Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
24-08-2024 04:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
19d0c65482ad77c6385914b10c736e40N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
19d0c65482ad77c6385914b10c736e40N.exe
-
Size
92KB
-
MD5
19d0c65482ad77c6385914b10c736e40
-
SHA1
c2e2acca004dc77bc83a2d304255f57ac706ba17
-
SHA256
56910911ada561beacb746c62f51ad8e5e8df7b933b33395b4daeef6c2a1aa8a
-
SHA512
39ba708b0e5a2099480bc06c16403cf12b075efaf33ddd6437db8180430f9367e0f3143278466977f39c0b8b5eb7a88219b2f11c4a3d1af1bc1b09048cb7dca3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLn9q:ymb3NkkiQ3mdBjFIi/REUZnKlb94h
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2336-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/472-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1428-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3320-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1160 tnnhth.exe 4508 djddv.exe 3228 5lrflfl.exe 560 xxxffxr.exe 2100 bnnnhh.exe 1580 dpvpj.exe 5104 5xrlffx.exe 2336 tnnhhh.exe 472 dvvpd.exe 1428 3rxrlrl.exe 4356 rrxxfxl.exe 2328 btbbtt.exe 3320 ntbthh.exe 4612 vpppj.exe 3768 xlxrfxx.exe 3800 1rlxrlr.exe 1448 tnnhbb.exe 1064 httnnh.exe 3364 dvdvj.exe 1524 xllfrxr.exe 2768 fflxllx.exe 4776 tntttt.exe 1492 vjppj.exe 1208 fxfxxxr.exe 5004 bbtnnn.exe 892 3bhhbb.exe 1408 rlllfll.exe 3524 5tnhbb.exe 4868 nnnhth.exe 1824 dvjvv.exe 1780 9xrlxrl.exe 3860 xxlllxx.exe 3908 thttnn.exe 4408 vvjdp.exe 3012 9dvpj.exe 4468 rrrlrrr.exe 2668 lffxrlf.exe 3484 tnhnhh.exe 1304 djjjd.exe 3112 7vdvd.exe 560 xlxrrll.exe 2100 hnhtnh.exe 1608 nntnhh.exe 3420 7vdvv.exe 5104 djjdj.exe 1588 fxxrffr.exe 1036 xxlflll.exe 1676 7ntthh.exe 2988 nhnhhh.exe 1380 jdvjd.exe 4356 djjjd.exe 1332 3rxlxrl.exe 1816 9rxrxrx.exe 2764 bnthbt.exe 2840 tnthtt.exe 2124 5jdpj.exe 3800 fxxfxff.exe 1848 ththnb.exe 4416 thtbnh.exe 924 jjddp.exe 3364 djddp.exe 4432 fflfffx.exe 2132 tbtnhh.exe 2968 7vdpj.exe -
resource yara_rule behavioral2/memory/2196-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2336-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/472-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1428-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1llfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2196 wrote to memory of 1160 2196 19d0c65482ad77c6385914b10c736e40N.exe 86 PID 2196 wrote to memory of 1160 2196 19d0c65482ad77c6385914b10c736e40N.exe 86 PID 2196 wrote to memory of 1160 2196 19d0c65482ad77c6385914b10c736e40N.exe 86 PID 1160 wrote to memory of 4508 1160 tnnhth.exe 87 PID 1160 wrote to memory of 4508 1160 tnnhth.exe 87 PID 1160 wrote to memory of 4508 1160 tnnhth.exe 87 PID 4508 wrote to memory of 3228 4508 djddv.exe 88 PID 4508 wrote to memory of 3228 4508 djddv.exe 88 PID 4508 wrote to memory of 3228 4508 djddv.exe 88 PID 3228 wrote to memory of 560 3228 5lrflfl.exe 89 PID 3228 wrote to memory of 560 3228 5lrflfl.exe 89 PID 3228 wrote to memory of 560 3228 5lrflfl.exe 89 PID 560 wrote to memory of 2100 560 xxxffxr.exe 90 PID 560 wrote to memory of 2100 560 xxxffxr.exe 90 PID 560 wrote to memory of 2100 560 xxxffxr.exe 90 PID 2100 wrote to memory of 1580 2100 bnnnhh.exe 91 PID 2100 wrote to memory of 1580 2100 bnnnhh.exe 91 PID 2100 wrote to memory of 1580 2100 bnnnhh.exe 91 PID 