Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-10-2024 06:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe
-
Size
65KB
-
MD5
35f7826585e5dac391a03cbc125178a0
-
SHA1
8ee4a34e43cab2f91c0213fde53a8bfc2c03ba20
-
SHA256
820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7
-
SHA512
89fe6e2525a96a09db106e68ebb48a6ff2fc5bc64e76f3483540d24435a113d829670286f3a83df8a034016b11444ad8c085731e3eddcceb0708f12419ab9a17
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27BqfB:ymb3NkkiQ3mdBjFI9cqfB
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4260-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3100-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3348 btttnn.exe 5004 jddvd.exe 2732 xrrxlxr.exe 2396 bhbbht.exe 2028 bntbtt.exe 1016 vjjdd.exe 1128 xfxrlff.exe 2536 xxfflrf.exe 3480 bntnhh.exe 4600 vjvpv.exe 2488 fxrxrrr.exe 1296 xxflllr.exe 3100 hbtnnt.exe 3136 vvpjj.exe 1568 vppjp.exe 4656 rxrrflr.exe 3572 bbbttn.exe 4788 lffxrrl.exe 2348 dppdv.exe 4340 ppjjv.exe 3780 tntthh.exe 432 hnnbth.exe 4520 djjdp.exe 3956 frxxrrl.exe 4380 hbbbhh.exe 3672 pdvdp.exe 4516 dpdvj.exe 1996 5xfrlrl.exe 560 5nbtbh.exe 3144 7pppj.exe 3120 pdpjd.exe 3184 rflfffl.exe 2900 hntnnn.exe 2528 dppdv.exe 4004 vjpjv.exe 1336 frlxllx.exe 748 nnhhbb.exe 3624 1ttnhb.exe 2512 pvjpd.exe 4388 jddjd.exe 1668 rffffrf.exe 1692 xxlrxll.exe 4568 nhbtnn.exe 2700 vvvvj.exe 60 pdpjj.exe 3148 frxxrxx.exe 2412 fxlxxrr.exe 2396 nnnhbb.exe 3396 ddjpd.exe 3132 lxrffxr.exe 2304 lxfrlfr.exe 4368 nhnhhh.exe 3728 nbthbt.exe 1980 1ppdv.exe 2084 fxrlxrr.exe 2216 1tntth.exe 4576 jdpdv.exe 4572 7dvjp.exe 2624 xlxxfrf.exe 1432 rlrlfll.exe 2052 hbbtnh.exe 3804 bthhhb.exe 4448 vjpdv.exe 1964 jdvdj.exe -
resource yara_rule behavioral2/memory/4260-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3100-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rxrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxrlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5btntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrxlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhtht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 3348 4260 820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe 82 PID 4260 wrote to memory of 3348 4260 820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe 82 PID 4260 wrote to memory of 3348 4260 820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe 82 PID 3348 wrote to memory of 5004 3348 btttnn.exe 83 PID 3348 wrote to memory of 5004 3348 btttnn.exe 83 PID 3348 wrote to memory of 5004 3348 btttnn.exe 83 PID 5004 wrote to memory of 2732 5004 jddvd.exe 84 PID 5004 wrote to memory of 2732 5004 jddvd.exe 84 PID 5004 wrote to memory of 2732 5004 jddvd.exe 84 PID 2732 wrote to memory of 2396 2732 xrrxlxr.exe 85 PID 2732 wrote to memory of 2396 2732 xrrxlxr.exe 85 PID 2732 wrote to memory of 2396 2732 xrrxlxr.exe 85 PID 2396 wrote to memory of 2028 2396 bhbbht.exe 86 PID 2396 wrote to memory of 2028 2396 bhbbht.exe 86 PID 2396 wrote to memory of 2028 2396 bhbbht.exe 86 PID 2028 wrote to memory of 1016 2028 bntbtt.exe 87 PID 2028 wrote to memory of 1016 2028 bntbtt.exe 87 PID 2028 wrote to memory of 1016 2028 bntbtt.exe 87 PID 1016 wrote to memory of 1128 1016 vjjdd.exe 88 PID 1016 wrote to memory