Analysis
-
max time kernel
119s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 11:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0fd8c69187cc7095f286c7423339c040N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
0fd8c69187cc7095f286c7423339c040N.exe
-
Size
67KB
-
MD5
0fd8c69187cc7095f286c7423339c040
-
SHA1
8478b9b7edf5d3187bd6d49cb1a143c81c863fb8
-
SHA256
3950c9f3a1a1323881693cc7219c987477cc53858c1ded958ceae81585c0bb90
-
SHA512
edfa1ed87e042316fb8bce89d9b79faedea5335d54b8baa16e84df53065a5c81a29e742dab9b0458c99e44bcc59fb3c1056ceedc4046447b973f3671b609e48f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIoAcu:ymb3NkkiQ3mdBjFIsIVcu
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4700-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2108-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 bnhhbb.exe 1064 djpjd.exe 2108 ppjdv.exe 2076 lfrlrrx.exe 4940 3nttnt.exe 3232 jjppp.exe 1208 vpdvd.exe 4452 5lllxxr.exe 1764 lfllrrx.exe 1356 nnbbhh.exe 2452 ththbb.exe 2260 7vvpd.exe 316 rlllffx.exe 3740 1btnnn.exe 2396 tttntn.exe 2312 dvjdp.exe 1156 jvvpd.exe 4468 rrfffff.exe 888 xllfxrf.exe 3256 nbbtbb.exe 4524 hnnnhh.exe 2732 dvjpj.exe 780 lxfxxxr.exe 3140 frrlffx.exe 2036 nbtnhb.exe 1636 vpdjj.exe 3120 vpvpj.exe 5088 fllxrlf.exe 2276 xxrlflf.exe 3360 bnhhnn.exe 4960 7hnhbb.exe 4276 vjppj.exe 1400 xlxrrlf.exe 2500 rxxrrfl.exe 224 lrrlrrl.exe 4884 1tnhbt.exe 1364 hntnhh.exe 4340 3jdvv.exe 1048 vvpjj.exe 3572 fxlxlfx.exe 4596 ntnhtt.exe 4044 hnnbbb.exe 2816 pjjdp.exe 920 vpppj.exe 1244 rfrlxxx.exe 208 fffxffr.exe 2940 hbnhth.exe 2260 thhnnn.exe 5072 jvdvp.exe 2060 1dpjp.exe 3896 7rxxrxl.exe 4956 fxrlxlx.exe 976 bhttnh.exe 1620 htttnn.exe 2368 ddvvp.exe 772 fxlfxxf.exe 4736 9ttbtt.exe 4268 tnbtbb.exe 388 jppjd.exe 4592 fllxxfr.exe 4408 lxflffx.exe 780 ttttnt.exe 3720 jdpjd.exe 5028 pvdvv.exe -
resource yara_rule behavioral2/memory/4700-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2276-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1636-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2108-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-19-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7vvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flflxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnnh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4700 wrote to memory of 2664 4700 0fd8c69187cc7095f286c7423339c040N.exe 84 PID 4700 wrote to memory of 2664 4700 0fd8c69187cc7095f286c7423339c040N.exe 84 PID 4700 wrote to memory of 2664 4700 0fd8c69187cc7095f286c7423339c040N.exe 84 PID 2664 wrote to memory of 1064 2664 bnhhbb.exe 85 PID 2664 wrote to memory of 1064 2664 bnhhbb.exe 85 PID 2664 wrote to memory of 1064 2664 bnhhbb.exe 85 PID 1064 wrote to memory of 2108 1064 djpjd.exe 86 PID 1064 wrote to memory of 2108 1064 djpjd.exe 86 PID 1064 wrote to memory of 2108 1064 djpjd.exe 86 PID 2108 wrote to memory of 2076 2108 ppjdv.exe 87 PID 2108 wrote to memory of 2076 2108 ppjdv.exe 87 PID 2108 wrote to memory of 2076 2108 ppjdv.exe 87 PID 2076 wrote to memory of 4940 2076 lfrlrrx.exe 88 PID 2076 wrote to memory of 4940 2076 lfrlrrx.exe 88 PID 2076 wrote to memory of 4940 2076 lfrlrrx.exe 88 PID 4940 wrote to memory of 3232 4940 3nttnt.exe 89 PID 4940 wrote to memory of 3232 4940 