Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 04:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe
-
Size
73KB
-
MD5
ea1dd3c97a3acb03c2005a759f429939
-
SHA1
58ed73be3ebe41382fbf29c1971c283b2e73d715
-
SHA256
aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b
-
SHA512
6b54d0e4ea7e29596084929b0229055da99dc93684d83c15093fce36563f3ab2bfba7a6bea7424496a6853840248f489528a1b13ea688821f6812bd22b1f6a91
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvdLH+O:ymb3NkkiQ3mdBjF0yMliCO
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1112-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1672-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3796-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3424 jjjjj.exe 1852 xxrlffx.exe 1112 flxfrrf.exe 2236 hbhhbb.exe 3408 ddjdd.exe 3300 rrflfxr.exe 64 thhntt.exe 2976 9bbbbb.exe 4488 vjpjp.exe 1672 lxxxfxf.exe 1832 rrxllxx.exe 684 hhtttb.exe 776 jdjjj.exe 5012 xxrrffx.exe 1320 xxxxfff.exe 2008 tnnttn.exe 3844 dvpjd.exe 3260 9fxrllf.exe 3632 httnhb.exe 1888 9bbbtt.exe 2160 jdjdd.exe 2592 fxxlfrf.exe 1284 bnnntn.exe 4676 bbnnhh.exe 5080 pjpjv.exe 4976 3pppd.exe 3796 xllfrrr.exe 2124 xflxrrl.exe 412 9bbnhb.exe 1172 pvdvp.exe 2200 dvvpp.exe 740 rxlfxfx.exe 4652 hnbbbb.exe 3676 7ntttt.exe 4472 vvjjv.exe 2876 jddvv.exe 624 7xrlfxx.exe 1840 nbbtbb.exe 4964 nnnnnn.exe 4836 thbbbb.exe 4480 5vvpp.exe 5108 dvvvv.exe 3800 3flfffl.exe 4484 rxrxxxf.exe 1648 bbttnt.exe 4856 bbnhbb.exe 3320 jvddd.exe 2560 jjpjj.exe 4244 1xffxxr.exe 4732 rlrflrl.exe 936 bbhnbt.exe 2436 hnnnnt.exe 2264 vpdvj.exe 4272 ddddv.exe 3984 rrlfxxr.exe 2356 frxrxff.exe 1396 btthbb.exe 4596 bhtnbt.exe 1844 7dvvv.exe 1932 rlrrlll.exe 1588 llxxxxf.exe 2472 hhhhbb.exe 1992 tbbbhh.exe 3344 dpvvj.exe -
resource yara_rule behavioral2/memory/3076-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1112-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1672-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3796-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1172-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9vvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrflrl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3076 wrote to memory of 3424 3076 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 81 PID 3076 wrote to memory of 3424 3076 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 81 PID 3076 wrote to memory of 3424 3076 aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe 81 PID 3424 wrote to memory of 1852 3424 jjjjj.exe 82 PID 3424 wrote to memory of 1852 3424 jjjjj.exe 82 PID 3424 wrote to memory of 1852 3424 jjjjj.exe 82 PID 1852 wrote to memory of 1112 1852 xxrlffx.exe 83 PID 1852 wrote to memory of 1112 1852 xxrlffx.exe 83 PID 1852 wrote to memory of 1112 1852 xxrlffx.exe 83 PID 1112 wrote to memory of 2236 1112 flxfrrf.exe 84 PID 1112 wrote to memory of 2236 1112 flxfrrf.exe 84 PID 1112 wrote to memory of 2236 1112 flxfrrf.exe 84 PID 2236 wrote to memory of 3408 2236 hbhhbb.exe 85 PID 2236 wrote to memory of 3408 2236 hbhhbb.exe 85 PID 2236 wrote to memory of 3408 2236 hbhhbb.exe 85 PID 3408 wrote to memory of 3300 3408 ddjdd.exe 86 PID 3408 wrote to memory of 3300 3408 ddjdd.exe 86 PID 3408 wrote to memory of 3300 3408 