Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 18:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe
-
Size
57KB
-
MD5
97d247a964ebc605b441b15cadf6ad37
-
SHA1
6f5bf24383710c9ce9d326fa0c3a7b0a060239ea
-
SHA256
0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91
-
SHA512
b091b5581859f722370276d60fe9a503ad92438cb0e122d5f2b177ca81f9929a9bd849cf83fd0a95a2ae4a28b4c28d3504811106628ced47369d34109c3e06ed
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIY6St9xn7v1:ymb3NkkiQ3mdBjFIY79xr1
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4944-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/992-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1556 vjjdp.exe 3176 1lxrffx.exe 1428 hbtnhb.exe 2788 7dvvd.exe 4080 1rrfrlf.exe 992 hbtnbb.exe 1180 pdjjj.exe 3116 rllfxrf.exe 2960 ttnhbt.exe 2876 ddvjd.exe 1368 xlrfxfr.exe 5056 3tttnh.exe 1752 rxrlfxr.exe 2180 rxrlfxl.exe 1576 bhhnbb.exe 4156 9jppd.exe 4916 vjdpj.exe 4172 7lrrfff.exe 2456 nttbtn.exe 2192 ddjvp.exe 4668 vvpjv.exe 3588 rflfrxl.exe 1524 xrxrxrx.exe 3524 tbthbt.exe 2808 xrlfrlf.exe 4808 3bbhbt.exe 1064 jvppp.exe 948 pjjdd.exe 3560 rxrrflx.exe 3968 rxlfrlx.exe 2220 1vddv.exe 4408 nhbtnh.exe 1472 dpjdv.exe 4952 lxflxrl.exe 1552 hbtnhh.exe 2324 7pppj.exe 2760 9xxlxrl.exe 3756 9xxrllf.exe 4988 ttnnbb.exe 4824 1bhbtt.exe 4392 7jpjd.exe 4008 frrlrlf.exe 3648 lfrrllf.exe 2100 hbnntn.exe 4992 bbbnbt.exe 4792 5djdv.exe 2076 3ddvj.exe 2516 flxrffx.exe 4868 1bttnt.exe 4928 ntbbbb.exe 4856 3dddp.exe 3124 5ddvd.exe 4000 rlxxxfl.exe 3624 btnhbb.exe 904 bttnhh.exe 2868 pjjdv.exe 4576 jdjdd.exe 2860 lfxrlll.exe 2692 7bhbbt.exe 1248 1ttnbb.exe 1368 5vvjj.exe 5052 pvdpd.exe 1072 xrfrfxr.exe 2676 btbtbt.exe -
resource yara_rule behavioral2/memory/4944-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/992-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1180-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9djdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4944 wrote to memory of 1556 4944 0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe 82 PID 4944 wrote to memory of 1556 4944 0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe 82 PID 4944 wrote to memory of 1556 4944 0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe 82 PID 1556 wrote to memory of 3176 1556 vjjdp.exe 83 PID 1556 wrote to memory of 3176 1556 vjjdp.exe 83 PID 1556 wrote to memory of 3176 1556 vjjdp.exe 83 PID 3176 wrote to memory of 1428 3176 1lxrffx.exe 84 PID 3176 wrote to memory of 1428 3176 1lxrffx.exe 84 PID 3176 wrote to memory of 1428 3176 1lxrffx.exe 84 PID 1428 wrote to memory of 2788 1428 hbtnhb.exe 85 PID 1428 wrote to memory of 2788 1428 hbtnhb.exe 85 PID 1428 wrote to memory of 2788 1428 hbtnhb.exe 85 PID 2788 wrote to memory of 4080 2788 7dvvd.exe 86 PID 2788 wrote to memory of 4080 2788 7dvvd.exe 86 PID 2788 wrote to memory of 4080 2788 7dvvd.exe 86 PID 4080 wrote to memory of 992 4080 1rrfrlf.exe 87 PID 4080 wrote to memory of 992 4080 1rrfrlf.exe 87 PID 4080 wrote to memory of 992 4080 1rrfrlf.exe 87 PID 992 wrote to memory of 1180 992 hbtnbb.exe 88 PID 992 wrote to memory of 1180 992 hbtnbb.exe 88 PID 992 wrote to memory of 1180 992 hbtnbb.exe 