Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
120 seconds
General
-
Target
891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe
-
Size
49KB
-
MD5
33a45d5f2859b27f238a8beac41e60a0
-
SHA1
c72f278b821bb319018307dfe07102a72a1655ff
-
SHA256
891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643
-
SHA512
04217b6f7afe2bef9393e8d1a9d394600f50dcc2d50ab02ff377dce2ef01324d9000c76abdb9c21ac86c26ca049ca4f45d87efd32ff243de584475dbed40dab8
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvFZ:0cdpeeBSHHMHLf9RyI0Z
Malware Config
Signatures
-
Detect Blackmoon payload 62 IoCs
resource yara_rule behavioral2/memory/2800-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2276-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/636-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-224-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-236-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-233-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-275-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4060-282-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-286-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-290-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-317-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-324-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-368-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-404-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-432-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-454-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-461-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-468-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-484-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-512-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-595-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-749-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-765-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-823-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-959-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-1008-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2676 tthnbt.exe 2324 tnnhbt.exe 3528 3xxxrrl.exe 4832 xrlffrl.exe 3008 lrfxrlf.exe 1616 hhhbtb.exe 4904 dvdvj.exe 452 jdvpd.exe 4320 3xrlfxr.exe 2276 hhbnbb.exe 1504 hnnnhn.exe 4884 vvvjj.exe 4560 lxxxxxr.exe 2024 rfxffll.exe 3584 nntnhn.exe 3004 dvppj.exe 3984 pvppp.exe 2028 rrllfxx.exe 3380 7nbtbt.exe 4828 nnnnnt.exe 3564 5dvpd.exe 1940 pdjdd.exe 3692 7jdvd.exe 3396 1ppvp.exe 3936 frrlflf.exe 8 tbnttt.exe 2044 tbnnhb.exe 1072 bntttt.exe 4564 tnnhhh.exe 2092 1pppj.exe 3264 7lrrllf.exe 4824 rrrrlll.exe 4400 bbtbtn.exe 1812 nntnbb.exe 1396 vppjd.exe 1860 djjjv.exe 5060 5dddp.exe 636 rflrlll.exe 1728 1btnhb.exe 4228 9dddv.exe 4772 pjvvv.exe 2312 rxfxxxr.exe 3888 9rrrlff.exe 1068 nhnhbb.exe 4516 ppdvv.exe 1460 3pjdp.exe 2992 3lrlrlr.exe 4024 1ttnhh.exe 3524 vdpjj.exe 2980 5rrrlff.exe 4744 hnnntb.exe 2444 jdjdv.exe 4004 dpddv.exe 1616 jpjvp.exe 1224 xlrrxxf.exe 3876 fllffxr.exe 3680 5nnhbt.exe 3116 htbtbb.exe 4060 vddvp.exe 4044 fffxllf.exe 4736 xxxxrll.exe 3624 nnbntn.exe 4656 5vvpd.exe 3148 flfxllf.