Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 00:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe
Resource
win7-20240708-en
5 signatures
120 seconds
General
-
Target
15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe
-
Size
52KB
-
MD5
803caa429e476296a3d984f90c0f3790
-
SHA1
506985e65326d8d55d5f615aafc505a7c1901b2e
-
SHA256
15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52
-
SHA512
d3b710acd01311696a67b9783422dc3eba04030ca0a10959167266730c8e05c79d88640f6877748864bbe39a33fb7667b02c8b0ee523e6e7e1b891bb429034fa
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvXZi:0cdpeeBSHHMHLf9RyIcZi
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3416-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4848-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4896-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2644-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-235-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1508-239-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-263-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-269-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-273-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-280-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-362-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-371-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-386-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-433-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-443-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-517-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-547-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-632-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-652-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-662-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-675-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-693-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-700-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-734-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-789-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-871-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-1270-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-1323-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3416 jdvjd.exe 3864 1llffrr.exe 3044 xrfrlll.exe 3592 tnthbt.exe 3684 pjjjv.exe 1100 xrfxxll.exe 3800 nhbnbt.exe 4848 bnhtnb.exe 4492 9vjvj.exe 2468 frxflrx.exe 2184 hbhbnb.exe 3348 vpjdd.exe 3764 vvdvj.exe 4312 lfrlrlr.exe 4004 5jvpj.exe 2440 llrlxxl.exe 4896 xxxxrlf.exe 3856 ntbnhb.exe 428 nnthtn.exe 2288 vvjdp.exe 3476 9fxrfxl.exe 3816 xfffrlf.exe 2296 nbbthb.exe 1620 vdjdp.exe 3208 jdjdv.exe 3236 7xxrfxx.exe 4352 1hbbnh.exe 3364 tnhttn.exe 4540 pvpjv.exe 3264 jdjjd.exe 4696 nnbtbh.exe 2644 nnnthb.exe 4544 djppd.exe 4424 fffxrlf.exe 1640 hnhnnb.exe 2904 nhbhtn.exe 2832 vpjdv.exe 4428 3dvjv.exe 1880 fxrlxff.exe 1196 btttnh.exe 2768 ttnnbb.exe 2260 jvpvp.exe 2008 djjjv.exe 4700 3xlrfrr.exe 3320 rffxlll.exe 220 tttbbt.exe 1508 pdjpj.exe 2828 jjjjd.exe 3456 lllxlfr.exe 4944 flfflrx.exe 4840 bhhhbb.exe 4768 5ppjd.exe 4372 pvpdv.exe 3828 xlllllr.exe 2136 1hhbbt.exe 4636 hhnnbb.exe 3864 vddjp.exe 1792 xxfxrlf.exe 1456 nhhbnn.exe 3672 tbbthb.exe 3204 frfrrfl.exe 3188 3tbtnn.exe 3800 5jppj.exe 4724 vvpdj.