exe 4792 3lllrlr.exe 996 xrrxxlr.exe 2616 hhnnhh.exe 1152 pvjjv.exe 2628 dvpvv.exe 2572 rlrlllr.exe 3588 httttt.exe 1460 jdjjd.exe 1928 jvvpd.exe 2568 frffrxr.exe 3288 htbnbn.exe 3840 tbhhtt.exe 3900 5dvpd.exe -
resource yara_rule behavioral2/memory/2328-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4748-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1928-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3420-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxflxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frrfrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ppjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2328 wrote to memory of 4476 2328 f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe 85 PID 2328 wrote to memory of 4476 2328 f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe 85 PID 2328 wrote to memory of 4476 2328 f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe 85 PID 4476 wrote to memory of 3416 4476 thnnnn.exe 86 PID 4476 wrote to memory of 3416 4476 thnnnn.exe 86 PID 4476 wrote to memory of 3416 4476 thnnnn.exe 86 PID 3416 wrote to memory of 3300 3416 flxffff.exe 87 PID 3416 wrote to memory of 3300 3416 flxffff.exe 87 PID 3416 wrote to memory of 3300 3416 flxffff.exe 87 PID 3300 wrote to memory of 1932 3300 xrxrlfx.exe 88 PID 3300 wrote to memory of 1932 3300 xrxrlfx.exe 88 PID 3300 wrote to memory of 1932 3300 xrxrlfx.exe 88 PID 1932 wrote to memory of 4108 1932 1tbbhh.exe 89 PID 1932 wrote to memory of 4108 1932 1tbbhh.exe 89 PID 1932 wrote to memory of 4108 1932 1tbbhh.exe 89 PID 4108 wrote to memory of 1324 4108 pvpdv.exe 90 PID 4108 wrote to memory of 1324 4108 pvpdv.exe 90 PID 4108 wrote to memory of 1324 4108 pvpdv.exe 90 PID 1324 wrote to memory of 2616 1324 lxxxrrr.exe 91 PID 1324 wrote to memory of 2616 1324 lxxxrrr.exe 91 PID 1324 wrote to memory of 2616 1324 lxxxrrr.exe 91 PID 2616 wrote to memory of 4748 2616 flxllll.exe 92 PID 2616 wrote to memory of 4748 2616 flxllll.exe 92 PID 2616 wrote to memory of 4748 2616 flxllll.exe 92 PID 4748 wrote to memory of 5024 4748 hbnbnn.exe 93 PID 4748 wrote to memory of 5024 4748 hbnbnn.exe 93 PID 4748 wrote to memory of 5024 4748 hbnbnn.exe 93 PID 5024 wrote to memory of 1460 5024 jddvj.exe 94 PID 5024 wrote to memory of 1460 5024 jddvj.exe 94 PID 5024 wrote to memory of 1460 5024 jddvj.exe 94 PID 1460 wrote to memory of 1928 1460 frrllll.exe 95 PID 1460 wrote to memory of 1928 1460 frrllll.exe 95 PID 1460 wrote to memory of 1928 1460 frrllll.exe 95 PID 1928 wrote to memory of 2020 1928 bttnhn.exe 96 PID 1928 wrote to memory of 2020 1928 bttnhn.exe 96 PID 1928 wrote to memory of 2020 1928 bttnhn.exe 96 PID 2020 wrote to memory of 1920 2020 ddvvp.exe 97 PID 2020 wrote to memory of 1920 2020 ddvvp.exe 97 PID 2020 wrote to memory of 1920 2020 ddvvp.exe 97 PID 1920 wrote to memory of 2272 