Analysis
-
max time kernel
91s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 05:43
Static task
static1
Behavioral task
behavioral1
Sample
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe
Resource
win7-20240903-en
General
-
Target
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe
-
Size
82KB
-
MD5
7b9f0a7b90de77b4940357127d5be098
-
SHA1
95c14897730771404ce4afe3748ff5ac5341fb61
-
SHA256
354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c
-
SHA512
a4d1e321aa4caedda459290e7ed690c45db5bd141bf565732a70231ec5669fd6ee6a2d64c13e2bc9d89b3886d5472ab244767180424610fe709c4781fd8d4548
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqB:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rJ
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2784-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4392-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4508 rffxrlf.exe 2936 xllffff.exe 3880 5nnhhh.exe 912 dvddj.exe 4884 3vjjd.exe 224 xxxrrxl.exe 3952 hnbbtn.exe 3536 jvvpp.exe 4212 fxxrllf.exe 1684 7tnhbb.exe 1572 3jjdv.exe 4800 fffxrrl.exe 1932 lrxrxrl.exe 2140 bhnhbt.exe 4720 fxllrlr.exe 1372 rlrfxrr.exe 2520 hbnnnn.exe 2420 pjdvp.exe 5108 rffxrrl.exe 4804 xxrrllf.exe 2356 bttnnn.exe 1396 ddjdd.exe 4392 djjpj.exe 680 fxrlxlf.exe 852 nbbbbh.exe 4976 tnbtnh.exe 3164 jdjjp.exe 3216 ttttnn.exe 4236 nhbbbb.exe 2944 5dpjj.exe 2200 lxrrflf.exe 1644 fxxrrrr.exe 2304 hhhbbb.exe 2940 btnhnn.exe 952 djvvv.exe 2288 dpvpp.exe 4592 1fllllr.exe 4808 rxxrlxl.exe 2968 1pvpp.exe 2320 vjvjd.exe 624 hnnhbt.exe 3960 thhbtt.exe 3188 vvddv.exe 2804 fxrlffx.exe 4380 bbbbtt.exe 4712 tnnhbt.exe 2060 jpvvp.exe 3364 rlxrfff.exe 3676 ttbbtb.exe 5076 jvdvp.exe 4852 flrlllf.exe 5008 jddjd.exe 912 9frrflf.exe 2856 httntt.exe 1384 xlrrlfx.exe 660 nhnhnn.exe 3180 vpjjv.exe 224 dvppp.exe 4016 7rrlxxx.exe 1808 fxfffxx.exe 2576 hhnnhh.exe 4528 nbttnn.exe 1556 jvvjj.exe 2800 rlfxxxr.exe -
resource yara_rule behavioral2/memory/2784-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4392-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlxfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2784 wrote to memory of 4508 2784 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 83 PID 2784 wrote to memory of 4508 2784 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 83 PID 2784 wrote to memory of 4508 2784 354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe 83 PID 4508 wrote to memory of 2936 4508 rffxrlf.exe 84 PID 4508 wrote to memory of 2936 4508 rffxrlf.exe 84 PID 4508 wrote to memory of 2936 4508 rffxrlf.exe 84 PID 2936 wrote to memory of 3880 2936 xllffff.exe 85 PID 2936 wrote to memory of 3880 2936 xllffff.exe 85 PID 2936 wrote to memory of 3880 2936 xllffff.exe 85 PID 3880 wrote to memory of 912 3880 5nnhhh.exe 86 PID 3880 wrote to memory of 912 3880 5nnhhh.exe 86 PID 3880 wrote to memory of 912 3880 5nnhhh.exe 86 PID 912 wrote to memory of 4884 912 dvddj.exe 87 PID 912 wrote to memory of 4884 912 dvddj.exe 87 PID 912 wrote to memory of 4884 912 dvddj.exe 87 PID 4884 wrote to memory of 224 4884 3vjjd.exe 88 PID 4884 wrote to memory of 224 4884 3vjjd.exe 88 PID 4884 wrote to memory of 224 4884 3vjjd.exe 88 PID 224 wrote to memory of 3952 224 xxxrrxl.exe 89 PID 224 wrote to memory of 3952 224 