Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 01:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe
Resource
win7-20241010-en
6 signatures
150 seconds
General
-
Target
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe
-
Size
53KB
-
MD5
f3622e4e42e6f564563caac3d1962a6f
-
SHA1
adc685342fc780f8a57438415418df24368d7112
-
SHA256
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f
-
SHA512
77733aa15f07624fd471ce384486947e2a219cf80dec9a3ef5ff19fce0f5ee7c014b542d1f13185ea79b711f37c08579ac7d7befd3b8114e96a64d80cecfbed4
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlW:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/3172-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3548-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-243-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-250-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2640-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-358-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-372-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-382-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-405-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4388-419-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-489-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-494-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-506-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-568-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-617-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-660-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-740-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1928-759-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-907-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-950-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-1168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-1286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-1621-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1468 jdjvj.exe 1944 rrxrrrl.exe 2040 rfffxxr.exe 1432 nhhbtb.exe 1884 9vvdd.exe 2432 rlfxxrl.exe 4680 hbthbb.exe 5040 hhnbhb.exe 940 vpdvp.exe 4956 xlrfllf.exe 232 hnnhbb.exe 3984 tnbnbt.exe 4476 vppjj.exe 2224 rxrlfrr.exe 4640 bhnnnt.exe 1540 9lrllff.exe 3560 ddjdp.exe 3252 frrrrlf.exe 1800 tnnnht.exe 4100 7ppdj.exe 3428 9djdp.exe 3060 9xrrllf.exe 1392 tbtntn.exe 1584 thnhbb.exe 764 xffxrrf.exe 2520 btnnhh.exe 3284 vppjd.exe 2448 5rllxfr.exe 3540 xfllfrr.exe 2220 nbhhtn.exe 4860 7jdpj.exe 2604 9vdvp.exe 1780 1llxlrr.exe 1680 tnhbtn.exe 3548 nbthtn.exe 4768 jpdpd.exe 3376 ffflxrx.exe 3616 9tttnh.exe 1416 pdjdv.exe 752 jddvv.exe 1260 xfrlfff.exe 4268 hhnhhn.exe 4796 nntntn.exe 2932 dddjv.exe 4604 lllrflx.exe 1548 rlrlffx.exe 4028 bbntbb.exe 1792 ddjdv.exe 2692 jvddv.exe 1044 3xllrff.exe 3112 tbtnhb.exe 3632 hhnhhh.exe 2640 pvppj.exe 1352 xrfxxxl.exe 1084 5llffff.exe 2844 tthbbh.exe 3452 1ppdv.exe 4492 rrxrrxf.exe 1100 rlffffx.exe 744 bntnbt.exe 448 jjpjd.exe 3068 jpddd.exe 3228 hhnhbt.exe 4820 bttnnn.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxlfxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxxfflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxxxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 1468 3172 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 82 PID 3172 wrote to memory of 1468 3172 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 82 PID 3172 wrote to memory of 1468 3172 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 82 PID 1468 wrote to memory of 1944 1468 jdjvj.exe 83 PID 1468 