Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe
-
Size
53KB
-
MD5
864bf3fac5dde4189a2ec07d7f651cc5
-
SHA1
23d2923fc8be4ae09ccbc158112fbe5c57b6bafb
-
SHA256
7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b
-
SHA512
1b74a2052d9f37771b672ec064b383742abf0b110b17ab1bf023d4444ba1bedc23dc9777e532d6b81bb8886be412fcc90a7dafe73b355a8c6670151a82126bdc
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlm:0cdpeeBSHHMHLf9RyIB
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4476-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1080-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/584-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-309-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-328-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-341-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-345-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-349-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-369-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-425-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-435-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-463-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-503-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-522-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-529-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-563-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-666-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-673-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-744-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/544-759-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-781-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-792-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-838-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-1076-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-1116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-1120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 404 pvvpj.exe 2244 fflfrlx.exe 448 nbtnbb.exe 4536 vvdvj.exe 1200 fxrlxxr.exe 1228 bttnbb.exe 3612 vjvpd.exe 2664 lrrlfxr.exe 4796 5bbtnh.exe 4976 htnhtn.exe 3700 3jvpd.exe 1440 pjdvj.exe 1476 rfxlrff.exe 1652 lllxlfx.exe 3144 nnhhhn.exe 2976 jdpjv.exe 4480 9jjvj.exe 4692 7lfrlxr.exe 4568 rrlfxrr.exe 2716 bthhbt.exe 3692 5thbnh.exe 5056 5ddvp.exe 1080 rffxffx.exe 4956 btnbtt.exe 2336 jjjdd.exe 4704 7jjdp.exe 3136 rxrxffr.exe 824 fxxlrlx.exe 2128 bbbtnh.exe 4984 1djpd.exe 3696 rrlxlfl.exe 1248 bnnhtt.exe 4420 5ddvj.exe 3908 jddpd.exe 2196 xlxlfxr.exe 584 9lfrfxr.exe 2680 tbtnbt.exe 4700 vddvd.exe 3504 vvpdv.exe 3460 rlxxrxf.exe 2412 httbnh.exe 1868 hbthtn.exe 4732 1djdd.exe 4428 lxffxfx.exe 3776 lxxlxlf.exe 3044 ttnhnn.exe 960 dpjdp.exe 4740 jdvpd.exe 4776 llxrrxx.exe 1160 xfllrll.exe 1000 3tbbtt.exe 1200 pjpjv.exe 1860 jppvv.exe 4236 rlfxlfx.exe 3476 fxlrxrr.exe 2424 ttnhtt.exe 536 jpvjd.exe 4796 9xxrlll.exe 1964 rlrlrrx.exe 2028 3btthh.exe 3260 ttnhnh.exe 944 1dvjv.exe 1632 xlxlrlf.exe 896 bnnnhb.