3nttnt.exe 89 PID 4940 wrote to memory of 3232 4940 3nttnt.exe 89 PID 3232 wrote to memory of 1208 3232 jjppp.exe 90 PID 3232 wrote to memory of 1208 3232 jjppp.exe 90 PID 3232 wrote to memory of 1208 3232 jjppp.exe 90 PID 1208 wrote to memory of 4452 1208 vpdvd.exe 91 PID 1208 wrote to memory of 4452 1208 vpdvd.exe 91 PID 1208 wrote to memory of 4452 1208 vpdvd.exe 91 PID 4452 wrote to memory of 1764 4452 5lllxxr.exe 92 PID 4452 wrote to memory of 1764 4452 5lllxxr.exe 92 PID 4452 wrote to memory of 1764 4452 5lllxxr.exe 92 PID 1764 wrote to memory of 1356 1764 lfllrrx.exe 93 PID 1764 wrote to memory of 1356 1764 lfllrrx.exe 93 PID 1764 wrote to memory of 1356 1764 lfllrrx.exe 93 PID 1356 wrote to memory of 2452 1356 nnbbhh.exe 94 PID 1356 wrote to memory of 2452 1356 nnbbhh.exe 94 PID 1356 wrote to memory of 2452 1356 nnbbhh.exe 94 PID 2452 wrote to memory of 2260 2452 ththbb.exe 95 PID 2452 wrote to memory of 2260 2452 ththbb.exe 95 PID 2452 wrote to memory of 2260 2452 ththbb.exe 95 PID 2260 wrote to memory of 316 2260 7vvpd.exe 96 PID 2260 wrote to memory of 316 2260 7vvpd.exe 96 PID 2260 wrote to memory of 316 2260 7vvpd.exe 96 PID 316 wrote to memory of 3740 316 rlllffx.exe 97 PID 316 wrote to memory of 3740 316 rlllffx.exe 97 PID 316 wrote to memory of 3740 316 rlllffx.exe 97 PID 3740 wrote to memory of 2396 3740 1btnnn.exe 99 PID 3740 wrote to memory of 2396 3740 1btnnn.exe 99 PID 3740 wrote to memory of 2396 3740 1btnnn.exe 99 PID 2396 wrote to memory of 2312 2396 tttntn.exe 100 PID 2396 wrote to memory of 2312 2396 tttntn.exe 100 PID 2396 wrote to memory of 2312 2396 tttntn.exe 100 PID 2312 wrote to memory of 1156 2312 dvjdp.exe 101 PID 2312 wrote to memory of 1156 2312 dvjdp.exe 101 PID 2312 wrote to memory of 1156 2312 dvjdp.exe 101 PID 1156 wrote to memory of 4468 1156 jvvpd.exe 102 PID 1156 wrote to memory of 4468 1156 jvvpd.exe 102 PID 1156 wrote to memory of 4468 1156 jvvpd.exe 102 PID 4468 wrote to memory of 888 4468 rrfffff.exe 103 PID 4468 wrote to memory of 888 4468 rrfffff.exe 103 PID 4468 wrote to memory of 888 4468 rrfffff.exe 103 PID 888 wrote to memory of 3256 888 xllfxrf.exe 105 PID 888 wrote to memory of 3256 888 xllfxrf.exe 105 PID 888 wrote to memory of 3256 888 xllfxrf.exe 105 PID 3256 wrote to memory of 4524 3256 nbbtbb.exe 106 PID 3256 wrote to memory of 4524 3256 nbbtbb.exe 106 PID 3256 wrote to memory of 4524 3256 nbbtbb.exe 106 PID 4524 wrote to memory of 2732 4524 hnnnhh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\0fd8c69187cc7095f286c7423339c040N.exe"C:\Users\Admin\AppData\Local\Temp\0fd8c69187cc7095f286c7423339c040N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\bnhhbb.exec:\bnhhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\djpjd.exec:\djpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\ppjdv.exec:\ppjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\lfrlrrx.exec:\lfrlrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\3nttnt.exec:\3nttnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\jjppp.exec:\jjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\vpdvd.exec:\vpdvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\5lllxxr.exec:\5lllxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\lfllrrx.exec:\lfllrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