Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
14/09/2024, 21:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d6aa3537708b6c71fae855e6ccb4030N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
1d6aa3537708b6c71fae855e6ccb4030N.exe
-
Size
65KB
-
MD5
1d6aa3537708b6c71fae855e6ccb4030
-
SHA1
9e5b2056677dca59ecdfc34ff30ef1aa63912afc
-
SHA256
f10630927d75d248175c0c497d865bdc9bb9dbc0da9831b6f4fb3a419f92fee3
-
SHA512
39b6fa125c401f4bdf155fbfc87dcce29fb9e8af905d6338454f2b99a563fab0979480a567192c0c74e130f8fe8d642dd69e13911278acc3895b2caa64969cbd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27Bqfp:ymb3NkkiQ3mdBjFI9cqfp
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/2744-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3428 ffrfrrx.exe 3924 nnnbth.exe 2700 7ppvv.exe 4688 lxxrlrf.exe 4652 tttbnh.exe 5048 vddpp.exe 944 1tnnnn.exe 2668 bbhtnb.exe 1960 jdjdd.exe 904 lxffffx.exe 216 9pvpj.exe 4488 dpvpp.exe 2544 flxrlfx.exe 924 bthhbb.exe 1028 pjpjj.exe 1540 rxrlllf.exe 636 hhhbtt.exe 2288 jpvpv.exe 2248 1jdvp.exe 4300 lxffxfx.exe 3376 bbttnb.exe 2152 7tnhhh.exe 3464 jjpjv.exe 4552 lrlfxxr.exe 2080 tbtnht.exe 980 bhnhhh.exe 1952 7rxxffl.exe 2128 btnnbb.exe 4408 pdddj.exe 3868 rflrlll.exe 4228 rfrllll.exe 4084 hntbth.exe 4232 pjpdd.exe 4616 rxrxlrl.exe 312 lrrxffl.exe 4432 nnttbh.exe 4864 hthhhh.exe 2092 3vdvv.exe 3620 rxxrrrx.exe 704 hhhbbb.exe 3140 tnntnn.exe 4352 ppppv.exe 4720 jvpjp.exe 2744 9lllxll.exe 3856 hhhhhh.exe 2768 bhnhhb.exe 2700 jpjjd.exe 3420 vjppp.exe 3764 9ffffrl.exe 2980 1rxrlrl.exe 2228 ntbbbb.exe 1132 ppddj.exe 3096 vjvpj.exe 1432 flxrlxr.exe 4860 frfxlll.exe 1612 5thhbb.exe 2148 jpvpj.exe 1760 3pddv.exe 1616 rrrxlxf.exe 316 hnnhhh.exe 1388 tbnnhh.exe 2280 vjpjj.exe 452 vjpvp.exe 2608 rlrlxxr.exe -
resource yara_rule behavioral2/memory/2744-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/636-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ntbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflfrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7dddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjdv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 3428 2744 1d6aa3537708b6c71fae855e6ccb4030N.exe 83 PID 2744 wrote to memory of 3428 2744 1d6aa3537708b6c71fae855e6ccb4030N.exe 83 PID 2744 wrote to memory of 3428 2744 1d6aa3537708b6c71fae855e6ccb4030N.exe 83 PID 3428 wrote to memory of 3924 3428 ffrfrrx.exe 84 PID 3428 wrote to memory of 3924 3428 ffrfrrx.exe 84 PID 3428 wrote to memory of 3924 3428 ffrfrrx.exe 84 PID 3924 wrote to memory of 2700 3924 nnnbth.exe 85 PID 3924 wrote to memory of 2700 3924 nnnbth.exe 85 PID 3924 wrote to memory of 2700 3924 nnnbth.exe 85 PID 2700 wrote to memory of 4688 2700 7ppvv.exe 86 PID 2700 wrote to memory of 4688 2700 7ppvv.exe 86 PID 2700 wrote to memory of 4688 2700 7ppvv.exe 86 PID 4688 wrote to memory of 4652 4688 lxxrlrf.exe 87 PID 4688 wrote to memory of 4652 4688 lxxrlrf.exe 87 PID 4688 wrote to memory of 4652 4688 lxxrlrf.exe 87 PID 4652 wrote to memory of 5048 4652 tttbnh.exe 88 PID 4652 wrote to memory of 5048 4652 tttbnh.exe 88 PID 4652 wrote to memory of 5048 4652 tttbnh.exe 88 PID 5048 wrote to memory of 944 5048 vddpp.exe 89 PID 5048 wrote to memory