1920 3vdvp.exe 98 PID 1920 wrote to memory of 2272 1920 3vdvp.exe 98 PID 1920 wrote to memory of 2272 1920 3vdvp.exe 98 PID 2272 wrote to memory of 4952 2272 lxxxlrl.exe 99 PID 2272 wrote to memory of 4952 2272 lxxxlrl.exe 99 PID 2272 wrote to memory of 4952 2272 lxxxlrl.exe 99 PID 4952 wrote to memory of 3420 4952 thnnhh.exe 100 PID 4952 wrote to memory of 3420 4952 thnnhh.exe 100 PID 4952 wrote to memory of 3420 4952 thnnhh.exe 100 PID 3420 wrote to memory of 1040 3420 frxrlrl.exe 101 PID 3420 wrote to memory of 1040 3420 frxrlrl.exe 101 PID 3420 wrote to memory of 1040 3420 frxrlrl.exe 101 PID 1040 wrote to memory of 4956 1040 tbbbnn.exe 102 PID 1040 wrote to memory of 4956 1040 tbbbnn.exe 102 PID 1040 wrote to memory of 4956 1040 tbbbnn.exe 102 PID 4956 wrote to memory of 3088 4956 pjvjd.exe 103 PID 4956 wrote to memory of 3088 4956 pjvjd.exe 103 PID 4956 wrote to memory of 3088 4956 pjvjd.exe 103 PID 3088 wrote to memory of 808 3088 lllfrrr.exe 104 PID 3088 wrote to memory of 808 3088 lllfrrr.exe 104 PID 3088 wrote to memory of 808 3088 lllfrrr.exe 104 PID 808 wrote to memory of 4376 808 hhbbbb.exe 105 PID 808 wrote to memory of 4376 808 hhbbbb.exe 105 PID 808 wrote to memory of 4376 808 hhbbbb.exe 105 PID 4376 wrote to memory of 2116 4376 jvdvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe"C:\Users\Admin\AppData\Local\Temp\f9df4404b6cd8faebba99cf1987fc0c3ab737078018d6deccceea2fcde774f72.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\thnnnn.exec:\thnnnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\flxffff.exec:\flxffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\xrxrlfx.exec:\xrxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\1tbbhh.exec:\1tbbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\pvpdv.exec:\pvpdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\flxllll.exec:\flxllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hbnbnn.exec:\hbnbnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\jddvj.exec:\jddvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\frrllll.exec:\frrllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\bttnhn.exec:\bttnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
\??\c:\ddvvp.exec:\ddvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\3vdvp.exec:\3vdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\lxxxlrl.exec:\lxxxlrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\thnnhh.exec:\thnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\frxrlrl.exec:\frxrlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\tbbbnn.exec:\tbbbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\pjvjd.exec:\pjvjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\lllfrrr.exec:\lllfrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\hhbbbb.exec:\hhbbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\jvdvp.exec:\jvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\vpppp.exec:\vpppp.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lfxxrrl.exec:\lfxxrrl.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bnhhbh.exec:\bnhhbh.exe25⤵