88 PID 1180 wrote to memory of 3116 1180 pdjjj.exe 89 PID 1180 wrote to memory of 3116 1180 pdjjj.exe 89 PID 1180 wrote to memory of 3116 1180 pdjjj.exe 89 PID 3116 wrote to memory of 2960 3116 rllfxrf.exe 90 PID 3116 wrote to memory of 2960 3116 rllfxrf.exe 90 PID 3116 wrote to memory of 2960 3116 rllfxrf.exe 90 PID 2960 wrote to memory of 2876 2960 ttnhbt.exe 91 PID 2960 wrote to memory of 2876 2960 ttnhbt.exe 91 PID 2960 wrote to memory of 2876 2960 ttnhbt.exe 91 PID 2876 wrote to memory of 1368 2876 ddvjd.exe 92 PID 2876 wrote to memory of 1368 2876 ddvjd.exe 92 PID 2876 wrote to memory of 1368 2876 ddvjd.exe 92 PID 1368 wrote to memory of 5056 1368 xlrfxfr.exe 93 PID 1368 wrote to memory of 5056 1368 xlrfxfr.exe 93 PID 1368 wrote to memory of 5056 1368 xlrfxfr.exe 93 PID 5056 wrote to memory of 1752 5056 3tttnh.exe 94 PID 5056 wrote to memory of 1752 5056 3tttnh.exe 94 PID 5056 wrote to memory of 1752 5056 3tttnh.exe 94 PID 1752 wrote to memory of 2180 1752 rxrlfxr.exe 95 PID 1752 wrote to memory of 2180 1752 rxrlfxr.exe 95 PID 1752 wrote to memory of 2180 1752 rxrlfxr.exe 95 PID 2180 wrote to memory of 1576 2180 rxrlfxl.exe 96 PID 2180 wrote to memory of 1576 2180 rxrlfxl.exe 96 PID 2180 wrote to memory of 1576 2180 rxrlfxl.exe 96 PID 1576 wrote to memory of 4156 1576 bhhnbb.exe 97 PID 1576 wrote to memory of 4156 1576 bhhnbb.exe 97 PID 1576 wrote to memory of 4156 1576 bhhnbb.exe 97 PID 4156 wrote to memory of 4916 4156 9jppd.exe 98 PID 4156 wrote to memory of 4916 4156 9jppd.exe 98 PID 4156 wrote to memory of 4916 4156 9jppd.exe 98 PID 4916 wrote to memory of 4172 4916 vjdpj.exe 99 PID 4916 wrote to memory of 4172 4916 vjdpj.exe 99 PID 4916 wrote to memory of 4172 4916 vjdpj.exe 99 PID 4172 wrote to memory of 2456 4172 7lrrfff.exe 100 PID 4172 wrote to memory of 2456 4172 7lrrfff.exe 100 PID 4172 wrote to memory of 2456 4172 7lrrfff.exe 100 PID 2456 wrote to memory of 2192 2456 nttbtn.exe 101 PID 2456 wrote to memory of 2192 2456 nttbtn.exe 101 PID 2456 wrote to memory of 2192 2456 nttbtn.exe 101 PID 2192 wrote to memory of 4668 2192 ddjvp.exe 102 PID 2192 wrote to memory of 4668 2192 ddjvp.exe 102 PID 2192 wrote to memory of 4668 2192 ddjvp.exe 102 PID 4668 wrote to memory of 3588 4668 vvpjv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe"C:\Users\Admin\AppData\Local\Temp\0da22660f5f5658f18427c7c1bc21b6e042fb3b7d1b81b94519d40502d07ed91.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\vjjdp.exec:\vjjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\1lxrffx.exec:\1lxrffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\hbtnhb.exec:\hbtnhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\7dvvd.exec:\7dvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\1rrfrlf.exec:\1rrfrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\hbtnbb.exec:\hbtnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\pdjjj.exec:\pdjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\rllfxrf.exec:\rllfxrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\ttnhbt.exec:\ttnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\ddvjd.exec:\ddvjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\xlrfxfr.exec:\xlrfxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\3tttnh.exec:\3tttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\rxrlfxl.exec:\rxrlfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\bhhnbb.exec:\bhhnbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\9jppd.exec:\9jppd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\vjdpj.exec:\vjdpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\7lrrfff.exec:\7lrrfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\nttbtn.exec:\nttbtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ddjvp.exec:\ddjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vvpjv.exec:\vvpjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\rflfrxl.exec:\rflfrxl.exe23⤵
- Executes dropped EXE
PID:3588 -
\??\c:\xrxrxrx.exec:\xrxrxrx.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\tbthbt.exec:\tbthbt.exe25⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\3bbhbt.exec:\3bbhbt.exe27⤵
- Executes dropped EXE
PID:4808 -
\??\c:\jvppp.exec:\jvppp.exe28⤵
- Executes dropped EXE
PID:1064 -
\??\c:\pjjdd.exec:\pjjdd.exe29⤵
- Executes dropped EXE
PID:948 -
\??\c:\rxrrflx.exec:\rxrrflx.exe30⤵
- Executes dropped EXE
PID:3560 -
\??\c:\rxlfrlx.exec:\rxlfrlx.exe31⤵
- Executes dropped EXE
PID:3968 -
\??\c:\1vddv.exec:\1vddv.exe32⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nhbtnh.exec:\nhbtnh.exe33⤵
- Executes dropped EXE
PID:4408 -
\??\c:\dpjdv.exec:\dpjdv.exe34⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lxflxrl.exec:\lxflxrl.exe35⤵
- Executes dropped EXE
PID:4952 -
\??\c:\hbtnhh.exec:\hbtnhh.exe36⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7pppj.exec:\7pppj.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\9xxlxrl.exec:\9xxlxrl.exe38⤵
- Executes dropped EXE
PID:2760 -
\??\c:\9xxrllf.exec:\9xxrllf.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3756 -
\??\c:\ttnnbb.exec:\ttnnbb.exe40⤵
- Executes dropped EXE
PID:4988 -
\??\c:\1bhbtt.exec:\1bhbtt.exe41⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7jpjd.exec:\7jpjd.exe42⤵
- Executes dropped EXE
PID:4392 -
\??\c:\frrlrlf.exec:\frrlrlf.exe43⤵
- Executes dropped EXE
PID:4008 -
\??\c:\lfrrllf.exec:\lfrrllf.exe44⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hbnntn.exec:\hbnntn.exe45⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bbbnbt.exec:\bbbnbt.exe46⤵
- Executes dropped EXE
PID:4992 -
\??\c:\5djdv.exec:\5djdv.exe47⤵
- Executes dropped EXE
PID:4792 -
\??\c:\3ddvj.exec:\3ddvj.exe48⤵
- Executes dropped EXE
PID:2076 -
\??\c:\flxrffx.exec:\flxrffx.exe49⤵
- Executes dropped EXE
PID:2516 -
\??\c:\1bttnt.exec:\1bttnt.exe50⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ntbbbb.exec:\ntbbbb.exe51⤵
- Executes dropped EXE
PID:4928 -
\??\c:\3dddp.exec:\3dddp.exe52⤵
- Executes dropped EXE
PID:4856 -
\??\c:\5ddvd.exec:\5ddvd.exe53⤵
- Executes dropped EXE
PID:3124 -
\??\c:\rlxxxfl.exec:\rlxxxfl.exe54⤵
- Executes dropped EXE
PID:4000 -
\??\c:\btnhbb.exec:\btnhbb.exe55⤵
- Executes dropped EXE
PID:3624 -
\??\c:\bttnhh.exec:\bttnhh.exe56⤵
- Executes dropped EXE
PID:904 -
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jdjdd.exec:\jdjdd.exe58⤵
- Executes dropped EXE
PID:4576 -