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4088 wrote to memory of 3416 4088 15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe 84 PID 4088 wrote to memory of 3416 4088 15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe 84 PID 4088 wrote to memory of 3416 4088 15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe 84 PID 3416 wrote to memory of 3864 3416 jdvjd.exe 85 PID 3416 wrote to memory of 3864 3416 jdvjd.exe 85 PID 3416 wrote to memory of 3864 3416 jdvjd.exe 85 PID 3864 wrote to memory of 3044 3864 1llffrr.exe 86 PID 3864 wrote to memory of 3044 3864 1llffrr.exe 86 PID 3864 wrote to memory of 3044 3864 1llffrr.exe 86 PID 3044 wrote to memory of 3592 3044 xrfrlll.exe 87 PID 3044 wrote to memory of 3592 3044 xrfrlll.exe 87 PID 3044 wrote to memory of 3592 3044 xrfrlll.exe 87 PID 3592 wrote to memory of 3684 3592 tnthbt.exe 88 PID 3592 wrote to memory of 3684 3592 tnthbt.exe 88 PID 3592 wrote to memory of 3684 3592 tnthbt.exe 88 PID 3684 wrote to memory of 1100 3684 pjjjv.exe 89 PID 3684 wrote to memory of 1100 3684 pjjjv.exe 89 PID 3684 wrote to memory of 1100 3684 pjjjv.exe 89 PID 1100 wrote to memory of 3800 1100 xrfxxll.exe 90 PID 1100 wrote to memory of 3800 1100 xrfxxll.exe 90 PID 1100 wrote to memory of 3800 1100 xrfxxll.exe 90 PID 3800 wrote to memory of 4848 3800 nhbnbt.exe 91 PID 3800 wrote to memory of 4848 3800 nhbnbt.exe 91 PID 3800 wrote to memory of 4848 3800 nhbnbt.exe 91 PID 4848 wrote to memory of 4492 4848 bnhtnb.exe 92 PID 4848 wrote to memory of 4492 4848 bnhtnb.exe 92 PID 4848 wrote to memory of 4492 4848 bnhtnb.exe 92 PID 4492 wrote to memory of 2468 4492 9vjvj.exe 93 PID 4492 wrote to memory of 2468 4492 9vjvj.exe 93 PID 4492 wrote to memory of 2468 4492 9vjvj.exe 93 PID 2468 wrote to memory of 2184 2468 frxflrx.exe 94 PID 2468 wrote to memory of 2184 2468 frxflrx.exe 94 PID 2468 wrote to memory of 2184 2468 frxflrx.exe 94 PID 2184 wrote to memory of 3348 2184 hbhbnb.exe 95 PID 2184 wrote to memory of 3348 2184 hbhbnb.exe 95 PID 2184 wrote to memory of 3348 2184 hbhbnb.exe 95 PID 3348 wrote to memory of 3764 3348 vpjdd.exe 96 PID 3348 wrote to memory of 3764 3348 vpjdd.exe 96 PID 3348 wrote to memory of 3764 3348 vpjdd.exe 96 PID 3764 wrote to memory of 4312 3764 vvdvj.exe 97 PID 3764 wrote to memory of 4312 3764 vvdvj.exe 97 PID 3764 wrote to memory of 4312 3764 vvdvj.exe 97 PID 4312 wrote to memory of 4004 4312 lfrlrlr.exe 98 PID 4312 wrote to memory of 4004 4312 lfrlrlr.exe 98 PID 4312 wrote to memory of 4004 4312 lfrlrlr.exe 98 PID 4004 wrote to memory of 2440 4004 5jvpj.exe 99 PID 4004 wrote to memory of 2440 4004 5jvpj.exe 99 PID 4004 wrote to memory of 2440 4004 5jvpj.exe 99 PID 2440 wrote to memory of 4896 2440 llrlxxl.exe 100 PID 2440 wrote to memory of 4896 2440 llrlxxl.exe 100 PID 2440 wrote to memory of 4896 2440 llrlxxl.exe 100 PID 4896 wrote to memory of 3856 4896 xxxxrlf.exe 101 PID 4896 wrote to memory of 3856 4896 xxxxrlf.exe 101 PID 4896 wrote to memory of 3856 4896 xxxxrlf.exe 101 PID 3856 wrote to memory of 428 3856 ntbnhb.exe 102 PID 3856 wrote to memory of 428 3856 ntbnhb.exe 102 PID 3856 wrote to memory of 428 3856 ntbnhb.exe 102 PID 428 wrote to memory of 2288 428 nnthtn.exe 103 PID 428 wrote to memory of 2288 428 nnthtn.exe 103 PID 428 wrote to memory of 2288 428 nnthtn.exe 103 PID 2288 wrote to memory of 3476 2288 vvjdp.exe 104 PID 2288 wrote to memory of 3476 2288 vvjdp.exe 104 PID 2288 wrote to memory of 3476 2288 vvjdp.exe 104 PID 3476 wrote to memory of 3816 3476 9fxrfxl.