ddjdd.exe 86 PID 3300 wrote to memory of 64 3300 rrflfxr.exe 87 PID 3300 wrote to memory of 64 3300 rrflfxr.exe 87 PID 3300 wrote to memory of 64 3300 rrflfxr.exe 87 PID 64 wrote to memory of 2976 64 thhntt.exe 88 PID 64 wrote to memory of 2976 64 thhntt.exe 88 PID 64 wrote to memory of 2976 64 thhntt.exe 88 PID 2976 wrote to memory of 4488 2976 9bbbbb.exe 89 PID 2976 wrote to memory of 4488 2976 9bbbbb.exe 89 PID 2976 wrote to memory of 4488 2976 9bbbbb.exe 89 PID 4488 wrote to memory of 1672 4488 vjpjp.exe 90 PID 4488 wrote to memory of 1672 4488 vjpjp.exe 90 PID 4488 wrote to memory of 1672 4488 vjpjp.exe 90 PID 1672 wrote to memory of 1832 1672 lxxxfxf.exe 91 PID 1672 wrote to memory of 1832 1672 lxxxfxf.exe 91 PID 1672 wrote to memory of 1832 1672 lxxxfxf.exe 91 PID 1832 wrote to memory of 684 1832 rrxllxx.exe 93 PID 1832 wrote to memory of 684 1832 rrxllxx.exe 93 PID 1832 wrote to memory of 684 1832 rrxllxx.exe 93 PID 684 wrote to memory of 776 684 hhtttb.exe 94 PID 684 wrote to memory of 776 684 hhtttb.exe 94 PID 684 wrote to memory of 776 684 hhtttb.exe 94 PID 776 wrote to memory of 5012 776 jdjjj.exe 95 PID 776 wrote to memory of 5012 776 jdjjj.exe 95 PID 776 wrote to memory of 5012 776 jdjjj.exe 95 PID 5012 wrote to memory of 1320 5012 xxrrffx.exe 96 PID 5012 wrote to memory of 1320 5012 xxrrffx.exe 96 PID 5012 wrote to memory of 1320 5012 xxrrffx.exe 96 PID 1320 wrote to memory of 2008 1320 xxxxfff.exe 97 PID 1320 wrote to memory of 2008 1320 xxxxfff.exe 97 PID 1320 wrote to memory of 2008 1320 xxxxfff.exe 97 PID 2008 wrote to memory of 3844 2008 tnnttn.exe 98 PID 2008 wrote to memory of 3844 2008 tnnttn.exe 98 PID 2008 wrote to memory of 3844 2008 tnnttn.exe 98 PID 3844 wrote to memory of 3260 3844 dvpjd.exe 99 PID 3844 wrote to memory of 3260 3844 dvpjd.exe 99 PID 3844 wrote to memory of 3260 3844 dvpjd.exe 99 PID 3260 wrote to memory of 3632 3260 9fxrllf.exe 101 PID 3260 wrote to memory of 3632 3260 9fxrllf.exe 101 PID 3260 wrote to memory of 3632 3260 9fxrllf.exe 101 PID 3632 wrote to memory of 1888 3632 httnhb.exe 102 PID 3632 wrote to memory of 1888 3632 httnhb.exe 102 PID 3632 wrote to memory of 1888 3632 httnhb.exe 102 PID 1888 wrote to memory of 2160 1888 9bbbtt.exe 103 PID 1888 wrote to memory of 2160 1888 9bbbtt.exe 103 PID 1888 wrote to memory of 2160 1888 9bbbtt.exe 103 PID 2160 wrote to memory of 2592 2160 jdjdd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe"C:\Users\Admin\AppData\Local\Temp\aef6850c84c6966bd6155700e546df0f346e368dde5017ae6fcb3e570c03a39b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\jjjjj.exec:\jjjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\xxrlffx.exec:\xxrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\flxfrrf.exec:\flxfrrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\hbhhbb.exec:\hbhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\ddjdd.exec:\ddjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\rrflfxr.exec:\rrflfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\thhntt.exec:\thhntt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\9bbbbb.exec:\9bbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vjpjp.exec:\vjpjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\lxxxfxf.exec:\lxxxfxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
