Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 11:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe
Resource
win7-20241010-en
7 signatures
120 seconds
General
-
Target
3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe
-
Size
67KB
-
MD5
4ec5e556585cf8ab72044074b67564f0
-
SHA1
9f93105757004fa91d5115070e6c19ac3b1575c8
-
SHA256
3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829
-
SHA512
26ea00f1e73d697cc80150cb23d737c0079fb5ee9b31a30cacf667d254cc2394abd34f99c8e16a20d02ab6e7b8132540d092abb7e5f7e6cfc9db7a7b4f365e86
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yU+kbxe7:ymb3NkkiQ3mdBjF0y7kbU7
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 23 IoCs
resource yara_rule behavioral2/memory/2124-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4396-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3860-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2828-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/956-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3888 lrrfrfl.exe 3828 httnnn.exe 3860 nhtnnn.exe 4508 ppddd.exe 4396 rxxxrrr.exe 1480 lflfxrl.exe 1160 bthhnn.exe 4204 pvvvj.exe 2600 3xfxrrl.exe 3468 nnhhbb.exe 2828 hbbtth.exe 872 5jppd.exe 4140 lrxxrrr.exe 5068 bnttnt.exe 2512 dvpvv.exe 2592 flrfrlx.exe 60 bnbtbt.exe 4444 5hbnbt.exe 404 jddpd.exe 2812 xxrlrlf.exe 2172 hbttbb.exe 5116 hbbhnb.exe 2436 ppppp.exe 1520 rxxlfrl.exe 64 bntnbt.exe 4644 djvdp.exe 4720 lfflfxl.exe 848 lfrlfxl.exe 956 nbnhhn.exe 4900 vppdp.exe 3232 nbbntb.exe 3404 pjjdp.exe 2016 jddpd.exe 1368 5lxrlrl.exe 3652 xlfrrlx.exe 4648 tbtnbb.exe 868 pdjvp.exe 2740 1vdpv.exe 2408 9ddvj.exe 4516 fllxlfr.exe 3968 fxxrrxr.exe 4484 nbthth.exe 3888 pjvpd.exe 3048 jddpj.exe 5016 flrfrfx.exe 3860 rfrlxrf.exe 1748 hbnhbb.exe 1932 lrfrlxl.exe 4428 nnhntb.exe 2944 nththt.exe 1836 vdvpj.exe 552 vjvpp.exe 4180 fxrfxlf.exe 3776 5xxfrxr.exe 1192 1vpdv.exe 3468 1rxrllf.exe 4628 lxrrllf.exe 4044 9btnhh.exe 4752 dpvpd.exe 512 jddvp.exe 5068 xffffff.exe 1940 fxxxxxf.exe 3388 tnbbhh.exe 3928 nhhbhh.exe -
resource yara_rule behavioral2/memory/2124-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4396-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3860-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2828-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2172-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/956-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5llfrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2124 wrote to memory of 3888 2124 3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe 83 PID 2124 wrote to memory of 3888 2124 3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe 83 PID 2124 wrote to memory of 3888 2124 3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe 83 PID 3888 wrote to memory of 3828 3888 lrrfrfl.exe 84 PID 3888 wrote to memory of 3828 3888 lrrfrfl.exe 84 PID 3888 wrote to memory of 3828 3888 lrrfrfl.exe 84 PID 3828 wrote to memory of 3860 3828 httnnn.exe 85 PID 3828 wrote to memory of 3860 3828 httnnn.exe 85 PID 3828 wrote to memory of 3860 3828 httnnn.exe 85 PID 3860 wrote to memory of 4508 3860 nhtnnn.exe 86 PID 3860 wrote to memory of 4508 3860 nhtnnn.exe 86 PID 3860 wrote to memory of 4508 3860 nhtnnn.exe 86 PID 4508 wrote to memory of 4396 4508 ppddd.exe 