Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 18:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
General
-
Target
1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe
-
Size
68KB
-
MD5
db485556bfa88b743ded11de0bb80807
-
SHA1
1e235382e05074c24134516999a4d06d4ee35eeb
-
SHA256
1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d
-
SHA512
2c88c455fb51d2582a82983db802fd6ad273a282aa8b9b9f6e1d51285bb4686c65a194b4b73be59ce60fdc50e427e62cc539028157b059944555c9a2ad2bd2ca
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIug6bL6Nl1B:ymb3NkkiQ3mdBjFIugptB
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3032-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/416-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3968 5tbttt.exe 3580 ppdjj.exe 2180 lfrlxxl.exe 3644 nntbtb.exe 3060 hbhbnn.exe 2700 ddppj.exe 2928 fxxllll.exe 2368 3lffffl.exe 388 nnnttt.exe 416 ppvvv.exe 4076 7rfrrfr.exe 3996 xxrlxxf.exe 2744 bnbhhn.exe 3776 djppp.exe 4632 fxrrlrl.exe 4832 bntttb.exe 3260 pjjpp.exe 2400 dpppj.exe 1008 flxrxlx.exe 4324 nbbtnh.exe 2196 nhhhhh.exe 760 7jvvd.exe 4232 llrlfxx.exe 2460 5xxxrxx.exe 964 thbtbb.exe 4304 jpdvd.exe 3140 rxffffl.exe 3716 9xfffll.exe 2412 9bnnnh.exe 3756 jppvp.exe 3476 xxrfxrr.exe 4796 ntnbtn.exe 4340 bhnhbt.exe 736 ddddv.exe 2112 rxfrfxx.exe 1244 httnnb.exe 1932 htbbtt.exe 464 dvppp.exe 1528 vdjjj.exe 4316 rrrlllf.exe 3268 bntttb.exe 4480 9tttnn.exe 4044 7pppj.exe 3580 fllffff.exe 1684 xxffffl.exe 1168 nttbbn.exe 2296 nhhnhn.exe 2116 ddppp.exe 4760 vvjpp.exe 1204 lxrlrxf.exe 3908 7bnntb.exe 4812 nnhntt.exe 416 jjpdd.exe 1408 5ffffll.exe 2300 rllrfxf.exe 1360 7hnbhn.exe 4948 7djpj.exe 2780 vdjdj.exe 2396 rffxxxx.exe 1452 hhhnbb.exe 1464 9tttbh.exe 4832 pddvv.exe 4504 vjvpd.exe 4824 lfrrllf.exe -
resource yara_rule behavioral2/memory/3032-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/416-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3140-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9rrrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfrrrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbtbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9hnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxrxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3968 3032 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 83 PID 3032 wrote to memory of 3968 3032 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 83 PID 3032 wrote to memory of 3968 3032 1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe 83 PID 3968 wrote to memory of 3580 3968 5tbttt.exe 85 PID 3968 wrote to memory of 3580 3968 5tbttt.exe 85 PID 3968 wrote to memory of 3580 3968 5tbttt.exe 85 PID 3580 wrote to memory of 2180 3580 ppdjj.exe 86 PID 3580 wrote to memory of 2180 3580 ppdjj.exe 86 PID 3580 wrote to memory of 2180 3580 ppdjj.exe 86 PID 2180 wrote to memory of 3644 2180 lfrlxxl.exe 88 PID 2180 wrote to memory of 3644 2180 lfrlxxl.exe 88 PID 2180 wrote to memory of 3644 2180 lfrlxxl.exe 88 PID 3644 wrote to memory of 3060 3644 nntbtb.exe 89 PID 3644 wrote to memory of 3060 3644 nntbtb.exe 89 PID 3644 wrote to memory of 3060 3644 nntbtb.exe 89 PID 3060 wrote to memory of 2700 3060 hbhbnn.exe 90 PID 3060 wrote to memory of 2700 3060 hbhbnn.exe 90 PID 3060 wrote to memory