Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 08:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe
Resource
win7-20241010-en
7 signatures
150 seconds
General
-
Target
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe
-
Size
52KB
-
MD5
7c714b0617dad817c42df4d2241f4ee8
-
SHA1
3c82ee424a84c05339e8cd205b341c44aa376117
-
SHA256
ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308
-
SHA512
cf4278e4168267a9d84ed128000c7dcc54d64017ebe47b1b3b5241f0ba547965139226fa4e790c7422de3967c1550e5de44d71c026ed6fff0ba7954d1c3fa137
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0ysbe:ymb3NkkiQ3mdBjF0yee
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4616-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1512 7btttb.exe 2768 djjdp.exe 3392 frrrffx.exe 4792 hhnnht.exe 2164 nhhtnb.exe 2744 jppjj.exe 4040 3lllxxr.exe 1956 fllfflf.exe 4928 htnthn.exe 3668 pppjd.exe 3360 fxxxrrl.exe 4640 frrlffx.exe 1900 bhnhtb.exe 2056 9jvpd.exe 4896 dpppj.exe 100 rlfxxrr.exe 4516 1bbttb.exe 2704 vdvdp.exe 4820 vpdvp.exe 1720 xxrlffx.exe 2440 3btttt.exe 1632 nhtbbb.exe 3596 djjjd.exe 4064 9xfxlfx.exe 1668 xfrrrrx.exe 2116 hnnnbh.exe 3184 btnhtn.exe 808 pdjdv.exe 4664 vdvpj.exe 4088 xxrlfff.exe 4856 nbttht.exe 4984 tnnhtt.exe 2528 jdvpj.exe 4444 vjpjd.exe 4788 rflffrl.exe 1144 xrlfxrl.exe 2348 bbbtnn.exe 5092 bbhbnn.exe 3688 vpvjp.exe 1984 dpdvp.exe 988 flfxrrl.exe 1060 xffffff.exe 1544 ntnhtn.exe 2928 jvjdv.exe 1636 vvddd.exe 3812 xxrfrlx.exe 3544 tnhhbb.exe 2600 tnnhtn.exe 2080 pjjdp.exe 2636 1flfffl.exe 3240 5ttnhh.exe 3360 nhnthh.exe 1520 dpvvv.exe 4116 djjdp.exe 4800 3ffxrxr.exe 232 xrlfffl.exe 4896 htnbnh.exe 3112 vvdpd.exe 4828 ffrlrxf.exe 2408 lfxfxfx.exe 2468 bnbnhb.exe 4988 hbbthh.exe 2072 9ddjd.exe 2440 jvvpd.exe -
resource yara_rule behavioral2/memory/4616-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4896-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7btttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 1512 4616 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 82 PID 4616 wrote to memory of 1512 4616 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 82 PID 4616 wrote to memory of 1512 4616 ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe 82 PID 1512 wrote to memory of 2768 1512 7btttb.exe 83 PID 1512 wrote to memory of 2768 1512 7btttb.exe 83 PID 1512 wrote to memory of 2768 1512 7btttb.exe 83 PID 2768 wrote to memory of 3392 2768 djjdp.exe 84 PID 2768 wrote to memory of 3392 2768 djjdp.exe 84 PID 2768 wrote to memory of 3392 2768 djjdp.exe 84 PID 3392 wrote to memory of 4792 3392 frrrffx.exe 86 PID 3392 wrote to memory of 4792 3392 frrrffx.exe 86 PID 3392 wrote to memory of 4792 3392 frrrffx.exe 86 PID 4792 wrote to memory of 2164 4792 hhnnht.exe 87 PID 4792 wrote to memory of 2164 4792 hhnnht.exe 87 PID 4792 wrote to memory of 2164 4792 hhnnht.exe 87 PID 2164 wrote to memory of 2744 2164 nhhtnb.exe 88 PID 2164 wrote to memory of 2744 2164 nhhtnb.exe 88 PID 2164 wrote to memory of 2744 2164 nhhtnb.exe 88 PID 2744 wrote to memory of 4040 2744 jppjj.exe 89 PID 2744 wrote to memory of 4040 2744 jppjj.exe 89 PID 2744 wrote to memory of 4040 2744 jppjj.exe 89 PID 4040 wrote to memory of 1956 4040 3lllxxr.exe 90 PID 4040 wrote to memory of 1956 4040 3lllxxr.exe 90 PID 4040 wrote to memory of 1956 4040 3lllxxr.exe 90 PID 1956 wrote to memory of 4928 1956 fllfflf.exe 91 PID 1956 wrote to memory of 4928 1956 fllfflf.exe 91 PID 1956 wrote to memory of 4928 1956 fllfflf.exe 91 PID 4928 wrote to memory of 3668 4928 htnthn.exe 92 PID 4928 wrote to memory of 3668 4928 htnthn.exe 92 PID 4928 wrote to memory of 3668 4928 htnthn.exe 92 PID 3668 wrote to memory of 3360 3668 pppjd.exe 93 PID 3668 wrote to memory of 3360 3668 pppjd.exe 93 PID 3668 wrote to memory of 3360 3668 pppjd.exe 93 PID 3360 wrote to memory of 4640 3360 fxxxrrl.exe 94 PID 3360 wrote to memory of 4640 3360 fxxxrrl.exe 94 PID 3360 wrote to memory of 4640 3360 fxxxrrl.exe 94 PID 4640 wrote to memory of 1900 4640 frrlffx.exe 95 PID 4640 wrote to memory of 1900 4640 frrlffx.exe 95 PID 4640 wrote to memory of 1900 4640 frrlffx.exe 95 PID 1900 wrote to memory of 2056 1900 bhnhtb.exe 96 PID 1900 wrote to memory of 2056 1900 bhnhtb.exe 96 PID 1900 wrote to memory of 2056 1900 bhnhtb.exe 96 PID 2056 wrote to memory of 4896 2056 9jvpd.exe 97 PID 2056 wrote to memory of 4896 2056 9jvpd.exe 97 PID 2056 wrote to memory of 4896 2056 9jvpd.exe 97 PID 4896 wrote to memory of 100 4896 dpppj.exe 98 PID 4896 wrote to memory of 100 4896 dpppj.exe 98 PID 4896 wrote to memory of 100 4896 dpppj.exe 98 PID 100 wrote to memory of 4516 100 rlfxxrr.exe 99 PID 100 wrote to memory of 4516 100 rlfxxrr.exe 99 PID 100 wrote to memory of 4516 100 rlfxxrr.exe 99 PID 4516 wrote to memory of 2704 4516 1bbttb.exe 100 PID 4516 wrote to memory of 2704 4516 1bbttb.exe 100 PID 4516 wrote to memory of 2704 4516 1bbttb.exe 100 PID 2704 wrote to memory of 4820 2704 vdvdp.exe 101 PID 2704 wrote to memory of 4820 2704 vdvdp.exe 101 PID 2704 wrote to memory of 4820 2704 vdvdp.exe 101 PID 4820 wrote to memory of 1720 4820 vpdvp.exe 102 PID 4820 wrote to memory of 1720 4820 vpdvp.exe 102 PID 4820 wrote to memory of 1720 4820 vpdvp.exe 102 PID 1720 wrote to memory of 2440 1720 xxrlffx.exe 103 PID 1720 wrote to memory of 2440 1720 xxrlffx.exe 103 PID 1720 wrote to memory of 2440 1720 xxrlffx.exe 103 PID 2440 wrote to memory of 1632 2440 3btttt.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe"C:\Users\Admin\AppData\Local\Temp\ffd15ef8cf01ab7ba5b87476727acfc8b23da2e30cb4d4e0aceae387f69b8308.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\7btttb.exec:\7btttb.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
\??\c:\djjdp.exec:\djjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\frrrffx.exec:\frrrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\hhnnht.exec:\hhnnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\nhhtnb.exec:\nhhtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\jppjj.exec:\jppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\3lllxxr.exec:\3lllxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\fllfflf.exec:\fllfflf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\htnthn.exec:\htnthn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\pppjd.exec:\pppjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\frrlffx.exec:\frrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\bhnhtb.exec:\bhnhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9jvpd.exec:\9jvpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\dpppj.exec:\dpppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\rlfxxrr.exec:\rlfxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\1bbttb.exec:\1bbttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\vdvdp.exec:\vdvdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\vpdvp.exec:\vpdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\xxrlffx.exec:\xxrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1720 -
\??\c:\3btttt.exec:\3btttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\nhtbbb.exec:\nhtbbb.exe23⤵
- Executes dropped EXE
PID:1632 -
\??\c:\djjjd.exec:\djjjd.exe24⤵
- Executes dropped EXE
PID:3596 -
\??\c:\9xfxlfx.exec:\9xfxlfx.exe25⤵
- Executes dropped EXE
PID:4064 -
\??\c:\xfrrrrx.exec:\xfrrrrx.exe26⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hnnnbh.exec:\hnnnbh.exe27⤵
- Executes dropped EXE
PID:2116 -
\??\c:\btnhtn.exec:\btnhtn.exe28⤵
- Executes dropped EXE
PID:3184 -
\??\c:\pdjdv.exec:\pdjdv.exe29⤵
- Executes dropped EXE
PID:808 -
\??\c:\vdvpj.exec:\vdvpj.exe30⤵
- Executes dropped EXE
PID:4664 -
\??\c:\xxrlfff.exec:\xxrlfff.exe31⤵
- Executes dropped EXE
PID:4088 -
\??\c:\nbttht.exec:\nbttht.exe32⤵
- Executes dropped EXE
PID:4856 -
\??\c:\tnnhtt.exec:\tnnhtt.exe33⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984 -
\??\c:\jdvpj.exec:\jdvpj.exe34⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vjpjd.exec:\vjpjd.exe35⤵
- Executes dropped EXE
PID:4444 -
\??\c:\rflffrl.exec:\rflffrl.exe36⤵
- Executes dropped EXE
PID:4788 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe37⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bbbtnn.exec:\bbbtnn.exe38⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bbhbnn.exec:\bbhbnn.exe39⤵
- Executes dropped EXE
PID:5092 -
\??\c:\vpvjp.exec:\vpvjp.exe40⤵
- Executes dropped EXE
PID:3688 -
\??\c:\dpdvp.exec:\dpdvp.exe41⤵
- Executes dropped EXE
PID:1984 -
\??\c:\flfxrrl.exec:\flfxrrl.exe42⤵
- Executes dropped EXE
PID:988 -
\??\c:\xffffff.exec:\xffffff.exe43⤵
- Executes dropped EXE
PID:1060 -
\??\c:\ntnhtn.exec:\ntnhtn.exe44⤵
- Executes dropped EXE
PID:1544 -
\??\c:\jvjdv.exec:\jvjdv.exe45⤵
- Executes dropped EXE
PID:2928 -
\??\c:\vvddd.exec:\vvddd.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\xxrfrlx.exec:\xxrfrlx.exe47⤵
- Executes dropped EXE
PID:3812 -
\??\c:\tnhhbb.exec:\tnhhbb.exe48⤵
- Executes dropped EXE
PID:3544 -
\??\c:\tnnhtn.exec:\tnnhtn.exe49⤵
- Executes dropped EXE
PID:2600 -
\??\c:\pjjdp.exec:\pjjdp.exe50⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1flfffl.exec:\1flfffl.exe51⤵
- Executes dropped EXE
PID:2636 -
\??\c:\5ttnhh.exec:\5ttnhh.exe52⤵
- Executes dropped EXE
PID:3240 -
\??\c:\nhnthh.exec:\nhnthh.exe53⤵
- Executes dropped EXE
PID:3360 -
\??\c:\dpvvv.exec:\dpvvv.exe54⤵
- Executes dropped EXE
PID:1520 -
\??\c:\djjdp.exec:\djjdp.exe55⤵
- Executes dropped EXE
PID:4116 -
\??\c:\3ffxrxr.exec:\3ffxrxr.exe56⤵
- Executes dropped EXE
PID:4800 -
\??\c:\xrlfffl.exec:\xrlfffl.exe57⤵
- Executes dropped EXE
PID:232 -
\??\c:\htnbnh.exec:\htnbnh.exe58⤵
- Executes dropped EXE
PID:4896 -
\??\c:\vvdpd.exec:\vvdpd.exe59⤵
- Executes dropped EXE
PID:3112 -
\??\c:\ffrlrxf.exec:\ffrlrxf.exe60⤵
- Executes dropped EXE