- Executes dropped EXE
PID:3012 -
\??\c:\httbtt.exec:\httbtt.exe26⤵
- Executes dropped EXE
PID:4688 -
\??\c:\pddvp.exec:\pddvp.exe27⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lxffrrf.exec:\lxffrrf.exe28⤵
- Executes dropped EXE
PID:5060 -
\??\c:\tbhhbh.exec:\tbhhbh.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\pvpdp.exec:\pvpdp.exe30⤵
- Executes dropped EXE
PID:4188 -
\??\c:\rxlfffx.exec:\rxlfffx.exe31⤵
- Executes dropped EXE
PID:2600 -
\??\c:\tttnhn.exec:\tttnhn.exe32⤵
- Executes dropped EXE
PID:208 -
\??\c:\1vvvj.exec:\1vvvj.exe33⤵
- Executes dropped EXE
PID:1704 -
\??\c:\djpdp.exec:\djpdp.exe34⤵
- Executes dropped EXE
PID:372 -
\??\c:\xlrffxf.exec:\xlrffxf.exe35⤵
- Executes dropped EXE
PID:3144 -
\??\c:\lfxrxfx.exec:\lfxrxfx.exe36⤵
- Executes dropped EXE
PID:4828 -
\??\c:\9nnbtt.exec:\9nnbtt.exe37⤵
- Executes dropped EXE
PID:2920 -
\??\c:\vpdvp.exec:\vpdvp.exe38⤵
- Executes dropped EXE
PID:224 -
\??\c:\pdvjv.exec:\pdvjv.exe39⤵
- Executes dropped EXE
PID:4568 -
\??\c:\fxlxrrr.exec:\fxlxrrr.exe40⤵
- Executes dropped EXE
PID:4772 -
\??\c:\bntbbb.exec:\bntbbb.exe41⤵
- Executes dropped EXE
PID:404 -
\??\c:\9tbhnh.exec:\9tbhnh.exe42⤵
- Executes dropped EXE
PID:4948 -
\??\c:\9pddp.exec:\9pddp.exe43⤵
- Executes dropped EXE
PID:2436 -
\??\c:\flxrfxr.exec:\flxrfxr.exe44⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe45⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bttnbh.exec:\bttnbh.exe46⤵
- Executes dropped EXE
PID:3020 -
\??\c:\nbbhtb.exec:\nbbhtb.exe47⤵
- Executes dropped EXE
PID:4476 -
\??\c:\dppjv.exec:\dppjv.exe48⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe49⤵
- Executes dropped EXE
PID:3300 -
\??\c:\nhbthh.exec:\nhbthh.exe50⤵
- Executes dropped EXE
PID:4752 -
\??\c:\nntnhh.exec:\nntnhh.exe51⤵
- Executes dropped EXE
PID:2192 -
\??\c:\dpjpd.exec:\dpjpd.exe52⤵
- Executes dropped EXE
PID:5076 -
\??\c:\3lllrlr.exec:\3lllrlr.exe53⤵
- Executes dropped EXE
PID:4792 -
\??\c:\xrrxxlr.exec:\xrrxxlr.exe54⤵
- Executes dropped EXE
PID:996 -
\??\c:\hhnnhh.exec:\hhnnhh.exe55⤵
- Executes dropped EXE
PID:2616 -
\??\c:\pvjjv.exec:\pvjjv.exe56⤵
- Executes dropped EXE
PID:1152 -
\??\c:\dvpvv.exec:\dvpvv.exe57⤵
- Executes dropped EXE
PID:2628 -
\??\c:\rlrlllr.exec:\rlrlllr.exe58⤵
- Executes dropped EXE
PID:2572 -
\??\c:\httttt.exec:\httttt.exe59⤵
- Executes dropped EXE
PID:3588 -
\??\c:\jdjjd.exec:\jdjjd.exe60⤵
- Executes dropped EXE
PID:1460 -
\??\c:\jvvpd.exec:\jvvpd.exe61⤵
- Executes dropped EXE
PID:1928 -
\??\c:\frffrxr.exec:\frffrxr.exe62⤵
- Executes dropped EXE
PID:2568 -
\??\c:\htbnbn.exec:\htbnbn.exe63⤵
- Executes dropped EXE
PID:3288 -
