Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 03:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe
Resource
win7-20241010-en
6 signatures
120 seconds
General
-
Target
2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe
-
Size
69KB
-
MD5
5a41971162bd74866ed0cdcea4acb2d0
-
SHA1
47edb1a711bed541854c1898d4544b6678eb6a28
-
SHA256
2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bc
-
SHA512
ac0a0371a325430f7fa02a35efaad70a1374077b86c28aabc9a95c38ac431620309867cb2096493d3e763d93e4034e32e77dc8fab1693778ac6153886341775f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+Luvdp:ymb3NkkiQ3mdBjF0yMlip
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/1768-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4868-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3792-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 388 7vvjd.exe 3608 xlfrllf.exe 4944 thbbbt.exe 1824 3jdjj.exe 4856 vdpjp.exe 944 frxxlfx.exe 1800 1nbttt.exe 4020 bttnbb.exe 2924 pdvpd.exe 4588 vpvjv.exe 4868 rlxrlfx.exe 4792 lxrlfxr.exe 3724 3ttnnn.exe 3792 jvppj.exe 4780 7rrlxxl.exe 800 nnbthh.exe 3600 thhhnb.exe 1568 7vpvj.exe 2964 lllfrrl.exe 4740 nhbtnn.exe 932 vvvpp.exe 3824 vddvj.exe 3012 lxfxlll.exe 4032 lfrrrlf.exe 1172 nntnnn.exe 2268 ddvpd.exe 4452 vdvvp.exe 4940 xrxrrlr.exe 3252 bbbtnn.exe 3044 nhtbnh.exe 1124 dvdvj.exe 3768 lllfxxx.exe 4848 rlrlffx.exe 3116 thnhtt.exe 2452 jddvj.exe 3584 1fffxrx.exe 3744 htnhbb.exe 2276 tnnnnn.exe 4880 dppjv.exe 4672 jvvpj.exe 2968 lrrlxrl.exe 5068 xxrrlfl.exe 3256 thhbnh.exe 412 vvpjd.exe 2732 jvpjd.exe 2908 frfxrrl.exe 2272 vpjdd.exe 1832 vpjdv.exe 4764 flxlffr.exe 856 rlrrllf.exe 4064 nhbbtt.exe 2524 dpjdd.exe 4236 flrllll.exe 1948 thbtnn.exe 2340 bttnhh.exe 4868 nbnhbh.exe 4792 ffrlffx.exe 3860 rxlfxrl.exe 3164 hbnnhn.exe 380 5bhbtb.exe 2692 jdddp.exe 3232 fllfrrr.exe 3620 rflfxrr.exe 2120 nhbbtt.exe -
resource yara_rule behavioral2/memory/1768-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4868-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3792-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxrxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5flfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1768 wrote to memory of 388 1768 2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe 84 PID 1768 wrote to memory of 388 1768 2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe 84 PID 1768 wrote to memory of 388 1768 2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe 84 PID 388 wrote to memory of 3608 388 7vvjd.exe 85 PID 388 wrote to memory of 3608 388 7vvjd.exe 85 PID 388 wrote to memory of 3608 388 7vvjd.exe 85 PID 3608 wrote to memory of 4944 3608 xlfrllf.exe 86 PID 3608 wrote to memory of 4944 3608 xlfrllf.exe 86 PID 3608 wrote to memory of 4944 3608 xlfrllf.exe 86 PID 4944 wrote to memory of 1824 4944 thbbbt.exe 87 PID 4944 wrote to memory of 1824 4944 thbbbt.exe 87 PID 4944 wrote to memory of 1824 4944 thbbbt.exe 87 PID 1824 wrote to memory of 4856 1824 3jdjj.exe 88 PID 1824 wrote to memory of 4856 1824 3jdjj.exe 88 PID 1824 wrote to memory of 4856 1824 3jdjj.exe 88 PID 4856 wrote to memory of 944 4856 vdpjp.exe 89 PID 4856 wrote to memory of 944 4856 vdpjp.exe 89 PID 4856 wrote to memory of 944 4856 vdpjp.exe 