Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 05:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
Resource
win7-20241023-en
windows7-x64
7 signatures
120 seconds
General
-
Target
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe
-
Size
105KB
-
MD5
a4c210bbb97e01caf3f428a3d44172f2
-
SHA1
fc9e2a416cb8a26622e3c668c7c0f4af265498bc
-
SHA256
eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd
-
SHA512
cf790335aa1841a2f216a00ab39d09b034d7bc005e235d324b4179f1ac743f75cea7353e7974c7d0e11614ba1a39d376b92b3b46f5920ef1c77daca9f8dff610
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHq82PC1:n3C9BRo7tvnJ99T/KZE891
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4008 jjvvv.exe 1232 ppddd.exe 4548 xxxxxrf.exe 3056 hbnttb.exe 2524 vvdvd.exe 4180 llxfllr.exe 3244 bbhhhn.exe 4680 nnnntb.exe 4380 djvpd.exe 4640 bntnhn.exe 4944 pdvdd.exe 3620 rrxrrrx.exe 3904 nntbnt.exe 388 vvvdd.exe 4424 ddddv.exe 2280 flfffff.exe 3652 tbntht.exe 2024 vvpvj.exe 1168 pjvdv.exe 3720 fxlflrf.exe 1860 xxllxff.exe 2032 3nnnhh.exe 1632 bnhnnn.exe 1700 jdpvd.exe 2936 1rxxfll.exe 4284 xxrxxff.exe 4228 bhnbnt.exe 760 bttbhn.exe 4600 jddpp.exe 3376 llllflf.exe 3224 tbhhhn.exe 2392 dpppj.exe 1312 lrrlfll.exe 1840 xxfxxff.exe 2616 hbnhtt.exe 3552 dddvd.exe 2456 xxxxxff.exe 3648 nbbbnt.exe 4296 jdddp.exe 3060 nhnnnn.exe 4572 hhnbtb.exe 3864 jdpjv.exe 2592 fxllllr.exe 872 ppddv.exe 4988 hntbbh.exe 916 xffxlrx.exe 4724 nbntbn.exe 4532 vddjd.exe 2184 jvddv.exe 2408 rrllrrr.exe 2012 ntbttn.exe 964 tnbhhn.exe 3604 jpddp.exe 1960 1vpvp.exe 2044 rfxrxxf.exe 4544 xfxffff.exe 4452 7bhhhn.exe 4180 jjppj.exe 3316 dpvvv.exe 4972 lfxrrff.exe 4696 3xxxfrr.exe 3400 9hnttt.exe 2264 ttbhhn.exe 2932 vpvvv.exe -
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxffflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxxfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2408 wrote to memory of 4008 2408 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 83 PID 2408 wrote to memory of 4008 2408 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 83 PID 2408 wrote to memory of 4008 2408 eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe 83 PID 4008 wrote to memory of 1232 4008 jjvvv.exe 84 PID 4008 wrote to memory of 1232 4008 jjvvv.exe 84 PID 4008 wrote to memory of 1232 4008 jjvvv.exe 84 PID 1232 wrote to memory of 4548 1232 ppddd.exe 85 PID 1232 wrote to memory of 4548 1232 ppddd.exe 85 PID 1232 wrote to memory of 4548 1232 ppddd.exe 85 PID 4548 wrote to memory of 3056 4548 xxxxxrf.exe 86 PID 4548 wrote to memory of 3056 4548 xxxxxrf.exe 86 PID 4548 wrote to memory of 3056 4548 xxxxxrf.exe 86 PID 3056 wrote to memory of 2524 3056 hbnttb.exe 87 PID 3056 wrote to memory of 2524 3056 hbnttb.exe 87 PID 3056 wrote to memory of 2524 3056 hbnttb.exe 87 PID 2524 wrote to memory of 4180 2524 vvdvd.exe 88 PID 2524 wrote to memory of 4180 2524 vvdvd.exe 88 PID 2524 wrote to memory of 4180 2524 vvdvd.exe 88 PID 4180 wrote to memory of 3244 4180 llxfllr.exe 89 PID 4180 wrote to memory of 3244 4180 llxfllr.exe 89 PID 4180 wrote to memory of 3244 4180 llxfllr.exe 89 PID 3244 wrote to memory of 4680 3244 bbhhhn.exe 90 PID 3244 wrote to memory of 4680 3244 