of 1128 1016 vjjdd.exe 88 PID 1016 wrote to memory of 1128 1016 vjjdd.exe 88 PID 1128 wrote to memory of 2536 1128 xfxrlff.exe 89 PID 1128 wrote to memory of 2536 1128 xfxrlff.exe 89 PID 1128 wrote to memory of 2536 1128 xfxrlff.exe 89 PID 2536 wrote to memory of 3480 2536 xxfflrf.exe 90 PID 2536 wrote to memory of 3480 2536 xxfflrf.exe 90 PID 2536 wrote to memory of 3480 2536 xxfflrf.exe 90 PID 3480 wrote to memory of 4600 3480 bntnhh.exe 91 PID 3480 wrote to memory of 4600 3480 bntnhh.exe 91 PID 3480 wrote to memory of 4600 3480 bntnhh.exe 91 PID 4600 wrote to memory of 2488 4600 vjvpv.exe 92 PID 4600 wrote to memory of 2488 4600 vjvpv.exe 92 PID 4600 wrote to memory of 2488 4600 vjvpv.exe 92 PID 2488 wrote to memory of 1296 2488 fxrxrrr.exe 93 PID 2488 wrote to memory of 1296 2488 fxrxrrr.exe 93 PID 2488 wrote to memory of 1296 2488 fxrxrrr.exe 93 PID 1296 wrote to memory of 3100 1296 xxflllr.exe 94 PID 1296 wrote to memory of 3100 1296 xxflllr.exe 94 PID 1296 wrote to memory of 3100 1296 xxflllr.exe 94 PID 3100 wrote to memory of 3136 3100 hbtnnt.exe 95 PID 3100 wrote to memory of 3136 3100 hbtnnt.exe 95 PID 3100 wrote to memory of 3136 3100 hbtnnt.exe 95 PID 3136 wrote to memory of 1568 3136 vvpjj.exe 96 PID 3136 wrote to memory of 1568 3136 vvpjj.exe 96 PID 3136 wrote to memory of 1568 3136 vvpjj.exe 96 PID 1568 wrote to memory of 4656 1568 vppjp.exe 97 PID 1568 wrote to memory of 4656 1568 vppjp.exe 97 PID 1568 wrote to memory of 4656 1568 vppjp.exe 97 PID 4656 wrote to memory of 3572 4656 rxrrflr.exe 98 PID 4656 wrote to memory of 3572 4656 rxrrflr.exe 98 PID 4656 wrote to memory of 3572 4656 rxrrflr.exe 98 PID 3572 wrote to memory of 4788 3572 bbbttn.exe 99 PID 3572 wrote to memory of 4788 3572 bbbttn.exe 99 PID 3572 wrote to memory of 4788 3572 bbbttn.exe 99 PID 4788 wrote to memory of 2348 4788 lffxrrl.exe 100 PID 4788 wrote to memory of 2348 4788 lffxrrl.exe 100 PID 4788 wrote to memory of 2348 4788 lffxrrl.exe 100 PID 2348 wrote to memory of 4340 2348 dppdv.exe 101 PID 2348 wrote to memory of 4340 2348 dppdv.exe 101 PID 2348 wrote to memory of 4340 2348 dppdv.exe 101 PID 4340 wrote to memory of 3780 4340 ppjjv.exe 102 PID 4340 wrote to memory of 3780 4340 ppjjv.exe 102 PID 4340 wrote to memory of 3780 4340 ppjjv.exe 102 PID 3780 wrote to memory of 432 3780 tntthh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe"C:\Users\Admin\AppData\Local\Temp\820332fbbfb62b4c7fa29895df6832959fd1df74116c323c0e324aa89d9721f7N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\btttnn.exec:\btttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\jddvd.exec:\jddvd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\xrrxlxr.exec:\xrrxlxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\bhbbht.exec:\bhbbht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\bntbtt.exec:\bntbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\vjjdd.exec:\vjjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\xfxrlff.exec:\xfxrlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\xxfflrf.exec:\xxfflrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\bntnhh.exec:\bntnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\vjvpv.exec:\vjvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\fxrxrrr.exec:\fxrxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\xxflllr.exec:\xxflllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\hbtnnt.exec:\hbtnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\vvpjj.exec:\vvpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\vppjp.exec:\vppjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\rxrrflr.exec:\rxrrflr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\bbbttn.exec:\bbbttn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\lffxrrl.exec:\lffxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\dppdv.exec:\dppdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\ppjjv.exec:\ppjjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\tntthh.exec:\tntthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\hnnbth.exec:\hnnbth.exe23⤵
- Executes dropped EXE
PID:432 -
\??\c:\djjdp.exec:\djjdp.exe24⤵
- Executes dropped EXE
PID:4520 -
\??\c:\frxxrrl.exec:\frxxrrl.exe25⤵
- Executes dropped EXE
PID:3956 -
\??\c:\hbbbhh.exec:\hbbbhh.exe26⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pdvdp.exec:\pdvdp.exe27⤵
- Executes dropped EXE
PID:3672 -
\??\c:\dpdvj.exec:\dpdvj.exe28⤵
- Executes dropped EXE
PID:4516 -
\??\c:\5xfrlrl.exec:\5xfrlrl.exe29⤵
- Executes dropped EXE
PID:1996 -
\??\c:\5nbtbh.exec:\5nbtbh.exe30⤵
- Executes dropped EXE
PID:560 -
\??\c:\7pppj.exec:\7pppj.exe31⤵
- Executes dropped EXE
PID:3144 -
\??\c:\pdpjd.exec:\pdpjd.exe32⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rflfffl.exec:\rflfffl.exe33⤵
- Executes dropped EXE
PID:3184 -
\??\c:\hntnnn.exec:\hntnnn.exe34⤵
- Executes dropped EXE
PID:2900 -
\??\c:\dppdv.exec:\dppdv.exe35⤵
- Executes dropped EXE
PID:2528 -
\??\c:\vjpjv.exec:\vjpjv.exe36⤵
- Executes dropped EXE
PID:4004 -
\??\c:\frlxllx.exec:\frlxllx.exe37⤵
- Executes dropped EXE
PID:1336 -
\??\c:\nnhhbb.exec:\nnhhbb.exe38⤵
- Executes dropped EXE
PID:748 -
\??\c:\1ttnhb.exec:\1ttnhb.exe39⤵
- Executes dropped EXE
PID:3624 -
\??\c:\pvjpd.exec:\pvjpd.exe40⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jddjd.exec:\jddjd.exe41⤵
- Executes dropped EXE
PID:4388 -
\??\c:\rffffrf.exec:\rffffrf.exe42⤵
- Executes dropped EXE
PID:1668 -
\??\c:\xxlrxll.exec:\xxlrxll.exe43⤵
- Executes dropped EXE
PID:1692 -
\??\c:\nhbtnn.exec:\nhbtnn.exe44⤵
- Executes dropped EXE
PID:4568 -
\??\c:\vvvvj.exec:\vvvvj.exe45⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pdpjj.exec:\pdpjj.exe46⤵
- Executes dropped EXE
PID:60 -
\??\c:\frxxrxx.exec:\frxxrxx.exe47⤵
- Executes dropped EXE
PID:3148 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe48⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nnnhbb.exec:\nnnhbb.exe49⤵
- Executes dropped EXE
PID:2396 -
\??\c:\ddjpd.exec:\ddjpd.exe50⤵
- Executes dropped EXE
PID:3396 -
\??\c:\lxrffxr.exec:\lxrffxr.exe51⤵
- Executes dropped EXE
PID:3132 -
\??\c:\lxfrlfr.exec:\lxfrlfr.exe52⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nhnhhh.exec:\nhnhhh.exe53⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nbthbt.exec:\nbthbt.exe54⤵
- Executes dropped EXE
PID:3728 -
\??\c:\1ppdv.exec:\1ppdv.exe55⤵
- Executes dropped EXE
PID:1980 -
\??\c:\fxrlxrr.exec:\fxrlxrr.exe56⤵
- Executes dropped EXE
PID:2084 -
\??\c:\1tntth.exec:\1tntth.exe57⤵
- Executes dropped EXE
PID:2216 -