89 PID 944 wrote to memory of 1800 944 frxxlfx.exe 90 PID 944 wrote to memory of 1800 944 frxxlfx.exe 90 PID 944 wrote to memory of 1800 944 frxxlfx.exe 90 PID 1800 wrote to memory of 4020 1800 1nbttt.exe 91 PID 1800 wrote to memory of 4020 1800 1nbttt.exe 91 PID 1800 wrote to memory of 4020 1800 1nbttt.exe 91 PID 4020 wrote to memory of 2924 4020 bttnbb.exe 92 PID 4020 wrote to memory of 2924 4020 bttnbb.exe 92 PID 4020 wrote to memory of 2924 4020 bttnbb.exe 92 PID 2924 wrote to memory of 4588 2924 pdvpd.exe 93 PID 2924 wrote to memory of 4588 2924 pdvpd.exe 93 PID 2924 wrote to memory of 4588 2924 pdvpd.exe 93 PID 4588 wrote to memory of 4868 4588 vpvjv.exe 94 PID 4588 wrote to memory of 4868 4588 vpvjv.exe 94 PID 4588 wrote to memory of 4868 4588 vpvjv.exe 94 PID 4868 wrote to memory of 4792 4868 rlxrlfx.exe 95 PID 4868 wrote to memory of 4792 4868 rlxrlfx.exe 95 PID 4868 wrote to memory of 4792 4868 rlxrlfx.exe 95 PID 4792 wrote to memory of 3724 4792 lxrlfxr.exe 96 PID 4792 wrote to memory of 3724 4792 lxrlfxr.exe 96 PID 4792 wrote to memory of 3724 4792 lxrlfxr.exe 96 PID 3724 wrote to memory of 3792 3724 3ttnnn.exe 97 PID 3724 wrote to memory of 3792 3724 3ttnnn.exe 97 PID 3724 wrote to memory of 3792 3724 3ttnnn.exe 97 PID 3792 wrote to memory of 4780 3792 jvppj.exe 98 PID 3792 wrote to memory of 4780 3792 jvppj.exe 98 PID 3792 wrote to memory of 4780 3792 jvppj.exe 98 PID 4780 wrote to memory of 800 4780 7rrlxxl.exe 99 PID 4780 wrote to memory of 800 4780 7rrlxxl.exe 99 PID 4780 wrote to memory of 800 4780 7rrlxxl.exe 99 PID 800 wrote to memory of 3600 800 nnbthh.exe 100 PID 800 wrote to memory of 3600 800 nnbthh.exe 100 PID 800 wrote to memory of 3600 800 nnbthh.exe 100 PID 3600 wrote to memory of 1568 3600 thhhnb.exe 101 PID 3600 wrote to memory of 1568 3600 thhhnb.exe 101 PID 3600 wrote to memory of 1568 3600 thhhnb.exe 101 PID 1568 wrote to memory of 2964 1568 7vpvj.exe 102 PID 1568 wrote to memory of 2964 1568 7vpvj.exe 102 PID 1568 wrote to memory of 2964 1568 7vpvj.exe 102 PID 2964 wrote to memory of 4740 2964 lllfrrl.exe 103 PID 2964 wrote to memory of 4740 2964 lllfrrl.exe 103 PID 2964 wrote to memory of 4740 2964 lllfrrl.exe 103 PID 4740 wrote to memory of 932 4740 nhbtnn.exe 104 PID 4740 wrote to memory of 932 4740 nhbtnn.exe 104 PID 4740 wrote to memory of 932 4740 nhbtnn.exe 104 PID 932 wrote to memory of 3824 932 vvvpp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe"C:\Users\Admin\AppData\Local\Temp\2b6e3c1c4bde62efa441de16fedc9988811e3ca0f3fc24728b336ba5986661bcN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\7vvjd.exec:\7vvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\xlfrllf.exec:\xlfrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\thbbbt.exec:\thbbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\3jdjj.exec:\3jdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\vdpjp.exec:\vdpjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\frxxlfx.exec:\frxxlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\1nbttt.exec:\1nbttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\bttnbb.exec:\bttnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\pdvpd.exec:\pdvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vpvjv.exec:\vpvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\rlxrlfx.exec:\rlxrlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\3ttnnn.exec:\3ttnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\jvppj.exec:\jvppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\7rrlxxl.exec:\7rrlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\nnbthh.exec:\nnbthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\thhhnb.exec:\thhhnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\7vpvj.exec:\7vpvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\lllfrrl.exec:\lllfrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\nhbtnn.exec:\nhbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\vvvpp.exec:\vvvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\vddvj.exec:\vddvj.exe23⤵
- Executes dropped EXE
PID:3824 -
\??\c:\lxfxlll.exec:\lxfxlll.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lfrrrlf.exec:\lfrrrlf.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4032 -
\??\c:\nntnnn.exec:\nntnnn.exe26⤵
- Executes dropped EXE
PID:1172 -
\??\c:\ddvpd.exec:\ddvpd.exe27⤵
- Executes dropped EXE
PID:2268 -
\??\c:\vdvvp.exec:\vdvvp.exe28⤵
- Executes dropped EXE
PID:4452 -
\??\c:\xrxrrlr.exec:\xrxrrlr.exe29⤵
- Executes dropped EXE
PID:4940 -
\??\c:\bbbtnn.exec:\bbbtnn.exe30⤵
- Executes dropped EXE
PID:3252 -
\??\c:\nhtbnh.exec:\nhtbnh.exe31⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvdvj.exec:\dvdvj.exe32⤵
- Executes dropped EXE
PID:1124 -
\??\c:\lllfxxx.exec:\lllfxxx.exe33⤵
- Executes dropped EXE
PID:3768 -
\??\c:\rlrlffx.exec:\rlrlffx.exe34⤵
- Executes dropped EXE
PID:4848 -
\??\c:\thnhtt.exec:\thnhtt.exe35⤵
- Executes dropped EXE
PID:3116 -
\??\c:\jddvj.exec:\jddvj.exe36⤵
- Executes dropped EXE
PID:2452 -
\??\c:\1fffxrx.exec:\1fffxrx.exe37⤵
- Executes dropped EXE
PID:3584 -
\??\c:\htnhbb.exec:\htnhbb.exe38⤵
- Executes dropped EXE
PID:3744 -
\??\c:\tnnnnn.exec:\tnnnnn.exe39⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dppjv.exec:\dppjv.exe40⤵
- Executes dropped EXE
PID:4880 -
\??\c:\jvvpj.exec:\jvvpj.exe41⤵
- Executes dropped EXE
PID:4672 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xxrrlfl.exec:\xxrrlfl.exe43⤵
- Executes dropped EXE
PID:5068 -
\??\c:\thhbnh.exec:\thhbnh.exe44⤵
- Executes dropped EXE
PID:3256 -
\??\c:\vvpjd.exec:\vvpjd.exe45⤵
- Executes dropped EXE
PID:412 -
\??\c:\jvpjd.exec:\jvpjd.exe46⤵
- Executes dropped EXE
PID:2732 -
\??\c:\frfxrrl.exec:\frfxrrl.exe47⤵
- Executes dropped EXE
PID:2908 -
\??\c:\vpjdd.exec:\vpjdd.exe48⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vpjdv.exec:\vpjdv.exe49⤵
- Executes dropped EXE
PID:1832 -
\??\c:\flxlffr.exec:\flxlffr.exe50⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rlrrllf.exec:\rlrrllf.exe51⤵
- Executes dropped EXE
PID:856 -
\??\c:\nhbbtt.exec:\nhbbtt.exe52⤵
- Executes dropped EXE
PID:4064 -
\??\c:\dpjdd.exec:\dpjdd.exe53⤵
- Executes dropped EXE
PID:2524 -
\??\c:\flrllll.exec:\flrllll.exe54⤵
- Executes dropped EXE
PID:4236 -
\??\c:\thbtnn.exec:\thbtnn.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1948 -
\??\c:\bttnhh.exec:\bttnhh.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nbnhbh.exec:\nbnhbh.exe57⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ffrlffx.exec:\ffrlffx.exe58⤵