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9fxrxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4476 wrote to memory of 404 4476 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 83 PID 4476 wrote to memory of 404 4476 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 83 PID 4476 wrote to memory of 404 4476 7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe 83 PID 404 wrote to memory of 2244 404 pvvpj.exe 84 PID 404 wrote to memory of 2244 404 pvvpj.exe 84 PID 404 wrote to memory of 2244 404 pvvpj.exe 84 PID 2244 wrote to memory of 448 2244 fflfrlx.exe 85 PID 2244 wrote to memory of 448 2244 fflfrlx.exe 85 PID 2244 wrote to memory of 448 2244 fflfrlx.exe 85 PID 448 wrote to memory of 4536 448 nbtnbb.exe 86 PID 448 wrote to memory of 4536 448 nbtnbb.exe 86 PID 448 wrote to memory of 4536 448 nbtnbb.exe 86 PID 4536 wrote to memory of 1200 4536 vvdvj.exe 87 PID 4536 wrote to memory of 1200 4536 vvdvj.exe 87 PID 4536 wrote to memory of 1200 4536 vvdvj.exe 87 PID 1200 wrote to memory of 1228 1200 fxrlxxr.exe 88 PID 1200 wrote to memory of 1228 1200 fxrlxxr.exe 88 PID 1200 wrote to memory of 1228 1200 fxrlxxr.exe 88 PID 1228 wrote to memory of 3612 1228 bttnbb.exe 89 PID 1228 wrote to memory of 3612 1228 bttnbb.exe 89 PID 1228 wrote to memory of 3612 1228 bttnbb.exe 89 PID 3612 wrote to memory of 2664 3612 vjvpd.exe 90 PID 3612 wrote to memory of 2664 3612 vjvpd.exe 90 PID 3612 wrote to memory of 2664 3612 vjvpd.exe 90 PID 2664 wrote to memory of 4796 2664 lrrlfxr.exe 91 PID 2664 wrote to memory of 4796 2664 lrrlfxr.exe 91 PID 2664 wrote to memory of 4796 2664 lrrlfxr.exe 91 PID 4796 wrote to memory of 4976 4796 5bbtnh.exe 92 PID 4796 wrote to memory of 4976 4796 5bbtnh.exe 92 PID 4796 wrote to memory of 4976 4796 5bbtnh.exe 92 PID 4976 wrote to memory of 3700 4976 htnhtn.exe 93 PID 4976 wrote to memory of 3700 4976 htnhtn.exe 93 PID 4976 wrote to memory of 3700 4976 htnhtn.exe 93 PID 3700 wrote to memory of 1440 3700 3jvpd.exe 94 PID 3700 wrote to memory of 1440 3700 3jvpd.exe 94 PID 3700 wrote to memory of 1440 3700 3jvpd.exe 94 PID 1440 wrote to memory of 1476 1440 pjdvj.exe 95 PID 1440 wrote to memory of 1476 1440 pjdvj.exe 95 PID 1440 wrote to memory of 1476 1440 pjdvj.exe 95 PID 1476 wrote to memory of 1652 1476 rfxlrff.exe 96 PID 1476 wrote to memory of 1652 1476 rfxlrff.exe 96 PID 1476 wrote to memory of 1652 1476 rfxlrff.exe 96 PID 1652 wrote to memory of 3144 1652 lllxlfx.exe 97 PID 1652 wrote to memory of 3144 1652 lllxlfx.exe 97 PID 1652 wrote to memory of 3144 1652 lllxlfx.exe 97 PID 3144 wrote to memory of 2976 3144 nnhhhn.exe 98 PID 3144 wrote to memory of 2976 3144 nnhhhn.exe 98 PID 3144 wrote to memory of 2976 3144 nnhhhn.exe 98 PID 2976 wrote to memory of 4480 2976 jdpjv.exe 99 PID 2976 wrote to memory of 4480 2976 jdpjv.exe 99 PID 2976 wrote to memory of 4480 2976 jdpjv.exe 99 PID 4480 wrote to memory of 4692 4480 9jjvj.exe 100 PID 4480 wrote to memory of 4692 4480 9jjvj.exe 100 PID 4480 wrote to memory of 4692 4480 9jjvj.exe 100 PID 4692 wrote to memory of 4568 4692 7lfrlxr.exe 101 PID 4692 wrote to memory of 4568 4692 7lfrlxr.exe 101 PID 4692 wrote to memory of 4568 4692 7lfrlxr.exe 101 PID 4568 wrote to memory of 2716 4568 rrlfxrr.exe 102 PID 4568 wrote to memory of 2716 4568 rrlfxrr.exe 102 PID 4568 wrote to memory of 2716 4568 rrlfxrr.exe 102 PID 2716 wrote to memory of 3692 2716 bthhbt.exe 103 PID 2716 wrote to memory of 3692 2716 bthhbt.exe 103 PID 2716 wrote to memory of 3692 2716 bthhbt.exe 103 PID 3692 wrote to memory of 5056 3692 5thbnh.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"C:\Users\Admin\AppData\Local\Temp\7650f3613bdcffe6ad8383e31547ef76c1f0f7077c63c111144e39f71b26686b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\pvvpj.exec:\pvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\fflfrlx.exec:\fflfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\nbtnbb.exec:\nbtnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\vvdvj.exec:\vvdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\bttnbb.exec:\bttnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\vjvpd.exec:\vjvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\5bbtnh.exec:\5bbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
