Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 04:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe
Resource
win7-20240729-en
6 signatures
150 seconds
General
-
Target
8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe
-
Size
250KB
-
MD5
134fec82a29a7110d058e3bb058cf430
-
SHA1
2eff4898575b65da6aac0e451777b4442f450dd3
-
SHA256
8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958
-
SHA512
d460a979d6544ae362e740907effca9252bd720076d9d21fb18a532cff63ff338f230cce130db2dcc4d357132087c0de98b9794170add6375c137a9ae144d0f9
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFRlu:n3C9uD6AUDCa4NYmRU
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2636-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2620-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/796-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3440-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4292 1frlxxr.exe 3652 9ppjd.exe 1676 3jpvp.exe 4304 1pvpd.exe 732 hthtnb.exe 3840 hthbbt.exe 4308 llxxxll.exe 2396 tnbbhb.exe 4604 1pjvp.exe 4908 lfrlxrf.exe 4484 dvdjv.exe 3288 9xxrfxr.exe 2620 nnhtnt.exe 2556 htnhbt.exe 4368 pjppj.exe 3304 5flffff.exe 652 3bthtn.exe 2864 vdjdp.exe 796 3fxrlll.exe 4336 hhhbbn.exe 2848 jdvpp.exe 3276 xxlfrrl.exe 2792 nntnnn.exe 900 nbbbtb.exe 4316 1vdpp.exe 2088 3jpdd.exe 4488 bbnbtn.exe 3440 jjdvp.exe 2124 rxxfrll.exe 1948 9rlfxlf.exe 4656 hhnhnt.exe 4780 hthbhn.exe 1744 jjpjv.exe 4528 xxfxllf.exe 4504 tttttt.exe 4608 vdpjj.exe 4972 lffrffx.exe 4772 rrrllrl.exe 4400 hntnhb.exe 1732 tbtntt.exe 5088 ppjjd.exe 1464 rrlfxxr.exe 3096 nbtnhh.exe 3928 dvdvj.exe 208 pjjvp.exe 3652 xrrlllx.exe 4956 1hhtnn.exe 5024 pvvpj.exe 3848 pjvvj.exe 4916 rxxlrlf.exe 4620 bntttt.exe 3888 5nnnbt.exe 996 dvvpd.exe 1796 ddjdp.exe 2736 llrrrxr.exe 2396 7hnhhh.exe 1424 3btnbb.exe 2204 3ppdv.exe 2804 7bbthh.exe 4484 pppdv.exe 2628 xxlfxxr.exe 3288 bbhbnh.exe 4724 nhtthb.exe 4652 pjjdv.exe -
resource yara_rule behavioral2/memory/2636-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2620-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/796-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3440-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrlrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jpdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 4292 2636 8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe 82 PID 2636 wrote to memory of 4292 2636 8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe 82 PID 2636 wrote to memory of 4292 2636 8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe 82 PID 4292 wrote to memory of 3652 4292 1frlxxr.exe 83 PID 4292 wrote to memory of 3652 4292 1frlxxr.exe 83 PID 4292 wrote to memory of 3652 4292 1frlxxr.exe 83 PID 3652 wrote to memory of 1676 3652 9ppjd.exe 84 PID 3652 wrote to memory of 1676 3652 9ppjd.exe 84 PID 3652 wrote to memory of 1676 3652 9ppjd.exe 84 PID 1676 wrote to memory of 4304 1676 3jpvp.exe 85 PID 1676 wrote to memory of 4304 1676 3jpvp.exe 85 PID 1676 wrote to memory of 4304 1676 3jpvp.exe 85 PID 4304 wrote to memory of 732 4304 1pvpd.exe 86 PID 4304 wrote to memory of 732 4304 1pvpd.exe 86 PID 4304 wrote to memory of 732 4304 1pvpd.exe 86 PID 732 wrote to memory of 3840 732 hthtnb.exe 87 PID 732 wrote to memory of 