87 PID 4508 wrote to memory of 4396 4508 ppddd.exe 87 PID 4508 wrote to memory of 4396 4508 ppddd.exe 87 PID 4396 wrote to memory of 1480 4396 rxxxrrr.exe 88 PID 4396 wrote to memory of 1480 4396 rxxxrrr.exe 88 PID 4396 wrote to memory of 1480 4396 rxxxrrr.exe 88 PID 1480 wrote to memory of 1160 1480 lflfxrl.exe 89 PID 1480 wrote to memory of 1160 1480 lflfxrl.exe 89 PID 1480 wrote to memory of 1160 1480 lflfxrl.exe 89 PID 1160 wrote to memory of 4204 1160 bthhnn.exe 90 PID 1160 wrote to memory of 4204 1160 bthhnn.exe 90 PID 1160 wrote to memory of 4204 1160 bthhnn.exe 90 PID 4204 wrote to memory of 2600 4204 pvvvj.exe 91 PID 4204 wrote to memory of 2600 4204 pvvvj.exe 91 PID 4204 wrote to memory of 2600 4204 pvvvj.exe 91 PID 2600 wrote to memory of 3468 2600 3xfxrrl.exe 92 PID 2600 wrote to memory of 3468 2600 3xfxrrl.exe 92 PID 2600 wrote to memory of 3468 2600 3xfxrrl.exe 92 PID 3468 wrote to memory of 2828 3468 nnhhbb.exe 93 PID 3468 wrote to memory of 2828 3468 nnhhbb.exe 93 PID 3468 wrote to memory of 2828 3468 nnhhbb.exe 93 PID 2828 wrote to memory of 872 2828 hbbtth.exe 94 PID 2828 wrote to memory of 872 2828 hbbtth.exe 94 PID 2828 wrote to memory of 872 2828 hbbtth.exe 94 PID 872 wrote to memory of 4140 872 5jppd.exe 95 PID 872 wrote to memory of 4140 872 5jppd.exe 95 PID 872 wrote to memory of 4140 872 5jppd.exe 95 PID 4140 wrote to memory of 5068 4140 lrxxrrr.exe 96 PID 4140 wrote to memory of 5068 4140 lrxxrrr.exe 96 PID 4140 wrote to memory of 5068 4140 lrxxrrr.exe 96 PID 5068 wrote to memory of 2512 5068 bnttnt.exe 97 PID 5068 wrote to memory of 2512 5068 bnttnt.exe 97 PID 5068 wrote to memory of 2512 5068 bnttnt.exe 97 PID 2512 wrote to memory of 2592 2512 dvpvv.exe 98 PID 2512 wrote to memory of 2592 2512 dvpvv.exe 98 PID 2512 wrote to memory of 2592 2512 dvpvv.exe 98 PID 2592 wrote to memory of 60 2592 flrfrlx.exe 99 PID 2592 wrote to memory of 60 2592 flrfrlx.exe 99 PID 2592 wrote to memory of 60 2592 flrfrlx.exe 99 PID 60 wrote to memory of 4444 60 bnbtbt.exe 100 PID 60 wrote to memory of 4444 60 bnbtbt.exe 100 PID 60 wrote to memory of 4444 60 bnbtbt.exe 100 PID 4444 wrote to memory of 404 4444 5hbnbt.exe 101 PID 4444 wrote to memory of 404 4444 5hbnbt.exe 101 PID 4444 wrote to memory of 404 4444 5hbnbt.exe 101 PID 404 wrote to memory of 2812 404 jddpd.exe 102 PID 404 wrote to memory of 2812 404 jddpd.exe 102 PID 404 wrote to memory of 2812 404 jddpd.exe 102 PID 2812 wrote to memory of 2172 2812 xxrlrlf.exe 103 PID 2812 wrote to memory of 2172 2812 xxrlrlf.exe 103 PID 2812 wrote to memory of 2172 2812 xxrlrlf.exe 103 PID 2172 wrote to memory of 5116 2172 hbttbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe"C:\Users\Admin\AppData\Local\Temp\3e916277ce2cead7ba5d6c904646e89d28d5103e4c7e91b8a960ecd32bf2e829N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\lrrfrfl.exec:\lrrfrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\httnnn.exec:\httnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\nhtnnn.exec:\nhtnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\ppddd.exec:\ppddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\lflfxrl.exec:\lflfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\bthhnn.exec:\bthhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\pvvvj.exec:\pvvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nnhhbb.exec:\nnhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\hbbtth.exec:\hbbtth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\5jppd.exec:\5jppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\bnttnt.exec:\bnttnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\dvpvv.exec:\dvpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\flrfrlx.exec:\flrfrlx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\bnbtbt.exec:\bnbtbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\5hbnbt.exec:\5hbnbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\jddpd.exec:\jddpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\xxrlrlf.exec:\xxrlrlf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\hbttbb.exec:\hbttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hbbhnb.exec:\hbbhnb.exe23⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ppppp.exec:\ppppp.exe24⤵
- Executes dropped EXE
PID:2436 -
\??\c:\rxxlfrl.exec:\rxxlfrl.exe25⤵
- Executes dropped EXE
PID:1520 -
\??\c:\bntnbt.exec:\bntnbt.exe26⤵
- Executes dropped EXE
PID:64 -
\??\c:\djvdp.exec:\djvdp.exe27⤵
- Executes dropped EXE
PID:4644 -
\??\c:\lfflfxl.exec:\lfflfxl.exe28⤵
- Executes dropped EXE
PID:4720 -
\??\c:\lfrlfxl.exec:\lfrlfxl.exe29⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbnhhn.exec:\nbnhhn.exe30⤵
- Executes dropped EXE
PID:956 -
\??\c:\vppdp.exec:\vppdp.exe31⤵
- Executes dropped EXE
PID:4900 -
\??\c:\nbbntb.exec:\nbbntb.exe32⤵
- Executes dropped EXE
PID:3232 -
\??\c:\pjjdp.exec:\pjjdp.exe33⤵
- Executes dropped EXE
PID:3404 -
\??\c:\jddpd.exec:\jddpd.exe34⤵
- Executes dropped EXE
PID:2016 -
\??\c:\5lxrlrl.exec:\5lxrlrl.exe35⤵
- Executes dropped EXE
PID:1368 -
\??\c:\xlfrrlx.exec:\xlfrrlx.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3652 -
\??\c:\tbtnbb.exec:\tbtnbb.exe37⤵
- Executes dropped EXE
PID:4648 -
\??\c:\pdjvp.exec:\pdjvp.exe38⤵
- Executes dropped EXE
PID:868 -
\??\c:\1vdpv.exec:\1vdpv.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\9ddvj.exec:\9ddvj.exe40⤵
- Executes dropped EXE
PID:2408 -
\??\c:\fllxlfr.exec:\fllxlfr.exe41⤵
- Executes dropped EXE
PID:4516 -
\??\c:\fxxrrxr.exec:\fxxrrxr.exe42⤵
- Executes dropped EXE
PID:3968 -
\??\c:\nbthth.exec:\nbthth.exe43⤵
- Executes dropped EXE
PID:4484 -
\??\c:\pjvpd.exec:\pjvpd.exe44⤵
- Executes dropped EXE
PID:3888 -
\??\c:\jddpj.exec:\jddpj.exe45⤵
- Executes dropped EXE
PID:3048 -
\??\c:\flrfrfx.exec:\flrfrfx.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\rfrlxrf.exec:\rfrlxrf.exe47⤵
- Executes dropped EXE
PID:3860 -
\??\c:\hbnhbb.exec:\hbnhbb.exe48⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lrfrlxl.exec:\lrfrlxl.exe49⤵
- Executes dropped EXE
PID:1932 -
\??\c:\nnhntb.exec:\nnhntb.exe50⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nththt.exec:\nththt.exe51⤵
- Executes dropped EXE
PID:2944 -
\??\c:\vdvpj.exec:\vdvpj.exe52⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vjvpp.exec:\vjvpp.exe53⤵
- Executes dropped EXE
PID:552 -
\??\c:\fxrfxlf.exec:\fxrfxlf.exe54⤵
- Executes dropped EXE
PID:4180 -
\??\c:\5xxfrxr.exec:\5xxfrxr.exe55⤵
- Executes dropped EXE
PID:3776 -
\??\c:\1vpdv.exec:\1vpdv.exe56⤵
- Executes dropped EXE
PID:1192 -
\??\c:\1rxrllf.exec:\1rxrllf.exe57⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3468 -