\nnbbhh.exec:\nnbbhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\ththbb.exec:\ththbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\7vvpd.exec:\7vvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\rlllffx.exec:\rlllffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\1btnnn.exec:\1btnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\tttntn.exec:\tttntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\dvjdp.exec:\dvjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\jvvpd.exec:\jvvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\rrfffff.exec:\rrfffff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\xllfxrf.exec:\xllfxrf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\nbbtbb.exec:\nbbtbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\hnnnhh.exec:\hnnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\dvjpj.exec:\dvjpj.exe23⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lxfxxxr.exec:\lxfxxxr.exe24⤵
- Executes dropped EXE
PID:780 -
\??\c:\frrlffx.exec:\frrlffx.exe25⤵
- Executes dropped EXE
PID:3140 -
\??\c:\nbtnhb.exec:\nbtnhb.exe26⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vpdjj.exec:\vpdjj.exe27⤵
- Executes dropped EXE
PID:1636 -
\??\c:\vpvpj.exec:\vpvpj.exe28⤵
- Executes dropped EXE
PID:3120 -
\??\c:\fllxrlf.exec:\fllxrlf.exe29⤵
- Executes dropped EXE
PID:5088 -
\??\c:\xxrlflf.exec:\xxrlflf.exe30⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bnhhnn.exec:\bnhhnn.exe31⤵
- Executes dropped EXE
PID:3360 -
\??\c:\7hnhbb.exec:\7hnhbb.exe32⤵
- Executes dropped EXE
PID:4960 -
\??\c:\vjppj.exec:\vjppj.exe33⤵
- Executes dropped EXE
PID:4276 -
\??\c:\xlxrrlf.exec:\xlxrrlf.exe34⤵
- Executes dropped EXE
PID:1400 -
\??\c:\rxxrrfl.exec:\rxxrrfl.exe35⤵
- Executes dropped EXE
PID:2500 -
\??\c:\lrrlrrl.exec:\lrrlrrl.exe36⤵
- Executes dropped EXE
PID:224 -
\??\c:\1tnhbt.exec:\1tnhbt.exe37⤵
- Executes dropped EXE
PID:4884 -
\??\c:\hntnhh.exec:\hntnhh.exe38⤵
- Executes dropped EXE
PID:1364 -
\??\c:\3jdvv.exec:\3jdvv.exe39⤵
- Executes dropped EXE
PID:4340 -
\??\c:\vvpjj.exec:\vvpjj.exe40⤵
- Executes dropped EXE
PID:1048 -
\??\c:\fxlxlfx.exec:\fxlxlfx.exe41⤵
- Executes dropped EXE
PID:3572 -
\??\c:\ntnhtt.exec:\ntnhtt.exe42⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hnnbbb.exec:\hnnbbb.exe43⤵
- Executes dropped EXE
PID:4044 -
\??\c:\pjjdp.exec:\pjjdp.exe44⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vpppj.exec:\vpppj.exe45⤵
- Executes dropped EXE
PID:920 -
\??\c:\rfrlxxx.exec:\rfrlxxx.exe46⤵
- Executes dropped EXE
PID:1244 -
\??\c:\fffxffr.exec:\fffxffr.exe47⤵
- Executes dropped EXE
PID:208 -
\??\c:\hbnhth.exec:\hbnhth.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\thhnnn.exec:\thhnnn.exe49⤵
- Executes dropped EXE
PID:2260 -
\??\c:\jvdvp.exec:\jvdvp.exe50⤵
- Executes dropped EXE
PID:5072 -
\??\c:\1dpjp.exec:\1dpjp.exe51⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7rxxrxl.exec:\7rxxrxl.exe52⤵
- Executes dropped EXE
PID:3896 -
\??\c:\fxrlxlx.exec:\fxrlxlx.exe53⤵
- Executes dropped EXE
PID:4956 -
\??\c:\bhttnh.exec:\bhttnh.exe54⤵
- Executes dropped EXE
PID:976 -
\??\c:\htttnn.exec:\htttnn.exe55⤵
- Executes dropped EXE
PID:1620 -
\??\c:\ddvvp.exec:\ddvvp.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe57⤵
- Executes dropped EXE