1580 wrote to memory of 5104 1580 dpvpj.exe 92 PID 1580 wrote to memory of 5104 1580 dpvpj.exe 92 PID 1580 wrote to memory of 5104 1580 dpvpj.exe 92 PID 5104 wrote to memory of 2336 5104 5xrlffx.exe 93 PID 5104 wrote to memory of 2336 5104 5xrlffx.exe 93 PID 5104 wrote to memory of 2336 5104 5xrlffx.exe 93 PID 2336 wrote to memory of 472 2336 tnnhhh.exe 94 PID 2336 wrote to memory of 472 2336 tnnhhh.exe 94 PID 2336 wrote to memory of 472 2336 tnnhhh.exe 94 PID 472 wrote to memory of 1428 472 dvvpd.exe 95 PID 472 wrote to memory of 1428 472 dvvpd.exe 95 PID 472 wrote to memory of 1428 472 dvvpd.exe 95 PID 1428 wrote to memory of 4356 1428 3rxrlrl.exe 96 PID 1428 wrote to memory of 4356 1428 3rxrlrl.exe 96 PID 1428 wrote to memory of 4356 1428 3rxrlrl.exe 96 PID 4356 wrote to memory of 2328 4356 rrxxfxl.exe 97 PID 4356 wrote to memory of 2328 4356 rrxxfxl.exe 97 PID 4356 wrote to memory of 2328 4356 rrxxfxl.exe 97 PID 2328 wrote to memory of 3320 2328 btbbtt.exe 98 PID 2328 wrote to memory of 3320 2328 btbbtt.exe 98 PID 2328 wrote to memory of 3320 2328 btbbtt.exe 98 PID 3320 wrote to memory of 4612 3320 ntbthh.exe 99 PID 3320 wrote to memory of 4612 3320 ntbthh.exe 99 PID 3320 wrote to memory of 4612 3320 ntbthh.exe 99 PID 4612 wrote to memory of 3768 4612 vpppj.exe 100 PID 4612 wrote to memory of 3768 4612 vpppj.exe 100 PID 4612 wrote to memory of 3768 4612 vpppj.exe 100 PID 3768 wrote to memory of 3800 3768 xlxrfxx.exe 101 PID 3768 wrote to memory of 3800 3768 xlxrfxx.exe 101 PID 3768 wrote to memory of 3800 3768 xlxrfxx.exe 101 PID 3800 wrote to memory of 1448 3800 1rlxrlr.exe 102 PID 3800 wrote to memory of 1448 3800 1rlxrlr.exe 102 PID 3800 wrote to memory of 1448 3800 1rlxrlr.exe 102 PID 1448 wrote to memory of 1064 1448 tnnhbb.exe 103 PID 1448 wrote to memory of 1064 1448 tnnhbb.exe 103 PID 1448 wrote to memory of 1064 1448 tnnhbb.exe 103 PID 1064 wrote to memory of 3364 1064 httnnh.exe 104 PID 1064 wrote to memory of 3364 1064 httnnh.exe 104 PID 1064 wrote to memory of 3364 1064 httnnh.exe 104 PID 3364 wrote to memory of 1524 3364 dvdvj.exe 105 PID 3364 wrote to memory of 1524 3364 dvdvj.exe 105 PID 3364 wrote to memory of 1524 3364 dvdvj.exe 105 PID 1524 wrote to memory of 2768 1524 xllfrxr.exe 106 PID 1524 wrote to memory of 2768 1524 xllfrxr.exe 106 PID 1524 wrote to memory of 2768 1524 xllfrxr.exe 106 PID 2768 wrote to memory of 4776 2768 fflxllx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\19d0c65482ad77c6385914b10c736e40N.exe"C:\Users\Admin\AppData\Local\Temp\19d0c65482ad77c6385914b10c736e40N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\tnnhth.exec:\tnnhth.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\djddv.exec:\djddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\5lrflfl.exec:\5lrflfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\xxxffxr.exec:\xxxffxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\bnnnhh.exec:\bnnnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\dpvpj.exec:\dpvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\5xrlffx.exec:\5xrlffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\tnnhhh.exec:\tnnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\dvvpd.exec:\dvvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:472 -