wrote to memory of 1944 1468 jdjvj.exe 83 PID 1468 wrote to memory of 1944 1468 jdjvj.exe 83 PID 1944 wrote to memory of 2040 1944 rrxrrrl.exe 84 PID 1944 wrote to memory of 2040 1944 rrxrrrl.exe 84 PID 1944 wrote to memory of 2040 1944 rrxrrrl.exe 84 PID 2040 wrote to memory of 1432 2040 rfffxxr.exe 85 PID 2040 wrote to memory of 1432 2040 rfffxxr.exe 85 PID 2040 wrote to memory of 1432 2040 rfffxxr.exe 85 PID 1432 wrote to memory of 1884 1432 nhhbtb.exe 86 PID 1432 wrote to memory of 1884 1432 nhhbtb.exe 86 PID 1432 wrote to memory of 1884 1432 nhhbtb.exe 86 PID 1884 wrote to memory of 2432 1884 9vvdd.exe 87 PID 1884 wrote to memory of 2432 1884 9vvdd.exe 87 PID 1884 wrote to memory of 2432 1884 9vvdd.exe 87 PID 2432 wrote to memory of 4680 2432 rlfxxrl.exe 88 PID 2432 wrote to memory of 4680 2432 rlfxxrl.exe 88 PID 2432 wrote to memory of 4680 2432 rlfxxrl.exe 88 PID 4680 wrote to memory of 5040 4680 hbthbb.exe 89 PID 4680 wrote to memory of 5040 4680 hbthbb.exe 89 PID 4680 wrote to memory of 5040 4680 hbthbb.exe 89 PID 5040 wrote to memory of 940 5040 hhnbhb.exe 90 PID 5040 wrote to memory of 940 5040 hhnbhb.exe 90 PID 5040 wrote to memory of 940 5040 hhnbhb.exe 90 PID 940 wrote to memory of 4956 940 vpdvp.exe 91 PID 940 wrote to memory of 4956 940 vpdvp.exe 91 PID 940 wrote to memory of 4956 940 vpdvp.exe 91 PID 4956 wrote to memory of 232 4956 xlrfllf.exe 92 PID 4956 wrote to memory of 232 4956 xlrfllf.exe 92 PID 4956 wrote to memory of 232 4956 xlrfllf.exe 92 PID 232 wrote to memory of 3984 232 hnnhbb.exe 93 PID 232 wrote to memory of 3984 232 hnnhbb.exe 93 PID 232 wrote to memory of 3984 232 hnnhbb.exe 93 PID 3984 wrote to memory of 4476 3984 tnbnbt.exe 94 PID 3984 wrote to memory of 4476 3984 tnbnbt.exe 94 PID 3984 wrote to memory of 4476 3984 tnbnbt.exe 94 PID 4476 wrote to memory of 2224 4476 vppjj.exe 95 PID 4476 wrote to memory of 2224 4476 vppjj.exe 95 PID 4476 wrote to memory of 2224 4476 vppjj.exe 95 PID 2224 wrote to memory of 4640 2224 rxrlfrr.exe 96 PID 2224 wrote to memory of 4640 2224 rxrlfrr.exe 96 PID 2224 wrote to memory of 4640 2224 rxrlfrr.exe 96 PID 4640 wrote to memory of 1540 4640 bhnnnt.exe 97 PID 4640 wrote to memory of 1540 4640 bhnnnt.exe 97 PID 4640 wrote to memory of 1540 4640 bhnnnt.exe 97 PID 1540 wrote to memory of 3560 1540 9lrllff.exe 98 PID 1540 wrote to memory of 3560 1540 9lrllff.exe 98 PID 1540 wrote to memory of 3560 1540 9lrllff.exe 98 PID 3560 wrote to memory of 3252 3560 ddjdp.exe 99 PID 3560 wrote to memory of 3252 3560 ddjdp.exe 99 PID 3560 wrote to memory of 3252 3560 ddjdp.exe 99 PID 3252 wrote to memory of 1800 3252 frrrrlf.exe 100 PID 3252 wrote to memory of 1800 3252 frrrrlf.exe 100 PID 3252 wrote to memory of 1800 3252 frrrrlf.exe 100 PID 1800 wrote to memory of 4100 1800 tnnnht.exe 101 PID 1800 wrote to memory of 4100 1800 tnnnht.exe 101 PID 1800 wrote to memory of 4100 1800 tnnnht.exe 101 PID 4100 wrote to memory of 3428 4100 7ppdj.exe 102 PID 4100 wrote to memory of 3428 4100 7ppdj.exe 102 PID 4100 wrote to memory of 3428 4100 7ppdj.exe 102 PID 3428 wrote to memory of 3060 3428 