of 2700 3060 hbhbnn.exe 90 PID 2700 wrote to memory of 2928 2700 ddppj.exe 91 PID 2700 wrote to memory of 2928 2700 ddppj.exe 91 PID 2700 wrote to memory of 2928 2700 ddppj.exe 91 PID 2928 wrote to memory of 2368 2928 fxxllll.exe 92 PID 2928 wrote to memory of 2368 2928 fxxllll.exe 92 PID 2928 wrote to memory of 2368 2928 fxxllll.exe 92 PID 2368 wrote to memory of 388 2368 3lffffl.exe 93 PID 2368 wrote to memory of 388 2368 3lffffl.exe 93 PID 2368 wrote to memory of 388 2368 3lffffl.exe 93 PID 388 wrote to memory of 416 388 nnnttt.exe 94 PID 388 wrote to memory of 416 388 nnnttt.exe 94 PID 388 wrote to memory of 416 388 nnnttt.exe 94 PID 416 wrote to memory of 4076 416 ppvvv.exe 95 PID 416 wrote to memory of 4076 416 ppvvv.exe 95 PID 416 wrote to memory of 4076 416 ppvvv.exe 95 PID 4076 wrote to memory of 3996 4076 7rfrrfr.exe 96 PID 4076 wrote to memory of 3996 4076 7rfrrfr.exe 96 PID 4076 wrote to memory of 3996 4076 7rfrrfr.exe 96 PID 3996 wrote to memory of 2744 3996 xxrlxxf.exe 97 PID 3996 wrote to memory of 2744 3996 xxrlxxf.exe 97 PID 3996 wrote to memory of 2744 3996 xxrlxxf.exe 97 PID 2744 wrote to memory of 3776 2744 bnbhhn.exe 98 PID 2744 wrote to memory of 3776 2744 bnbhhn.exe 98 PID 2744 wrote to memory of 3776 2744 bnbhhn.exe 98 PID 3776 wrote to memory of 4632 3776 djppp.exe 100 PID 3776 wrote to memory of 4632 3776 djppp.exe 100 PID 3776 wrote to memory of 4632 3776 djppp.exe 100 PID 4632 wrote to memory of 4832 4632 fxrrlrl.exe 101 PID 4632 wrote to memory of 4832 4632 fxrrlrl.exe 101 PID 4632 wrote to memory of 4832 4632 fxrrlrl.exe 101 PID 4832 wrote to memory of 3260 4832 bntttb.exe 102 PID 4832 wrote to memory of 3260 4832 bntttb.exe 102 PID 4832 wrote to memory of 3260 4832 bntttb.exe 102 PID 3260 wrote to memory of 2400 3260 pjjpp.exe 103 PID 3260 wrote to memory of 2400 3260 pjjpp.exe 103 PID 3260 wrote to memory of 2400 3260 pjjpp.exe 103 PID 2400 wrote to memory of 1008 2400 dpppj.exe 104 PID 2400 wrote to memory of 1008 2400 dpppj.exe 104 PID 2400 wrote to memory of 1008 2400 dpppj.exe 104 PID 1008 wrote to memory of 4324 1008 flxrxlx.exe 105 PID 1008 wrote to memory of 4324 1008 flxrxlx.exe 105 PID 1008 wrote to memory of 4324 1008 flxrxlx.exe 105 PID 4324 wrote to memory of 2196 4324 nbbtnh.exe 106 PID 4324 wrote to memory of 2196 4324 nbbtnh.exe 106 PID 4324 wrote to memory of 2196 4324 nbbtnh.exe 106 PID 2196 wrote to memory of 760 2196 nhhhhh.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe"C:\Users\Admin\AppData\Local\Temp\1459458a4278014c86d635f1f259dc9e37c08e8417c2a89a45e8527a956b7a4d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\5tbttt.exec:\5tbttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\ppdjj.exec:\ppdjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\lfrlxxl.exec:\lfrlxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\nntbtb.exec:\nntbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\hbhbnn.exec:\hbhbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\ddppj.exec:\ddppj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fxxllll.exec:\fxxllll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\3lffffl.exec:\3lffffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nnnttt.exec:\nnnttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\ppvvv.exec:\ppvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