bbhhhn.exe 90 PID 3244 wrote to memory of 4680 3244 bbhhhn.exe 90 PID 4680 wrote to memory of 4380 4680 nnnntb.exe 91 PID 4680 wrote to memory of 4380 4680 nnnntb.exe 91 PID 4680 wrote to memory of 4380 4680 nnnntb.exe 91 PID 4380 wrote to memory of 4640 4380 djvpd.exe 92 PID 4380 wrote to memory of 4640 4380 djvpd.exe 92 PID 4380 wrote to memory of 4640 4380 djvpd.exe 92 PID 4640 wrote to memory of 4944 4640 bntnhn.exe 93 PID 4640 wrote to memory of 4944 4640 bntnhn.exe 93 PID 4640 wrote to memory of 4944 4640 bntnhn.exe 93 PID 4944 wrote to memory of 3620 4944 pdvdd.exe 94 PID 4944 wrote to memory of 3620 4944 pdvdd.exe 94 PID 4944 wrote to memory of 3620 4944 pdvdd.exe 94 PID 3620 wrote to memory of 3904 3620 rrxrrrx.exe 95 PID 3620 wrote to memory of 3904 3620 rrxrrrx.exe 95 PID 3620 wrote to memory of 3904 3620 rrxrrrx.exe 95 PID 3904 wrote to memory of 388 3904 nntbnt.exe 96 PID 3904 wrote to memory of 388 3904 nntbnt.exe 96 PID 3904 wrote to memory of 388 3904 nntbnt.exe 96 PID 388 wrote to memory of 4424 388 vvvdd.exe 97 PID 388 wrote to memory of 4424 388 vvvdd.exe 97 PID 388 wrote to memory of 4424 388 vvvdd.exe 97 PID 4424 wrote to memory of 2280 4424 ddddv.exe 98 PID 4424 wrote to memory of 2280 4424 ddddv.exe 98 PID 4424 wrote to memory of 2280 4424 ddddv.exe 98 PID 2280 wrote to memory of 3652 2280 flfffff.exe 99 PID 2280 wrote to memory of 3652 2280 flfffff.exe 99 PID 2280 wrote to memory of 3652 2280 flfffff.exe 99 PID 3652 wrote to memory of 2024 3652 tbntht.exe 100 PID 3652 wrote to memory of 2024 3652 tbntht.exe 100 PID 3652 wrote to memory of 2024 3652 tbntht.exe 100 PID 2024 wrote to memory of 1168 2024 vvpvj.exe 101 PID 2024 wrote to memory of 1168 2024 vvpvj.exe 101 PID 2024 wrote to memory of 1168 2024 vvpvj.exe 101 PID 1168 wrote to memory of 3720 1168 pjvdv.exe 102 PID 1168 wrote to memory of 3720 1168 pjvdv.exe 102 PID 1168 wrote to memory of 3720 1168 pjvdv.exe 102 PID 3720 wrote to memory of 1860 3720 fxlflrf.exe 103 PID 3720 wrote to memory of 1860 3720 fxlflrf.exe 103 PID 3720 wrote to memory of 1860 3720 fxlflrf.exe 103 PID 1860 wrote to memory of 2032 1860 xxllxff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"C:\Users\Admin\AppData\Local\Temp\eefa5b53fceff1cf1207bdfbdf03e4f7060b721ab07b4259d748e6acc1ced1fd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\jjvvv.exec:\jjvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\ppddd.exec:\ppddd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\xxxxxrf.exec:\xxxxxrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\hbnttb.exec:\hbnttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\vvdvd.exec:\vvdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\llxfllr.exec:\llxfllr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\bbhhhn.exec:\bbhhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\nnnntb.exec:\nnnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\djvpd.exec:\djvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\bntnhn.exec:\bntnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\pdvdd.exec:\pdvdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\rrxrrrx.exec:\rrxrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