xxxrrxl.exe 89 PID 224 wrote to memory of 3952 224 xxxrrxl.exe 89 PID 3952 wrote to memory of 3536 3952 hnbbtn.exe 90 PID 3952 wrote to memory of 3536 3952 hnbbtn.exe 90 PID 3952 wrote to memory of 3536 3952 hnbbtn.exe 90 PID 3536 wrote to memory of 4212 3536 jvvpp.exe 91 PID 3536 wrote to memory of 4212 3536 jvvpp.exe 91 PID 3536 wrote to memory of 4212 3536 jvvpp.exe 91 PID 4212 wrote to memory of 1684 4212 fxxrllf.exe 92 PID 4212 wrote to memory of 1684 4212 fxxrllf.exe 92 PID 4212 wrote to memory of 1684 4212 fxxrllf.exe 92 PID 1684 wrote to memory of 1572 1684 7tnhbb.exe 93 PID 1684 wrote to memory of 1572 1684 7tnhbb.exe 93 PID 1684 wrote to memory of 1572 1684 7tnhbb.exe 93 PID 1572 wrote to memory of 4800 1572 3jjdv.exe 94 PID 1572 wrote to memory of 4800 1572 3jjdv.exe 94 PID 1572 wrote to memory of 4800 1572 3jjdv.exe 94 PID 4800 wrote to memory of 1932 4800 fffxrrl.exe 95 PID 4800 wrote to memory of 1932 4800 fffxrrl.exe 95 PID 4800 wrote to memory of 1932 4800 fffxrrl.exe 95 PID 1932 wrote to memory of 2140 1932 lrxrxrl.exe 96 PID 1932 wrote to memory of 2140 1932 lrxrxrl.exe 96 PID 1932 wrote to memory of 2140 1932 lrxrxrl.exe 96 PID 2140 wrote to memory of 4720 2140 bhnhbt.exe 97 PID 2140 wrote to memory of 4720 2140 bhnhbt.exe 97 PID 2140 wrote to memory of 4720 2140 bhnhbt.exe 97 PID 4720 wrote to memory of 1372 4720 fxllrlr.exe 98 PID 4720 wrote to memory of 1372 4720 fxllrlr.exe 98 PID 4720 wrote to memory of 1372 4720 fxllrlr.exe 98 PID 1372 wrote to memory of 2520 1372 rlrfxrr.exe 99 PID 1372 wrote to memory of 2520 1372 rlrfxrr.exe 99 PID 1372 wrote to memory of 2520 1372 rlrfxrr.exe 99 PID 2520 wrote to memory of 2420 2520 hbnnnn.exe 100 PID 2520 wrote to memory of 2420 2520 hbnnnn.exe 100 PID 2520 wrote to memory of 2420 2520 hbnnnn.exe 100 PID 2420 wrote to memory of 5108 2420 pjdvp.exe 101 PID 2420 wrote to memory of 5108 2420 pjdvp.exe 101 PID 2420 wrote to memory of 5108 2420 pjdvp.exe 101 PID 5108 wrote to memory of 4804 5108 rffxrrl.exe 102 PID 5108 wrote to memory of 4804 5108 rffxrrl.exe 102 PID 5108 wrote to memory of 4804 5108 rffxrrl.exe 102 PID 4804 wrote to memory of 2356 4804 xxrrllf.exe 103 PID 4804 wrote to memory of 2356 4804 xxrrllf.exe 103 PID 4804 wrote to memory of 2356 4804 xxrrllf.exe 103 PID 2356 wrote to memory of 1396 2356 bttnnn.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe"C:\Users\Admin\AppData\Local\Temp\354031771af37f4cfe7d31435341e5c8e420f1479edb343476681c4c82029e4c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\rffxrlf.exec:\rffxrlf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\xllffff.exec:\xllffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\5nnhhh.exec:\5nnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\dvddj.exec:\dvddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\3vjjd.exec:\3vjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\xxxrrxl.exec:\xxxrrxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\hnbbtn.exec:\hnbbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\jvvpp.exec:\jvvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\fxxrllf.exec:\fxxrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\7tnhbb.exec:\7tnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\3jjdv.exec:\3jjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\fffxrrl.exec:\fffxrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\lrxrxrl.exec:\lrxrxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\bhnhbt.exec:\bhnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\fxllrlr.exec:\fxllrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\rlrfxrr.exec:\rlrfxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\hbnnnn.exec:\hbnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pjdvp.exec:\pjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\rffxrrl.exec:\rffxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\xxrrllf.exec:\xxrrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\bttnnn.exec:\bttnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\ddjdd.exec:\ddjdd.exe23⤵
- Executes dropped EXE
PID:1396 -
\??\c:\djjpj.exec:\djjpj.exe24⤵
- Executes dropped EXE
PID:4392 -
\??\c:\fxrlxlf.exec:\fxrlxlf.exe25⤵
- Executes dropped EXE
PID:680 -
\??\c:\nbbbbh.exec:\nbbbbh.exe26⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnbtnh.exec:\tnbtnh.exe27⤵
- Executes dropped EXE
PID:4976 -
\??\c:\jdjjp.exec:\jdjjp.exe28⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ttttnn.exec:\ttttnn.exe29⤵
- Executes dropped EXE
PID:3216 -
\??\c:\nhbbbb.exec:\nhbbbb.exe30⤵
- Executes dropped EXE
PID:4236 -
\??\c:\5dpjj.exec:\5dpjj.exe31⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lxrrflf.exec:\lxrrflf.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe33⤵
- Executes dropped EXE
PID:1644 -
\??\c:\hhhbbb.exec:\hhhbbb.exe34⤵
- Executes dropped EXE
PID:2304 -
\??\c:\btnhnn.exec:\btnhnn.exe35⤵
- Executes dropped EXE
PID:2940 -
\??\c:\djvvv.exec:\djvvv.exe36⤵
- Executes dropped EXE
PID:952 -
\??\c:\dpvpp.exec:\dpvpp.exe37⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1fllllr.exec:\1fllllr.exe38⤵
- Executes dropped EXE
PID:4592 -
\??\c:\rxxrlxl.exec:\rxxrlxl.exe39⤵
- Executes dropped EXE
PID:4808 -
\??\c:\1pvpp.exec:\1pvpp.exe40⤵
- Executes dropped EXE
PID:2968 -
\??\c:\vjvjd.exec:\vjvjd.exe41⤵
- Executes dropped EXE
PID:2320 -
\??\c:\hnnhbt.exec:\hnnhbt.exe42⤵
- Executes dropped EXE
PID:624 -
\??\c:\thhbtt.exec:\thhbtt.exe43⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vvddv.exec:\vvddv.exe44⤵
- Executes dropped EXE
PID:3188 -
\??\c:\fxrlffx.exec:\fxrlffx.exe45⤵
- Executes dropped EXE
PID:2804 -
\??\c:\bbbbtt.exec:\bbbbtt.exe46⤵
- Executes dropped EXE
PID:4380 -
\??\c:\tnnhbt.exec:\tnnhbt.exe47⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jpvvp.exec:\jpvvp.exe48⤵
- Executes dropped EXE
PID:2060 -
\??\c:\rlxrfff.exec:\rlxrfff.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3364 -
\??\c:\ttbbtb.exec:\ttbbtb.exe50⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jvdvp.exec:\jvdvp.exe51⤵
- Executes dropped EXE
PID:5076 -
\??\c:\flrlllf.exec:\flrlllf.exe52⤵
- Executes dropped EXE
PID:4852 -
\??\c:\jddjd.exec:\jddjd.exe53⤵
- Executes dropped EXE
PID:5008 -
\??\c:\9frrflf.exec:\9frrflf.exe54⤵
- Executes dropped EXE
PID:912 -
\??\c:\httntt.exec:\httntt.exe55⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xlrrlfx.exec:\xlrrlfx.exe56⤵
- Executes dropped EXE
PID:1384 -
\??\c:\nhnhnn.exec:\nhnhnn.exe57⤵
- Executes dropped EXE
PID:660 -
\??\c:\vpjjv.exec:\vpjjv.exe58⤵
- Executes dropped EXE