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe"C:\Users\Admin\AppData\Local\Temp\15bb6146472b232de023862282864a26de9a6f33622c459424d4aa2063fc4a52N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\jdvjd.exec:\jdvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\1llffrr.exec:\1llffrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\xrfrlll.exec:\xrfrlll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\tnthbt.exec:\tnthbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\pjjjv.exec:\pjjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\xrfxxll.exec:\xrfxxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\nhbnbt.exec:\nhbnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\bnhtnb.exec:\bnhtnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\9vjvj.exec:\9vjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\frxflrx.exec:\frxflrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\hbhbnb.exec:\hbhbnb.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\vpjdd.exec:\vpjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\vvdvj.exec:\vvdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\lfrlrlr.exec:\lfrlrlr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\5jvpj.exec:\5jvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\llrlxxl.exec:\llrlxxl.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\xxxxrlf.exec:\xxxxrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\ntbnhb.exec:\ntbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\nnthtn.exec:\nnthtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\vvjdp.exec:\vvjdp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\9fxrfxl.exec:\9fxrfxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\xfffrlf.exec:\xfffrlf.exe23⤵
- Executes dropped EXE
PID:3816 -
\??\c:\nbbthb.exec:\nbbthb.exe24⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vdjdp.exec:\vdjdp.exe25⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jdjdv.exec:\jdjdv.exe26⤵
- Executes dropped EXE
PID:3208 -
\??\c:\7xxrfxx.exec:\7xxrfxx.exe27⤵
- Executes dropped EXE
PID:3236 -
\??\c:\1hbbnh.exec:\1hbbnh.exe28⤵
- Executes dropped EXE
PID:4352 -
\??\c:\tnhttn.exec:\tnhttn.exe29⤵
- Executes dropped EXE
PID:3364 -
\??\c:\pvpjv.exec:\pvpjv.exe30⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jdjjd.exec:\jdjjd.exe31⤵
- Executes dropped EXE
PID:3264 -
\??\c:\nnbtbh.exec:\nnbtbh.exe32⤵
- Executes dropped EXE
PID:4696 -
\??\c:\nnnthb.exec:\nnnthb.exe33⤵
- Executes dropped EXE
PID:2644 -
\??\c:\djppd.exec:\djppd.exe34⤵
- Executes dropped EXE
PID:4544 -
\??\c:\fffxrlf.exec:\fffxrlf.exe35⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hnhnnb.exec:\hnhnnb.exe36⤵
- Executes dropped EXE
PID:1640 -
\??\c:\nhbhtn.exec:\nhbhtn.exe37⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vpjdv.exec:\vpjdv.exe38⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3dvjv.exec:\3dvjv.exe39⤵
- Executes dropped EXE
PID:4428 -
\??\c:\fxrlxff.exec:\fxrlxff.exe40⤵
- Executes dropped EXE
PID:1880 -
\??\c:\btttnh.exec:\btttnh.exe41⤵
- Executes dropped EXE
PID:1196 -
\??\c:\ttnnbb.exec:\ttnnbb.exe42⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvpvp.exec:\jvpvp.exe43⤵
- Executes dropped EXE
PID:2260 -
\??\c:\djjjv.exec:\djjjv.exe44⤵
- Executes dropped EXE
PID:2008 -
\??\c:\3xlrfrr.exec:\3xlrfrr.exe45⤵
- Executes dropped EXE
PID:4700 -
\??\c:\rffxlll.exec:\rffxlll.exe46⤵
- Executes dropped EXE
PID:3320 -
\??\c:\tttbbt.exec:\tttbbt.exe47⤵
- Executes dropped EXE
PID:220 -
\??\c:\pdjpj.exec:\pdjpj.exe48⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjjjd.exec:\jjjjd.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\lllxlfr.exec:\lllxlfr.exe50⤵
- Executes dropped EXE
PID:3456 -
\??\c:\flfflrx.exec:\flfflrx.exe51⤵
- Executes dropped EXE
PID:4944 -
\??\c:\bhhhbb.exec:\bhhhbb.exe52⤵
- Executes dropped EXE
PID:4840 -