\nntbnt.exec:\nntbnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\vvvdd.exec:\vvvdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ddddv.exec:\ddddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\flfffff.exec:\flfffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\tbntht.exec:\tbntht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\vvpvj.exec:\vvpvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\pjvdv.exec:\pjvdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\fxlflrf.exec:\fxlflrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\xxllxff.exec:\xxllxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\3nnnhh.exec:\3nnnhh.exe23⤵
- Executes dropped EXE
PID:2032 -
\??\c:\bnhnnn.exec:\bnhnnn.exe24⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jdpvd.exec:\jdpvd.exe25⤵
- Executes dropped EXE
PID:1700 -
\??\c:\1rxxfll.exec:\1rxxfll.exe26⤵
- Executes dropped EXE
PID:2936 -
\??\c:\xxrxxff.exec:\xxrxxff.exe27⤵
- Executes dropped EXE
PID:4284 -
\??\c:\bhnbnt.exec:\bhnbnt.exe28⤵
- Executes dropped EXE
PID:4228 -
\??\c:\bttbhn.exec:\bttbhn.exe29⤵
- Executes dropped EXE
PID:760 -
\??\c:\jddpp.exec:\jddpp.exe30⤵
- Executes dropped EXE
PID:4600 -
\??\c:\llllflf.exec:\llllflf.exe31⤵
- Executes dropped EXE
PID:3376 -
\??\c:\tbhhhn.exec:\tbhhhn.exe32⤵
- Executes dropped EXE
PID:3224 -
\??\c:\dpppj.exec:\dpppj.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lrrlfll.exec:\lrrlfll.exe34⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xxfxxff.exec:\xxfxxff.exe35⤵
- Executes dropped EXE
PID:1840 -
\??\c:\hbnhtt.exec:\hbnhtt.exe36⤵
- Executes dropped EXE
PID:2616 -
\??\c:\dddvd.exec:\dddvd.exe37⤵
- Executes dropped EXE
PID:3552 -
\??\c:\xxxxxff.exec:\xxxxxff.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nbbbnt.exec:\nbbbnt.exe39⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jdddp.exec:\jdddp.exe40⤵
- Executes dropped EXE
PID:4296 -
\??\c:\nhnnnn.exec:\nhnnnn.exe41⤵
- Executes dropped EXE
PID:3060 -
\??\c:\hhnbtb.exec:\hhnbtb.exe42⤵
- Executes dropped EXE
PID:4572 -
\??\c:\jdpjv.exec:\jdpjv.exe43⤵
- Executes dropped EXE
PID:3864 -
\??\c:\fxllllr.exec:\fxllllr.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\ppddv.exec:\ppddv.exe45⤵
- Executes dropped EXE
PID:872 -
\??\c:\hntbbh.exec:\hntbbh.exe46⤵
- Executes dropped EXE
PID:4988 -
\??\c:\xffxlrx.exec:\xffxlrx.exe47⤵
- Executes dropped EXE
PID:916 -
\??\c:\nbntbn.exec:\nbntbn.exe48⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vddjd.exec:\vddjd.exe49⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jvddv.exec:\jvddv.exe50⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rrllrrr.exec:\rrllrrr.exe51⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ntbttn.exec:\ntbttn.exe52⤵
- Executes dropped EXE
PID:2012 -
\??\c:\tnbhhn.exec:\tnbhhn.exe53⤵
- Executes dropped EXE
PID:964 -
\??\c:\jpddp.exec:\jpddp.exe54⤵
- Executes dropped EXE
PID:3604 -
\??\c:\1vpvp.exec:\1vpvp.exe55⤵
- Executes dropped EXE
PID:1960 -
\??\c:\rfxrxxf.exec:\rfxrxxf.exe56⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xfxffff.exec:\xfxffff.exe57⤵
- Executes dropped EXE
PID:4544 -
\??\c:\7bhhhn.exec:\7bhhhn.exe58⤵
- Executes dropped EXE