\??\c:\7rfrrfr.exec:\7rfrrfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\xxrlxxf.exec:\xxrlxxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\bnbhhn.exec:\bnbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\djppp.exec:\djppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\fxrrlrl.exec:\fxrrlrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\bntttb.exec:\bntttb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\pjjpp.exec:\pjjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\dpppj.exec:\dpppj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\flxrxlx.exec:\flxrxlx.exe20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\nbbtnh.exec:\nbbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\nhhhhh.exec:\nhhhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\7jvvd.exec:\7jvvd.exe23⤵
- Executes dropped EXE
PID:760 -
\??\c:\llrlfxx.exec:\llrlfxx.exe24⤵
- Executes dropped EXE
PID:4232 -
\??\c:\5xxxrxx.exec:\5xxxrxx.exe25⤵
- Executes dropped EXE
PID:2460 -
\??\c:\thbtbb.exec:\thbtbb.exe26⤵
- Executes dropped EXE
PID:964 -
\??\c:\jpdvd.exec:\jpdvd.exe27⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rxffffl.exec:\rxffffl.exe28⤵
- Executes dropped EXE
PID:3140 -
\??\c:\9xfffll.exec:\9xfffll.exe29⤵
- Executes dropped EXE
PID:3716 -
\??\c:\9bnnnh.exec:\9bnnnh.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\jppvp.exec:\jppvp.exe31⤵
- Executes dropped EXE
PID:3756 -
\??\c:\xxrfxrr.exec:\xxrfxrr.exe32⤵
- Executes dropped EXE
PID:3476 -
\??\c:\ntnbtn.exec:\ntnbtn.exe33⤵
- Executes dropped EXE
PID:4796 -
\??\c:\bhnhbt.exec:\bhnhbt.exe34⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ddddv.exec:\ddddv.exe35⤵
- Executes dropped EXE
PID:736 -
\??\c:\rxfrfxx.exec:\rxfrfxx.exe36⤵
- Executes dropped EXE
PID:2112 -
\??\c:\httnnb.exec:\httnnb.exe37⤵
- Executes dropped EXE
PID:1244 -
\??\c:\htbbtt.exec:\htbbtt.exe38⤵
- Executes dropped EXE
PID:1932 -
\??\c:\dvppp.exec:\dvppp.exe39⤵
- Executes dropped EXE
PID:464 -
\??\c:\vdjjj.exec:\vdjjj.exe40⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rrrlllf.exec:\rrrlllf.exe41⤵
- Executes dropped EXE
PID:4316 -
\??\c:\bntttb.exec:\bntttb.exe42⤵
- Executes dropped EXE
PID:3268 -
\??\c:\9tttnn.exec:\9tttnn.exe43⤵
- Executes dropped EXE
PID:4480 -
\??\c:\7pppj.exec:\7pppj.exe44⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fllffff.exec:\fllffff.exe45⤵
- Executes dropped EXE
PID:3580 -
\??\c:\xxffffl.exec:\xxffffl.exe46⤵
- Executes dropped EXE
PID:1684 -
\??\c:\nttbbn.exec:\nttbbn.exe47⤵
- Executes dropped EXE
PID:1168 -
\??\c:\nhhnhn.exec:\nhhnhn.exe48⤵
- Executes dropped EXE
PID:2296 -
\??\c:\ddppp.exec:\ddppp.exe49⤵
- Executes dropped EXE
PID:2116 -
\??\c:\vvjpp.exec:\vvjpp.exe50⤵
- Executes dropped EXE
PID:4760 -
\??\c:\lxrlrxf.exec:\lxrlrxf.exe51⤵
- Executes dropped EXE
PID:1204 -
\??\c:\7bnntb.exec:\7bnntb.exe52⤵
- Executes dropped EXE
PID:3908 -
\??\c:\nnhntt.exec:\nnhntt.exe53⤵
- Executes dropped EXE
PID:4812 -
\??\c:\jjpdd.exec:\jjpdd.exe54⤵
- Executes dropped EXE
PID:416 -
\??\c:\5ffffll.exec:\5ffffll.exe55⤵
- Executes dropped EXE
PID:1408 -
\??\c:\rllrfxf.exec:\rllrfxf.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\7hnbhn.exec:\7hnbhn.exe57⤵
