Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/10/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe
Resource
win7-20240903-en
General
-
Target
455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe
-
Size
76KB
-
MD5
919e3c76216dd15c75e50b07a4bc2050
-
SHA1
2947994fcec32371127d19d4a64218cb0c3ced12
-
SHA256
455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20f
-
SHA512
1f2432c85b0faa06b01911533eb045c7c75bc53022a3fe4179766c465710b7dce0c7b5bbea33470a5eaf607024aba77e2ee504c94c213d4add2e4c1f01d3f88f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmP7y:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHL
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4756-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3432-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1792-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4968 xlrrllf.exe 4440 thhhtn.exe 4852 hhnhbn.exe 3432 9dpjj.exe 1920 lrrlffl.exe 3672 5ntbbt.exe 3664 vdjpd.exe 2060 fxllrrf.exe 1648 hhttnb.exe 2216 jddvp.exe 4952 ppppj.exe 1792 xrrlffx.exe 628 hbnhbh.exe 3980 ttbtbb.exe 2548 nhbbtb.exe 1412 3nnnbh.exe 4696 jjpjp.exe 1020 xfxrrrl.exe 5048 3thbhh.exe 5020 3thhnt.exe 4580 dddvp.exe 3092 fffxrrr.exe 2544 nhnnnt.exe 2844 hbnbnn.exe 3004 1vjjd.exe 3984 3xffrxr.exe 2212 tnhhbb.exe 1476 pdjjj.exe 3428 jpdvp.exe 3080 frrrrrr.exe 4184 bthhnn.exe 1856 htthtn.exe 1260 dvvvp.exe 3568 fxrfrlx.exe 4684 xrrfrlf.exe 4664 btnhtt.exe 5100 ntnbnn.exe 4596 jvpdp.exe 2920 3xrlxxr.exe 868 xrxrrrf.exe 636 nhbthb.exe 1636 3bhbnh.exe 4288 1llfxxr.exe 1712 rrxrxxr.exe 2908 nbthbt.exe 4300 vdvjd.exe 4520 lxrfrlx.exe 1396 hthnnh.exe 4868 htnbnh.exe 2156 vdpdv.exe 3904 pvpdp.exe 3144 llxrlfx.exe 2564 flrlfxr.exe 3432 hbtbth.exe 4724 thbnhb.exe 740 1vjdp.exe 2260 vdvdd.exe 3536 xffrlfx.exe 3988 hntbhn.exe 840 bbbttt.exe 1668 vppjd.exe 1116 jvvpd.exe 4532 llfllrr.exe 608 7tttnt.exe -
resource yara_rule behavioral2/memory/4756-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3432-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1792-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrlflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbbbb.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4968 4756 455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe 83 PID 4756 wrote to memory of 4968 4756 455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe 83 PID 4756 wrote to memory of 4968 4756 455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe 83 PID 4968 wrote to memory of 4440 4968 xlrrllf.exe 84 PID 4968 wrote to memory of 4440 4968 xlrrllf.exe 84 PID 4968 wrote to memory of 4440 4968 xlrrllf.exe 84 PID 4440 wrote to memory of 4852 4440 thhhtn.exe 85 PID 4440 wrote to memory of 4852 4440 thhhtn.exe 85 PID 4440 wrote to memory of 4852 4440 thhhtn.exe 85 PID 4852 wrote to memory of 3432 4852 hhnhbn.exe 86 PID 4852 wrote to memory of 3432 4852 hhnhbn.exe 86 PID 4852 wrote to memory of 3432 4852 hhnhbn.exe 86 PID 3432 wrote to memory of 1920 3432 9dpjj.exe 87 PID 3432 wrote to memory of 1920 3432 9dpjj.exe 87 PID 3432 wrote to memory of 1920 3432 9dpjj.exe 87 PID 1920 wrote to memory of 3672 1920 lrrlffl.exe 88 PID 1920 wrote to memory of 3672 1920 lrrlffl.exe 88 PID 1920 wrote to memory of 3672 1920 