Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 06:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2264689478909fe19136fcee06585a80N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
2264689478909fe19136fcee06585a80N.exe
-
Size
71KB
-
MD5
2264689478909fe19136fcee06585a80
-
SHA1
3a910179d0a034840b040e65264b2ab677272200
-
SHA256
85d6998f66fac1aca2d5c9be257970adf1f08ccb13a06bd9f2fdffcec4e304a1
-
SHA512
5de2df35ce447b9523d061da2cf86c9699ae0dec3b84fb293c4723da7256e57163d87392af1448216b410dbcd970693db02c7840e251871bd77862fae8f8fb41
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj6:ymb3NkkiQ3mdBjFI4Vq
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2740-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/416-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3088-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2616-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1584 pvddd.exe 3728 xlllfrx.exe 1808 hthbnn.exe 1924 vdppd.exe 416 rlxllfl.exe 2084 ttbnbn.exe 3272 1jpjj.exe 1604 ppvpp.exe 3300 nnbhhn.exe 3088 7hbbtt.exe 3252 jvpjv.exe 5104 rlllrll.exe 4500 nttnhb.exe 2616 jjdvp.exe 3460 jvvpj.exe 112 lflrxxf.exe 4528 ffrllll.exe 3552 nthhnh.exe 3588 vpjjv.exe 4292 xlxrlfx.exe 1084 hhttbt.exe 1188 btnhbt.exe 1980 pjvpp.exe 1104 llrrrrx.exe 3096 btbtbb.exe 1568 3hhbtt.exe 1844 pvjjd.exe 2056 fffxllf.exe 1432 1xxxrlf.exe 4984 5nnhbt.exe 1996 vvpdp.exe 3248 9xrlrrf.exe 1592 lfffxxl.exe 1028 ntthbn.exe 4552 9bhtbb.exe 3232 xfrlxxr.exe 3352 nhnhhb.exe 4412 nhnhbt.exe 832 5jpjd.exe 4172 lflfxxr.exe 5048 ffffxxx.exe 3728 ttnnnh.exe 2164 nbhtnn.exe 2356 9pvpd.exe 1472 7jvjd.exe 4380 lrrxlll.exe 524 fffxfff.exe 3304 nnnnhh.exe 3732 tbtbtt.exe 3940 dpjvv.exe 216 ppjdv.exe 3816 3rrlxxr.exe 1436 1rxlxxr.exe 4792 ntnnnh.exe 3064 9bbbbb.exe 4224 ttnbtt.exe 3716 vjjdv.exe 5064 rrxrlff.exe 272 flllffr.exe 3460 ntnnhb.exe 1728 7htbnn.exe 3336 1ddvp.exe 2148 3djdj.exe 3296 fflxxrx.exe -
resource yara_rule behavioral2/memory/2740-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3088-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2616-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1584 2740 2264689478909fe19136fcee06585a80N.exe 83 PID 2740 wrote to memory of 1584 2740 2264689478909fe19136fcee06585a80N.exe 83 PID 2740 wrote to memory of 1584 2740 2264689478909fe19136fcee06585a80N.exe 83 PID 1584 wrote to memory of 3728 1584 pvddd.exe 84 PID 1584 wrote to memory of 3728 1584 pvddd.exe 84 PID 1584 wrote to memory of 3728 1584 pvddd.exe 84 PID 3728 wrote to memory of 1808 3728 xlllfrx.exe 85 PID 3728 wrote to memory of 1808 3728 xlllfrx.exe 85 PID 3728 wrote to memory of 1808 3728 xlllfrx.exe 85 PID 1808 wrote to memory of 1924 1808 hthbnn.exe 86 PID 1808 wrote to memory of 1924 1808 hthbnn.exe 86 PID 1808 wrote to memory of 1924 1808 hthbnn.exe 86 PID 1924 wrote to memory of 416 1924 vdppd.exe 87 PID 1924 wrote to memory of 416 1924 vdppd.exe 87 PID 1924 wrote to memory of 416 1924 vdppd.exe 87 PID 416 wrote to memory of 2084 416 rlxllfl.exe 88 PID 416 wrote to memory of 2084 416 rlxllfl.exe 88 PID 416 wrote to memory of 2084 416 rlxllfl.exe 88 PID 2084 wrote to memory of 3272 2084 ttbnbn.exe 89 PID 2084 wrote to memory of 