\??\c:\5ppjd.exec:\5ppjd.exe53⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pvpdv.exec:\pvpdv.exe54⤵
- Executes dropped EXE
PID:4372 -
\??\c:\xlllllr.exec:\xlllllr.exe55⤵
- Executes dropped EXE
PID:3828 -
\??\c:\1hhbbt.exec:\1hhbbt.exe56⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhnnbb.exec:\hhnnbb.exe57⤵
- Executes dropped EXE
PID:4636 -
\??\c:\vddjp.exec:\vddjp.exe58⤵
- Executes dropped EXE
PID:3864 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe59⤵
- Executes dropped EXE
PID:1792 -
\??\c:\nhhbnn.exec:\nhhbnn.exe60⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tbbthb.exec:\tbbthb.exe61⤵
- Executes dropped EXE
PID:3672 -
\??\c:\frfrrfl.exec:\frfrrfl.exe62⤵
- Executes dropped EXE
PID:3204 -
\??\c:\3tbtnn.exec:\3tbtnn.exe63⤵
- Executes dropped EXE
PID:3188 -
\??\c:\5jppj.exec:\5jppj.exe64⤵
- Executes dropped EXE
PID:3800 -
\??\c:\vvpdj.exec:\vvpdj.exe65⤵
- Executes dropped EXE
PID:4724 -
\??\c:\fxrffff.exec:\fxrffff.exe66⤵PID:3992
-
\??\c:\llxlfrr.exec:\llxlfrr.exe67⤵PID:1420
-
\??\c:\hbbtnh.exec:\hbbtnh.exe68⤵PID:2564
-
\??\c:\dvjdv.exec:\dvjdv.exe69⤵PID:2468
-
\??\c:\ddpjv.exec:\ddpjv.exe70⤵PID:5008
-
\??\c:\lrlffff.exec:\lrlffff.exe71⤵PID:5072
-
\??\c:\lflflfl.exec:\lflflfl.exe72⤵PID:3276
-
\??\c:\tnhhtt.exec:\tnhhtt.exe73⤵PID:720
-
\??\c:\dddvp.exec:\dddvp.exe74⤵PID:3712
-
\??\c:\9dvdv.exec:\9dvdv.exe75⤵PID:1400
-
\??\c:\lffllxx.exec:\lffllxx.exe76⤵PID:4380
-
\??\c:\httthn.exec:\httthn.exe77⤵PID:1072
-
\??\c:\lllffxr.exec:\lllffxr.exe78⤵PID:4692
-
\??\c:\lrlfxxl.exec:\lrlfxxl.exe79⤵PID:4828
-
\??\c:\5hhhhh.exec:\5hhhhh.exe80⤵PID:2060
-
\??\c:\pppdj.exec:\pppdj.exe81⤵PID:2204
-
\??\c:\jdjdp.exec:\jdjdp.exe82⤵PID:4160
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe83⤵PID:4532
-
\??\c:\5lrfrlx.exec:\5lrfrlx.exe84⤵PID:1856
-
\??\c:\thbnhb.exec:\thbnhb.exe85⤵PID:4556
-
\??\c:\htbnhh.exec:\htbnhh.exe86⤵PID:1920
-
\??\c:\jjvvj.exec:\jjvvj.exe87⤵PID:920
-
\??\c:\dvjdp.exec:\dvjdp.exe88⤵PID:1604
-
\??\c:\flxrffx.exec:\flxrffx.exe89⤵PID:1660
-
\??\c:\ntbtnt.exec:\ntbtnt.exe90⤵PID:816
-
\??\c:\htbtnh.exec:\htbtnh.exe91⤵PID:3040
-
\??\c:\vpjdp.exec:\vpjdp.exe92⤵PID:2524
-
\??\c:\jjdvv.exec:\jjdvv.exe93⤵PID:116
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe94⤵PID:1352
-
\??\c:\9rxrxll.exec:\9rxrxll.exe95⤵PID:1324
-
\??\c:\hthbnh.exec:\hthbnh.exe96⤵PID:3696
-
\??\c:\jpddd.exec:\jpddd.exe97⤵PID:4488
-
\??\c:\pvjjp.exec:\pvjjp.exe98⤵PID:4908
-
\??\c:\1lxlfxl.exec:\1lxlfxl.exe99⤵PID:4544
-
\??\c:\tbbntt.exec:\tbbntt.exe100⤵PID:3036
-
\??\c:\1vdvd.exec:\1vdvd.exe101⤵PID:1860
-
\??\c:\jvjvj.exec:\jvjvj.exe102⤵PID:3624
-
\??\c:\frxllfl.exec:\frxllfl.exe103⤵PID:1040
-
\??\c:\5lfxrlx.exec:\5lfxrlx.exe104⤵PID:4428
-
\??\c:\hnttnh.exec:\hnttnh.exe105⤵PID:3172
-
\??\c:\5jvpd.exec:\5jvpd.exe106⤵PID:2744
-
\??\c:\dddpd.exec:\dddpd.exe107⤵PID:388
-
\??\c:\frxrffl.exec:\frxrffl.exe108⤵PID:3048
-
\??\c:\xlfrxrl.exec:\xlfrxrl.exe109⤵PID:1436
-
\??\c:\hnnnbt.exec:\hnnnbt.exe110⤵PID:3976
-
\??\c:\1bhbbb.exec:\1bhbbb.exe111⤵PID:4592
-
\??\c:\1jvjv.exec:\1jvjv.exe112⤵PID:1672
-
\??\c:\jppjj.exec:\jppjj.exe113⤵PID:3104
-
\??\c:\lxlllrl.exec:\lxlllrl.exe114⤵PID:4564
-
\??\c:\flrlfxr.exec:\flrlfxr.exe115⤵PID:2632
-
\??\c:\1bbthb.exec:\1bbthb.exe116⤵PID:3388
-
\??\c:\nhhbnb.exec:\nhhbnb.exe117⤵PID:4964
-
\??\c:\dvjvd.exec:\dvjvd.exe118⤵PID:4368
-
\??\c:\fxlxlrl.exec:\fxlxlrl.exe119⤵PID:3400
-
\??\c:\lxxrfxr.exec:\lxxrfxr.exe120⤵PID:4088
-
\??\c:\bhnhbt.exec:\bhnhbt.exe121⤵PID:2664
-
\??\c:\hhhhbt.exec:\hhhhbt.exe122⤵PID:2136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-