\??\c:\jdpdv.exec:\jdpdv.exe58⤵
- Executes dropped EXE
PID:4576 -
\??\c:\7dvjp.exec:\7dvjp.exe59⤵
- Executes dropped EXE
PID:4572 -
\??\c:\xlxxfrf.exec:\xlxxfrf.exe60⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rlrlfll.exec:\rlrlfll.exe61⤵
- Executes dropped EXE
PID:1432 -
\??\c:\hbbtnh.exec:\hbbtnh.exe62⤵
- Executes dropped EXE
PID:2052 -
\??\c:\bthhhb.exec:\bthhhb.exe63⤵
- Executes dropped EXE
PID:3804 -
\??\c:\vjpdv.exec:\vjpdv.exe64⤵
- Executes dropped EXE
PID:4448 -
\??\c:\jdvdj.exec:\jdvdj.exe65⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lfxrffx.exec:\lfxrffx.exe66⤵PID:920
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe67⤵
- System Location Discovery: System Language Discovery
PID:968 -
\??\c:\tnnnbb.exec:\tnnnbb.exe68⤵PID:3572
-
\??\c:\thhtnt.exec:\thhtnt.exe69⤵PID:4504
-
\??\c:\ppjvj.exec:\ppjvj.exe70⤵PID:4144
-
\??\c:\rflrfxr.exec:\rflrfxr.exe71⤵PID:864
-
\??\c:\fllffrl.exec:\fllffrl.exe72⤵PID:816
-
\??\c:\1nbtnh.exec:\1nbtnh.exe73⤵PID:3448
-
\??\c:\hbhttb.exec:\hbhttb.exe74⤵PID:3900
-
\??\c:\1vdjv.exec:\1vdjv.exe75⤵PID:1664
-
\??\c:\fllfrlf.exec:\fllfrlf.exe76⤵PID:5012
-
\??\c:\xrlfrlf.exec:\xrlfrlf.exe77⤵PID:2400
-
\??\c:\nbhntb.exec:\nbhntb.exe78⤵PID:416
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe79⤵PID:4252
-
\??\c:\nbnhbn.exec:\nbnhbn.exe80⤵PID:5008
-
\??\c:\nbtnbh.exec:\nbtnbh.exe81⤵PID:1996
-
\??\c:\vjjdv.exec:\vjjdv.exe82⤵PID:1400
-
\??\c:\3rrlrrr.exec:\3rrlrrr.exe83⤵PID:5016
-
\??\c:\xlllffx.exec:\xlllffx.exe84⤵PID:820
-
\??\c:\tthbth.exec:\tthbth.exe85⤵PID:2428
-
\??\c:\hbbnbt.exec:\hbbnbt.exe86⤵PID:3184
-
\??\c:\dvdvd.exec:\dvdvd.exe87⤵PID:2900
-
\??\c:\7ffrfrl.exec:\7ffrfrl.exe88⤵PID:1904
-
\??\c:\rflfrlf.exec:\rflfrlf.exe89⤵PID:4900
-
\??\c:\bttnbb.exec:\bttnbb.exe90⤵PID:4320
-
\??\c:\jddvp.exec:\jddvp.exe91⤵PID:2888
-
\??\c:\jdpdv.exec:\jdpdv.exe92⤵PID:3128
-
\??\c:\lflfxfx.exec:\lflfxfx.exe93⤵PID:4308
-
\??\c:\rlfxffx.exec:\rlfxffx.exe94⤵PID:4388
-
\??\c:\nnbnhb.exec:\nnbnhb.exe95⤵PID:4864
-
\??\c:\9ppjv.exec:\9ppjv.exe96⤵PID:3692
-
\??\c:\dvjdp.exec:\dvjdp.exe97⤵PID:4796
-
\??\c:\llrlxxx.exec:\llrlxxx.exe98⤵PID:384
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe99⤵PID:2212
-
\??\c:\hbnhhh.exec:\hbnhhh.exe100⤵PID:1860
-
\??\c:\tnhthh.exec:\tnhthh.exe101⤵PID:736
-
\??\c:\pvvpp.exec:\pvvpp.exe102⤵PID:3564
-
\??\c:\xrxlrxl.exec:\xrxlrxl.exe103⤵PID:3256
-
\??\c:\llxlrlx.exec:\llxlrlx.exe104⤵PID:3636
-
\??\c:\nbbtnn.exec:\nbbtnn.exe105⤵PID:3236
-
\??\c:\nhbthb.exec:\nhbthb.exe106⤵PID:2544
-
\??\c:\3dddv.exec:\3dddv.exe107⤵PID:3704
-
\??\c:\lrflxfl.exec:\lrflxfl.exe108⤵PID:620
-
\??\c:\frfxlxf.exec:\frfxlxf.exe109⤵PID:2132
-
\??\c:\1bbttt.exec:\1bbttt.exe110⤵PID:2332
-
\??\c:\thhnhb.exec:\thhnhb.exe111⤵PID:1524
-
\??\c:\pppdp.exec:\pppdp.exe112⤵PID:2612
-
\??\c:\llrlxxl.exec:\llrlxxl.exe113⤵PID:3620
-
\??\c:\btttbh.exec:\btttbh.exe114⤵PID:3488
-
\??\c:\tnhbnn.exec:\tnhbnn.exe115⤵PID:3644
-
\??\c:\dvvpp.exec:\dvvpp.exe116⤵PID:1568
-
\??\c:\pdvvp.exec:\pdvvp.exe117⤵PID:4280
-
\??\c:\fxxrxrf.exec:\fxxrxrf.exe118⤵PID:2192
-
\??\c:\httnbt.exec:\httnbt.exe119⤵PID:4068
-
\??\c:\httnhb.exec:\httnhb.exe120⤵PID:4008
-
\??\c:\vjpdv.exec:\vjpdv.exe121⤵PID:2340
-
\??\c:\dvvpd.exec:\dvvpd.exe122⤵PID:4504
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-