- Executes dropped EXE
PID:4792 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe59⤵
- Executes dropped EXE
PID:3860 -
\??\c:\hbnnhn.exec:\hbnnhn.exe60⤵
- Executes dropped EXE
PID:3164 -
\??\c:\5bhbtb.exec:\5bhbtb.exe61⤵
- Executes dropped EXE
PID:380 -
\??\c:\jdddp.exec:\jdddp.exe62⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fllfrrr.exec:\fllfrrr.exe63⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rflfxrr.exec:\rflfxrr.exe64⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nhbbtt.exec:\nhbbtt.exe65⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jdpjd.exec:\jdpjd.exe66⤵PID:4496
-
\??\c:\rlfxllf.exec:\rlfxllf.exe67⤵PID:1996
-
\??\c:\fxlffff.exec:\fxlffff.exe68⤵PID:1280
-
\??\c:\tnbnhb.exec:\tnbnhb.exe69⤵PID:3380
-
\??\c:\bntnhb.exec:\bntnhb.exe70⤵PID:4908
-
\??\c:\vdvpd.exec:\vdvpd.exe71⤵PID:2244
-
\??\c:\jddpj.exec:\jddpj.exe72⤵PID:916
-
\??\c:\llfxxxf.exec:\llfxxxf.exe73⤵PID:4032
-
\??\c:\nhhbbn.exec:\nhhbbn.exe74⤵PID:4608
-
\??\c:\thhtnh.exec:\thhtnh.exe75⤵PID:1976
-
\??\c:\lrrfxlf.exec:\lrrfxlf.exe76⤵PID:4076
-
\??\c:\ntnttb.exec:\ntnttb.exe77⤵PID:4860
-
\??\c:\bnhbnt.exec:\bnhbnt.exe78⤵PID:1772
-
\??\c:\dvjjp.exec:\dvjjp.exe79⤵PID:4436
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe80⤵PID:2028
-
\??\c:\tbbbtt.exec:\tbbbtt.exe81⤵PID:1124
-
\??\c:\nhbtnn.exec:\nhbtnn.exe82⤵PID:3768
-
\??\c:\dvppj.exec:\dvppj.exe83⤵PID:3108
-
\??\c:\rllfrrl.exec:\rllfrrl.exe84⤵PID:1696
-
\??\c:\5fxflfx.exec:\5fxflfx.exe85⤵PID:3696
-
\??\c:\ttbbbb.exec:\ttbbbb.exe86⤵PID:4732
-
\??\c:\llxrxxx.exec:\llxrxxx.exe87⤵
- System Location Discovery: System Language Discovery
PID:4972 -
\??\c:\3bhbbh.exec:\3bhbbh.exe88⤵PID:4540
-
\??\c:\ppdvv.exec:\ppdvv.exe89⤵PID:3572
-
\??\c:\lfxfrfx.exec:\lfxfrfx.exe90⤵PID:3576
-
\??\c:\lxfxrll.exec:\lxfxrll.exe91⤵PID:4304
-
\??\c:\9vddv.exec:\9vddv.exe92⤵PID:2552
-
\??\c:\frflxxr.exec:\frflxxr.exe93⤵PID:1404
-
\??\c:\lffxxxr.exec:\lffxxxr.exe94⤵PID:1728
-
\??\c:\nbbnhh.exec:\nbbnhh.exe95⤵PID:4408
-
\??\c:\tbhhtt.exec:\tbhhtt.exe96⤵PID:4244
-
\??\c:\dpvpp.exec:\dpvpp.exe97⤵PID:1424
-
\??\c:\djjjv.exec:\djjjv.exe98⤵PID:4824
-
\??\c:\rlfrfff.exec:\rlfrfff.exe99⤵PID:1296
-
\??\c:\xlrrllf.exec:\xlrrllf.exe100⤵PID:740
-
\??\c:\bhhnhh.exec:\bhhnhh.exe101⤵PID:1800
-
\??\c:\hhnhbt.exec:\hhnhbt.exe102⤵PID:4260
-
\??\c:\vvpjv.exec:\vvpjv.exe103⤵PID:1588
-
\??\c:\rlxxrxx.exec:\rlxxrxx.exe104⤵PID:2264
-
\??\c:\hhnnnn.exec:\hhnnnn.exe105⤵PID:2064
-
\??\c:\httnhn.exec:\httnhn.exe106⤵PID:5088
-
\??\c:\jjddp.exec:\jjddp.exe107⤵PID:4120
-
\??\c:\pjvpd.exec:\pjvpd.exe108⤵PID:1348
-
\??\c:\rfxrffx.exec:\rfxrffx.exe109⤵PID:3860
-
\??\c:\5bhbtt.exec:\5bhbtt.exe110⤵PID:3152
-
\??\c:\vvpjj.exec:\vvpjj.exe111⤵PID:2460
-
\??\c:\rrrxxrl.exec:\rrrxxrl.exe112⤵PID:208
-
\??\c:\hbtnhh.exec:\hbtnhh.exe113⤵PID:3600
-
\??\c:\vvpvp.exec:\vvpvp.exe114⤵PID:3620
-
\??\c:\1xxrrxr.exec:\1xxrrxr.exe115⤵PID:2120
-
\??\c:\vppjj.exec:\vppjj.exe116⤵PID:5080
-
\??\c:\jddpv.exec:\jddpv.exe117⤵PID:932
-
\??\c:\ffrffxf.exec:\ffrffxf.exe118⤵PID:3824
-
\??\c:\bbtbtb.exec:\bbtbtb.exe119⤵PID:1876
-
\??\c:\hbtnbb.exec:\hbtnbb.exe120⤵PID:548
-
\??\c:\pvdvp.exec:\pvdvp.exe121⤵PID:1084
-
\??\c:\7djdd.exec:\7djdd.exe122⤵PID:2348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-