3840 732 hthtnb.exe 87 PID 732 wrote to memory of 3840 732 hthtnb.exe 87 PID 3840 wrote to memory of 4308 3840 hthbbt.exe 88 PID 3840 wrote to memory of 4308 3840 hthbbt.exe 88 PID 3840 wrote to memory of 4308 3840 hthbbt.exe 88 PID 4308 wrote to memory of 2396 4308 llxxxll.exe 89 PID 4308 wrote to memory of 2396 4308 llxxxll.exe 89 PID 4308 wrote to memory of 2396 4308 llxxxll.exe 89 PID 2396 wrote to memory of 4604 2396 tnbbhb.exe 90 PID 2396 wrote to memory of 4604 2396 tnbbhb.exe 90 PID 2396 wrote to memory of 4604 2396 tnbbhb.exe 90 PID 4604 wrote to memory of 4908 4604 1pjvp.exe 91 PID 4604 wrote to memory of 4908 4604 1pjvp.exe 91 PID 4604 wrote to memory of 4908 4604 1pjvp.exe 91 PID 4908 wrote to memory of 4484 4908 lfrlxrf.exe 92 PID 4908 wrote to memory of 4484 4908 lfrlxrf.exe 92 PID 4908 wrote to memory of 4484 4908 lfrlxrf.exe 92 PID 4484 wrote to memory of 3288 4484 dvdjv.exe 93 PID 4484 wrote to memory of 3288 4484 dvdjv.exe 93 PID 4484 wrote to memory of 3288 4484 dvdjv.exe 93 PID 3288 wrote to memory of 2620 3288 9xxrfxr.exe 94 PID 3288 wrote to memory of 2620 3288 9xxrfxr.exe 94 PID 3288 wrote to memory of 2620 3288 9xxrfxr.exe 94 PID 2620 wrote to memory of 2556 2620 nnhtnt.exe 95 PID 2620 wrote to memory of 2556 2620 nnhtnt.exe 95 PID 2620 wrote to memory of 2556 2620 nnhtnt.exe 95 PID 2556 wrote to memory of 4368 2556 htnhbt.exe 96 PID 2556 wrote to memory of 4368 2556 htnhbt.exe 96 PID 2556 wrote to memory of 4368 2556 htnhbt.exe 96 PID 4368 wrote to memory of 3304 4368 pjppj.exe 97 PID 4368 wrote to memory of 3304 4368 pjppj.exe 97 PID 4368 wrote to memory of 3304 4368 pjppj.exe 97 PID 3304 wrote to memory of 652 3304 5flffff.exe 98 PID 3304 wrote to memory of 652 3304 5flffff.exe 98 PID 3304 wrote to memory of 652 3304 5flffff.exe 98 PID 652 wrote to memory of 2864 652 3bthtn.exe 99 PID 652 wrote to memory of 2864 652 3bthtn.exe 99 PID 652 wrote to memory of 2864 652 3bthtn.exe 99 PID 2864 wrote to memory of 796 2864 vdjdp.exe 100 PID 2864 wrote to memory of 796 2864 vdjdp.exe 100 PID 2864 wrote to memory of 796 2864 vdjdp.exe 100 PID 796 wrote to memory of 4336 796 3fxrlll.exe 101 PID 796 wrote to memory of 4336 796 3fxrlll.exe 101 PID 796 wrote to memory of 4336 796 3fxrlll.exe 101 PID 4336 wrote to memory of 2848 4336 hhhbbn.exe 102 PID 4336 wrote to memory of 2848 4336 hhhbbn.exe 102 PID 4336 wrote to memory of 2848 4336 hhhbbn.exe 102 PID 2848 wrote to memory of 3276 2848 jdvpp.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe"C:\Users\Admin\AppData\Local\Temp\8f17241114bcc7750a42233942a7f9bfa6991ecf203edf496125403d7eac0958N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\1frlxxr.exec:\1frlxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\9ppjd.exec:\9ppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\3jpvp.exec:\3jpvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\1pvpd.exec:\1pvpd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\hthtnb.exec:\hthtnb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:732 -