3272 2084 ttbnbn.exe 89 PID 2084 wrote to memory of 3272 2084 ttbnbn.exe 89 PID 3272 wrote to memory of 1604 3272 1jpjj.exe 90 PID 3272 wrote to memory of 1604 3272 1jpjj.exe 90 PID 3272 wrote to memory of 1604 3272 1jpjj.exe 90 PID 1604 wrote to memory of 3300 1604 ppvpp.exe 91 PID 1604 wrote to memory of 3300 1604 ppvpp.exe 91 PID 1604 wrote to memory of 3300 1604 ppvpp.exe 91 PID 3300 wrote to memory of 3088 3300 nnbhhn.exe 92 PID 3300 wrote to memory of 3088 3300 nnbhhn.exe 92 PID 3300 wrote to memory of 3088 3300 nnbhhn.exe 92 PID 3088 wrote to memory of 3252 3088 7hbbtt.exe 93 PID 3088 wrote to memory of 3252 3088 7hbbtt.exe 93 PID 3088 wrote to memory of 3252 3088 7hbbtt.exe 93 PID 3252 wrote to memory of 5104 3252 jvpjv.exe 94 PID 3252 wrote to memory of 5104 3252 jvpjv.exe 94 PID 3252 wrote to memory of 5104 3252 jvpjv.exe 94 PID 5104 wrote to memory of 4500 5104 rlllrll.exe 95 PID 5104 wrote to memory of 4500 5104 rlllrll.exe 95 PID 5104 wrote to memory of 4500 5104 rlllrll.exe 95 PID 4500 wrote to memory of 2616 4500 nttnhb.exe 97 PID 4500 wrote to memory of 2616 4500 nttnhb.exe 97 PID 4500 wrote to memory of 2616 4500 nttnhb.exe 97 PID 2616 wrote to memory of 3460 2616 jjdvp.exe 98 PID 2616 wrote to memory of 3460 2616 jjdvp.exe 98 PID 2616 wrote to memory of 3460 2616 jjdvp.exe 98 PID 3460 wrote to memory of 112 3460 jvvpj.exe 99 PID 3460 wrote to memory of 112 3460 jvvpj.exe 99 PID 3460 wrote to memory of 112 3460 jvvpj.exe 99 PID 112 wrote to memory of 4528 112 lflrxxf.exe 100 PID 112 wrote to memory of 4528 112 lflrxxf.exe 100 PID 112 wrote to memory of 4528 112 lflrxxf.exe 100 PID 4528 wrote to memory of 3552 4528 ffrllll.exe 101 PID 4528 wrote to memory of 3552 4528 ffrllll.exe 101 PID 4528 wrote to memory of 3552 4528 ffrllll.exe 101 PID 3552 wrote to memory of 3588 3552 nthhnh.exe 103 PID 3552 wrote to memory of 3588 3552 nthhnh.exe 103 PID 3552 wrote to memory of 3588 3552 nthhnh.exe 103 PID 3588 wrote to memory of 4292 3588 vpjjv.exe 104 PID 3588 wrote to memory of 4292 3588 vpjjv.exe 104 PID 3588 wrote to memory of 4292 3588 vpjjv.exe 104 PID 4292 wrote to memory of 1084 4292 xlxrlfx.exe 105 PID 4292 wrote to memory of 1084 4292 xlxrlfx.exe 105 PID 4292 wrote to memory of 1084 4292 xlxrlfx.exe 105 PID 1084 wrote to memory of 1188 1084 hhttbt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2264689478909fe19136fcee06585a80N.exe"C:\Users\Admin\AppData\Local\Temp\2264689478909fe19136fcee06585a80N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pvddd.exec:\pvddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\xlllfrx.exec:\xlllfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\hthbnn.exec:\hthbnn.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\vdppd.exec:\vdppd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\rlxllfl.exec:\rlxllfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\ttbnbn.exec:\ttbnbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\1jpjj.exec:\1jpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\ppvpp.exec:\ppvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\nnbhhn.exec:\nnbhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\7hbbtt.exec:\7hbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3088 -