\??\c:\3rxrlrl.exec:\3rxrlrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\rrxxfxl.exec:\rrxxfxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\btbbtt.exec:\btbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\ntbthh.exec:\ntbthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\vpppj.exec:\vpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\xlxrfxx.exec:\xlxrfxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\1rlxrlr.exec:\1rlxrlr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\tnnhbb.exec:\tnnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\httnnh.exec:\httnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\dvdvj.exec:\dvdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\xllfrxr.exec:\xllfrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\fflxllx.exec:\fflxllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tntttt.exec:\tntttt.exe23⤵
- Executes dropped EXE
PID:4776 -
\??\c:\vjppj.exec:\vjppj.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe25⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbtnnn.exec:\bbtnnn.exe26⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3bhhbb.exec:\3bhhbb.exe27⤵
- Executes dropped EXE
PID:892 -
\??\c:\rlllfll.exec:\rlllfll.exe28⤵
- Executes dropped EXE
PID:1408 -
\??\c:\5tnhbb.exec:\5tnhbb.exe29⤵
- Executes dropped EXE
PID:3524 -
\??\c:\nnnhth.exec:\nnnhth.exe30⤵
- Executes dropped EXE
PID:4868 -
\??\c:\dvjvv.exec:\dvjvv.exe31⤵
- Executes dropped EXE
PID:1824 -
\??\c:\9xrlxrl.exec:\9xrlxrl.exe32⤵
- Executes dropped EXE
PID:1780 -
\??\c:\xxlllxx.exec:\xxlllxx.exe33⤵
- Executes dropped EXE
PID:3860 -
\??\c:\thttnn.exec:\thttnn.exe34⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vvjdp.exec:\vvjdp.exe35⤵
- Executes dropped EXE
PID:4408 -
\??\c:\9dvpj.exec:\9dvpj.exe36⤵
- Executes dropped EXE
PID:3012 -
\??\c:\rrrlrrr.exec:\rrrlrrr.exe37⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lffxrlf.exec:\lffxrlf.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\tnhnhh.exec:\tnhnhh.exe39⤵
- Executes dropped EXE
PID:3484 -
\??\c:\djjjd.exec:\djjjd.exe40⤵
- Executes dropped EXE
PID:1304 -
\??\c:\7vdvd.exec:\7vdvd.exe41⤵
- Executes dropped EXE
PID:3112 -
\??\c:\xlxrrll.exec:\xlxrrll.exe42⤵
- Executes dropped EXE
PID:560 -
\??\c:\hnhtnh.exec:\hnhtnh.exe43⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nntnhh.exec:\nntnhh.exe44⤵
- Executes dropped EXE
PID:1608 -
\??\c:\7vdvv.exec:\7vdvv.exe45⤵
- Executes dropped EXE
PID:3420 -
\??\c:\djjdj.exec:\djjdj.exe46⤵
- Executes dropped EXE
PID:5104 -
\??\c:\fxxrffr.exec:\fxxrffr.exe47⤵
- Executes dropped EXE
PID:1588 -
\??\c:\xxlflll.exec:\xxlflll.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7ntthh.exec:\7ntthh.exe49⤵
- Executes dropped EXE
PID:1676 -
\??\c:\nhnhhh.exec:\nhnhhh.exe50⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jdvjd.exec:\jdvjd.exe51⤵
- Executes dropped EXE
PID:1380 -
\??\c:\djjjd.exec:\djjjd.exe52⤵
- Executes dropped EXE
PID:4356 -
\??\c:\3rxlxrl.exec:\3rxlxrl.exe53⤵
- Executes dropped EXE
PID:1332 -
\??\c:\9rxrxrx.exec:\9rxrxrx.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\bnthbt.exec:\bnthbt.exe55⤵
- Executes dropped EXE
PID:2764 -
\??\c:\tnthtt.exec:\tnthtt.exe56⤵
- Executes dropped EXE
PID:2840 -
\??\c:\5jdpj.exec:\5jdpj.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxxfxff.exec:\fxxfxff.exe58⤵
