Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 05:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe
Resource
win7-20240729-en
windows7-x64
7 signatures
120 seconds
General
-
Target
edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe
-
Size
70KB
-
MD5
c1b30d8ffe3c0b578b19e19e5a677690
-
SHA1
0c9474d6b65b9fbe09d999abc03638cf876d558f
-
SHA256
edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077b
-
SHA512
979ea833491cb1d3d6f3436af3469eb7614191af345bc5a5edf930896f73a5934739191ec6a85efe3d5cdd18d1a189872e95962a6c29428d8dfc66c469eee673
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcN:ymb3NkkiQ3mdBjFIsIVcN
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2412-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-27-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4804 9jvpj.exe 4636 rrlrxlr.exe 4468 xrlffff.exe 1544 3tbbtb.exe 400 ddddd.exe 1416 llllllf.exe 1484 ttntbt.exe 4340 vpvdp.exe 5112 xxxxrrr.exe 4480 tthtbn.exe 3556 5dvpv.exe 4996 5vjdd.exe 3460 fxfxfxl.exe 4548 tnnthh.exe 2380 ppjdd.exe 1892 1jdvp.exe 3304 xfrrrrl.exe 1284 5bbbtn.exe 3740 ffllrlx.exe 2424 hhbthh.exe 636 rlxrllf.exe 3300 hhbttt.exe 4692 nhhtnh.exe 1392 9vppd.exe 1056 frllxxl.exe 64 bhbhbh.exe 3276 thnhtt.exe 1760 pppdd.exe 640 3ffxfxl.exe 4024 lrfrrfr.exe 2068 btnhtn.exe 2264 5vpdp.exe 2960 5llxlfr.exe 1696 9hnhnn.exe 1520 nbbttt.exe 3964 ppjpj.exe 1596 9fflrll.exe 4952 9tttnh.exe 3500 thnbhb.exe 2780 5dpdj.exe 3416 9vvpd.exe 1220 xlfxlfr.exe 2428 bhbhbt.exe 1600 ttnnnb.exe 4612 pdvjp.exe 2684 xxfxlll.exe 4144 7xrxrxl.exe 2584 hbhhnn.exe 4076 5dppj.exe 2412 1pjdv.exe 4556 1xrlxff.exe 4820 3bbnhh.exe 1048 9hbnnh.exe 2996 vvpjv.exe 2580 lflffff.exe 3652 xxrfrxl.exe 3804 nbbhhh.exe 3752 3thhbh.exe 2932 pjdvj.exe 2144 xlffrrf.exe 4504 httthb.exe 1632 tnnnhb.exe 224 jvvpv.exe 4764 3vjvd.exe -
resource yara_rule behavioral2/memory/2412-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3btthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7lfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnttbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 4804 2412 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 82 PID 2412 wrote to memory of 4804 2412 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 82 PID 2412 wrote to memory of 4804 2412 edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe 82 PID 4804 wrote to memory of 4636 4804 9jvpj.exe 83 PID 4804 wrote to memory of 4636 4804 9jvpj.exe 83 PID 4804 wrote to memory of 4636 4804 9jvpj.exe 83 PID 4636 wrote to memory of 4468 4636 rrlrxlr.exe 84 PID 4636 wrote to memory of 4468 4636 rrlrxlr.exe 84 PID 4636 wrote to memory of 4468 4636 rrlrxlr.exe 84 PID 4468 wrote to memory of 1544 4468 xrlffff.exe 85 PID 4468 wrote to memory of 1544 4468 xrlffff.exe 85 PID 4468 wrote to memory of 1544 4468 xrlffff.exe 85 PID 1544 wrote to memory of 400 1544 3tbbtb.exe 86 PID 1544 wrote to memory of 400 1544 3tbbtb.exe 86 PID 1544 wrote to memory of 400 1544 3tbbtb.exe 86 PID 400 wrote to memory of 1416 400 ddddd.exe 87 PID 400 wrote to memory of 1416 400 ddddd.exe 87 PID 400 wrote to memory of 1416 400 ddddd.exe 87 PID 1416 wrote to memory of 1484 1416 llllllf.exe 88 PID 1416 wrote to memory of 1484 1416 llllllf.exe 