\??\c:\hthbbt.exec:\hthbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\llxxxll.exec:\llxxxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\tnbbhb.exec:\tnbbhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\1pjvp.exec:\1pjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\lfrlxrf.exec:\lfrlxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\dvdjv.exec:\dvdjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\9xxrfxr.exec:\9xxrfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\nnhtnt.exec:\nnhtnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\htnhbt.exec:\htnhbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\pjppj.exec:\pjppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\5flffff.exec:\5flffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\3bthtn.exec:\3bthtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
\??\c:\vdjdp.exec:\vdjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\3fxrlll.exec:\3fxrlll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\hhhbbn.exec:\hhhbbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\jdvpp.exec:\jdvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xxlfrrl.exec:\xxlfrrl.exe23⤵
- Executes dropped EXE
PID:3276 -
\??\c:\nntnnn.exec:\nntnnn.exe24⤵
- Executes dropped EXE
PID:2792 -
\??\c:\nbbbtb.exec:\nbbbtb.exe25⤵
- Executes dropped EXE
PID:900 -
\??\c:\1vdpp.exec:\1vdpp.exe26⤵
- Executes dropped EXE
PID:4316 -
\??\c:\3jpdd.exec:\3jpdd.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2088 -
\??\c:\bbnbtn.exec:\bbnbtn.exe28⤵
- Executes dropped EXE
PID:4488 -
\??\c:\jjdvp.exec:\jjdvp.exe29⤵
- Executes dropped EXE
PID:3440 -
\??\c:\rxxfrll.exec:\rxxfrll.exe30⤵
- Executes dropped EXE
PID:2124 -
\??\c:\9rlfxlf.exec:\9rlfxlf.exe31⤵
- Executes dropped EXE
PID:1948 -
\??\c:\hhnhnt.exec:\hhnhnt.exe32⤵
- Executes dropped EXE
PID:4656 -
\??\c:\hthbhn.exec:\hthbhn.exe33⤵
- Executes dropped EXE
PID:4780 -
\??\c:\jjpjv.exec:\jjpjv.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\xxfxllf.exec:\xxfxllf.exe35⤵
- Executes dropped EXE
PID:4528 -
\??\c:\tttttt.exec:\tttttt.exe36⤵
- Executes dropped EXE
PID:4504 -
\??\c:\vdpjj.exec:\vdpjj.exe37⤵
- Executes dropped EXE
PID:4608 -
\??\c:\lffrffx.exec:\lffrffx.exe38⤵
- Executes dropped EXE
PID:4972 -
\??\c:\rrrllrl.exec:\rrrllrl.exe39⤵
- Executes dropped EXE
PID:4772 -
\??\c:\hntnhb.exec:\hntnhb.exe40⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tbtntt.exec:\tbtntt.exe41⤵
- Executes dropped EXE
PID:1732 -
\??\c:\ppjjd.exec:\ppjjd.exe42⤵
- Executes dropped EXE
PID:5088 -
\??\c:\rrlfxxr.exec:\rrlfxxr.exe43⤵
- Executes dropped EXE
PID:1464 -
\??\c:\nnnhhb.exec:\nnnhhb.exe44⤵PID:4356
-
\??\c:\nbtnhh.exec:\nbtnhh.exe45⤵
- Executes dropped EXE
PID:3096 -
\??\c:\dvdvj.exec:\dvdvj.exe46⤵
- Executes dropped EXE
PID:3928 -
\??\c:\pjjvp.exec:\pjjvp.exe47⤵
- Executes dropped EXE
PID:208 -
\??\c:\xrrlllx.exec:\xrrlllx.exe48⤵
- Executes dropped EXE
PID:3652 -
\??\c:\1hhtnn.exec:\1hhtnn.exe49⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pvvpj.exec:\pvvpj.exe50⤵
- Executes dropped EXE
PID:5024 -
\??\c:\pjvvj.exec:\pjvvj.exe51⤵
- Executes dropped EXE
PID:3848 -
\??\c:\rxxlrlf.exec:\rxxlrlf.exe52⤵
- Executes dropped EXE
PID:4916 -
\??\c:\bntttt.exec:\bntttt.exe53⤵
- Executes dropped EXE
PID:4620 -
\??\c:\5nnnbt.exec:\5nnnbt.exe54⤵
- Executes dropped EXE
PID:3888 -
\??\c:\dvvpd.exec:\dvvpd.exe55⤵
- Executes dropped EXE
PID:996 -
\??\c:\ddjdp.exec:\ddjdp.exe56⤵
- Executes dropped EXE
PID:1796 -