- Executes dropped EXE
PID:3800 -
\??\c:\ththnb.exec:\ththnb.exe59⤵
- Executes dropped EXE
PID:1848 -
\??\c:\thtbnh.exec:\thtbnh.exe60⤵
- Executes dropped EXE
PID:4416 -
\??\c:\jjddp.exec:\jjddp.exe61⤵
- Executes dropped EXE
PID:924 -
\??\c:\djddp.exec:\djddp.exe62⤵
- Executes dropped EXE
PID:3364 -
\??\c:\fflfffx.exec:\fflfffx.exe63⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tbtnhh.exec:\tbtnhh.exe64⤵
- Executes dropped EXE
PID:2132 -
\??\c:\7vdpj.exec:\7vdpj.exe65⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jvvpd.exec:\jvvpd.exe66⤵PID:3332
-
\??\c:\5rrfrrf.exec:\5rrfrrf.exe67⤵PID:3684
-
\??\c:\nbhbth.exec:\nbhbth.exe68⤵PID:2168
-
\??\c:\jdpjd.exec:\jdpjd.exe69⤵PID:724
-
\??\c:\9vpdv.exec:\9vpdv.exe70⤵PID:4996
-
\??\c:\fxfxxrr.exec:\fxfxxrr.exe71⤵PID:4608
-
\??\c:\lfllfxr.exec:\lfllfxr.exe72⤵PID:1168
-
\??\c:\bhtnhn.exec:\bhtnhn.exe73⤵PID:2508
-
\??\c:\vddjv.exec:\vddjv.exe74⤵PID:4596
-
\??\c:\jddjv.exec:\jddjv.exe75⤵PID:824
-
\??\c:\rrxrxrl.exec:\rrxrxrl.exe76⤵PID:216
-
\??\c:\ffllrlr.exec:\ffllrlr.exe77⤵PID:4216
-
\??\c:\bhnbnb.exec:\bhnbnb.exe78⤵PID:1152
-
\??\c:\bbnnnn.exec:\bbnnnn.exe79⤵PID:4228
-
\??\c:\3vpjd.exec:\3vpjd.exe80⤵PID:388
-
\??\c:\7vvvj.exec:\7vvvj.exe81⤵PID:2040
-
\??\c:\btttnn.exec:\btttnn.exe82⤵PID:1180
-
\??\c:\3bbttn.exec:\3bbttn.exe83⤵PID:2028
-
\??\c:\vjdvp.exec:\vjdvp.exe84⤵PID:4468
-
\??\c:\pppjj.exec:\pppjj.exe85⤵PID:3496
-
\??\c:\fxfrxlr.exec:\fxfrxlr.exe86⤵PID:2796
-
\??\c:\hnnhbb.exec:\hnnhbb.exe87⤵PID:4808
-
\??\c:\9jpjj.exec:\9jpjj.exe88⤵PID:928
-
\??\c:\jdjdp.exec:\jdjdp.exe89⤵PID:4604
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe90⤵PID:3024
-
\??\c:\7xfxfff.exec:\7xfxfff.exe91⤵PID:1580
-
\??\c:\hhnbnh.exec:\hhnbnh.exe92⤵PID:3032
-
\??\c:\htbhhh.exec:\htbhhh.exe93⤵PID:3412
-
\??\c:\pjpjv.exec:\pjpjv.exe94⤵PID:3952
-
\??\c:\jvvjv.exec:\jvvjv.exe95⤵PID:64
-
\??\c:\rffxxrl.exec:\rffxxrl.exe96⤵
- System Location Discovery: System Language Discovery
PID:1876 -
\??\c:\rlfxlfr.exec:\rlfxlfr.exe97⤵PID:4232
-
\??\c:\bnhhbb.exec:\bnhhbb.exe98⤵PID:372
-
\??\c:\nbnhnt.exec:\nbnhnt.exe99⤵PID:1216
-
\??\c:\jjjjv.exec:\jjjjv.exe100⤵PID:728
-
\??\c:\jppjv.exec:\jppjv.exe101⤵PID:2128
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe102⤵PID:400
-
\??\c:\5xfxrlf.exec:\5xfxrlf.exe103⤵PID:4132
-
\??\c:\htnhbt.exec:\htnhbt.exe104⤵PID:1736
-
\??\c:\hbtthn.exec:\hbtthn.exe105⤵PID:2840
-
\??\c:\pjvjv.exec:\pjvjv.exe106⤵PID:4068
-
\??\c:\pdjdv.exec:\pdjdv.exe107⤵PID:3800
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe108⤵PID:1848
-
\??\c:\ffrxlxr.exec:\ffrxlxr.exe109⤵PID:2592
-
\??\c:\bbbnhh.exec:\bbbnhh.exe110⤵PID:4912
-
\??\c:\bbnbhb.exec:\bbnbhb.exe111⤵PID:3364
-
\??\c:\9dddv.exec:\9dddv.exe112⤵PID:2016
-
\??\c:\9xfxlfx.exec:\9xfxlfx.exe113⤵
- System Location Discovery: System Language Discovery
PID:404 -
\??\c:\rlxlllr.exec:\rlxlllr.exe114⤵PID:3612
-
\??\c:\5tbbhb.exec:\5tbbhb.exe115⤵PID:1440
-
\??\c:\pjjdp.exec:\pjjdp.exe116⤵PID:1208
-
\??\c:\9flfxxx.exec:\9flfxxx.exe117⤵PID:4548
-
\??\c:\xrfrlfl.exec:\xrfrlfl.exe118⤵PID:352
-
\??\c:\nbbnhb.exec:\nbbnhb.exe119⤵PID:4172
-
\??\c:\nhhtnh.exec:\nhhtnh.exe120⤵PID:4240
-
\??\c:\5djdp.exec:\5djdp.exe121⤵PID:1408
-
\??\c:\lxxrlrl.exec:\lxxrlrl.exe122⤵PID:3336
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-