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrflff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5htnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 2676 2800 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 81 PID 2800 wrote to memory of 2676 2800 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 81 PID 2800 wrote to memory of 2676 2800 891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe 81 PID 2676 wrote to memory of 2324 2676 tthnbt.exe 82 PID 2676 wrote to memory of 2324 2676 tthnbt.exe 82 PID 2676 wrote to memory of 2324 2676 tthnbt.exe 82 PID 2324 wrote to memory of 3528 2324 tnnhbt.exe 83 PID 2324 wrote to memory of 3528 2324 tnnhbt.exe 83 PID 2324 wrote to memory of 3528 2324 tnnhbt.exe 83 PID 3528 wrote to memory of 4832 3528 3xxxrrl.exe 84 PID 3528 wrote to memory of 4832 3528 3xxxrrl.exe 84 PID 3528 wrote to memory of 4832 3528 3xxxrrl.exe 84 PID 4832 wrote to memory of 3008 4832 xrlffrl.exe 85 PID 4832 wrote to memory of 3008 4832 xrlffrl.exe 85 PID 4832 wrote to memory of 3008 4832 xrlffrl.exe 85 PID 3008 wrote to memory of 1616 3008 lrfxrlf.exe 86 PID 3008 wrote to memory of 1616 3008 lrfxrlf.exe 86 PID 3008 wrote to memory of 1616 3008 lrfxrlf.exe 86 PID 1616 wrote to memory of 4904 1616 hhhbtb.exe 87 PID 1616 wrote to memory of 4904 1616 hhhbtb.exe 87 PID 1616 wrote to memory of 4904 1616 hhhbtb.exe 87 PID 4904 wrote to memory of 452 4904 dvdvj.exe 88 PID 4904 wrote to memory of 452 4904 dvdvj.exe 88 PID 4904 wrote to memory of 452 4904 dvdvj.exe 88 PID 452 wrote to memory of 4320 452 jdvpd.exe 89 PID 452 wrote to memory of 4320 452 jdvpd.exe 89 PID 452 wrote to memory of 4320 452 jdvpd.exe 89 PID 4320 wrote to memory of 2276 4320 3xrlfxr.exe 90 PID 4320 wrote to memory of 2276 4320 3xrlfxr.exe 90 PID 4320 wrote to memory of 2276 4320 3xrlfxr.exe 90 PID 2276 wrote to memory of 1504 2276 hhbnbb.exe 91 PID 2276 wrote to memory of 1504 2276 hhbnbb.exe 91 PID 2276 wrote to memory of 1504 2276 hhbnbb.exe 91 PID 1504 wrote to memory of 4884 1504 hnnnhn.exe 92 PID 1504 wrote to memory of 4884 1504 hnnnhn.exe 92 PID 1504 wrote to memory of 4884 1504 hnnnhn.exe 92 PID 4884 wrote to memory of 4560 4884 vvvjj.exe 93 PID 4884 wrote to memory of 4560 4884 vvvjj.exe 93 PID 4884 wrote to memory of 4560 4884 vvvjj.exe 93 PID 4560 wrote to memory of 2024 4560 lxxxxxr.exe 94 PID 4560 wrote to memory of 2024 4560 lxxxxxr.exe 94 PID 4560 wrote to memory of 2024 4560 lxxxxxr.exe 94 PID 2024 wrote to memory of 3584 2024 rfxffll.exe 95 PID 2024 wrote to memory of 3584 2024 rfxffll.exe 95 PID 2024 wrote to memory of 3584 2024 rfxffll.exe 95 PID 3584 wrote to memory of 3004 3584 nntnhn.exe 96 PID 3584 wrote to memory of 3004 3584 nntnhn.exe 96 PID 3584 wrote to memory of 3004 3584 nntnhn.exe 96 PID 3004 wrote to memory of 3984 3004 dvppj.exe 97 PID 3004 wrote to memory of 3984 3004 dvppj.exe 97 PID 3004 wrote to memory of 3984 3004 dvppj.exe 97 PID 3984 wrote to memory of 2028 3984 pvppp.exe 98 PID 3984 wrote to memory of 2028 3984 pvppp.exe 98 PID 3984 wrote to memory of 2028 3984 pvppp.exe 98 PID 2028 wrote to memory of 3380 2028 rrllfxx.exe 99 PID 2028 wrote to memory of 3380 2028 rrllfxx.exe 99 PID 2028 wrote to memory of 3380 2028 rrllfxx.exe 99 PID 3380 wrote to memory of 4828 3380 7nbtbt.exe 100 PID 3380 wrote to memory of 4828 3380 7nbtbt.exe 100 PID 3380 wrote to memory of 4828 3380 7nbtbt.exe 100 PID 4828 wrote to memory of 3564 4828 nnnnnt.exe 101 PID 4828 wrote to memory of 3564 4828 nnnnnt.exe 101 PID 4828 wrote to memory of 3564 4828 nnnnnt.exe 101 PID 3564 wrote to memory of 1940 3564 