\??\c:\htnhtn.exec:\htnhtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\3jvpd.exec:\3jvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\pjdvj.exec:\pjdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\rfxlrff.exec:\rfxlrff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\lllxlfx.exec:\lllxlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\nnhhhn.exec:\nnhhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\jdpjv.exec:\jdpjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\9jjvj.exec:\9jjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\7lfrlxr.exec:\7lfrlxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\rrlfxrr.exec:\rrlfxrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\bthhbt.exec:\bthhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\5thbnh.exec:\5thbnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\5ddvp.exec:\5ddvp.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5056 -
\??\c:\rffxffx.exec:\rffxffx.exe24⤵
- Executes dropped EXE
PID:1080 -
\??\c:\btnbtt.exec:\btnbtt.exe25⤵
- Executes dropped EXE
PID:4956 -
\??\c:\jjjdd.exec:\jjjdd.exe26⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7jjdp.exec:\7jjdp.exe27⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rxrxffr.exec:\rxrxffr.exe28⤵
- Executes dropped EXE
PID:3136 -
\??\c:\fxxlrlx.exec:\fxxlrlx.exe29⤵
- Executes dropped EXE
PID:824 -
\??\c:\bbbtnh.exec:\bbbtnh.exe30⤵
- Executes dropped EXE
PID:2128 -
\??\c:\1djpd.exec:\1djpd.exe31⤵
- Executes dropped EXE
PID:4984 -
\??\c:\rrlxlfl.exec:\rrlxlfl.exe32⤵
- Executes dropped EXE
PID:3696 -
\??\c:\bnnhtt.exec:\bnnhtt.exe33⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5ddvj.exec:\5ddvj.exe34⤵
- Executes dropped EXE
PID:4420 -
\??\c:\jddpd.exec:\jddpd.exe35⤵
- Executes dropped EXE
PID:3908 -
\??\c:\xlxlfxr.exec:\xlxlfxr.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\9lfrfxr.exec:\9lfrfxr.exe37⤵
- Executes dropped EXE
PID:584 -
\??\c:\tbtnbt.exec:\tbtnbt.exe38⤵
- Executes dropped EXE
PID:2680 -
\??\c:\vddvd.exec:\vddvd.exe39⤵
- Executes dropped EXE
PID:4700 -
\??\c:\vvpdv.exec:\vvpdv.exe40⤵
- Executes dropped EXE
PID:3504 -
\??\c:\rlxxrxf.exec:\rlxxrxf.exe41⤵
- Executes dropped EXE
PID:3460 -
\??\c:\httbnh.exec:\httbnh.exe42⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbthtn.exec:\hbthtn.exe43⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1djdd.exec:\1djdd.exe44⤵
- Executes dropped EXE
PID:4732 -
\??\c:\lxffxfx.exec:\lxffxfx.exe45⤵
- Executes dropped EXE
PID:4428 -
\??\c:\lxxlxlf.exec:\lxxlxlf.exe46⤵
- Executes dropped EXE
PID:3776 -
\??\c:\ttnhnn.exec:\ttnhnn.exe47⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dpjdp.exec:\dpjdp.exe48⤵
- Executes dropped EXE
PID:960 -
\??\c:\jdvpd.exec:\jdvpd.exe49⤵
- Executes dropped EXE
PID:4740 -
\??\c:\llxrrxx.exec:\llxrrxx.exe50⤵
- Executes dropped EXE
PID:4776 -
\??\c:\xfllrll.exec:\xfllrll.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\3tbbtt.exec:\3tbbtt.exe52⤵
- Executes dropped EXE
PID:1000 -
\??\c:\pjpjv.exec:\pjpjv.exe53⤵
- Executes dropped EXE
PID:1200 -
\??\c:\jppvv.exec:\jppvv.exe54⤵