9djdp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe"C:\Users\Admin\AppData\Local\Temp\eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\jdjvj.exec:\jdjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\rrxrrrl.exec:\rrxrrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rfffxxr.exec:\rfffxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\nhhbtb.exec:\nhhbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\9vvdd.exec:\9vvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rlfxxrl.exec:\rlfxxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\hbthbb.exec:\hbthbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\hhnbhb.exec:\hhnbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\vpdvp.exec:\vpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\xlrfllf.exec:\xlrfllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\hnnhbb.exec:\hnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\tnbnbt.exec:\tnbnbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\vppjj.exec:\vppjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\rxrlfrr.exec:\rxrlfrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\bhnnnt.exec:\bhnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\9lrllff.exec:\9lrllff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\ddjdp.exec:\ddjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\frrrrlf.exec:\frrrrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\tnnnht.exec:\tnnnht.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\7ppdj.exec:\7ppdj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\9djdp.exec:\9djdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\9xrrllf.exec:\9xrrllf.exe23⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tbtntn.exec:\tbtntn.exe24⤵
- Executes dropped EXE
PID:1392 -
\??\c:\thnhbb.exec:\thnhbb.exe25⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xffxrrf.exec:\xffxrrf.exe26⤵
- Executes dropped EXE
PID:764 -
\??\c:\btnnhh.exec:\btnnhh.exe27⤵
- Executes dropped EXE
PID:2520 -
\??\c:\vppjd.exec:\vppjd.exe28⤵
- Executes dropped EXE
PID:3284 -
\??\c:\5rllxfr.exec:\5rllxfr.exe29⤵
- Executes dropped EXE
PID:2448 -
\??\c:\xfllfrr.exec:\xfllfrr.exe30⤵
- Executes dropped EXE
PID:3540 -
\??\c:\nbhhtn.exec:\nbhhtn.exe31⤵
- Executes dropped EXE
PID:2220 -
\??\c:\7jdpj.exec:\7jdpj.exe32⤵
- Executes dropped EXE
PID:4860 -
\??\c:\9vdvp.exec:\9vdvp.exe33⤵
- Executes dropped EXE
PID:2604 -
\??\c:\1llxlrr.exec:\1llxlrr.exe34⤵
- Executes dropped EXE
PID:1780 -
\??\c:\tnhbtn.exec:\tnhbtn.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nbthtn.exec:\nbthtn.exe36⤵
- Executes dropped EXE
PID:3548 -
\??\c:\jpdpd.exec:\jpdpd.exe37⤵
- Executes dropped EXE
PID:4768 -
\??\c:\ffflxrx.exec:\ffflxrx.exe38⤵
- Executes dropped EXE
PID:3376 -
\??\c:\9tttnh.exec:\9tttnh.exe39⤵
- Executes dropped EXE
PID:3616 -
\??\c:\pdjdv.exec:\pdjdv.exe40⤵
- Executes dropped EXE
PID:1416 -
\??\c:\jddvv.exec:\jddvv.exe41⤵
- Executes dropped EXE
PID:752 -
\??\c:\xfrlfff.exec:\xfrlfff.exe42⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hhnhhn.exec:\hhnhhn.exe43⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nntntn.exec:\nntntn.exe44⤵
- Executes dropped EXE
PID:4796 -
\??\c:\dddjv.exec:\dddjv.exe45⤵
- Executes dropped EXE
PID:2932 -
\??\c:\lllrflx.exec:\lllrflx.exe46⤵
- Executes dropped EXE
PID:4604 -
\??\c:\rlrlffx.exec:\rlrlffx.exe47⤵
- Executes dropped EXE
PID:1548 -
\??\c:\bbntbb.exec:\bbntbb.exe48⤵
- Executes dropped EXE
PID:4028 -
\??\c:\ddjdv.exec:\ddjdv.exe49⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jvddv.exec:\jvddv.exe50⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3xllrff.exec:\3xllrff.exe51⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tbtnhb.exec:\tbtnhb.exe52⤵
- Executes dropped EXE
PID:3112 -
\??\c:\hhnhhh.exec:\hhnhhh.exe53⤵
- Executes dropped EXE
PID:3632 -