88 PID 1416 wrote to memory of 1484 1416 llllllf.exe 88 PID 1484 wrote to memory of 4340 1484 ttntbt.exe 89 PID 1484 wrote to memory of 4340 1484 ttntbt.exe 89 PID 1484 wrote to memory of 4340 1484 ttntbt.exe 89 PID 4340 wrote to memory of 5112 4340 vpvdp.exe 90 PID 4340 wrote to memory of 5112 4340 vpvdp.exe 90 PID 4340 wrote to memory of 5112 4340 vpvdp.exe 90 PID 5112 wrote to memory of 4480 5112 xxxxrrr.exe 91 PID 5112 wrote to memory of 4480 5112 xxxxrrr.exe 91 PID 5112 wrote to memory of 4480 5112 xxxxrrr.exe 91 PID 4480 wrote to memory of 3556 4480 tthtbn.exe 92 PID 4480 wrote to memory of 3556 4480 tthtbn.exe 92 PID 4480 wrote to memory of 3556 4480 tthtbn.exe 92 PID 3556 wrote to memory of 4996 3556 5dvpv.exe 93 PID 3556 wrote to memory of 4996 3556 5dvpv.exe 93 PID 3556 wrote to memory of 4996 3556 5dvpv.exe 93 PID 4996 wrote to memory of 3460 4996 5vjdd.exe 94 PID 4996 wrote to memory of 3460 4996 5vjdd.exe 94 PID 4996 wrote to memory of 3460 4996 5vjdd.exe 94 PID 3460 wrote to memory of 4548 3460 fxfxfxl.exe 95 PID 3460 wrote to memory of 4548 3460 fxfxfxl.exe 95 PID 3460 wrote to memory of 4548 3460 fxfxfxl.exe 95 PID 4548 wrote to memory of 2380 4548 tnnthh.exe 96 PID 4548 wrote to memory of 2380 4548 tnnthh.exe 96 PID 4548 wrote to memory of 2380 4548 tnnthh.exe 96 PID 2380 wrote to memory of 1892 2380 ppjdd.exe 97 PID 2380 wrote to memory of 1892 2380 ppjdd.exe 97 PID 2380 wrote to memory of 1892 2380 ppjdd.exe 97 PID 1892 wrote to memory of 3304 1892 1jdvp.exe 98 PID 1892 wrote to memory of 3304 1892 1jdvp.exe 98 PID 1892 wrote to memory of 3304 1892 1jdvp.exe 98 PID 3304 wrote to memory of 1284 3304 xfrrrrl.exe 99 PID 3304 wrote to memory of 1284 3304 xfrrrrl.exe 99 PID 3304 wrote to memory of 1284 3304 xfrrrrl.exe 99 PID 1284 wrote to memory of 3740 1284 5bbbtn.exe 100 PID 1284 wrote to memory of 3740 1284 5bbbtn.exe 100 PID 1284 wrote to memory of 3740 1284 5bbbtn.exe 100 PID 3740 wrote to memory of 2424 3740 ffllrlx.exe 101 PID 3740 wrote to memory of 2424 3740 ffllrlx.exe 101 PID 3740 wrote to memory of 2424 3740 ffllrlx.exe 101 PID 2424 wrote to memory of 636 2424 hhbthh.exe 102 PID 2424 wrote to memory of 636 2424 hhbthh.exe 102 PID 2424 wrote to memory of 636 2424 hhbthh.exe 102 PID 636 wrote to memory of 3300 636 rlxrllf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe"C:\Users\Admin\AppData\Local\Temp\edf178def828a4835bcaadc5dd4006c6502f770c0948c5c22f2bf1eb35a5077bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\9jvpj.exec:\9jvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\rrlrxlr.exec:\rrlrxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\xrlffff.exec:\xrlffff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\3tbbtb.exec:\3tbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\ddddd.exec:\ddddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\llllllf.exec:\llllllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1416 -