5dvpd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe"C:\Users\Admin\AppData\Local\Temp\891307c88d5cabb3b64d6f865db18f9ccae09c5952a8e6389b909de032985643N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\tthnbt.exec:\tthnbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\tnnhbt.exec:\tnnhbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\3xxxrrl.exec:\3xxxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\xrlffrl.exec:\xrlffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\lrfxrlf.exec:\lrfxrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\hhhbtb.exec:\hhhbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\dvdvj.exec:\dvdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jdvpd.exec:\jdvpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\3xrlfxr.exec:\3xrlfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hhbnbb.exec:\hhbnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
\??\c:\hnnnhn.exec:\hnnnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\vvvjj.exec:\vvvjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\lxxxxxr.exec:\lxxxxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\rfxffll.exec:\rfxffll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\nntnhn.exec:\nntnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\dvppj.exec:\dvppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\pvppp.exec:\pvppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\rrllfxx.exec:\rrllfxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7nbtbt.exec:\7nbtbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\nnnnnt.exec:\nnnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\5dvpd.exec:\5dvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\pdjdd.exec:\pdjdd.exe23⤵
- Executes dropped EXE
PID:1940 -
\??\c:\7jdvd.exec:\7jdvd.exe24⤵
- Executes dropped EXE
PID:3692 -
\??\c:\1ppvp.exec:\1ppvp.exe25⤵
- Executes dropped EXE
PID:3396 -
\??\c:\frrlflf.exec:\frrlflf.exe26⤵
- Executes dropped EXE
PID:3936 -
\??\c:\tbnttt.exec:\tbnttt.exe27⤵
- Executes dropped EXE
PID:8 -
\??\c:\tbnnhb.exec:\tbnnhb.exe28⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bntttt.exec:\bntttt.exe29⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tnnhhh.exec:\tnnhhh.exe30⤵
- Executes dropped EXE
PID:4564 -
\??\c:\1pppj.exec:\1pppj.exe31⤵
- Executes dropped EXE
PID:2092 -
\??\c:\7lrrllf.exec:\7lrrllf.exe32⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rrrrlll.exec:\rrrrlll.exe33⤵
- Executes dropped EXE
PID:4824 -
\??\c:\bbtbtn.exec:\bbtbtn.exe34⤵
- Executes dropped EXE
PID:4400 -
\??\c:\nntnbb.exec:\nntnbb.exe35⤵
- Executes dropped EXE
PID:1812 -
\??\c:\vppjd.exec:\vppjd.exe36⤵
- Executes dropped EXE
PID:1396 -
\??\c:\djjjv.exec:\djjjv.exe37⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5dddp.exec:\5dddp.exe38⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rflrlll.exec:\rflrlll.exe39⤵
- Executes dropped EXE
PID:636 -
\??\c:\1btnhb.exec:\1btnhb.exe40⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9dddv.exec:\9dddv.exe41⤵
- Executes dropped EXE
PID:4228 -
\??\c:\pjvvv.exec:\pjvvv.exe42⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe43⤵
- Executes dropped EXE
PID:2312 -
\??\c:\9rrrlff.exec:\9rrrlff.exe44⤵
- Executes dropped EXE
PID:3888 -
\??\c:\nhnhbb.exec:\nhnhbb.exe45⤵
- Executes dropped EXE
PID:1068 -
\??\c:\ppdvv.exec:\ppdvv.exe46⤵
- Executes dropped EXE
PID:4516 -
\??\c:\3pjdp.exec:\3pjdp.exe47⤵
- Executes dropped EXE
PID:1460 -
\??\c:\3lrlrlr.exec:\3lrlrlr.exe48⤵
- Executes dropped EXE
PID:2992 -
\??\c:\1ttnhh.exec:\1ttnhh.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4024 -
\??\c:\vdpjj.exec:\vdpjj.exe50⤵
- Executes dropped EXE
PID:3524 -
\??\c:\5rrrlff.exec:\5rrrlff.exe51⤵
- Executes dropped EXE
PID:2980 -
\??\c:\hnnntb.exec:\hnnntb.exe52⤵
- Executes dropped EXE
PID:4744 -
