Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe
-
Size
71KB
-
MD5
1ade8b39c6e1d586768139bd2a9d3180
-
SHA1
eb9380d3cd3c7fbba5caee983b13d6ae3a5abe20
-
SHA256
1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76b
-
SHA512
1b1a15646308f97a086220038c80a2d0b358caf719c8e2a2cedab98b09f4f346ca8e63a1f6ba4a537bfbe0ed4150cd186fcf4ef15f7e16737ac75338b74bde1d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfj9:ymb3NkkiQ3mdBjFI4Vt
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3676-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4816-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2120-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2368 ddddd.exe 3684 ffrxxll.exe 1464 tttttt.exe 3976 htnnnn.exe 4492 bnhhbb.exe 3044 vjddv.exe 316 5ddjd.exe 1008 flfflrf.exe 5116 fffxxxx.exe 4608 nnhthn.exe 3432 nttttt.exe 1716 pdvjd.exe 3064 7lrflfl.exe 3504 xlfrflx.exe 4484 hhtttb.exe 2708 thbbbn.exe 1964 jjdvv.exe 3164 ddvvp.exe 2120 fxrrrff.exe 4072 fxlrrrl.exe 3564 ntbbhn.exe 1456 3nntnt.exe 3880 pdjdd.exe 3568 vvpvp.exe 4816 ffrrrxr.exe 3840 flxrrll.exe 1780 tbnttb.exe 2592 nnbhnh.exe 3032 pppjd.exe 412 pjvdv.exe 1648 xrlrlrx.exe 4188 xxlrflf.exe 1536 nnbtnn.exe 1416 bntnhn.exe 5024 ddddv.exe 4908 vvvvv.exe 1968 frxxxfx.exe 2736 xfrfrrf.exe 1364 nntbbh.exe 680 bhbbtt.exe 3496 bhhnnt.exe 4960 vddvp.exe 3012 pdjdd.exe 3308 fxxxrxx.exe 4444 fxflfll.exe 4424 fxxrlll.exe 3000 nnhbbn.exe 684 thhnbh.exe 3864 9dddv.exe 1592 ddvjj.exe 2936 llfxflx.exe 4508 llxrlrl.exe 5088 xllfxrl.exe 116 bbnnhb.exe 5080 hnbtnt.exe 2836 7pvvv.exe 3784 ddddp.exe 2852 rlrlfxr.exe 4268 5bhbbb.exe 2448 hhtttb.exe 1332 pdjdv.exe 320 lfrfxfx.exe 3052 rrlffll.exe 708 bnhhnn.exe -
resource yara_rule behavioral2/memory/3676-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4816-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-215-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2120-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-17-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3676 wrote to memory of 2368 3676 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 82 PID 3676 wrote to memory of 2368 3676 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 82 PID 3676 wrote to memory of 2368 3676 1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe 82 PID 2368 wrote to memory of 3684 2368 ddddd.exe 83 PID 2368 wrote to memory of 3684 2368 ddddd.exe 83 PID 2368 wrote to memory of 3684 2368 ddddd.exe 83 PID 3684 wrote to memory of 1464 3684 ffrxxll.exe 84 PID 3684 wrote to memory of 1464 3684 ffrxxll.exe 84 PID 3684 wrote to memory of 1464 3684 ffrxxll.exe 84 PID 1464 wrote to memory of 3976 1464 tttttt.exe 85 PID 1464 wrote to memory of 3976 1464 tttttt.exe 85 PID 1464 wrote to memory of 3976 1464 tttttt.exe 85 PID 3976 wrote to memory of 4492 3976 htnnnn.exe 86 PID 3976 wrote to memory of 4492 3976 htnnnn.exe 86 PID 3976 wrote to memory of 4492 3976 htnnnn.exe 86 PID 4492 wrote to memory of 3044 4492 bnhhbb.exe 87 PID 4492 wrote to memory of 3044 4492 bnhhbb.exe 87 PID 4492 wrote to memory of 3044 4492 bnhhbb.exe 87 PID 3044 wrote to memory of 316 3044 vjddv.exe 88 PID 3044 wrote to memory of 316 3044 vjddv.exe 88 PID 3044 wrote to memory of 316 3044 vjddv.exe 88 PID 316 wrote