\??\c:\ttntbt.exec:\ttntbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vpvdp.exec:\vpvdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\tthtbn.exec:\tthtbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\5dvpv.exec:\5dvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\5vjdd.exec:\5vjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\fxfxfxl.exec:\fxfxfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\tnnthh.exec:\tnnthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\ppjdd.exec:\ppjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\1jdvp.exec:\1jdvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\5bbbtn.exec:\5bbbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\ffllrlx.exec:\ffllrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\hhbthh.exec:\hhbthh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\rlxrllf.exec:\rlxrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\hhbttt.exec:\hhbttt.exe23⤵
- Executes dropped EXE
PID:3300 -
\??\c:\nhhtnh.exec:\nhhtnh.exe24⤵
- Executes dropped EXE
PID:4692 -
\??\c:\9vppd.exec:\9vppd.exe25⤵
- Executes dropped EXE
PID:1392 -
\??\c:\frllxxl.exec:\frllxxl.exe26⤵
- Executes dropped EXE
PID:1056 -
\??\c:\bhbhbh.exec:\bhbhbh.exe27⤵
- Executes dropped EXE
PID:64 -
\??\c:\thnhtt.exec:\thnhtt.exe28⤵
- Executes dropped EXE
PID:3276 -
\??\c:\pppdd.exec:\pppdd.exe29⤵
- Executes dropped EXE
PID:1760 -
\??\c:\3ffxfxl.exec:\3ffxfxl.exe30⤵
- Executes dropped EXE
PID:640 -
\??\c:\lrfrrfr.exec:\lrfrrfr.exe31⤵
- Executes dropped EXE
PID:4024 -
\??\c:\btnhtn.exec:\btnhtn.exe32⤵
- Executes dropped EXE
PID:2068 -
\??\c:\5vpdp.exec:\5vpdp.exe33⤵
- Executes dropped EXE
PID:2264 -
\??\c:\5llxlfr.exec:\5llxlfr.exe34⤵
- Executes dropped EXE
PID:2960 -
\??\c:\9hnhnn.exec:\9hnhnn.exe35⤵
- Executes dropped EXE
PID:1696 -
\??\c:\nbbttt.exec:\nbbttt.exe36⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ppjpj.exec:\ppjpj.exe37⤵
- Executes dropped EXE
PID:3964 -
\??\c:\9fflrll.exec:\9fflrll.exe38⤵
- Executes dropped EXE
PID:1596 -
\??\c:\9tttnh.exec:\9tttnh.exe39⤵
- Executes dropped EXE
PID:4952 -
\??\c:\thnbhb.exec:\thnbhb.exe40⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5dpdj.exec:\5dpdj.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\9vvpd.exec:\9vvpd.exe42⤵
- Executes dropped EXE
PID:3416 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe43⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bhbhbt.exec:\bhbhbt.exe44⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ttnnnb.exec:\ttnnnb.exe45⤵
- Executes dropped EXE
PID:1600 -
\??\c:\pdvjp.exec:\pdvjp.exe46⤵
- Executes dropped EXE
PID:4612 -
\??\c:\xxfxlll.exec:\xxfxlll.exe47⤵
- Executes dropped EXE
PID:2684 -
\??\c:\7xrxrxl.exec:\7xrxrxl.exe48⤵
- Executes dropped EXE
PID:4144 -
\??\c:\hbhhnn.exec:\hbhhnn.exe49⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5dppj.exec:\5dppj.exe50⤵
- Executes dropped EXE
PID:4076 -
\??\c:\1pjdv.exec:\1pjdv.exe51⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1xrlxff.exec:\1xrlxff.exe52⤵
- Executes dropped EXE
PID:4556 -
\??\c:\3bbnhh.exec:\3bbnhh.exe53⤵
- Executes dropped EXE
PID:4820 -
\??\c:\9hbnnh.exec:\9hbnnh.exe54⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vvpjv.exec:\vvpjv.exe55⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lflffff.exec:\lflffff.exe56⤵
- Executes dropped EXE
PID:2580 -
\??\c:\xxrfrxl.exec:\xxrfrxl.exe57⤵
- Executes dropped EXE
PID:3652 -
\??\c:\nbbhhh.exec:\nbbhhh.exe58⤵
- Executes dropped EXE
PID:3804 -
\??\c:\3thhbh.exec:\3thhbh.exe59⤵