PID:4452 -
\??\c:\jjppj.exec:\jjppj.exe59⤵
- Executes dropped EXE
PID:4180 -
\??\c:\dpvvv.exec:\dpvvv.exe60⤵
- Executes dropped EXE
PID:3316 -
\??\c:\lfxrrff.exec:\lfxrrff.exe61⤵
- Executes dropped EXE
PID:4972 -
\??\c:\3xxxfrr.exec:\3xxxfrr.exe62⤵
- Executes dropped EXE
PID:4696 -
\??\c:\9hnttt.exec:\9hnttt.exe63⤵
- Executes dropped EXE
PID:3400 -
\??\c:\ttbhhn.exec:\ttbhhn.exe64⤵
- Executes dropped EXE
PID:2264 -
\??\c:\vpvvv.exec:\vpvvv.exe65⤵
- Executes dropped EXE
PID:2932 -
\??\c:\rrflllx.exec:\rrflllx.exe66⤵PID:4640
-
\??\c:\hnbhnt.exec:\hnbhnt.exe67⤵PID:5112
-
\??\c:\vdvpj.exec:\vdvpj.exe68⤵PID:1544
-
\??\c:\rlxxxfr.exec:\rlxxxfr.exe69⤵PID:4376
-
\??\c:\xffffll.exec:\xffffll.exe70⤵PID:1536
-
\??\c:\hbnttt.exec:\hbnttt.exe71⤵PID:3032
-
\??\c:\jjjjp.exec:\jjjjp.exe72⤵PID:2964
-
\??\c:\3dvvd.exec:\3dvvd.exe73⤵PID:3428
-
\??\c:\rrffxrx.exec:\rrffxrx.exe74⤵PID:2280
-
\??\c:\5rxxlrr.exec:\5rxxlrr.exe75⤵PID:5012
-
\??\c:\bbhtbn.exec:\bbhtbn.exe76⤵PID:4568
-
\??\c:\jjppp.exec:\jjppp.exe77⤵PID:324
-
\??\c:\3vdjd.exec:\3vdjd.exe78⤵PID:4720
-
\??\c:\rfxxfxx.exec:\rfxxfxx.exe79⤵PID:1696
-
\??\c:\fflxxfl.exec:\fflxxfl.exe80⤵PID:2460
-
\??\c:\hbhttb.exec:\hbhttb.exe81⤵PID:2148
-
\??\c:\bbbbhn.exec:\bbbbhn.exe82⤵PID:1632
-
\??\c:\vjjvd.exec:\vjjvd.exe83⤵PID:2860
-
\??\c:\9rllrxl.exec:\9rllrxl.exe84⤵PID:1416
-
\??\c:\tnnntt.exec:\tnnntt.exe85⤵PID:3460
-
\??\c:\tntbtn.exec:\tntbtn.exe86⤵PID:1224
-
\??\c:\7pddp.exec:\7pddp.exe87⤵PID:1928
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe88⤵PID:4172
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe89⤵PID:812
-
\??\c:\ththhn.exec:\ththhn.exe90⤵PID:3172
-
\??\c:\vvpjp.exec:\vvpjp.exe91⤵PID:4156
-
\??\c:\ddvvp.exec:\ddvvp.exe92⤵PID:4364
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe93⤵PID:644
-
\??\c:\xflrfrx.exec:\xflrfrx.exe94⤵PID:3708
-
\??\c:\htnttb.exec:\htnttb.exe95⤵PID:2908
-
\??\c:\ddppv.exec:\ddppv.exe96⤵PID:2260
-
\??\c:\jdjpv.exec:\jdjpv.exe97⤵PID:512
-
\??\c:\5lxllrx.exec:\5lxllrx.exe98⤵PID:4352
-
\??\c:\xrffxfl.exec:\xrffxfl.exe99⤵PID:4032
-
\??\c:\bbnntb.exec:\bbnntb.exe100⤵PID:436
-
\??\c:\djdjp.exec:\djdjp.exe101⤵PID:2708
-
\??\c:\jjvdj.exec:\jjvdj.exe102⤵PID:5084
-
\??\c:\rfllflr.exec:\rfllflr.exe103⤵PID:3404
-
\??\c:\5tthhb.exec:\5tthhb.exe104⤵PID:448
-
\??\c:\bbhhhn.exec:\bbhhhn.exe105⤵PID:3924
-
\??\c:\djjjd.exec:\djjjd.exe106⤵PID:2008
-
\??\c:\3vppj.exec:\3vppj.exe107⤵PID:1608
-
\??\c:\xxrrllr.exec:\xxrrllr.exe108⤵PID:1352
-
\??\c:\thtthn.exec:\thtthn.exe109⤵PID:1592
-
\??\c:\hbhbbh.exec:\hbhbbh.exe110⤵PID:3608
-
\??\c:\3jjjp.exec:\3jjjp.exe111⤵PID:4792
-
\??\c:\ppvvv.exec:\ppvvv.exe112⤵PID:384
-
\??\c:\rrfflxf.exec:\rrfflxf.exe113⤵PID:2544
-
\??\c:\pppvv.exec:\pppvv.exe114⤵
- System Location Discovery: System Language Discovery
PID:1452 -
\??\c:\3ddpj.exec:\3ddpj.exe115⤵PID:3944
-
\??\c:\rffxlrr.exec:\rffxlrr.exe116⤵PID:1996
-
\??\c:\ffxlrff.exec:\ffxlrff.exe117⤵PID:864
-
\??\c:\hhhhbh.exec:\hhhhbh.exe118⤵PID:2476
-
\??\c:\pvddd.exec:\pvddd.exe119⤵PID:1164
-
\??\c:\pdjdp.exec:\pdjdp.exe120⤵PID:4832
-
\??\c:\rlxrlxx.exec:\rlxrlxx.exe121⤵PID:4936
-
\??\c:\nbtnhh.exec:\nbtnhh.exe122⤵PID:936
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-