\??\c:\lfxrlll.exec:\lfxrlll.exe59⤵
- Executes dropped EXE
PID:2860 -
\??\c:\7bhbbt.exec:\7bhbbt.exe60⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1ttnbb.exec:\1ttnbb.exe61⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5vvjj.exec:\5vvjj.exe62⤵
- Executes dropped EXE
PID:1368 -
\??\c:\pvdpd.exec:\pvdpd.exe63⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xrfrfxr.exec:\xrfrfxr.exe64⤵
- Executes dropped EXE
PID:1072 -
\??\c:\btbtbt.exec:\btbtbt.exe65⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9nnbnh.exec:\9nnbnh.exe66⤵PID:2772
-
\??\c:\vvdpv.exec:\vvdpv.exe67⤵PID:5092
-
\??\c:\xxxfxff.exec:\xxxfxff.exe68⤵PID:3256
-
\??\c:\lfrllff.exec:\lfrllff.exe69⤵PID:4320
-
\??\c:\tbbbbb.exec:\tbbbbb.exe70⤵PID:2320
-
\??\c:\bbnhbb.exec:\bbnhbb.exe71⤵PID:3428
-
\??\c:\7pjjj.exec:\7pjjj.exe72⤵PID:4884
-
\??\c:\jddpd.exec:\jddpd.exe73⤵PID:3668
-
\??\c:\1rrlrlx.exec:\1rrlrlx.exe74⤵PID:4896
-
\??\c:\nnbtnn.exec:\nnbtnn.exe75⤵PID:2632
-
\??\c:\5nnnhb.exec:\5nnnhb.exe76⤵PID:3224
-
\??\c:\vvvpj.exec:\vvvpj.exe77⤵PID:3024
-
\??\c:\5flffxf.exec:\5flffxf.exe78⤵PID:3524
-
\??\c:\5flfxxr.exec:\5flfxxr.exe79⤵PID:1728
-
\??\c:\nnhhbb.exec:\nnhhbb.exe80⤵PID:964
-
\??\c:\hnttnh.exec:\hnttnh.exe81⤵PID:1188
-
\??\c:\ddvpj.exec:\ddvpj.exe82⤵PID:768
-
\??\c:\xrxxlll.exec:\xrxxlll.exe83⤵PID:3328
-
\??\c:\xxxrfxl.exec:\xxxrfxl.exe84⤵PID:4160
-
\??\c:\bnnbhh.exec:\bnnbhh.exe85⤵PID:3672
-
\??\c:\vvppj.exec:\vvppj.exe86⤵PID:856
-
\??\c:\jdjdj.exec:\jdjdj.exe87⤵PID:4408
-
\??\c:\flfxrlx.exec:\flfxrlx.exe88⤵PID:960
-
\??\c:\fffxxrr.exec:\fffxxrr.exe89⤵PID:1960
-
\??\c:\bbhthb.exec:\bbhthb.exe90⤵PID:4956
-
\??\c:\bhhbhb.exec:\bhhbhb.exe91⤵PID:4620
-
\??\c:\jjvpj.exec:\jjvpj.exe92⤵PID:388
-
\??\c:\pppjv.exec:\pppjv.exe93⤵PID:1396
-
\??\c:\fllfxrl.exec:\fllfxrl.exe94⤵PID:3056
-
\??\c:\nhhbtt.exec:\nhhbtt.exe95⤵PID:1756
-
\??\c:\1btthn.exec:\1btthn.exe96⤵PID:4404
-
\??\c:\pjdvp.exec:\pjdvp.exe97⤵PID:4964
-
\??\c:\5jdvp.exec:\5jdvp.exe98⤵PID:4216
-
\??\c:\1ffxlrl.exec:\1ffxlrl.exe99⤵PID:4212
-
\??\c:\7xxxrrr.exec:\7xxxrrr.exe100⤵PID:4992
-
\??\c:\bhhhhh.exec:\bhhhhh.exe101⤵PID:4152
-
\??\c:\5vvvj.exec:\5vvvj.exe102⤵PID:4848
-
\??\c:\5lflxxr.exec:\5lflxxr.exe103⤵PID:4880
-
\??\c:\9bnhhb.exec:\9bnhhb.exe104⤵PID:4080
-
\??\c:\7bhnht.exec:\7bhnht.exe105⤵PID:3460
-
\??\c:\ppvvv.exec:\ppvvv.exe106⤵PID:3748
-
\??\c:\pdvpd.exec:\pdvpd.exe107⤵PID:3368
-
\??\c:\rffxllf.exec:\rffxllf.exe108⤵PID:1180
-
\??\c:\tnntbt.exec:\tnntbt.exe109⤵PID:1304
-
\??\c:\nhhtnn.exec:\nhhtnn.exe110⤵PID:1940
-
\??\c:\1vpjv.exec:\1vpjv.exe111⤵PID:1040
-
\??\c:\dpppj.exec:\dpppj.exe112⤵PID:4624
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe113⤵PID:4920
-
\??\c:\3bbbtn.exec:\3bbbtn.exe114⤵
- System Location Discovery: System Language Discovery
PID:3908 -
\??\c:\btbttt.exec:\btbttt.exe115⤵PID:3040
-
\??\c:\vjpdp.exec:\vjpdp.exe116⤵PID:1184
-
\??\c:\jjjdp.exec:\jjjdp.exe117⤵PID:3824
-
\??\c:\rlffxll.exec:\rlffxll.exe118⤵PID:4272
-
\??\c:\llrlfxr.exec:\llrlfxr.exe119⤵PID:3504
-
\??\c:\5bhbtt.exec:\5bhbtt.exe120⤵PID:2224
-
\??\c:\7hbttn.exec:\7hbttn.exe121⤵PID:4016
-
\??\c:\jjdvp.exec:\jjdvp.exe122⤵PID:3200
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-