- Executes dropped EXE
PID:3752 -
\??\c:\pjdvj.exec:\pjdvj.exe60⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xlffrrf.exec:\xlffrrf.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\httthb.exec:\httthb.exe62⤵
- Executes dropped EXE
PID:4504 -
\??\c:\tnnnhb.exec:\tnnnhb.exe63⤵
- Executes dropped EXE
PID:1632 -
\??\c:\jvvpv.exec:\jvvpv.exe64⤵
- Executes dropped EXE
PID:224 -
\??\c:\3vjvd.exec:\3vjvd.exe65⤵
- Executes dropped EXE
PID:4764 -
\??\c:\frlfrrf.exec:\frlfrrf.exe66⤵PID:940
-
\??\c:\nhnhbb.exec:\nhnhbb.exe67⤵PID:3664
-
\??\c:\hnbttt.exec:\hnbttt.exe68⤵PID:2276
-
\??\c:\vppdp.exec:\vppdp.exe69⤵PID:220
-
\??\c:\vjvjp.exec:\vjvjp.exe70⤵PID:1992
-
\??\c:\lrlxllx.exec:\lrlxllx.exe71⤵PID:1672
-
\??\c:\dppjj.exec:\dppjj.exe72⤵PID:376
-
\??\c:\lrllfxr.exec:\lrllfxr.exe73⤵PID:4316
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe74⤵PID:2628
-
\??\c:\tttnbn.exec:\tttnbn.exe75⤵PID:8
-
\??\c:\djjjd.exec:\djjjd.exe76⤵PID:4528
-
\??\c:\vdjpd.exec:\vdjpd.exe77⤵PID:712
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe78⤵PID:2076
-
\??\c:\bbbttt.exec:\bbbttt.exe79⤵PID:1692
-
\??\c:\htbtnn.exec:\htbtnn.exe80⤵PID:4332
-
\??\c:\9jpjj.exec:\9jpjj.exe81⤵PID:4844
-
\??\c:\xrrrllf.exec:\xrrrllf.exe82⤵PID:1260
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe83⤵PID:2176
-
\??\c:\3nnbtb.exec:\3nnbtb.exe84⤵PID:4700
-
\??\c:\pjjjd.exec:\pjjjd.exe85⤵PID:3944
-
\??\c:\9jjdj.exec:\9jjdj.exe86⤵
- System Location Discovery: System Language Discovery
PID:1476 -
\??\c:\1lrflfx.exec:\1lrflfx.exe87⤵PID:1908
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe88⤵PID:4936
-
\??\c:\thhbtt.exec:\thhbtt.exe89⤵PID:1852
-
\??\c:\hhhhnt.exec:\hhhhnt.exe90⤵PID:5048
-
\??\c:\3pjdp.exec:\3pjdp.exe91⤵PID:1616
-
\??\c:\lrrlfff.exec:\lrrlfff.exe92⤵PID:3720
-
\??\c:\lfllrrl.exec:\lfllrrl.exe93⤵PID:3656
-
\??\c:\3tntnn.exec:\3tntnn.exe94⤵PID:3640
-
\??\c:\dpjpd.exec:\dpjpd.exe95⤵PID:4872
-
\??\c:\pdpjp.exec:\pdpjp.exe96⤵PID:1696
-
\??\c:\1ffllxr.exec:\1ffllxr.exe97⤵PID:1384
-
\??\c:\xlrfrxl.exec:\xlrfrxl.exe98⤵PID:2012
-
\??\c:\nbtttb.exec:\nbtttb.exe99⤵PID:2884
-
\??\c:\pdppd.exec:\pdppd.exe100⤵PID:4952
-
\??\c:\pvpjv.exec:\pvpjv.exe101⤵PID:3500
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe102⤵PID:3312
-
\??\c:\lrxrfxx.exec:\lrxrfxx.exe103⤵PID:4728
-
\??\c:\ntthtn.exec:\ntthtn.exe104⤵PID:1220
-
\??\c:\9nhtht.exec:\9nhtht.exe105⤵PID:3580
-
\??\c:\vjjvj.exec:\vjjvj.exe106⤵PID:1600
-
\??\c:\vjvjv.exec:\vjvjv.exe107⤵PID:2660
-
\??\c:\1xlrrll.exec:\1xlrrll.exe108⤵PID:4460
-
\??\c:\rrxrlll.exec:\rrxrlll.exe109⤵PID:5044
-
\??\c:\hhnnhh.exec:\hhnnhh.exe110⤵PID:1836
-
\??\c:\3nbthh.exec:\3nbthh.exe111⤵PID:2876
-
\??\c:\pjddp.exec:\pjddp.exe112⤵PID:3728
-
\??\c:\flrlfxf.exec:\flrlfxf.exe113⤵PID:4688
-
\??\c:\rrrfrlf.exec:\rrrfrlf.exe114⤵PID:5040
-
\??\c:\htbnhb.exec:\htbnhb.exe115⤵PID:1544
-
\??\c:\7vvjv.exec:\7vvjv.exe116⤵PID:2996
-
\??\c:\pddvv.exec:\pddvv.exe117⤵PID:1648
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe118⤵PID:4136
-
\??\c:\pdddv.exec:\pdddv.exe119⤵PID:3804
-
\??\c:\xxrflfr.exec:\xxrflfr.exe120⤵PID:1960
-
\??\c:\5xrrllx.exec:\5xrrllx.exe121⤵PID:2400
-
\??\c:\thtthn.exec:\thtthn.exe122⤵PID:620
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-