\??\c:\tbhhtt.exec:\tbhhtt.exe64⤵
- Executes dropped EXE
PID:3840 -
\??\c:\5dvpd.exec:\5dvpd.exe65⤵
- Executes dropped EXE
PID:3900 -
\??\c:\rlxrfxr.exec:\rlxrfxr.exe66⤵PID:3364
-
\??\c:\bbtttt.exec:\bbtttt.exe67⤵PID:3656
-
\??\c:\hhtbhh.exec:\hhtbhh.exe68⤵PID:3420
-
\??\c:\vjjdv.exec:\vjjdv.exe69⤵PID:2096
-
\??\c:\ppvvv.exec:\ppvvv.exe70⤵PID:4964
-
\??\c:\jpdpd.exec:\jpdpd.exe71⤵PID:4888
-
\??\c:\fxflrrx.exec:\fxflrrx.exe72⤵PID:2368
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe73⤵PID:3408
-
\??\c:\ntnhbb.exec:\ntnhbb.exe74⤵PID:524
-
\??\c:\ddddp.exec:\ddddp.exe75⤵PID:4640
-
\??\c:\7ppjd.exec:\7ppjd.exe76⤵PID:4532
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe77⤵PID:244
-
\??\c:\frrfrlf.exec:\frrfrlf.exe78⤵PID:4936
-
\??\c:\tbnnbb.exec:\tbnnbb.exe79⤵PID:1368
-
\??\c:\pvppd.exec:\pvppd.exe80⤵PID:4852
-
\??\c:\ppppj.exec:\ppppj.exe81⤵PID:884
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe82⤵PID:3180
-
\??\c:\tbntnn.exec:\tbntnn.exe83⤵PID:1736
-
\??\c:\nbtnbb.exec:\nbtnbb.exe84⤵PID:4848
-
\??\c:\dvvpd.exec:\dvvpd.exe85⤵PID:5108
-
\??\c:\fxrrlxx.exec:\fxrrlxx.exe86⤵PID:3684
-
\??\c:\bttnbb.exec:\bttnbb.exe87⤵PID:968
-
\??\c:\vjpjd.exec:\vjpjd.exe88⤵PID:3956
-
\??\c:\vddvv.exec:\vddvv.exe89⤵PID:2968
-
\??\c:\xffxrrl.exec:\xffxrrl.exe90⤵PID:2344
-
\??\c:\ffffxll.exec:\ffffxll.exe91⤵PID:4060
-
\??\c:\nbbbbb.exec:\nbbbbb.exe92⤵PID:4744
-
\??\c:\dppdp.exec:\dppdp.exe93⤵PID:460
-
\??\c:\vppjd.exec:\vppjd.exe94⤵PID:1140
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe95⤵PID:540
-
\??\c:\btbthh.exec:\btbthh.exe96⤵PID:2844
-
\??\c:\3hhhtt.exec:\3hhhtt.exe97⤵PID:4076
-
\??\c:\dvvvp.exec:\dvvvp.exe98⤵PID:3352
-
\??\c:\jdpdv.exec:\jdpdv.exe99⤵PID:4636
-
\??\c:\xrrlffx.exec:\xrrlffx.exe100⤵PID:3604
-
\??\c:\9ntnbt.exec:\9ntnbt.exe101⤵PID:5080
-
\??\c:\jvvvp.exec:\jvvvp.exe102⤵PID:2896
-
\??\c:\ddddv.exec:\ddddv.exe103⤵PID:1308
-
\??\c:\vpdvv.exec:\vpdvv.exe104⤵PID:1688
-
\??\c:\lfrrxxl.exec:\lfrrxxl.exe105⤵PID:2092
-
\??\c:\tntnbt.exec:\tntnbt.exe106⤵PID:2256
-
\??\c:\jvjvp.exec:\jvjvp.exe107⤵PID:1796
-
\??\c:\pddvj.exec:\pddvj.exe108⤵
- System Location Discovery: System Language Discovery
PID:2004 -
\??\c:\pjdvp.exec:\pjdvp.exe109⤵PID:1912
-
\??\c:\1rllfff.exec:\1rllfff.exe110⤵PID:3336
-
\??\c:\thbhhh.exec:\thbhhh.exe111⤵PID:1152
-
\??\c:\tnhbbb.exec:\tnhbbb.exe112⤵PID:3688
-
\??\c:\pddvj.exec:\pddvj.exe113⤵PID:2032
-
\??\c:\xrffxrl.exec:\xrffxrl.exe114⤵PID:3588
-
\??\c:\frllfxl.exec:\frllfxl.exe115⤵PID:216
-
\??\c:\thbhtb.exec:\thbhtb.exe116⤵PID:1928
-
\??\c:\7vvpp.exec:\7vvpp.exe117⤵PID:3580
-
\??\c:\vppjv.exec:\vppjv.exe118⤵PID:3288
-
\??\c:\lrrlfff.exec:\lrrlfff.exe119⤵PID:3840
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe120⤵PID:1208
-
\??\c:\5bhhbb.exec:\5bhhbb.exe121⤵PID:748
-
\??\c:\bthbtt.exec:\bthbtt.exe122⤵PID:3340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-