lrrlffl.exe 88 PID 3672 wrote to memory of 3664 3672 5ntbbt.exe 89 PID 3672 wrote to memory of 3664 3672 5ntbbt.exe 89 PID 3672 wrote to memory of 3664 3672 5ntbbt.exe 89 PID 3664 wrote to memory of 2060 3664 vdjpd.exe 90 PID 3664 wrote to memory of 2060 3664 vdjpd.exe 90 PID 3664 wrote to memory of 2060 3664 vdjpd.exe 90 PID 2060 wrote to memory of 1648 2060 fxllrrf.exe 91 PID 2060 wrote to memory of 1648 2060 fxllrrf.exe 91 PID 2060 wrote to memory of 1648 2060 fxllrrf.exe 91 PID 1648 wrote to memory of 2216 1648 hhttnb.exe 92 PID 1648 wrote to memory of 2216 1648 hhttnb.exe 92 PID 1648 wrote to memory of 2216 1648 hhttnb.exe 92 PID 2216 wrote to memory of 4952 2216 jddvp.exe 93 PID 2216 wrote to memory of 4952 2216 jddvp.exe 93 PID 2216 wrote to memory of 4952 2216 jddvp.exe 93 PID 4952 wrote to memory of 1792 4952 ppppj.exe 94 PID 4952 wrote to memory of 1792 4952 ppppj.exe 94 PID 4952 wrote to memory of 1792 4952 ppppj.exe 94 PID 1792 wrote to memory of 628 1792 xrrlffx.exe 95 PID 1792 wrote to memory of 628 1792 xrrlffx.exe 95 PID 1792 wrote to memory of 628 1792 xrrlffx.exe 95 PID 628 wrote to memory of 3980 628 hbnhbh.exe 96 PID 628 wrote to memory of 3980 628 hbnhbh.exe 96 PID 628 wrote to memory of 3980 628 hbnhbh.exe 96 PID 3980 wrote to memory of 2548 3980 ttbtbb.exe 97 PID 3980 wrote to memory of 2548 3980 ttbtbb.exe 97 PID 3980 wrote to memory of 2548 3980 ttbtbb.exe 97 PID 2548 wrote to memory of 1412 2548 nhbbtb.exe 98 PID 2548 wrote to memory of 1412 2548 nhbbtb.exe 98 PID 2548 wrote to memory of 1412 2548 nhbbtb.exe 98 PID 1412 wrote to memory of 4696 1412 3nnnbh.exe 99 PID 1412 wrote to memory of 4696 1412 3nnnbh.exe 99 PID 1412 wrote to memory of 4696 1412 3nnnbh.exe 99 PID 4696 wrote to memory of 1020 4696 jjpjp.exe 100 PID 4696 wrote to memory of 1020 4696 jjpjp.exe 100 PID 4696 wrote to memory of 1020 4696 jjpjp.exe 100 PID 1020 wrote to memory of 5048 1020 xfxrrrl.exe 101 PID 1020 wrote to memory of 5048 1020 xfxrrrl.exe 101 PID 1020 wrote to memory of 5048 1020 xfxrrrl.exe 101 PID 5048 wrote to memory of 5020 5048 3thbhh.exe 102 PID 5048 wrote to memory of 5020 5048 3thbhh.exe 102 PID 5048 wrote to memory of 5020 5048 3thbhh.exe 102 PID 5020 wrote to memory of 4580 5020 3thhnt.exe 103 PID 5020 wrote to memory of 4580 5020 3thhnt.exe 103 PID 5020 wrote to memory of 4580 5020 3thhnt.exe 103 PID 4580 wrote to memory of 3092 4580 dddvp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe"C:\Users\Admin\AppData\Local\Temp\455b30a4b3b213f361b9b8a558f9dd7d6f793506d386551ed9a355d9d63bb20fN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\xlrrllf.exec:\xlrrllf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\thhhtn.exec:\thhhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\hhnhbn.exec:\hhnhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\9dpjj.exec:\9dpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