\??\c:\jvpjv.exec:\jvpjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\rlllrll.exec:\rlllrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\nttnhb.exec:\nttnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\jjdvp.exec:\jjdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jvvpj.exec:\jvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\lflrxxf.exec:\lflrxxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\ffrllll.exec:\ffrllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\nthhnh.exec:\nthhnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\vpjjv.exec:\vpjjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\hhttbt.exec:\hhttbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\btnhbt.exec:\btnhbt.exe23⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pjvpp.exec:\pjvpp.exe24⤵
- Executes dropped EXE
PID:1980 -
\??\c:\llrrrrx.exec:\llrrrrx.exe25⤵
- Executes dropped EXE
PID:1104 -
\??\c:\btbtbb.exec:\btbtbb.exe26⤵
- Executes dropped EXE
PID:3096 -
\??\c:\3hhbtt.exec:\3hhbtt.exe27⤵
- Executes dropped EXE
PID:1568 -
\??\c:\pvjjd.exec:\pvjjd.exe28⤵
- Executes dropped EXE
PID:1844 -
\??\c:\fffxllf.exec:\fffxllf.exe29⤵
- Executes dropped EXE
PID:2056 -
\??\c:\1xxxrlf.exec:\1xxxrlf.exe30⤵
- Executes dropped EXE
PID:1432 -
\??\c:\5nnhbt.exec:\5nnhbt.exe31⤵
- Executes dropped EXE
PID:4984 -
\??\c:\vvpdp.exec:\vvpdp.exe32⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9xrlrrf.exec:\9xrlrrf.exe33⤵
- Executes dropped EXE
PID:3248 -
\??\c:\lfffxxl.exec:\lfffxxl.exe34⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ntthbn.exec:\ntthbn.exe35⤵
- Executes dropped EXE
PID:1028 -
\??\c:\9bhtbb.exec:\9bhtbb.exe36⤵
- Executes dropped EXE
PID:4552 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe37⤵
- Executes dropped EXE
PID:3232 -
\??\c:\nhnhhb.exec:\nhnhhb.exe38⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nhnhbt.exec:\nhnhbt.exe39⤵
- Executes dropped EXE
PID:4412 -
\??\c:\5jpjd.exec:\5jpjd.exe40⤵
- Executes dropped EXE
PID:832 -
\??\c:\lflfxxr.exec:\lflfxxr.exe41⤵
- Executes dropped EXE
PID:4172 -
\??\c:\ffffxxx.exec:\ffffxxx.exe42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5048 -
\??\c:\ttnnnh.exec:\ttnnnh.exe43⤵
- Executes dropped EXE
PID:3728 -
\??\c:\nbhtnn.exec:\nbhtnn.exe44⤵
- Executes dropped EXE
PID:2164 -
\??\c:\9pvpd.exec:\9pvpd.exe45⤵
- Executes dropped EXE
PID:2356 -
\??\c:\7jvjd.exec:\7jvjd.exe46⤵
- Executes dropped EXE
PID:1472 -
\??\c:\lrrxlll.exec:\lrrxlll.exe47⤵
- Executes dropped EXE
PID:4380 -
\??\c:\fffxfff.exec:\fffxfff.exe48⤵
- Executes dropped EXE
PID:524 -
\??\c:\nnnnhh.exec:\nnnnhh.exe49⤵
- Executes dropped EXE
PID:3304 -
\??\c:\tbtbtt.exec:\tbtbtt.exe50⤵
- Executes dropped EXE
PID:3732 -
\??\c:\dpjvv.exec:\dpjvv.exe51⤵
- Executes dropped EXE
PID:3940 -
\??\c:\ppjdv.exec:\ppjdv.exe52⤵
- Executes dropped EXE
PID:216 -
\??\c:\3rrlxxr.exec:\3rrlxxr.exe53⤵
- Executes dropped EXE
PID:3816 -
\??\c:\1rxlxxr.exec:\1rxlxxr.exe54⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ntnnnh.exec:\ntnnnh.exe55⤵
- Executes dropped EXE
PID:4792 -
\??\c:\9bbbbb.exec:\9bbbbb.exe56⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ttnbtt.exec:\ttnbtt.exe57⤵