- Executes dropped EXE
PID:1860 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe55⤵
- Executes dropped EXE
PID:4236 -
\??\c:\fxlrxrr.exec:\fxlrxrr.exe56⤵
- Executes dropped EXE
PID:3476 -
\??\c:\ttnhtt.exec:\ttnhtt.exe57⤵
- Executes dropped EXE
PID:2424 -
\??\c:\jpvjd.exec:\jpvjd.exe58⤵
- Executes dropped EXE
PID:536 -
\??\c:\9xxrlll.exec:\9xxrlll.exe59⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe60⤵
- Executes dropped EXE
PID:1964 -
\??\c:\3btthh.exec:\3btthh.exe61⤵
- Executes dropped EXE
PID:2028 -
\??\c:\ttnhnh.exec:\ttnhnh.exe62⤵
- Executes dropped EXE
PID:3260 -
\??\c:\1dvjv.exec:\1dvjv.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\xlxlrlf.exec:\xlxlrlf.exe64⤵
- Executes dropped EXE
PID:1632 -
\??\c:\bnnnhb.exec:\bnnnhb.exe65⤵
- Executes dropped EXE
PID:896 -
\??\c:\nnthnn.exec:\nnthnn.exe66⤵PID:2828
-
\??\c:\jdjjj.exec:\jdjjj.exe67⤵PID:3756
-
\??\c:\jdvjj.exec:\jdvjj.exe68⤵PID:3716
-
\??\c:\5fllrxx.exec:\5fllrxx.exe69⤵PID:4716
-
\??\c:\7nbtnh.exec:\7nbtnh.exe70⤵PID:4540
-
\??\c:\7tbntb.exec:\7tbntb.exe71⤵PID:2648
-
\??\c:\pvdvp.exec:\pvdvp.exe72⤵PID:3272
-
\??\c:\jdjjj.exec:\jdjjj.exe73⤵PID:4280
-
\??\c:\lxfxlfl.exec:\lxfxlfl.exe74⤵PID:2880
-
\??\c:\rlrfxrf.exec:\rlrfxrf.exe75⤵PID:4208
-
\??\c:\9nnhbt.exec:\9nnhbt.exe76⤵PID:3692
-
\??\c:\nbbnbn.exec:\nbbnbn.exe77⤵PID:4456
-
\??\c:\pvddj.exec:\pvddj.exe78⤵PID:1828
-
\??\c:\jvdjv.exec:\jvdjv.exe79⤵PID:760
-
\??\c:\rllxlfx.exec:\rllxlfx.exe80⤵PID:1840
-
\??\c:\ttbtnh.exec:\ttbtnh.exe81⤵PID:3060
-
\??\c:\9hhthh.exec:\9hhthh.exe82⤵PID:4040
-
\??\c:\ttbbbb.exec:\ttbbbb.exe83⤵PID:436
-
\??\c:\vpvpp.exec:\vpvpp.exe84⤵PID:2916
-
\??\c:\1dpjv.exec:\1dpjv.exe85⤵PID:1372
-
\??\c:\lflxlfx.exec:\lflxlfx.exe86⤵PID:2588
-
\??\c:\xrrfrrf.exec:\xrrfrrf.exe87⤵PID:4008
-
\??\c:\fxfrfrl.exec:\fxfrfrl.exe88⤵PID:4984
-
\??\c:\hnnhbt.exec:\hnnhbt.exe89⤵PID:3280
-
\??\c:\dpvpj.exec:\dpvpj.exe90⤵PID:2684
-
\??\c:\9rrrrxx.exec:\9rrrrxx.exe91⤵PID:5040
-
\??\c:\rfxfrxf.exec:\rfxfrxf.exe92⤵PID:2116
-
\??\c:\tbhntt.exec:\tbhntt.exe93⤵PID:2688
-
\??\c:\hnnhnh.exec:\hnnhnh.exe94⤵PID:1588
-
\??\c:\vvpdp.exec:\vvpdp.exe95⤵PID:1496
-
\??\c:\pjdpv.exec:\pjdpv.exe96⤵PID:2680
-
\??\c:\rrrrfff.exec:\rrrrfff.exe97⤵PID:3264
-
\??\c:\ttbntn.exec:\ttbntn.exe98⤵PID:3504
-
\??\c:\htnthn.exec:\htnthn.exe99⤵PID:3460
-
\??\c:\vpjjv.exec:\vpjjv.exe100⤵PID:2412
-
\??\c:\xrrxrlx.exec:\xrrxrlx.exe101⤵PID:1868
-
\??\c:\nhbbbb.exec:\nhbbbb.exe102⤵PID:4288
-
\??\c:\vjppj.exec:\vjppj.exe103⤵PID:4476
-
\??\c:\vjjvp.exec:\vjjvp.exe104⤵PID:724
-
\??\c:\xfffrrr.exec:\xfffrrr.exe105⤵PID:2800
-
\??\c:\bhhbbt.exec:\bhhbbt.exe106⤵PID:960
-
\??\c:\tbnbnn.exec:\tbnbnn.exe107⤵PID:4820
-
\??\c:\7djdd.exec:\7djdd.exe108⤵PID:2928
-
\??\c:\1pvpd.exec:\1pvpd.exe109⤵PID:2524
-
\??\c:\7lfrrfr.exec:\7lfrrfr.exe110⤵PID:1000
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe111⤵PID:1136
-
\??\c:\9tbbth.exec:\9tbbth.exe112⤵PID:728
-
\??\c:\bbhtnn.exec:\bbhtnn.exe113⤵
- System Location Discovery: System Language Discovery
PID:3612 -
\??\c:\ddppp.exec:\ddppp.exe114⤵PID:524
-
\??\c:\9jjdv.exec:\9jjdv.exe115⤵PID:4872
-
\??\c:\lflffff.exec:\lflffff.exe116⤵PID:536
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe117⤵PID:1984
-
\??\c:\nnnhth.exec:\nnnhth.exe118⤵PID:2952
-
\??\c:\pjdjj.exec:\pjdjj.exe119⤵PID:2328
-
\??\c:\dpdjd.exec:\dpdjd.exe120⤵PID:1476
-
\??\c:\ddjdp.exec:\ddjdp.exe121⤵PID:2808
-
\??\c:\frlfrlx.exec:\frlfrlx.exe122⤵PID:5084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-