\??\c:\lrrlffl.exec:\lrrlffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\5ntbbt.exec:\5ntbbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\vdjpd.exec:\vdjpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\fxllrrf.exec:\fxllrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\hhttnb.exec:\hhttnb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\jddvp.exec:\jddvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\ppppj.exec:\ppppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\xrrlffx.exec:\xrrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\hbnhbh.exec:\hbnhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\ttbtbb.exec:\ttbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\nhbbtb.exec:\nhbbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\3nnnbh.exec:\3nnnbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\jjpjp.exec:\jjpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\3thbhh.exec:\3thbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\3thhnt.exec:\3thhnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\dddvp.exec:\dddvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\fffxrrr.exec:\fffxrrr.exe23⤵
- Executes dropped EXE
PID:3092 -
\??\c:\nhnnnt.exec:\nhnnnt.exe24⤵
- Executes dropped EXE
PID:2544 -
\??\c:\hbnbnn.exec:\hbnbnn.exe25⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1vjjd.exec:\1vjjd.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3xffrxr.exec:\3xffrxr.exe27⤵
- Executes dropped EXE
PID:3984 -
\??\c:\tnhhbb.exec:\tnhhbb.exe28⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pdjjj.exec:\pdjjj.exe29⤵
- Executes dropped EXE
PID:1476 -
\??\c:\jpdvp.exec:\jpdvp.exe30⤵
- Executes dropped EXE
PID:3428 -
\??\c:\frrrrrr.exec:\frrrrrr.exe31⤵
- Executes dropped EXE
PID:3080 -
\??\c:\bthhnn.exec:\bthhnn.exe32⤵
- Executes dropped EXE
PID:4184 -
\??\c:\htthtn.exec:\htthtn.exe33⤵
- Executes dropped EXE
PID:1856 -
\??\c:\dvvvp.exec:\dvvvp.exe34⤵
- Executes dropped EXE
PID:1260 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe35⤵
- Executes dropped EXE
PID:3568 -
\??\c:\xrrfrlf.exec:\xrrfrlf.exe36⤵
- Executes dropped EXE
PID:4684 -
\??\c:\btnhtt.exec:\btnhtt.exe37⤵
- Executes dropped EXE
PID:4664 -
\??\c:\ntnbnn.exec:\ntnbnn.exe38⤵
- Executes dropped EXE
PID:5100 -
\??\c:\jvpdp.exec:\jvpdp.exe39⤵
- Executes dropped EXE
PID:4596 -
\??\c:\3xrlxxr.exec:\3xrlxxr.exe40⤵
- Executes dropped EXE
PID:2920 -
\??\c:\xrxrrrf.exec:\xrxrrrf.exe41⤵
- Executes dropped EXE
PID:868 -
\??\c:\nhbthb.exec:\nhbthb.exe42⤵
- Executes dropped EXE
PID:636 -
\??\c:\3bhbnh.exec:\3bhbnh.exe43⤵
- Executes dropped EXE
PID:1636 -
\??\c:\1llfxxr.exec:\1llfxxr.exe44⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rrxrxxr.exec:\rrxrxxr.exe45⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nbthbt.exec:\nbthbt.exe46⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vdvjd.exec:\vdvjd.exe47⤵
- Executes dropped EXE
PID:4300 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe48⤵
- Executes dropped EXE
PID:4520 -
\??\c:\hthnnh.exec:\hthnnh.exe49⤵
- Executes dropped EXE
PID:1396 -
\??\c:\htnbnh.exec:\htnbnh.exe50⤵
- Executes dropped EXE
PID:4868 -
\??\c:\vdpdv.exec:\vdpdv.exe51⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pvpdp.exec:\pvpdp.exe52⤵
- Executes dropped EXE
PID:3904 -
\??\c:\llxrlfx.exec:\llxrlfx.exe53⤵
- Executes dropped EXE
PID:3144 -
\??\c:\flrlfxr.exec:\flrlfxr.exe54⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hbtbth.exec:\hbtbth.exe55⤵
- Executes dropped EXE
PID:3432 -
\??\c:\thbnhb.exec:\thbnhb.exe56⤵
- Executes dropped EXE
PID:4724 -
\??\c:\1vjdp.exec:\1vjdp.exe57⤵