\??\c:\rrxllxx.exec:\rrxllxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\hhtttb.exec:\hhtttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\jdjjj.exec:\jdjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\xxrrffx.exec:\xxrrffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\xxxxfff.exec:\xxxxfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\tnnttn.exec:\tnnttn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\dvpjd.exec:\dvpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\9fxrllf.exec:\9fxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\httnhb.exec:\httnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\9bbbtt.exec:\9bbbtt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\jdjdd.exec:\jdjdd.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\fxxlfrf.exec:\fxxlfrf.exe23⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bnnntn.exec:\bnnntn.exe24⤵
- Executes dropped EXE
PID:1284 -
\??\c:\bbnnhh.exec:\bbnnhh.exe25⤵
- Executes dropped EXE
PID:4676 -
\??\c:\pjpjv.exec:\pjpjv.exe26⤵
- Executes dropped EXE
PID:5080 -
\??\c:\3pppd.exec:\3pppd.exe27⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xllfrrr.exec:\xllfrrr.exe28⤵
- Executes dropped EXE
PID:3796 -
\??\c:\xflxrrl.exec:\xflxrrl.exe29⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9bbnhb.exec:\9bbnhb.exe30⤵
- Executes dropped EXE
PID:412 -
\??\c:\pvdvp.exec:\pvdvp.exe31⤵
- Executes dropped EXE
PID:1172 -
\??\c:\dvvpp.exec:\dvvpp.exe32⤵
- Executes dropped EXE
PID:2200 -
\??\c:\rxlfxfx.exec:\rxlfxfx.exe33⤵
- Executes dropped EXE
PID:740 -
\??\c:\hnbbbb.exec:\hnbbbb.exe34⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7ntttt.exec:\7ntttt.exe35⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vvjjv.exec:\vvjjv.exe36⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jddvv.exec:\jddvv.exe37⤵
- Executes dropped EXE
PID:2876 -
\??\c:\7xrlfxx.exec:\7xrlfxx.exe38⤵
- Executes dropped EXE
PID:624 -
\??\c:\nbbtbb.exec:\nbbtbb.exe39⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nnnnnn.exec:\nnnnnn.exe40⤵
- Executes dropped EXE
PID:4964 -
\??\c:\thbbbb.exec:\thbbbb.exe41⤵
- Executes dropped EXE
PID:4836 -
\??\c:\5vvpp.exec:\5vvpp.exe42⤵
- Executes dropped EXE
PID:4480 -
\??\c:\dvvvv.exec:\dvvvv.exe43⤵
- Executes dropped EXE
PID:5108 -
\??\c:\3flfffl.exec:\3flfffl.exe44⤵
- Executes dropped EXE
PID:3800 -
\??\c:\rxrxxxf.exec:\rxrxxxf.exe45⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bbttnt.exec:\bbttnt.exe46⤵
- Executes dropped EXE
PID:1648 -
\??\c:\bbnhbb.exec:\bbnhbb.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\jvddd.exec:\jvddd.exe48⤵
- Executes dropped EXE
PID:3320 -
\??\c:\jjpjj.exec:\jjpjj.exe49⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1xffxxr.exec:\1xffxxr.exe50⤵
- Executes dropped EXE
PID:4244 -
\??\c:\rlrflrl.exec:\rlrflrl.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732 -
\??\c:\bbhnbt.exec:\bbhnbt.exe52⤵
- Executes dropped EXE
PID:936 -
\??\c:\hnnnnt.exec:\hnnnnt.exe53⤵
- Executes dropped EXE
PID:2436 -
\??\c:\vpdvj.exec:\vpdvj.exe54⤵
- Executes dropped EXE
PID:2264 -
\??\c:\ddddv.exec:\ddddv.exe55⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe56⤵