PID:3180 -
\??\c:\dvppp.exec:\dvppp.exe59⤵
- Executes dropped EXE
PID:224 -
\??\c:\7rrlxxx.exec:\7rrlxxx.exe60⤵
- Executes dropped EXE
PID:4016 -
\??\c:\fxfffxx.exec:\fxfffxx.exe61⤵
- Executes dropped EXE
PID:1808 -
\??\c:\hhnnhh.exec:\hhnnhh.exe62⤵
- Executes dropped EXE
PID:2576 -
\??\c:\nbttnn.exec:\nbttnn.exe63⤵
- Executes dropped EXE
PID:4528 -
\??\c:\jvvjj.exec:\jvvjj.exe64⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe65⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frfxrll.exec:\frfxrll.exe66⤵PID:1376
-
\??\c:\htbttb.exec:\htbttb.exe67⤵PID:2168
-
\??\c:\bnnhnh.exec:\bnnhnh.exe68⤵PID:3648
-
\??\c:\ddjjp.exec:\ddjjp.exe69⤵PID:1008
-
\??\c:\xrrlffl.exec:\xrrlffl.exe70⤵PID:1332
-
\??\c:\rlxxrll.exec:\rlxxrll.exe71⤵PID:2780
-
\??\c:\bthhnh.exec:\bthhnh.exe72⤵PID:5012
-
\??\c:\thntnt.exec:\thntnt.exe73⤵PID:3004
-
\??\c:\pddpp.exec:\pddpp.exe74⤵PID:2796
-
\??\c:\jvvpp.exec:\jvvpp.exe75⤵PID:4684
-
\??\c:\fxlfxxr.exec:\fxlfxxr.exe76⤵PID:5108
-
\??\c:\xxxrllf.exec:\xxxrllf.exe77⤵PID:4804
-
\??\c:\ddjdv.exec:\ddjdv.exe78⤵PID:1408
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe79⤵PID:1820
-
\??\c:\xfllffx.exec:\xfllffx.exe80⤵PID:368
-
\??\c:\7tnhbt.exec:\7tnhbt.exe81⤵PID:2536
-
\??\c:\dpvpj.exec:\dpvpj.exe82⤵PID:3572
-
\??\c:\7dppj.exec:\7dppj.exe83⤵PID:3120
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe84⤵PID:852
-
\??\c:\tnntnn.exec:\tnntnn.exe85⤵PID:4976
-
\??\c:\nbhbtt.exec:\nbhbtt.exe86⤵PID:3164
-
\??\c:\9ddvj.exec:\9ddvj.exe87⤵PID:1488
-
\??\c:\jjdpv.exec:\jjdpv.exe88⤵PID:1404
-
\??\c:\rlrxlfx.exec:\rlrxlfx.exe89⤵
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\xlrlxxr.exec:\xlrlxxr.exe90⤵PID:3112
-
\??\c:\7nhhhb.exec:\7nhhhb.exe91⤵PID:1640
-
\??\c:\dpvpp.exec:\dpvpp.exe92⤵PID:1644
-
\??\c:\5dvpd.exec:\5dvpd.exe93⤵PID:2004
-
\??\c:\9lfxlfx.exec:\9lfxlfx.exe94⤵PID:1776
-
\??\c:\httnhh.exec:\httnhh.exe95⤵PID:4112
-
\??\c:\bhbbtn.exec:\bhbbtn.exe96⤵PID:3892
-
\??\c:\ppvjv.exec:\ppvjv.exe97⤵
- System Location Discovery: System Language Discovery
PID:3448 -
\??\c:\dpjdp.exec:\dpjdp.exe98⤵PID:2500
-
\??\c:\rfffxrr.exec:\rfffxrr.exe99⤵PID:1964
-
\??\c:\fxlxfxr.exec:\fxlxfxr.exe100⤵
- System Location Discovery: System Language Discovery
PID:4596 -
\??\c:\bttthh.exec:\bttthh.exe101⤵PID:2176
-
\??\c:\1jdvj.exec:\1jdvj.exe102⤵PID:2188
-
\??\c:\dvdpd.exec:\dvdpd.exe103⤵PID:1348
-
\??\c:\xrxllrr.exec:\xrxllrr.exe104⤵PID:1580
-
\??\c:\tbbtnn.exec:\tbbtnn.exe105⤵PID:4744
-
\??\c:\nhhhtn.exec:\nhhhtn.exe106⤵PID:4676
-
\??\c:\djjvp.exec:\djjvp.exe107⤵PID:452
-
\??\c:\dpdvj.exec:\dpdvj.exe108⤵PID:3852
-
\??\c:\rffrllf.exec:\rffrllf.exe109⤵PID:3588
-
\??\c:\tnhbbt.exec:\tnhbbt.exe110⤵PID:3520
-
\??\c:\nhbtnn.exec:\nhbtnn.exe111⤵PID:4852
-
\??\c:\vdjdp.exec:\vdjdp.exe112⤵PID:3016
-
\??\c:\jvvpj.exec:\jvvpj.exe113⤵PID:2148
-
\??\c:\frrrfrl.exec:\frrrfrl.exe114⤵PID:3736
-
\??\c:\thnnhb.exec:\thnnhb.exe115⤵PID:1192
-
\??\c:\5tthbt.exec:\5tthbt.exe116⤵PID:660
-
\??\c:\dvddv.exec:\dvddv.exe117⤵PID:2088
-
\??\c:\5jdvj.exec:\5jdvj.exe118⤵PID:224
-
\??\c:\xflfxxx.exec:\xflfxxx.exe119⤵PID:4016
-
\??\c:\xrrlffx.exec:\xrrlffx.exe120⤵PID:1416
-
\??\c:\tbnhhn.exec:\tbnhhn.exe121⤵PID:2380
-
\??\c:\htnhtt.exec:\htnhtt.exe122⤵PID:1876
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-