- Executes dropped EXE
PID:740 -
\??\c:\vdvdd.exec:\vdvdd.exe58⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xffrlfx.exec:\xffrlfx.exe59⤵
- Executes dropped EXE
PID:3536 -
\??\c:\hntbhn.exec:\hntbhn.exe60⤵
- Executes dropped EXE
PID:3988 -
\??\c:\bbbttt.exec:\bbbttt.exe61⤵
- Executes dropped EXE
PID:840 -
\??\c:\vppjd.exec:\vppjd.exe62⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jvvpd.exec:\jvvpd.exe63⤵
- Executes dropped EXE
PID:1116 -
\??\c:\llfllrr.exec:\llfllrr.exe64⤵
- Executes dropped EXE
PID:4532 -
\??\c:\7tttnt.exec:\7tttnt.exe65⤵
- Executes dropped EXE
PID:608 -
\??\c:\djpjd.exec:\djpjd.exe66⤵PID:2404
-
\??\c:\vpjpj.exec:\vpjpj.exe67⤵PID:3212
-
\??\c:\lfrffxl.exec:\lfrffxl.exe68⤵PID:4980
-
\??\c:\7bhbht.exec:\7bhbht.exe69⤵PID:2172
-
\??\c:\tbnnbh.exec:\tbnnbh.exe70⤵PID:464
-
\??\c:\3ddvj.exec:\3ddvj.exe71⤵PID:4212
-
\??\c:\jdjpd.exec:\jdjpd.exe72⤵PID:748
-
\??\c:\frrrflf.exec:\frrrflf.exe73⤵PID:3864
-
\??\c:\bnhhtn.exec:\bnhhtn.exe74⤵PID:1272
-
\??\c:\dvvjv.exec:\dvvjv.exe75⤵PID:4916
-
\??\c:\3tthbt.exec:\3tthbt.exe76⤵PID:2056
-
\??\c:\jppjd.exec:\jppjd.exe77⤵PID:2992
-
\??\c:\1jdjv.exec:\1jdjv.exe78⤵PID:1444
-
\??\c:\1xxlxrf.exec:\1xxlxrf.exe79⤵PID:3560
-
\??\c:\rrrffxr.exec:\rrrffxr.exe80⤵PID:2648
-
\??\c:\hbtbnh.exec:\hbtbnh.exe81⤵PID:4716
-
\??\c:\htnhnn.exec:\htnhnn.exe82⤵PID:2948
-
\??\c:\jjdvd.exec:\jjdvd.exe83⤵PID:3236
-
\??\c:\fllfrlf.exec:\fllfrlf.exe84⤵PID:1956
-
\??\c:\rllfxrl.exec:\rllfxrl.exe85⤵PID:1480
-
\??\c:\bnhtbt.exec:\bnhtbt.exe86⤵PID:5036
-
\??\c:\hnnbnh.exec:\hnnbnh.exe87⤵PID:4576
-
\??\c:\3nntnn.exec:\3nntnn.exe88⤵PID:4844
-
\??\c:\vpjvj.exec:\vpjvj.exe89⤵PID:2968
-
\??\c:\fffxlfx.exec:\fffxlfx.exe90⤵PID:3668
-
\??\c:\httnnh.exec:\httnnh.exe91⤵PID:3208
-
\??\c:\9nnhbb.exec:\9nnhbb.exe92⤵PID:4524
-
\??\c:\jdvvd.exec:\jdvvd.exe93⤵PID:744
-
\??\c:\frrfrlx.exec:\frrfrlx.exe94⤵PID:1224
-
\??\c:\rffrlfr.exec:\rffrlfr.exe95⤵PID:548
-
\??\c:\bbnnnh.exec:\bbnnnh.exe96⤵PID:2356
-
\??\c:\ntbtnh.exec:\ntbtnh.exe97⤵PID:3244
-
\??\c:\9pvvj.exec:\9pvvj.exe98⤵PID:828
-
\??\c:\rlrrrff.exec:\rlrrrff.exe99⤵PID:1552
-
\??\c:\xrffxxf.exec:\xrffxxf.exe100⤵PID:3444
-
\??\c:\bbbnhb.exec:\bbbnhb.exe101⤵PID:2316
-
\??\c:\bbthtn.exec:\bbthtn.exe102⤵PID:868
-
\??\c:\djdvp.exec:\djdvp.exe103⤵PID:636
-
\??\c:\pdvjv.exec:\pdvjv.exe104⤵PID:1888
-
\??\c:\flxfxlr.exec:\flxfxlr.exe105⤵PID:1064
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe106⤵PID:400
-
\??\c:\nbhttt.exec:\nbhttt.exe107⤵PID:4416
-
\??\c:\dvvpd.exec:\dvvpd.exe108⤵PID:2688
-
\??\c:\pjjdv.exec:\pjjdv.exe109⤵
- System Location Discovery: System Language Discovery
PID:4520 -
\??\c:\9rxlxrl.exec:\9rxlxrl.exe110⤵PID:3976
-
\??\c:\lfrlxrl.exec:\lfrlxrl.exe111⤵PID:1492
-
\??\c:\1hnbtn.exec:\1hnbtn.exe112⤵PID:2900
-
\??\c:\tbtthb.exec:\tbtthb.exe113⤵PID:2336
-
\??\c:\vppjv.exec:\vppjv.exe114⤵PID:3144
-
\??\c:\vdjdp.exec:\vdjdp.exe115⤵PID:2084
-
\??\c:\rllrfxr.exec:\rllrfxr.exe116⤵PID:3104
-
\??\c:\7nhbnh.exec:\7nhbnh.exe117⤵PID:4840
-
\??\c:\3tnbht.exec:\3tnbht.exe118⤵PID:5072
-
\??\c:\1pppj.exec:\1pppj.exe119⤵PID:2260
-
\??\c:\rlrllfx.exec:\rlrllfx.exe120⤵PID:392
-
\??\c:\xrrffxr.exec:\xrrffxr.exe121⤵PID:336
-
\??\c:\9bnhnn.exec:\9bnhnn.exe122⤵PID:840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-