PID:772 -
\??\c:\9ttbtt.exec:\9ttbtt.exe58⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnbtbb.exec:\tnbtbb.exe59⤵
- Executes dropped EXE
PID:4268 -
\??\c:\jppjd.exec:\jppjd.exe60⤵
- Executes dropped EXE
PID:388 -
\??\c:\fllxxfr.exec:\fllxxfr.exe61⤵
- Executes dropped EXE
PID:4592 -
\??\c:\lxflffx.exec:\lxflffx.exe62⤵
- Executes dropped EXE
PID:4408 -
\??\c:\ttttnt.exec:\ttttnt.exe63⤵
- Executes dropped EXE
PID:780 -
\??\c:\jdpjd.exec:\jdpjd.exe64⤵
- Executes dropped EXE
PID:3720 -
\??\c:\pvdvv.exec:\pvdvv.exe65⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rfllllf.exec:\rfllllf.exe66⤵PID:4584
-
\??\c:\llrrfxx.exec:\llrrfxx.exe67⤵PID:2960
-
\??\c:\nhhbhh.exec:\nhhbhh.exe68⤵PID:4756
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵
- System Location Discovery: System Language Discovery
PID:2096 -
\??\c:\7djdp.exec:\7djdp.exe70⤵PID:4204
-
\??\c:\vjpjd.exec:\vjpjd.exe71⤵PID:4312
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe72⤵PID:2276
-
\??\c:\xxlxlfl.exec:\xxlxlfl.exe73⤵PID:4548
-
\??\c:\tnnnhh.exec:\tnnnhh.exe74⤵PID:3336
-
\??\c:\hbbtnn.exec:\hbbtnn.exe75⤵PID:4304
-
\??\c:\3jdvv.exec:\3jdvv.exe76⤵PID:4276
-
\??\c:\lfrlxrr.exec:\lfrlxrr.exe77⤵PID:3900
-
\??\c:\3flfffx.exec:\3flfffx.exe78⤵PID:1044
-
\??\c:\bbbnht.exec:\bbbnht.exe79⤵PID:884
-
\??\c:\bnnhtt.exec:\bnnhtt.exe80⤵PID:1088
-
\??\c:\jjpjv.exec:\jjpjv.exe81⤵PID:4008
-
\??\c:\frrlfff.exec:\frrlfff.exe82⤵PID:1944
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe83⤵PID:3016
-
\??\c:\nhttbb.exec:\nhttbb.exe84⤵PID:1048
-
\??\c:\vjjdd.exec:\vjjdd.exe85⤵PID:4768
-
\??\c:\3pvpd.exec:\3pvpd.exe86⤵PID:3156
-
\??\c:\djvpj.exec:\djvpj.exe87⤵PID:4472
-
\??\c:\llrlxrr.exec:\llrlxrr.exe88⤵PID:2700
-
\??\c:\9xrxlll.exec:\9xrxlll.exe89⤵PID:3996
-
\??\c:\nbbttt.exec:\nbbttt.exe90⤵PID:4732
-
\??\c:\bttnhb.exec:\bttnhb.exe91⤵PID:2452
-
\??\c:\vjpjv.exec:\vjpjv.exe92⤵PID:4308
-
\??\c:\xflfxxr.exec:\xflfxxr.exe93⤵PID:3460
-
\??\c:\rfrrllf.exec:\rfrrllf.exe94⤵PID:1692
-
\??\c:\bnbbnn.exec:\bnbbnn.exe95⤵PID:4388
-
\??\c:\tbthtt.exec:\tbthtt.exe96⤵PID:2396
-
\??\c:\dvpjd.exec:\dvpjd.exe97⤵PID:3020
-
\??\c:\vdvjd.exec:\vdvjd.exe98⤵PID:1548
-
\??\c:\lxfxfxr.exec:\lxfxfxr.exe99⤵PID:1916
-
\??\c:\fxlllll.exec:\fxlllll.exe100⤵PID:1912
-
\??\c:\hhhbnn.exec:\hhhbnn.exe101⤵PID:4928
-
\??\c:\nhhbnh.exec:\nhhbnh.exe102⤵PID:2212
-
\??\c:\djvjd.exec:\djvjd.exe103⤵PID:1760
-
\??\c:\7vppd.exec:\7vppd.exe104⤵PID:4088
-
\??\c:\7flxllr.exec:\7flxllr.exe105⤵PID:4592
-
\??\c:\xffxrll.exec:\xffxrll.exe106⤵PID:2592
-
\??\c:\nnthbt.exec:\nnthbt.exe107⤵PID:3564
-
\??\c:\tnnhtn.exec:\tnnhtn.exe108⤵PID:2080
-
\??\c:\vjpjv.exec:\vjpjv.exe109⤵PID:5028
-
\??\c:\1xxrlff.exec:\1xxrlff.exe110⤵PID:4584
-
\??\c:\nhbbbb.exec:\nhbbbb.exe111⤵PID:2960
-
\??\c:\jdvpp.exec:\jdvpp.exe112⤵PID:4064
-
\??\c:\llxrlff.exec:\llxrlff.exe113⤵PID:3492
-
\??\c:\nbhhbt.exec:\nbhhbt.exe114⤵PID:4204
-
\??\c:\dpjdp.exec:\dpjdp.exe115⤵PID:116
-
\??\c:\rfrflff.exec:\rfrflff.exe116⤵PID:968
-
\??\c:\ttnbhb.exec:\ttnbhb.exe117⤵PID:2448
-
\??\c:\bttnhb.exec:\bttnhb.exe118⤵PID:4420
-
\??\c:\ddddv.exec:\ddddv.exe119⤵PID:3732
-
\??\c:\jpjvp.exec:\jpjvp.exe120⤵PID:5008
-
\??\c:\lfrfrlf.exec:\lfrfrlf.exe121⤵PID:2016
-
\??\c:\xffxrlf.exec:\xffxrlf.exe122⤵PID:1732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-