of 944 5048 vddpp.exe 89 PID 5048 wrote to memory of 944 5048 vddpp.exe 89 PID 944 wrote to memory of 2668 944 1tnnnn.exe 90 PID 944 wrote to memory of 2668 944 1tnnnn.exe 90 PID 944 wrote to memory of 2668 944 1tnnnn.exe 90 PID 2668 wrote to memory of 1960 2668 bbhtnb.exe 91 PID 2668 wrote to memory of 1960 2668 bbhtnb.exe 91 PID 2668 wrote to memory of 1960 2668 bbhtnb.exe 91 PID 1960 wrote to memory of 904 1960 jdjdd.exe 92 PID 1960 wrote to memory of 904 1960 jdjdd.exe 92 PID 1960 wrote to memory of 904 1960 jdjdd.exe 92 PID 904 wrote to memory of 216 904 lxffffx.exe 93 PID 904 wrote to memory of 216 904 lxffffx.exe 93 PID 904 wrote to memory of 216 904 lxffffx.exe 93 PID 216 wrote to memory of 4488 216 9pvpj.exe 94 PID 216 wrote to memory of 4488 216 9pvpj.exe 94 PID 216 wrote to memory of 4488 216 9pvpj.exe 94 PID 4488 wrote to memory of 2544 4488 dpvpp.exe 95 PID 4488 wrote to memory of 2544 4488 dpvpp.exe 95 PID 4488 wrote to memory of 2544 4488 dpvpp.exe 95 PID 2544 wrote to memory of 924 2544 flxrlfx.exe 96 PID 2544 wrote to memory of 924 2544 flxrlfx.exe 96 PID 2544 wrote to memory of 924 2544 flxrlfx.exe 96 PID 924 wrote to memory of 1028 924 bthhbb.exe 97 PID 924 wrote to memory of 1028 924 bthhbb.exe 97 PID 924 wrote to memory of 1028 924 bthhbb.exe 97 PID 1028 wrote to memory of 1540 1028 pjpjj.exe 99 PID 1028 wrote to memory of 1540 1028 pjpjj.exe 99 PID 1028 wrote to memory of 1540 1028 pjpjj.exe 99 PID 1540 wrote to memory of 636 1540 rxrlllf.exe 100 PID 1540 wrote to memory of 636 1540 rxrlllf.exe 100 PID 1540 wrote to memory of 636 1540 rxrlllf.exe 100 PID 636 wrote to memory of 2288 636 hhhbtt.exe 102 PID 636 wrote to memory of 2288 636 hhhbtt.exe 102 PID 636 wrote to memory of 2288 636 hhhbtt.exe 102 PID 2288 wrote to memory of 2248 2288 jpvpv.exe 103 PID 2288 wrote to memory of 2248 2288 jpvpv.exe 103 PID 2288 wrote to memory of 2248 2288 jpvpv.exe 103 PID 2248 wrote to memory of 4300 2248 1jdvp.exe 104 PID 2248 wrote to memory of 4300 2248 1jdvp.exe 104 PID 2248 wrote to memory of 4300 2248 1jdvp.exe 104 PID 4300 wrote to memory of 3376 4300 lxffxfx.exe 105 PID 4300 wrote to memory of 3376 4300 lxffxfx.exe 105 PID 4300 wrote to memory of 3376 4300 lxffxfx.exe 105 PID 3376 wrote to memory of 2152 3376 bbttnb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d6aa3537708b6c71fae855e6ccb4030N.exe"C:\Users\Admin\AppData\Local\Temp\1d6aa3537708b6c71fae855e6ccb4030N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\ffrfrrx.exec:\ffrfrrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\nnnbth.exec:\nnnbth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\7ppvv.exec:\7ppvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\lxxrlrf.exec:\lxxrlrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\tttbnh.exec:\tttbnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\vddpp.exec:\vddpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\1tnnnn.exec:\1tnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\bbhtnb.exec:\bbhtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\jdjdd.exec:\jdjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\lxffffx.exec:\lxffffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\9pvpj.exec:\9pvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\dpvpp.exec:\dpvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\flxrlfx.exec:\flxrlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bthhbb.exec:\bthhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\pjpjj.exec:\pjpjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\rxrlllf.exec:\rxrlllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\hhhbtt.exec:\hhhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\jpvpv.exec:\jpvpv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\1jdvp.exec:\1jdvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\lxffxfx.exec:\lxffxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\bbttnb.exec:\bbttnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\7tnhhh.exec:\7tnhhh.exe23⤵
- Executes dropped EXE
PID:2152 -
\??\c:\jjpjv.exec:\jjpjv.exe24⤵
- Executes dropped EXE
PID:3464 -
\??\c:\lrlfxxr.exec:\lrlfxxr.exe25⤵
- Executes dropped EXE
PID:4552 -
\??\c:\tbtnht.exec:\tbtnht.exe26⤵
- Executes dropped EXE
PID:2080 -
\??\c:\bhnhhh.exec:\bhnhhh.exe27⤵
- Executes dropped EXE
PID:980 -
\??\c:\7rxxffl.exec:\7rxxffl.exe28⤵
- Executes dropped EXE
PID:1952 -
\??\c:\btnnbb.exec:\btnnbb.exe29⤵
- Executes dropped EXE
PID:2128 -
\??\c:\pdddj.exec:\pdddj.exe30⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rflrlll.exec:\rflrlll.exe31⤵
- Executes dropped EXE
PID:3868 -
\??\c:\rfrllll.exec:\rfrllll.exe32⤵
- Executes dropped EXE
PID:4228 -
\??\c:\hntbth.exec:\hntbth.exe33⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pjpdd.exec:\pjpdd.exe34⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rxrxlrl.exec:\rxrxlrl.exe35⤵
- Executes dropped EXE
PID:4616 -
\??\c:\lrrxffl.exec:\lrrxffl.exe36⤵
- Executes dropped EXE
PID:312 -
\??\c:\nnttbh.exec:\nnttbh.exe37⤵
- Executes dropped EXE
PID:4432 -
\??\c:\hthhhh.exec:\hthhhh.exe38⤵
- Executes dropped EXE
PID:4864 -
\??\c:\3vdvv.exec:\3vdvv.exe39⤵
- Executes dropped EXE
PID:2092 -
\??\c:\rxxrrrx.exec:\rxxrrrx.exe40⤵
- Executes dropped EXE
PID:3620 -
\??\c:\hhhbbb.exec:\hhhbbb.exe41⤵
- Executes dropped EXE
PID:704 -
\??\c:\tnntnn.exec:\tnntnn.exe42⤵
- Executes dropped EXE
PID:3140 -
\??\c:\ppppv.exec:\ppppv.exe43⤵
- Executes dropped EXE
PID:4352 -
\??\c:\jvpjp.exec:\jvpjp.exe44⤵
- Executes dropped EXE
PID:4720 -
\??\c:\9lllxll.exec:\9lllxll.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\hhhhhh.exec:\hhhhhh.exe46⤵
- Executes dropped EXE
PID:3856 -
\??\c:\bhnhhb.exec:\bhnhhb.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jpjjd.exec:\jpjjd.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vjppp.exec:\vjppp.exe49⤵
- Executes dropped EXE
PID:3420 -
\??\c:\9ffffrl.exec:\9ffffrl.exe50⤵
- Executes dropped EXE
PID:3764 -
\??\c:\1rxrlrl.exec:\1rxrlrl.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ntbbbb.exec:\ntbbbb.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\ppddj.exec:\ppddj.exe53⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vjvpj.exec:\vjvpj.exe54⤵
- Executes dropped EXE
PID:3096 -
\??\c:\flxrlxr.exec:\flxrlxr.exe55⤵
- Executes dropped EXE
PID:1432 -
\??\c:\frfxlll.exec:\frfxlll.exe56⤵
- Executes dropped EXE
PID:4860 -