\??\c:\llrrrxr.exec:\llrrrxr.exe57⤵
- Executes dropped EXE
PID:2736 -
\??\c:\7hnhhh.exec:\7hnhhh.exe58⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3btnbb.exec:\3btnbb.exe59⤵
- Executes dropped EXE
PID:1424 -
\??\c:\3ppdv.exec:\3ppdv.exe60⤵
- Executes dropped EXE
PID:2204 -
\??\c:\7bbthh.exec:\7bbthh.exe61⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pppdv.exec:\pppdv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe63⤵
- Executes dropped EXE
PID:2628 -
\??\c:\bbhbnh.exec:\bbhbnh.exe64⤵
- Executes dropped EXE
PID:3288 -
\??\c:\nhtthb.exec:\nhtthb.exe65⤵
- Executes dropped EXE
PID:4724 -
\??\c:\pjjdv.exec:\pjjdv.exe66⤵
- Executes dropped EXE
PID:4652 -
\??\c:\9vvvp.exec:\9vvvp.exe67⤵PID:3636
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe68⤵PID:2436
-
\??\c:\hbbhnn.exec:\hbbhnn.exe69⤵PID:3228
-
\??\c:\vdpjv.exec:\vdpjv.exe70⤵PID:652
-
\??\c:\pjvpp.exec:\pjvpp.exe71⤵PID:4920
-
\??\c:\rrrrxxr.exec:\rrrrxxr.exe72⤵PID:4208
-
\??\c:\bhnnnt.exec:\bhnnnt.exe73⤵PID:3452
-
\??\c:\jjvpd.exec:\jjvpd.exe74⤵PID:4376
-
\??\c:\jjdvp.exec:\jjdvp.exe75⤵PID:2920
-
\??\c:\1xfxrll.exec:\1xfxrll.exe76⤵PID:2716
-
\??\c:\xlfxrrl.exec:\xlfxrrl.exe77⤵PID:3188
-
\??\c:\9tnhbb.exec:\9tnhbb.exe78⤵PID:2344
-
\??\c:\pjppd.exec:\pjppd.exe79⤵PID:4172
-
\??\c:\xlxlxxl.exec:\xlxlxxl.exe80⤵PID:988
-
\??\c:\lrllfxx.exec:\lrllfxx.exe81⤵PID:1280
-
\??\c:\hhhnnn.exec:\hhhnnn.exe82⤵PID:5072
-
\??\c:\ppppv.exec:\ppppv.exe83⤵PID:3380
-
\??\c:\ffxflxl.exec:\ffxflxl.exe84⤵PID:3440
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe85⤵PID:496
-
\??\c:\3hnhnn.exec:\3hnhnn.exe86⤵PID:5104
-
\??\c:\vdpdp.exec:\vdpdp.exe87⤵PID:3896
-
\??\c:\pjdjv.exec:\pjdjv.exe88⤵PID:3756
-
\??\c:\9frlxlx.exec:\9frlxlx.exe89⤵PID:4132
-
\??\c:\rfrrrrl.exec:\rfrrrrl.exe90⤵PID:1472
-
\??\c:\nthhbh.exec:\nthhbh.exe91⤵PID:4456
-
\??\c:\5vpjv.exec:\5vpjv.exe92⤵PID:2260
-
\??\c:\vvjvp.exec:\vvjvp.exe93⤵PID:2528
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe94⤵PID:1284
-
\??\c:\hnhhbh.exec:\hnhhbh.exe95⤵PID:4452
-
\??\c:\dpvjv.exec:\dpvjv.exe96⤵PID:4400
-
\??\c:\vpppp.exec:\vpppp.exe97⤵PID:236
-
\??\c:\xlxxllf.exec:\xlxxllf.exe98⤵PID:1536
-
\??\c:\3nhbbb.exec:\3nhbbb.exe99⤵PID:3004
-
\??\c:\ddddp.exec:\ddddp.exe100⤵PID:1964
-
\??\c:\ppvjd.exec:\ppvjd.exe101⤵PID:1428
-
\??\c:\7tbttn.exec:\7tbttn.exe102⤵PID:3928
-
\??\c:\pjdvd.exec:\pjdvd.exe103⤵PID:1064
-
\??\c:\9dpvj.exec:\9dpvj.exe104⤵PID:5052
-
\??\c:\7rxxrrx.exec:\7rxxrrx.exe105⤵PID:3988
-
\??\c:\3nhnbh.exec:\3nhnbh.exe106⤵PID:5024
-
\??\c:\1vvpj.exec:\1vvpj.exe107⤵PID:2352
-
\??\c:\lxxxfff.exec:\lxxxfff.exe108⤵PID:3784
-
\??\c:\lflrflf.exec:\lflrflf.exe109⤵PID:3732
-
\??\c:\5tbbtt.exec:\5tbbtt.exe110⤵PID:3952
-
\??\c:\3pjdj.exec:\3pjdj.exe111⤵PID:4220
-
\??\c:\rllfrrl.exec:\rllfrrl.exe112⤵PID:1796
-
\??\c:\xlrrffx.exec:\xlrrffx.exe113⤵PID:3100
-
\??\c:\5hbthh.exec:\5hbthh.exe114⤵PID:4408
-
\??\c:\vjjdv.exec:\vjjdv.exe115⤵PID:1424
-
\??\c:\frrlffx.exec:\frrlffx.exe116⤵PID:856
-
\??\c:\fxfflfr.exec:\fxfflfr.exe117⤵PID:2804
-
\??\c:\bnnhbt.exec:\bnnhbt.exe118⤵PID:1968
-
\??\c:\jdjdd.exec:\jdjdd.exe119⤵PID:2128
-
\??\c:\xfrrrll.exec:\xfrrrll.exe120⤵PID:4328
-
\??\c:\tbbtnh.exec:\tbbtnh.exe121⤵PID:4724
-
\??\c:\1vpdv.exec:\1vpdv.exe122⤵PID:4652
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-