\??\c:\lxrrllf.exec:\lxrrllf.exe58⤵
- Executes dropped EXE
PID:4628 -
\??\c:\9btnhh.exec:\9btnhh.exe59⤵
- Executes dropped EXE
PID:4044 -
\??\c:\dpvpd.exec:\dpvpd.exe60⤵
- Executes dropped EXE
PID:4752 -
\??\c:\jddvp.exec:\jddvp.exe61⤵
- Executes dropped EXE
PID:512 -
\??\c:\xffffff.exec:\xffffff.exe62⤵
- Executes dropped EXE
PID:5068 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe63⤵
- Executes dropped EXE
PID:1940 -
\??\c:\tnbbhh.exec:\tnbbhh.exe64⤵
- Executes dropped EXE
PID:3388 -
\??\c:\nhhbhh.exec:\nhhbhh.exe65⤵
- Executes dropped EXE
PID:3928 -
\??\c:\jvpdv.exec:\jvpdv.exe66⤵PID:60
-
\??\c:\7fxrllf.exec:\7fxrllf.exe67⤵PID:2564
-
\??\c:\frrlffx.exec:\frrlffx.exe68⤵PID:1740
-
\??\c:\bntbbh.exec:\bntbbh.exe69⤵PID:3084
-
\??\c:\bbhbtt.exec:\bbhbtt.exe70⤵PID:1664
-
\??\c:\3jjdp.exec:\3jjdp.exe71⤵PID:1168
-
\??\c:\pjdvv.exec:\pjdvv.exe72⤵PID:4120
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe73⤵PID:3040
-
\??\c:\lfrxxll.exec:\lfrxxll.exe74⤵PID:3640
-
\??\c:\3btbtb.exec:\3btbtb.exe75⤵PID:3608
-
\??\c:\bhnnbb.exec:\bhnnbb.exe76⤵PID:4252
-
\??\c:\pvdvp.exec:\pvdvp.exe77⤵PID:64
-
\??\c:\vjvvp.exec:\vjvvp.exe78⤵PID:924
-
\??\c:\jdjjd.exec:\jdjjd.exe79⤵PID:1544
-
\??\c:\fxrlrrf.exec:\fxrlrrf.exe80⤵PID:1408
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe81⤵PID:2296
-
\??\c:\tnhhbt.exec:\tnhhbt.exe82⤵PID:1524
-
\??\c:\hbbtnh.exec:\hbbtnh.exe83⤵PID:4012
-
\??\c:\vdpjj.exec:\vdpjj.exe84⤵PID:3160
-
\??\c:\lllxffr.exec:\lllxffr.exe85⤵PID:4980
-
\??\c:\rlrlfff.exec:\rlrlfff.exe86⤵PID:2196
-
\??\c:\hbbhhh.exec:\hbbhhh.exe87⤵PID:4808
-
\??\c:\jjjjd.exec:\jjjjd.exe88⤵PID:1928
-
\??\c:\jvpjd.exec:\jvpjd.exe89⤵PID:4620
-
\??\c:\lfflxfx.exec:\lfflxfx.exe90⤵PID:540
-
\??\c:\xllfrrl.exec:\xllfrrl.exe91⤵PID:5108
-
\??\c:\htthtn.exec:\htthtn.exe92⤵PID:3112
-
\??\c:\tbbbtt.exec:\tbbbtt.exe93⤵PID:3108
-
\??\c:\vpvpp.exec:\vpvpp.exe94⤵PID:976
-
\??\c:\jpvjd.exec:\jpvjd.exe95⤵PID:640
-
\??\c:\5xffxxx.exec:\5xffxxx.exe96⤵PID:3908
-
\??\c:\lrffffx.exec:\lrffffx.exe97⤵PID:4372
-
\??\c:\9tbhbh.exec:\9tbhbh.exe98⤵PID:4260
-
\??\c:\9bttht.exec:\9bttht.exe99⤵PID:4832
-
\??\c:\dvvvp.exec:\dvvvp.exe100⤵PID:2632
-
\??\c:\3ppjv.exec:\3ppjv.exe101⤵PID:2144
-
\??\c:\fxrlrlf.exec:\fxrlrlf.exe102⤵PID:4956
-
\??\c:\nttnhh.exec:\nttnhh.exe103⤵
- System Location Discovery: System Language Discovery
PID:2040 -
\??\c:\7ntnhn.exec:\7ntnhn.exe104⤵PID:2192
-
\??\c:\pjvdd.exec:\pjvdd.exe105⤵PID:3100
-
\??\c:\llxxlrf.exec:\llxxlrf.exe106⤵PID:3348
-
\??\c:\hbtbnh.exec:\hbtbnh.exe107⤵PID:1932
-
\??\c:\xfrxlfx.exec:\xfrxlfx.exe108⤵PID:4428
-
\??\c:\thhhhh.exec:\thhhhh.exe109⤵PID:4156
-
\??\c:\dvdvp.exec:\dvdvp.exe110⤵PID:1456
-
\??\c:\rxlfxrf.exec:\rxlfxrf.exe111⤵PID:4148
-
\??\c:\xlffxfx.exec:\xlffxfx.exe112⤵PID:4180
-
\??\c:\xxxxffl.exec:\xxxxffl.exe113⤵PID:3264
-
\??\c:\hnbbbb.exec:\hnbbbb.exe114⤵PID:2288
-
\??\c:\jvppv.exec:\jvppv.exe115⤵PID:4220
-
\??\c:\ddddd.exec:\ddddd.exe116⤵PID:2668
-
\??\c:\xrxxfxl.exec:\xrxxfxl.exe117⤵PID:4884
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe118⤵PID:4304
-
\??\c:\1nhtnh.exec:\1nhtnh.exe119⤵PID:3720
-
\??\c:\htnhbt.exec:\htnhbt.exe120⤵PID:1284
-
\??\c:\ppdvd.exec:\ppdvd.exe121⤵PID:4800
-
\??\c:\jvddj.exec:\jvddj.exe122⤵PID:4272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-