- Executes dropped EXE
PID:3984 -
\??\c:\frxrxff.exec:\frxrxff.exe57⤵
- Executes dropped EXE
PID:2356 -
\??\c:\btthbb.exec:\btthbb.exe58⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bhtnbt.exec:\bhtnbt.exe59⤵
- Executes dropped EXE
PID:4596 -
\??\c:\7dvvv.exec:\7dvvv.exe60⤵
- Executes dropped EXE
PID:1844 -
\??\c:\rlrrlll.exec:\rlrrlll.exe61⤵
- Executes dropped EXE
PID:1932 -
\??\c:\llxxxxf.exec:\llxxxxf.exe62⤵
- Executes dropped EXE
PID:1588 -
\??\c:\hhhhbb.exec:\hhhhbb.exe63⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tbbbhh.exec:\tbbbhh.exe64⤵
- Executes dropped EXE
PID:1992 -
\??\c:\dpvvj.exec:\dpvvj.exe65⤵
- Executes dropped EXE
PID:3344 -
\??\c:\1pvdv.exec:\1pvdv.exe66⤵PID:1320
-
\??\c:\lfrxrxx.exec:\lfrxrxx.exe67⤵PID:1984
-
\??\c:\xxlffff.exec:\xxlffff.exe68⤵PID:1724
-
\??\c:\bhbnhh.exec:\bhbnhh.exe69⤵PID:4828
-
\??\c:\ttnnht.exec:\ttnnht.exe70⤵PID:2604
-
\??\c:\dpvdv.exec:\dpvdv.exe71⤵PID:3304
-
\??\c:\rxrlrlr.exec:\rxrlrlr.exe72⤵PID:212
-
\??\c:\hbtttb.exec:\hbtttb.exe73⤵PID:2160
-
\??\c:\dvvpp.exec:\dvvpp.exe74⤵PID:732
-
\??\c:\lflrfff.exec:\lflrfff.exe75⤵PID:1284
-
\??\c:\jjjdd.exec:\jjjdd.exe76⤵PID:628
-
\??\c:\9vvvp.exec:\9vvvp.exe77⤵PID:4252
-
\??\c:\bttttb.exec:\bttttb.exe78⤵PID:4928
-
\??\c:\1pvpd.exec:\1pvpd.exe79⤵PID:228
-
\??\c:\9rxrlll.exec:\9rxrlll.exe80⤵PID:1752
-
\??\c:\fflllrr.exec:\fflllrr.exe81⤵PID:4124
-
\??\c:\jdpvj.exec:\jdpvj.exe82⤵PID:2020
-
\??\c:\jdjdd.exec:\jdjdd.exe83⤵PID:1176
-
\??\c:\xxrrlxx.exec:\xxrrlxx.exe84⤵PID:1572
-
\??\c:\ntnnbh.exec:\ntnnbh.exe85⤵PID:1880
-
\??\c:\jvjdd.exec:\jvjdd.exe86⤵PID:3268
-
\??\c:\jjddv.exec:\jjddv.exe87⤵PID:2056
-
\??\c:\xxlrffx.exec:\xxlrffx.exe88⤵PID:2856
-
\??\c:\7ntnbh.exec:\7ntnbh.exe89⤵PID:3016
-
\??\c:\nnhhhh.exec:\nnhhhh.exe90⤵PID:2564
-
\??\c:\vjjdv.exec:\vjjdv.exe91⤵PID:4884
-
\??\c:\bhhhbt.exec:\bhhhbt.exe92⤵PID:4072
-
\??\c:\tbtntn.exec:\tbtntn.exe93⤵PID:1956
-
\??\c:\jjpjj.exec:\jjpjj.exe94⤵PID:3336
-
\??\c:\5dddd.exec:\5dddd.exe95⤵PID:3548
-
\??\c:\rrrrlll.exec:\rrrrlll.exe96⤵PID:5108
-
\??\c:\pvdjj.exec:\pvdjj.exe97⤵PID:3800
-
\??\c:\pdddd.exec:\pdddd.exe98⤵PID:4152
-
\??\c:\fffxrxx.exec:\fffxrxx.exe99⤵PID:1352
-
\??\c:\nntnnt.exec:\nntnnt.exe100⤵PID:5004
-
\??\c:\tbtttt.exec:\tbtttt.exe101⤵PID:1820
-
\??\c:\jdjdp.exec:\jdjdp.exe102⤵PID:3288
-
\??\c:\rlxxrrx.exec:\rlxxrrx.exe103⤵PID:2520
-
\??\c:\5lllflf.exec:\5lllflf.exe104⤵PID:4148
-
\??\c:\bthhht.exec:\bthhht.exe105⤵PID:3904
-
\??\c:\hnnttb.exec:\hnnttb.exe106⤵PID:512
-
\??\c:\pjvpv.exec:\pjvpv.exe107⤵PID:2432
-
\??\c:\jpppj.exec:\jpppj.exe108⤵PID:2624
-
\??\c:\7xxxxxr.exec:\7xxxxxr.exe109⤵PID:4488
-
\??\c:\lrxfxff.exec:\lrxfxff.exe110⤵PID:2356
-
\??\c:\tbbnnn.exec:\tbbnnn.exe111⤵PID:1396
-
\??\c:\nbntnt.exec:\nbntnt.exe112⤵PID:4432
-
\??\c:\dvppj.exec:\dvppj.exe113⤵PID:684
-
\??\c:\5djdv.exec:\5djdv.exe114⤵PID:848
-
\??\c:\lxxrrrx.exec:\lxxrrrx.exe115⤵PID:3968
-
\??\c:\bhtbtn.exec:\bhtbtn.exe116⤵PID:468
-
\??\c:\9nbbbb.exec:\9nbbbb.exe117⤵PID:1044
-
\??\c:\ppvvv.exec:\ppvvv.exe118⤵PID:2008
-
\??\c:\vjdvj.exec:\vjdvj.exe119⤵PID:1072
-
\??\c:\lffxrrr.exec:\lffxrrr.exe120⤵PID:3844
-
\??\c:\tnhhnn.exec:\tnhhnn.exe121⤵PID:1092
-
\??\c:\vvddd.exec:\vvddd.exe122⤵PID:3092
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-