- Executes dropped EXE
PID:4224 -
\??\c:\vjjdv.exec:\vjjdv.exe58⤵
- Executes dropped EXE
PID:3716 -
\??\c:\rrxrlff.exec:\rrxrlff.exe59⤵
- Executes dropped EXE
PID:5064 -
\??\c:\flllffr.exec:\flllffr.exe60⤵
- Executes dropped EXE
PID:272 -
\??\c:\ntnnhb.exec:\ntnnhb.exe61⤵
- Executes dropped EXE
PID:3460 -
\??\c:\7htbnn.exec:\7htbnn.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\1ddvp.exec:\1ddvp.exe63⤵
- Executes dropped EXE
PID:3336 -
\??\c:\3djdj.exec:\3djdj.exe64⤵
- Executes dropped EXE
PID:2148 -
\??\c:\fflxxrx.exec:\fflxxrx.exe65⤵
- Executes dropped EXE
PID:3296 -
\??\c:\1xfxllx.exec:\1xfxllx.exe66⤵PID:2080
-
\??\c:\tttnhn.exec:\tttnhn.exe67⤵PID:3588
-
\??\c:\rllfxxx.exec:\rllfxxx.exe68⤵PID:1092
-
\??\c:\llxxffl.exec:\llxxffl.exe69⤵PID:1908
-
\??\c:\nbbttt.exec:\nbbttt.exe70⤵PID:4580
-
\??\c:\3hnhhn.exec:\3hnhhn.exe71⤵PID:3668
-
\??\c:\jjjdv.exec:\jjjdv.exe72⤵PID:4084
-
\??\c:\ppppj.exec:\ppppj.exe73⤵PID:3328
-
\??\c:\lfrlflf.exec:\lfrlflf.exe74⤵PID:3652
-
\??\c:\rlxffrr.exec:\rlxffrr.exe75⤵PID:228
-
\??\c:\nbnnnn.exec:\nbnnnn.exe76⤵PID:2584
-
\??\c:\vjpvv.exec:\vjpvv.exe77⤵PID:3400
-
\??\c:\jvjdp.exec:\jvjdp.exe78⤵PID:4472
-
\??\c:\dvjpv.exec:\dvjpv.exe79⤵PID:4980
-
\??\c:\lrrlrlr.exec:\lrrlrlr.exe80⤵PID:3556
-
\??\c:\ffrrrrl.exec:\ffrrrrl.exe81⤵PID:3660
-
\??\c:\5tnnnn.exec:\5tnnnn.exe82⤵PID:4984
-
\??\c:\pdjdv.exec:\pdjdv.exe83⤵PID:1508
-
\??\c:\djjjv.exec:\djjjv.exe84⤵PID:3248
-
\??\c:\lfrrrrl.exec:\lfrrrrl.exe85⤵PID:2332
-
\??\c:\flrlfff.exec:\flrlfff.exe86⤵PID:4028
-
\??\c:\thtthb.exec:\thtthb.exe87⤵PID:4920
-
\??\c:\tnnnhb.exec:\tnnnhb.exe88⤵PID:4872
-
\??\c:\tnnnbb.exec:\tnnnbb.exe89⤵PID:1700
-
\??\c:\pddpd.exec:\pddpd.exe90⤵PID:3996
-
\??\c:\3ddvj.exec:\3ddvj.exe91⤵PID:560
-
\??\c:\ffxlffx.exec:\ffxlffx.exe92⤵PID:4048
-
\??\c:\nnhhnt.exec:\nnhhnt.exe93⤵PID:3596
-
\??\c:\btnhbb.exec:\btnhbb.exe94⤵PID:3876
-
\??\c:\dvjjd.exec:\dvjjd.exe95⤵PID:1328
-
\??\c:\dvjpd.exec:\dvjpd.exe96⤵PID:872
-
\??\c:\lrffxrr.exec:\lrffxrr.exe97⤵PID:3216
-
\??\c:\bhhhbh.exec:\bhhhbh.exe98⤵PID:3812
-
\??\c:\htnthn.exec:\htnthn.exe99⤵PID:2540
-
\??\c:\jvjjv.exec:\jvjjv.exe100⤵PID:2084
-
\??\c:\pjpjd.exec:\pjpjd.exe101⤵PID:1952
-
\??\c:\lflllll.exec:\lflllll.exe102⤵PID:5096
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe103⤵PID:3300
-
\??\c:\9thnnh.exec:\9thnnh.exe104⤵PID:3088
-
\??\c:\ttbbtb.exec:\ttbbtb.exe105⤵PID:4200
-
\??\c:\thtnnn.exec:\thtnnn.exe106⤵PID:3280
-
\??\c:\ddjdp.exec:\ddjdp.exe107⤵PID:2464
-
\??\c:\jppvp.exec:\jppvp.exe108⤵PID:2780
-
\??\c:\rlxlfxl.exec:\rlxlfxl.exe109⤵PID:464
-
\??\c:\5rlllll.exec:\5rlllll.exe110⤵PID:2200
-
\??\c:\1ttnhh.exec:\1ttnhh.exe111⤵PID:5060
-
\??\c:\tbnnhh.exec:\tbnnhh.exe112⤵PID:1288
-
\??\c:\1jvvd.exec:\1jvvd.exe113⤵PID:1320
-
\??\c:\pjvvp.exec:\pjvvp.exe114⤵PID:2016
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe115⤵PID:1848
-
\??\c:\xrfxllf.exec:\xrfxllf.exe116⤵PID:1492
-
\??\c:\5tbbbb.exec:\5tbbbb.exe117⤵PID:2388
-
\??\c:\9nnhbt.exec:\9nnhbt.exe118⤵PID:3708
-
\??\c:\jddvp.exec:\jddvp.exe119⤵PID:4736
-
\??\c:\xrffxxf.exec:\xrffxxf.exe120⤵PID:1084
-
\??\c:\xxlllxx.exec:\xxlllxx.exe121⤵PID:1188
-
\??\c:\xllflfl.exec:\xllflfl.exe122⤵PID:4132
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-