- Executes dropped EXE
PID:1360 -
\??\c:\7djpj.exec:\7djpj.exe58⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vdjdj.exec:\vdjdj.exe59⤵
- Executes dropped EXE
PID:2780 -
\??\c:\rffxxxx.exec:\rffxxxx.exe60⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hhhnbb.exec:\hhhnbb.exe61⤵
- Executes dropped EXE
PID:1452 -
\??\c:\9tttbh.exec:\9tttbh.exe62⤵
- Executes dropped EXE
PID:1464 -
\??\c:\pddvv.exec:\pddvv.exe63⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vjvpd.exec:\vjvpd.exe64⤵
- Executes dropped EXE
PID:4504 -
\??\c:\lfrrllf.exec:\lfrrllf.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\flrlllr.exec:\flrlllr.exe66⤵PID:412
-
\??\c:\ttnnnb.exec:\ttnnnb.exe67⤵PID:2392
-
\??\c:\jpdvd.exec:\jpdvd.exe68⤵PID:680
-
\??\c:\7jjjv.exec:\7jjjv.exe69⤵PID:2692
-
\??\c:\lxrrxfr.exec:\lxrrxfr.exe70⤵PID:3592
-
\??\c:\9thnht.exec:\9thnht.exe71⤵PID:4224
-
\??\c:\vvdjd.exec:\vvdjd.exe72⤵PID:440
-
\??\c:\pdvpp.exec:\pdvpp.exe73⤵PID:392
-
\??\c:\rffrrrl.exec:\rffrrrl.exe74⤵PID:3212
-
\??\c:\bntnnt.exec:\bntnnt.exe75⤵PID:3748
-
\??\c:\pjvvj.exec:\pjvvj.exe76⤵PID:4916
-
\??\c:\ddddd.exec:\ddddd.exe77⤵PID:3716
-
\??\c:\hbnbtn.exec:\hbnbtn.exe78⤵PID:2108
-
\??\c:\1pvpp.exec:\1pvpp.exe79⤵PID:3936
-
\??\c:\vpjvp.exec:\vpjvp.exe80⤵PID:3084
-
\??\c:\fxxxlrx.exec:\fxxxlrx.exe81⤵PID:3112
-
\??\c:\nnbhhh.exec:\nnbhhh.exe82⤵PID:4796
-
\??\c:\btbtbb.exec:\btbtbb.exe83⤵PID:4340
-
\??\c:\3djjv.exec:\3djjv.exe84⤵PID:4380
-
\??\c:\pjjpp.exec:\pjjpp.exe85⤵PID:2112
-
\??\c:\xxlfffx.exec:\xxlfffx.exe86⤵PID:4908
-
\??\c:\hbbbbb.exec:\hbbbbb.exe87⤵PID:1932
-
\??\c:\nbnhbb.exec:\nbnhbb.exe88⤵PID:4172
-
\??\c:\ppjdp.exec:\ppjdp.exe89⤵PID:1528
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:3784
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe91⤵PID:3268
-
\??\c:\xrfflll.exec:\xrfflll.exe92⤵PID:3788
-
\??\c:\hbbbbb.exec:\hbbbbb.exe93⤵PID:4372
-
\??\c:\jdvjd.exec:\jdvjd.exe94⤵PID:3580
-
\??\c:\pjjdv.exec:\pjjdv.exe95⤵PID:1140
-
\??\c:\xfllrxl.exec:\xfllrxl.exe96⤵PID:2380
-
\??\c:\5bhhhh.exec:\5bhhhh.exe97⤵PID:244
-
\??\c:\vvvpp.exec:\vvvpp.exe98⤵PID:1264
-
\??\c:\vvvjv.exec:\vvvjv.exe99⤵PID:2020
-
\??\c:\ntbbtt.exec:\ntbbtt.exe100⤵
- System Location Discovery: System Language Discovery
PID:2368 -
\??\c:\9djjd.exec:\9djjd.exe101⤵PID:1992
-
\??\c:\flxxlrl.exec:\flxxlrl.exe102⤵PID:2280
-
\??\c:\3nbtnn.exec:\3nbtnn.exe103⤵PID:5100
-
\??\c:\hhhttb.exec:\hhhttb.exe104⤵PID:3996
-
\??\c:\jpvvp.exec:\jpvvp.exe105⤵PID:5016
-
\??\c:\pddvv.exec:\pddvv.exe106⤵PID:4584
-
\??\c:\5vdpp.exec:\5vdpp.exe107⤵PID:5080
-
\??\c:\fxrxxrx.exec:\fxrxxrx.exe108⤵PID:4748
-
\??\c:\bhhbbt.exec:\bhhbbt.exe109⤵PID:4632
-
\??\c:\tbbhnn.exec:\tbbhnn.exe110⤵PID:2264
-
\??\c:\pdppp.exec:\pdppp.exe111⤵PID:3260
-
\??\c:\djdjv.exec:\djdjv.exe112⤵PID:1820
-
\??\c:\fflfrff.exec:\fflfrff.exe113⤵PID:4012
-
\??\c:\hhtnbt.exec:\hhtnbt.exe114⤵PID:4524
-
\??\c:\nntbnn.exec:\nntbnn.exe115⤵PID:412
-
\??\c:\jddpd.exec:\jddpd.exe116⤵PID:2392
-
\??\c:\lxffxfl.exec:\lxffxfl.exe117⤵PID:232
-
\??\c:\bhnbht.exec:\bhnbht.exe118⤵PID:4300
-
\??\c:\nnnntb.exec:\nnnntb.exe119⤵PID:3592
-
\??\c:\nnttnt.exec:\nnttnt.exe120⤵PID:4224
-
\??\c:\jjvvv.exec:\jjvvv.exe121⤵PID:2360
-
\??\c:\7tbtnn.exec:\7tbtnn.exe122⤵PID:392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-