to memory of 1008 316 5ddjd.exe 89 PID 316 wrote to memory of 1008 316 5ddjd.exe 89 PID 316 wrote to memory of 1008 316 5ddjd.exe 89 PID 1008 wrote to memory of 5116 1008 flfflrf.exe 90 PID 1008 wrote to memory of 5116 1008 flfflrf.exe 90 PID 1008 wrote to memory of 5116 1008 flfflrf.exe 90 PID 5116 wrote to memory of 4608 5116 fffxxxx.exe 91 PID 5116 wrote to memory of 4608 5116 fffxxxx.exe 91 PID 5116 wrote to memory of 4608 5116 fffxxxx.exe 91 PID 4608 wrote to memory of 3432 4608 nnhthn.exe 92 PID 4608 wrote to memory of 3432 4608 nnhthn.exe 92 PID 4608 wrote to memory of 3432 4608 nnhthn.exe 92 PID 3432 wrote to memory of 1716 3432 nttttt.exe 93 PID 3432 wrote to memory of 1716 3432 nttttt.exe 93 PID 3432 wrote to memory of 1716 3432 nttttt.exe 93 PID 1716 wrote to memory of 3064 1716 pdvjd.exe 94 PID 1716 wrote to memory of 3064 1716 pdvjd.exe 94 PID 1716 wrote to memory of 3064 1716 pdvjd.exe 94 PID 3064 wrote to memory of 3504 3064 7lrflfl.exe 147 PID 3064 wrote to memory of 3504 3064 7lrflfl.exe 147 PID 3064 wrote to memory of 3504 3064 7lrflfl.exe 147 PID 3504 wrote to memory of 4484 3504 xlfrflx.exe 96 PID 3504 wrote to memory of 4484 3504 xlfrflx.exe 96 PID 3504 wrote to memory of 4484 3504 xlfrflx.exe 96 PID 4484 wrote to memory of 2708 4484 hhtttb.exe 97 PID 4484 wrote to memory of 2708 4484 hhtttb.exe 97 PID 4484 wrote to memory of 2708 4484 hhtttb.exe 97 PID 2708 wrote to memory of 1964 2708 thbbbn.exe 98 PID 2708 wrote to memory of 1964 2708 thbbbn.exe 98 PID 2708 wrote to memory of 1964 2708 thbbbn.exe 98 PID 1964 wrote to memory of 3164 1964 jjdvv.exe 99 PID 1964 wrote to memory of 3164 1964 jjdvv.exe 99 PID 1964 wrote to memory of 3164 1964 jjdvv.exe 99 PID 3164 wrote to memory of 2120 3164 ddvvp.exe 100 PID 3164 wrote to memory of 2120 3164 ddvvp.exe 100 PID 3164 wrote to memory of 2120 3164 ddvvp.exe 100 PID 2120 wrote to memory of 4072 2120 fxrrrff.exe 101 PID 2120 wrote to memory of 4072 2120 fxrrrff.exe 101 PID 2120 wrote to memory of 4072 2120 fxrrrff.exe 101 PID 4072 wrote to memory of 3564 4072 fxlrrrl.exe 102 PID 4072 wrote to memory of 3564 4072 fxlrrrl.exe 102 PID 4072 wrote to memory of 3564 4072 fxlrrrl.exe 102 PID 3564 wrote to memory of 1456 3564 ntbbhn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe"C:\Users\Admin\AppData\Local\Temp\1793b318d98e68980202af7526559a827a3127e53fe95a56efe40351bbcdc76bN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\ddddd.exec:\ddddd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\ffrxxll.exec:\ffrxxll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\tttttt.exec:\tttttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\htnnnn.exec:\htnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\bnhhbb.exec:\bnhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\vjddv.exec:\vjddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\5ddjd.exec:\5ddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\flfflrf.exec:\flfflrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\fffxxxx.exec:\fffxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\nnhthn.exec:\nnhthn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\nttttt.exec:\nttttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\pdvjd.exec:\pdvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\7lrflfl.exec:\7lrflfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\xlfrflx.exec:\xlfrflx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\hhtttb.exec:\hhtttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\thbbbn.exec:\thbbbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\jjdvv.exec:\jjdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\ddvvp.exec:\ddvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\fxrrrff.exec:\fxrrrff.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
\??\c:\fxlrrrl.exec:\fxlrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\ntbbhn.exec:\ntbbhn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\3nntnt.exec:\3nntnt.exe23⤵
- Executes dropped EXE
PID:1456 -
\??\c:\pdjdd.exec:\pdjdd.exe24⤵
- Executes dropped EXE
PID:3880 -
\??\c:\vvpvp.exec:\vvpvp.exe25⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ffrrrxr.exec:\ffrrrxr.exe26⤵
- Executes dropped EXE
PID:4816 -
\??\c:\flxrrll.exec:\flxrrll.exe27⤵
- Executes dropped EXE
PID:3840 -
\??\c:\tbnttb.exec:\tbnttb.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780 -
\??\c:\nnbhnh.exec:\nnbhnh.exe29⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pppjd.exec:\pppjd.exe30⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjvdv.exec:\pjvdv.exe31⤵
- Executes dropped EXE
PID:412 -
\??\c:\xrlrlrx.exec:\xrlrlrx.exe32⤵
- Executes dropped EXE
PID:1648 -
\??\c:\xxlrflf.exec:\xxlrflf.exe33⤵
- Executes dropped EXE
PID:4188 -
\??\c:\nnbtnn.exec:\nnbtnn.exe34⤵
- Executes dropped EXE
PID:1536 -
\??\c:\bntnhn.exec:\bntnhn.exe35⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ddddv.exec:\ddddv.exe36⤵
- Executes dropped EXE
PID:5024 -
\??\c:\vvvvv.exec:\vvvvv.exe37⤵
- Executes dropped EXE
PID:4908 -
\??\c:\frxxxfx.exec:\frxxxfx.exe38⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xfrfrrf.exec:\xfrfrrf.exe39⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nntbbh.exec:\nntbbh.exe40⤵
- Executes dropped EXE
PID:1364 -
\??\c:\bhbbtt.exec:\bhbbtt.exe41⤵
- Executes dropped EXE
PID:680 -
\??\c:\bhhnnt.exec:\bhhnnt.exe42⤵
- Executes dropped EXE
PID:3496 -
\??\c:\vddvp.exec:\vddvp.exe43⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pdjdd.exec:\pdjdd.exe44⤵
- Executes dropped EXE
PID:3012 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe45⤵
- Executes dropped EXE
PID:3308 -
\??\c:\fxflfll.exec:\fxflfll.exe46⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fxxrlll.exec:\fxxrlll.exe47⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nnhbbn.exec:\nnhbbn.exe48⤵
- Executes dropped EXE
PID:3000 -
\??\c:\thhnbh.exec:\thhnbh.exe49⤵
- Executes dropped EXE
PID:684 -
\??\c:\9dddv.exec:\9dddv.exe50⤵
- Executes dropped EXE
PID:3864 -
\??\c:\ddvjj.exec:\ddvjj.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\llfxflx.exec:\llfxflx.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\llxrlrl.exec:\llxrlrl.exe53⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xllfxrl.exec:\xllfxrl.exe54⤵
- Executes dropped EXE
PID:5088 -
\??\c:\bbnnhb.exec:\bbnnhb.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:116 -
\??\c:\hnbtnt.exec:\hnbtnt.exe56⤵
- Executes dropped EXE
PID:5080 -
\??\c:\7pvvv.exec:\7pvvv.exe57⤵