\??\c:\pvppj.exec:\pvppj.exe54⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xrfxxxl.exec:\xrfxxxl.exe55⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5llffff.exec:\5llffff.exe56⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tthbbh.exec:\tthbbh.exe57⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1ppdv.exec:\1ppdv.exe58⤵
- Executes dropped EXE
PID:3452 -
\??\c:\rrxrrxf.exec:\rrxrrxf.exe59⤵
- Executes dropped EXE
PID:4492 -
\??\c:\rlffffx.exec:\rlffffx.exe60⤵
- Executes dropped EXE
PID:1100 -
\??\c:\bntnbt.exec:\bntnbt.exe61⤵
- Executes dropped EXE
PID:744 -
\??\c:\jjpjd.exec:\jjpjd.exe62⤵
- Executes dropped EXE
PID:448 -
\??\c:\jpddd.exec:\jpddd.exe63⤵
- Executes dropped EXE
PID:3068 -
\??\c:\hhnhbt.exec:\hhnhbt.exe64⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bttnnn.exec:\bttnnn.exe65⤵
- Executes dropped EXE
PID:4820 -
\??\c:\7ppjj.exec:\7ppjj.exe66⤵PID:1720
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe67⤵PID:1344
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe68⤵PID:1216
-
\??\c:\hhbbbh.exec:\hhbbbh.exe69⤵PID:1660
-
\??\c:\btbhhb.exec:\btbhhb.exe70⤵PID:4568
-
\??\c:\jjvvd.exec:\jjvvd.exe71⤵PID:4392
-
\??\c:\5vvpd.exec:\5vvpd.exe72⤵PID:3344
-
\??\c:\lxllfxr.exec:\lxllfxr.exe73⤵PID:1128
-
\??\c:\bhhhbb.exec:\bhhhbb.exe74⤵PID:2748
-
\??\c:\jpppj.exec:\jpppj.exe75⤵PID:4136
-
\??\c:\dvvvd.exec:\dvvvd.exe76⤵PID:808
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe77⤵PID:856
-
\??\c:\rlxrlll.exec:\rlxrlll.exe78⤵PID:1952
-
\??\c:\hbbhbb.exec:\hbbhbb.exe79⤵PID:3560
-
\??\c:\nntttb.exec:\nntttb.exe80⤵
- System Location Discovery: System Language Discovery
PID:1948 -
\??\c:\5vpjd.exec:\5vpjd.exe81⤵PID:3676
-
\??\c:\3xrlxrl.exec:\3xrlxrl.exe82⤵PID:4800
-
\??\c:\xxxffll.exec:\xxxffll.exe83⤵PID:1156
-
\??\c:\tbnnnn.exec:\tbnnnn.exe84⤵PID:4876
-
\??\c:\btnnbb.exec:\btnnbb.exe85⤵PID:2588
-
\??\c:\vvjdv.exec:\vvjdv.exe86⤵PID:3372
-
\??\c:\rfllxrl.exec:\rfllxrl.exe87⤵PID:4856
-
\??\c:\frrxrxx.exec:\frrxrxx.exe88⤵PID:1392
-
\??\c:\tnnnht.exec:\tnnnht.exe89⤵PID:2364
-
\??\c:\pvppp.exec:\pvppp.exe90⤵PID:2396
-
\??\c:\dvddd.exec:\dvddd.exe91⤵PID:112
-
\??\c:\lxrxfrx.exec:\lxrxfrx.exe92⤵PID:1708
-
\??\c:\htnhhn.exec:\htnhhn.exe93⤵PID:3276
-
\??\c:\3jvpv.exec:\3jvpv.exe94⤵PID:2296
-
\??\c:\5vdjv.exec:\5vdjv.exe95⤵PID:1076
-
\??\c:\5xffxxx.exec:\5xffxxx.exe96⤵PID:4788
-
\??\c:\flrxffr.exec:\flrxffr.exe97⤵PID:2144
-
\??\c:\bbhbnn.exec:\bbhbnn.exe98⤵PID:2456
-
\??\c:\jdppp.exec:\jdppp.exe99⤵PID:5100
-
\??\c:\vjpdp.exec:\vjpdp.exe100⤵PID:3964
-
\??\c:\fxrlfll.exec:\fxrlfll.exe101⤵PID:2276
-
\??\c:\hhbbtt.exec:\hhbbtt.exe102⤵PID:1408
-
\??\c:\btnhbb.exec:\btnhbb.exe103⤵PID:4388
-
\??\c:\djvpp.exec:\djvpp.exe104⤵PID:1208
-
\??\c:\pjdvp.exec:\pjdvp.exe105⤵
- System Location Discovery: System Language Discovery
PID:1588 -
\??\c:\frxrllf.exec:\frxrllf.exe106⤵PID:4920
-
\??\c:\bbnntt.exec:\bbnntt.exe107⤵PID:3568
-
\??\c:\ttnhnn.exec:\ttnhnn.exe108⤵PID:4412
-
\??\c:\jjpjp.exec:\jjpjp.exe109⤵PID:1308
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe110⤵PID:1048
-
\??\c:\lxxfflf.exec:\lxxfflf.exe111⤵
- System Location Discovery: System Language Discovery
PID:4060 -
\??\c:\nnbtbt.exec:\nnbtbt.exe112⤵PID:1400
-
\??\c:\ppvpv.exec:\ppvpv.exe113⤵PID:3704
-
\??\c:\pjvvd.exec:\pjvvd.exe114⤵PID:4284
-
\??\c:\rffxrrr.exec:\rffxrrr.exe115⤵PID:4028
-
\??\c:\hbbhbb.exec:\hbbhbb.exe116⤵PID:4624
-
\??\c:\tnbtnn.exec:\tnbtnn.exe117⤵PID:4524
-
\??\c:\pjdpv.exec:\pjdpv.exe118⤵PID:1224
-
\??\c:\5fxrrrr.exec:\5fxrrrr.exe119⤵PID:4972
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe120⤵PID:4436
-
\??\c:\btbtnn.exec:\btbtnn.exe121⤵PID:2168
-
\??\c:\nntnnh.exec:\nntnnh.exe122⤵PID:1460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-