\??\c:\5thhbb.exec:\5thhbb.exe57⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jpvpj.exec:\jpvpj.exe58⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3pddv.exec:\3pddv.exe59⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rrrxlxf.exec:\rrrxlxf.exe60⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hnnhhh.exec:\hnnhhh.exe61⤵
- Executes dropped EXE
PID:316 -
\??\c:\tbnnhh.exec:\tbnnhh.exe62⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vjpjj.exec:\vjpjj.exe63⤵
- Executes dropped EXE
PID:2280 -
\??\c:\vjpvp.exec:\vjpvp.exe64⤵
- Executes dropped EXE
PID:452 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe65⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rrfxrrl.exec:\rrfxrrl.exe66⤵PID:4968
-
\??\c:\nntnhh.exec:\nntnhh.exe67⤵PID:3268
-
\??\c:\ppjdp.exec:\ppjdp.exe68⤵PID:2480
-
\??\c:\pdpjv.exec:\pdpjv.exe69⤵PID:2508
-
\??\c:\xrlflrx.exec:\xrlflrx.exe70⤵PID:4436
-
\??\c:\bbnbbb.exec:\bbnbbb.exe71⤵PID:1860
-
\??\c:\ttbbbt.exec:\ttbbbt.exe72⤵PID:1844
-
\??\c:\ddvdd.exec:\ddvdd.exe73⤵PID:2152
-
\??\c:\1pvdv.exec:\1pvdv.exe74⤵PID:1576
-
\??\c:\5fllxxr.exec:\5fllxxr.exe75⤵PID:2852
-
\??\c:\frxxrrr.exec:\frxxrrr.exe76⤵PID:1228
-
\??\c:\tbnbtt.exec:\tbnbtt.exe77⤵PID:3500
-
\??\c:\jpjvv.exec:\jpjvv.exe78⤵PID:3932
-
\??\c:\1lfrlll.exec:\1lfrlll.exe79⤵PID:1296
-
\??\c:\frxxxxr.exec:\frxxxxr.exe80⤵PID:3940
-
\??\c:\hhhbtb.exec:\hhhbtb.exe81⤵PID:4564
-
\??\c:\hbnnbh.exec:\hbnnbh.exe82⤵PID:1356
-
\??\c:\9vppd.exec:\9vppd.exe83⤵PID:4408
-
\??\c:\5djdv.exec:\5djdv.exe84⤵PID:4420
-
\??\c:\lxxxllf.exec:\lxxxllf.exe85⤵PID:3104
-
\??\c:\hhbbtb.exec:\hhbbtb.exe86⤵PID:4016
-
\??\c:\tntnnb.exec:\tntnnb.exe87⤵PID:4660
-
\??\c:\dvddv.exec:\dvddv.exe88⤵PID:5056
-
\??\c:\pddvd.exec:\pddvd.exe89⤵PID:4724
-
\??\c:\fxfrxxf.exec:\fxfrxxf.exe90⤵PID:1376
-
\??\c:\btbbbb.exec:\btbbbb.exe91⤵PID:4484
-
\??\c:\nbhbnn.exec:\nbhbnn.exe92⤵PID:224
-
\??\c:\ddddv.exec:\ddddv.exe93⤵PID:4872
-
\??\c:\ppdvp.exec:\ppdvp.exe94⤵PID:4368
-
\??\c:\lfllllx.exec:\lfllllx.exe95⤵PID:4376
-
\??\c:\nnttnn.exec:\nnttnn.exe96⤵PID:4480
-
\??\c:\thnnnn.exec:\thnnnn.exe97⤵PID:4352
-
\??\c:\jjdvp.exec:\jjdvp.exe98⤵PID:2744
-
\??\c:\vvdvp.exec:\vvdvp.exe99⤵PID:3856
-
\??\c:\9rrrlll.exec:\9rrrlll.exe100⤵PID:3984
-
\??\c:\1jjpp.exec:\1jjpp.exe101⤵PID:4716
-
\??\c:\dpvpj.exec:\dpvpj.exe102⤵PID:4836
-
\??\c:\rflrfff.exec:\rflrfff.exe103⤵PID:1348
-
\??\c:\hbbnhn.exec:\hbbnhn.exe104⤵PID:4844
-
\??\c:\5pdvj.exec:\5pdvj.exe105⤵PID:732
-
\??\c:\rlxrfff.exec:\rlxrfff.exe106⤵PID:4108
-
\??\c:\frxxxrr.exec:\frxxxrr.exe107⤵PID:3096
-
\??\c:\btbtnb.exec:\btbtnb.exe108⤵PID:3148
-
\??\c:\7hhbbb.exec:\7hhbbb.exe109⤵PID:3600
-
\??\c:\jvpdv.exec:\jvpdv.exe110⤵PID:2436
-
\??\c:\lfxrxxl.exec:\lfxrxxl.exe111⤵PID:1760
-
\??\c:\3fffrrr.exec:\3fffrrr.exe112⤵PID:2180
-
\??\c:\7tbbtt.exec:\7tbbtt.exe113⤵PID:1732
-
\??\c:\jdjdv.exec:\jdjdv.exe114⤵PID:2556
-
\??\c:\vpjdv.exec:\vpjdv.exe115⤵PID:2280
-
\??\c:\lfrffxx.exec:\lfrffxx.exe116⤵PID:452
-
\??\c:\9pvdj.exec:\9pvdj.exe117⤵PID:2608
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe118⤵PID:4968
-
\??\c:\btbtbb.exec:\btbtbb.exe119⤵PID:3268
-
\??\c:\httttb.exec:\httttb.exe120⤵PID:2480
-
\??\c:\jpvpj.exec:\jpvpj.exe121⤵PID:2144
-
\??\c:\lfxrffx.exec:\lfxrffx.exe122⤵PID:2624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-