- Executes dropped EXE
PID:2836 -
\??\c:\ddddp.exec:\ddddp.exe58⤵
- Executes dropped EXE
PID:3784 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe59⤵
- Executes dropped EXE
PID:2852 -
\??\c:\5bhbbb.exec:\5bhbbb.exe60⤵
- Executes dropped EXE
PID:4268 -
\??\c:\hhtttb.exec:\hhtttb.exe61⤵
- Executes dropped EXE
PID:2448 -
\??\c:\pdjdv.exec:\pdjdv.exe62⤵
- Executes dropped EXE
PID:1332 -
\??\c:\lfrfxfx.exec:\lfrfxfx.exe63⤵
- Executes dropped EXE
PID:320 -
\??\c:\rrlffll.exec:\rrlffll.exe64⤵
- Executes dropped EXE
PID:3052 -
\??\c:\bnhhnn.exec:\bnhhnn.exe65⤵
- Executes dropped EXE
PID:708 -
\??\c:\9pppd.exec:\9pppd.exe66⤵PID:4228
-
\??\c:\pjvvp.exec:\pjvvp.exe67⤵PID:3504
-
\??\c:\rxffxrr.exec:\rxffxrr.exe68⤵PID:1672
-
\??\c:\xxxrffr.exec:\xxxrffr.exe69⤵PID:1900
-
\??\c:\nnhhht.exec:\nnhhht.exe70⤵PID:4004
-
\??\c:\bbhnnn.exec:\bbhnnn.exe71⤵PID:2372
-
\??\c:\tntbbt.exec:\tntbbt.exe72⤵PID:392
-
\??\c:\ddvvp.exec:\ddvvp.exe73⤵PID:4412
-
\??\c:\flxlfxf.exec:\flxlfxf.exe74⤵PID:3056
-
\??\c:\lfxxflr.exec:\lfxxflr.exe75⤵PID:2740
-
\??\c:\bbnntb.exec:\bbnntb.exe76⤵PID:4072
-
\??\c:\bttthh.exec:\bttthh.exe77⤵PID:452
-
\??\c:\hhnttb.exec:\hhnttb.exe78⤵PID:2024
-
\??\c:\flllrrx.exec:\flllrrx.exe79⤵PID:3712
-
\??\c:\7vjpv.exec:\7vjpv.exe80⤵PID:3348
-
\??\c:\bbtnbh.exec:\bbtnbh.exe81⤵PID:2956
-
\??\c:\hbnnhh.exec:\hbnnhh.exe82⤵PID:4036
-
\??\c:\dvjjp.exec:\dvjjp.exe83⤵PID:4464
-
\??\c:\rfrffff.exec:\rfrffff.exe84⤵PID:2476
-
\??\c:\nhtbbh.exec:\nhtbbh.exe85⤵PID:1780
-
\??\c:\xxrrrrx.exec:\xxrrrrx.exe86⤵PID:4448
-
\??\c:\djdjj.exec:\djdjj.exe87⤵PID:3304
-
\??\c:\xxxxlll.exec:\xxxxlll.exe88⤵PID:1296
-
\??\c:\ffrrffr.exec:\ffrrffr.exe89⤵PID:1628
-
\??\c:\btbhtt.exec:\btbhtt.exe90⤵PID:2600
-
\??\c:\ddpjv.exec:\ddpjv.exe91⤵PID:3664
-
\??\c:\nthhht.exec:\nthhht.exe92⤵PID:3544
-
\??\c:\rflrrrr.exec:\rflrrrr.exe93⤵PID:4496
-
\??\c:\ntthhh.exec:\ntthhh.exe94⤵PID:1600
-
\??\c:\tttbnb.exec:\tttbnb.exe95⤵PID:628
-
\??\c:\pjvjd.exec:\pjvjd.exe96⤵PID:4748
-
\??\c:\ffrrfll.exec:\ffrrfll.exe97⤵PID:4376
-
\??\c:\rrffxxr.exec:\rrffxxr.exe98⤵PID:2340
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe99⤵PID:448
-
\??\c:\ttnnnn.exec:\ttnnnn.exe100⤵PID:4892
-
\??\c:\vdvpp.exec:\vdvpp.exe101⤵PID:1084
-
\??\c:\pjjdj.exec:\pjjdj.exe102⤵PID:2500
-
\??\c:\xrrlfrr.exec:\xrrlfrr.exe103⤵PID:740
-
\??\c:\5bnntt.exec:\5bnntt.exe104⤵PID:4884
-
\??\c:\ntttnn.exec:\ntttnn.exe105⤵PID:3636
-
\??\c:\pvjvv.exec:\pvjvv.exe106⤵PID:2040
-
\??\c:\rfxrfff.exec:\rfxrfff.exe107⤵PID:4316
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe108⤵PID:2208
-
\??\c:\hhttnn.exec:\hhttnn.exe109⤵PID:2696
-
\??\c:\dddpj.exec:\dddpj.exe110⤵PID:3600
-
\??\c:\xfffxll.exec:\xfffxll.exe111⤵PID:4544
-
\??\c:\rllllrr.exec:\rllllrr.exe112⤵PID:5000
-
\??\c:\tttbtb.exec:\tttbtb.exe113⤵PID:5104
-
\??\c:\jdpjj.exec:\jdpjj.exe114⤵PID:4492
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe115⤵PID:3044
-
\??\c:\tntbbb.exec:\tntbbb.exe116⤵PID:1924
-
\??\c:\bbnbhh.exec:\bbnbhh.exe117⤵PID:4532
-
\??\c:\vpjpp.exec:\vpjpp.exe118⤵PID:2952
-
\??\c:\rfllfff.exec:\rfllfff.exe119⤵PID:1244
-
\??\c:\xxrrflf.exec:\xxrrflf.exe120⤵PID:4984
-
\??\c:\nhbbhh.exec:\nhbbhh.exe121⤵PID:2864
-
\??\c:\tntnhb.exec:\tntnhb.exe122⤵PID:772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-