\??\c:\jdjdv.exec:\jdjdv.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dpddv.exec:\dpddv.exe54⤵
- Executes dropped EXE
PID:4004 -
\??\c:\jpjvp.exec:\jpjvp.exe55⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe56⤵
- Executes dropped EXE
PID:1224 -
\??\c:\fllffxr.exec:\fllffxr.exe57⤵
- Executes dropped EXE
PID:3876 -
\??\c:\5nnhbt.exec:\5nnhbt.exe58⤵
- Executes dropped EXE
PID:3680 -
\??\c:\htbtbb.exec:\htbtbb.exe59⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vddvp.exec:\vddvp.exe60⤵
- Executes dropped EXE
PID:4060 -
\??\c:\fffxllf.exec:\fffxllf.exe61⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xxxxrll.exec:\xxxxrll.exe62⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nnbntn.exec:\nnbntn.exe63⤵
- Executes dropped EXE
PID:3624 -
\??\c:\5vvpd.exec:\5vvpd.exe64⤵
- Executes dropped EXE
PID:4656 -
\??\c:\flfxllf.exec:\flfxllf.exe65⤵
- Executes dropped EXE
PID:3148 -
\??\c:\lxffxff.exec:\lxffxff.exe66⤵PID:3736
-
\??\c:\7ttthb.exec:\7ttthb.exe67⤵PID:4368
-
\??\c:\1nhbnh.exec:\1nhbnh.exe68⤵PID:2184
-
\??\c:\pjddv.exec:\pjddv.exe69⤵PID:2212
-
\??\c:\3djdj.exec:\3djdj.exe70⤵PID:2176
-
\??\c:\hhnhtb.exec:\hhnhtb.exe71⤵PID:2424
-
\??\c:\jdjdd.exec:\jdjdd.exe72⤵PID:1916
-
\??\c:\rrxlfxx.exec:\rrxlfxx.exe73⤵PID:3380
-
\??\c:\xffffxr.exec:\xffffxr.exe74⤵PID:2220
-
\??\c:\1hbthh.exec:\1hbthh.exe75⤵PID:2240
-
\??\c:\hbhhbh.exec:\hbhhbh.exe76⤵PID:4380
-
\??\c:\5jvpj.exec:\5jvpj.exe77⤵PID:1056
-
\??\c:\xffrrlx.exec:\xffrrlx.exe78⤵PID:5016
-
\??\c:\7fxlflf.exec:\7fxlflf.exe79⤵PID:3988
-
\??\c:\hbtnnh.exec:\hbtnnh.exe80⤵PID:3068
-
\??\c:\dpvvj.exec:\dpvvj.exe81⤵PID:692
-
\??\c:\pjjdp.exec:\pjjdp.exe82⤵PID:1408
-
\??\c:\lrrxxrr.exec:\lrrxxrr.exe83⤵PID:2136
-
\??\c:\hhnnhb.exec:\hhnnhb.exe84⤵PID:3892
-
\??\c:\nntthh.exec:\nntthh.exe85⤵PID:388
-
\??\c:\1jppj.exec:\1jppj.exe86⤵PID:3036
-
\??\c:\jdjdp.exec:\jdjdp.exe87⤵PID:888
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe88⤵PID:2092
-
\??\c:\hbnhbb.exec:\hbnhbb.exe89⤵PID:4500
-
\??\c:\pjpjd.exec:\pjpjd.exe90⤵PID:4824
-
\??\c:\vjppd.exec:\vjppd.exe91⤵PID:2412
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe92⤵PID:4936
-
\??\c:\hhnbtn.exec:\hhnbtn.exe93⤵PID:4092
-
\??\c:\tbnhbt.exec:\tbnhbt.exe94⤵PID:3140
-
\??\c:\pjddd.exec:\pjddd.exe95⤵PID:4908
-
\??\c:\7vdvp.exec:\7vdvp.exe96⤵PID:4988
-
\??\c:\fxxfxrl.exec:\fxxfxrl.exe97⤵PID:636
-
\??\c:\7ntnbh.exec:\7ntnbh.exe98⤵PID:4208
-
\??\c:\ththbb.exec:\ththbb.exe99⤵PID:4228
-
\??\c:\jdpjj.exec:\jdpjj.exe100⤵PID:4772
-
\??\c:\3ddvp.exec:\3ddvp.exe101⤵PID:2312
-
\??\c:\flrfrrr.exec:\flrfrrr.exe102⤵PID:1084
-
\??\c:\btnnhh.exec:\btnnhh.exe103⤵PID:404
-
\??\c:\nbbtnn.exec:\nbbtnn.exe104⤵PID:3052
-
\??\c:\jdvpj.exec:\jdvpj.exe105⤵PID:2800
-
\??\c:\jjjdp.exec:\jjjdp.exe106⤵PID:4104
-
\??\c:\lfrlllr.exec:\lfrlllr.exe107⤵PID:2400
-
\??\c:\bbnhnn.exec:\bbnhnn.exe108⤵PID:3528
-
\??\c:\thhbtt.exec:\thhbtt.exe109⤵PID:4028
-
\??\c:\7vddv.exec:\7vddv.exe110⤵PID:4832
-
\??\c:\9vvvp.exec:\9vvvp.exe111⤵PID:2680
-
\??\c:\7ffxlfr.exec:\7ffxlfr.exe112⤵PID:3304
-
\??\c:\tthhbh.exec:\tthhbh.exe113⤵PID:4904
-
\??\c:\nttnhb.exec:\nttnhb.exe114⤵PID:448
-
\??\c:\dpvdd.exec:\dpvdd.exe115⤵PID:4292
-
\??\c:\vdvdd.exec:\vdvdd.exe116⤵PID:4940
-
\??\c:\xlrrlxr.exec:\xlrrlxr.exe117⤵PID:4328
-
\??\c:\9hhttn.exec:\9hhttn.exe118⤵PID:1172
-
\??\c:\vvdvp.exec:\vvdvp.exe119⤵PID:4884
-
\??\c:\xxlxllr.exec:\xxlxllr.exe120⤵PID:4016
-
\??\c:\1xxrllf.exec:\1xxrllf.exe121⤵PID:1064
-
\??\c:\9hnnnn.exec:\9hnnnn.exe122⤵PID:2268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-