PID:4828 -
\??\c:\lfxfxfx.exec:\lfxfxfx.exe61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2408 -
\??\c:\bnbnhb.exec:\bnbnhb.exe62⤵
- Executes dropped EXE
PID:2468 -
\??\c:\hbbthh.exec:\hbbthh.exe63⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9ddjd.exec:\9ddjd.exe64⤵
- Executes dropped EXE
PID:2072 -
\??\c:\jvvpd.exec:\jvvpd.exe65⤵
- Executes dropped EXE
PID:2440 -
\??\c:\rllxrlf.exec:\rllxrlf.exe66⤵PID:1632
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe67⤵PID:4288
-
\??\c:\tnhbtt.exec:\tnhbtt.exe68⤵
- System Location Discovery: System Language Discovery
PID:3592 -
\??\c:\bnthhb.exec:\bnthhb.exe69⤵PID:4464
-
\??\c:\pjjvd.exec:\pjjvd.exe70⤵PID:2912
-
\??\c:\flllxxr.exec:\flllxxr.exe71⤵PID:3892
-
\??\c:\xrxrfrr.exec:\xrxrfrr.exe72⤵PID:5096
-
\??\c:\tntttb.exec:\tntttb.exe73⤵PID:3352
-
\??\c:\bnbttt.exec:\bnbttt.exe74⤵PID:1120
-
\??\c:\pddvv.exec:\pddvv.exe75⤵PID:5108
-
\??\c:\9rxrrrx.exec:\9rxrrrx.exe76⤵PID:2976
-
\??\c:\9rrrrrf.exec:\9rrrrrf.exe77⤵PID:2536
-
\??\c:\bntnhh.exec:\bntnhh.exe78⤵PID:2676
-
\??\c:\bnnhtn.exec:\bnnhtn.exe79⤵PID:4796
-
\??\c:\jpppd.exec:\jpppd.exe80⤵PID:4448
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe81⤵PID:1160
-
\??\c:\3nthbt.exec:\3nthbt.exe82⤵PID:2888
-
\??\c:\vjvpd.exec:\vjvpd.exe83⤵PID:4352
-
\??\c:\frrrrrl.exec:\frrrrrl.exe84⤵PID:5092
-
\??\c:\ttnhbb.exec:\ttnhbb.exe85⤵PID:3960
-
\??\c:\vddpv.exec:\vddpv.exe86⤵PID:4536
-
\??\c:\rlfxlll.exec:\rlfxlll.exe87⤵PID:2380
-
\??\c:\lflxrrl.exec:\lflxrrl.exe88⤵PID:1052
-
\??\c:\7httbb.exec:\7httbb.exe89⤵PID:1696
-
\??\c:\3hhbnn.exec:\3hhbnn.exe90⤵PID:2260
-
\??\c:\jvjjd.exec:\jvjjd.exe91⤵PID:2928
-
\??\c:\rlflflf.exec:\rlflflf.exe92⤵PID:4040
-
\??\c:\hhnnnh.exec:\hhnnnh.exe93⤵PID:1044
-
\??\c:\tnhhnn.exec:\tnhhnn.exe94⤵PID:2488
-
\??\c:\3hbtnn.exec:\3hbtnn.exe95⤵PID:4092
-
\??\c:\vpjjj.exec:\vpjjj.exe96⤵PID:2080
-
\??\c:\dddvj.exec:\dddvj.exe97⤵PID:2636
-
\??\c:\rrrllll.exec:\rrrllll.exe98⤵PID:3240
-
\??\c:\1fxlffx.exec:\1fxlffx.exe99⤵PID:3360
-
\??\c:\bhhhhh.exec:\bhhhhh.exe100⤵PID:1520
-
\??\c:\1djvp.exec:\1djvp.exe101⤵PID:2284
-
\??\c:\7pppj.exec:\7pppj.exe102⤵PID:3384
-
\??\c:\llrlffx.exec:\llrlffx.exe103⤵PID:4844
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe104⤵PID:4896
-
\??\c:\bnbbbb.exec:\bnbbbb.exe105⤵PID:1432
-
\??\c:\vpvjp.exec:\vpvjp.exe106⤵PID:4904
-
\??\c:\7vjdv.exec:\7vjdv.exe107⤵
- System Location Discovery: System Language Discovery
PID:4628 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe108⤵PID:3064
-
\??\c:\lflllff.exec:\lflllff.exe109⤵PID:3624
-
\??\c:\9ntbhb.exec:\9ntbhb.exe110⤵PID:3776
-
\??\c:\nthbhh.exec:\nthbhh.exe111⤵PID:2464
-
\??\c:\jpjvj.exec:\jpjvj.exe112⤵PID:1632
-
\??\c:\ffxfxxf.exec:\ffxfxxf.exe113⤵PID:1664
-
\??\c:\9llllll.exec:\9llllll.exe114⤵PID:4368
-
\??\c:\nthhtt.exec:\nthhtt.exe115⤵
- System Location Discovery: System Language Discovery
PID:4768 -
\??\c:\vvdjj.exec:\vvdjj.exe116⤵PID:1048
-
\??\c:\fflffxx.exec:\fflffxx.exe117⤵PID:1380
-
\??\c:\nttnth.exec:\nttnth.exe118⤵PID:1924
-
\??\c:\thnnnn.exec:\thnnnn.exe119⤵PID:3160
-
\??\c:\dpvvp.exec:\dpvvp.exe120⤵PID:5052
-
\??\c:\xlllllf.exec:\xlllllf.exe121⤵PID:4664
-
\??\c:\jjvjj.exec:\jjvjj.exe122⤵PID:3608
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-