Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 15:33
Static task
static1
Behavioral task
behavioral1
Sample
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe
Resource
win7-20240903-en
General
-
Target
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe
-
Size
127KB
-
MD5
0eb828ff2d44a68e0310dc9f42792e0f
-
SHA1
b263de6d8eb3076b7676d3d01802e8cf9d7ccd6f
-
SHA256
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126
-
SHA512
6d205e297295475085c4b4e44df2a54934bcbc27f545d74d6840099f43f2f79aa063f9a785e93acaf7b5a67e3795270d70f73a1f43119d700d788499b13731b1
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zD+WVb+PoGSSTeV:n3C9BRo7tvnJ99mQb+PouG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4028-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4184-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2992-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbbbb.exeppjjj.exerfxrrll.exejddvp.exe1jpjj.exexllxrrf.exehhbbbh.exe5fxxrxr.exe1tttbb.exevdddd.exebhntnt.exebttnhh.exerlrrrrf.exetbthtt.exe7dddd.exefxfxrrl.exebthhhh.exeddpjj.exeddvvp.exehhbthn.exeppppj.exelffxxxx.exebnnttb.exedvvjd.exerfxxrrl.exentttnn.exejjjdv.exetbbbhn.exebbbttt.exedjddj.exerrlffff.exe7bhbhh.exejvddd.exefxlxrfr.exebnnbbt.exethnnhn.exetnhttn.exeddjjd.exexfxxrrf.exellfxfff.exe9thbhb.exe1jppj.exexrrrlll.exehttttn.exepjjjd.exelrrlflf.exehthhht.exe7jddd.exexlrfxlf.exebthhbn.exerflrffl.exejjjjj.exevpjdv.exerxfxffx.exe1thbtt.exedjjjj.exefxrfxfl.exebnnbbt.exe3btnnt.exexlflflf.exexfxxrxl.exehbbtht.exedjjpd.exexfrxfrl.exepid Process 2072 nbbbbb.exe 2112 ppjjj.exe 3624 rfxrrll.exe 1276 jddvp.exe 1920 1jpjj.exe 2332 xllxrrf.exe 1824 hhbbbh.exe 2200 5fxxrxr.exe 2984 1tttbb.exe 4184 vdddd.exe 2368 bhntnt.exe 3172 bttnhh.exe 3248 rlrrrrf.exe 1980 tbthtt.exe 640 7dddd.exe 4464 fxfxrrl.exe 4076 bthhhh.exe 3116 ddpjj.exe 4960 ddvvp.exe 3808 hhbthn.exe 988 ppppj.exe 2224 lffxxxx.exe 3752 bnnttb.exe 4208 dvvjd.exe 1512 rfxxrrl.exe 4712 ntttnn.exe 1700 jjjdv.exe 2572 tbbbhn.exe 3680 bbbttt.exe 2992 djddj.exe 1924 rrlffff.exe 4356 7bhbhh.exe 3096 jvddd.exe 2504 fxlxrfr.exe 1080 bnnbbt.exe 4796 thnnhn.exe 3240 tnhttn.exe 1320 ddjjd.exe 4952 xfxxrrf.exe 3708 llfxfff.exe 2272 9thbhb.exe 3900 1jppj.exe 440 xrrrlll.exe 4920 httttn.exe 2424 pjjjd.exe 4420 lrrlflf.exe 4908 hthhht.exe 1992 7jddd.exe 2072 xlrfxlf.exe 2196 bthhbn.exe 3404 rflrffl.exe 4572 jjjjj.exe 4676 vpjdv.exe 1428 rxfxffx.exe 2460 1thbtt.exe 2332 djjjj.exe 2844 fxrfxfl.exe 1368 bnnbbt.exe 1824 3btnnt.exe 2200 xlflflf.exe 1004 xfxxrxl.exe 4144 hbbtht.exe 2664 djjpd.exe 1932 xfrxfrl.exe -
Processes:
resource yara_rule behavioral2/memory/4028-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4184-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2992-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bhbbtb.exejpvpp.exerlfxxxx.exehnnhbt.exeddpjj.exehhhhbh.exe1bhhnn.exelflfrff.exexxrxlrf.exe3hhhhh.exexlxrfrl.exettbtnn.exejdjpj.exeddvdv.exe9lfffll.exentthhb.exe7tnttt.exexxlrrrr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lflfrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlrrrr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exenbbbbb.exeppjjj.exerfxrrll.exejddvp.exe1jpjj.exexllxrrf.exehhbbbh.exe5fxxrxr.exe1tttbb.exevdddd.exebhntnt.exebttnhh.exerlrrrrf.exetbthtt.exe7dddd.exefxfxrrl.exebthhhh.exeddpjj.exeddvvp.exehhbthn.exeppppj.exedescription pid Process procid_target PID 4028 wrote to memory of 2072 4028 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe 83 PID 4028 wrote to memory of 2072 4028 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe 83 PID 4028 wrote to memory of 2072 4028 e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe 83 PID 2072 wrote to memory of 2112 2072 nbbbbb.exe 84 PID 2072 wrote to memory of 2112 2072 nbbbbb.exe 84 PID 2072 wrote to memory of 2112 2072 nbbbbb.exe 84 PID 2112 wrote to memory of 3624 2112 ppjjj.exe 85 PID 2112 wrote to memory of 3624 2112 ppjjj.exe 85 PID 2112 wrote to memory of 3624 2112 ppjjj.exe 85 PID 3624 wrote to memory of 1276 3624 rfxrrll.exe 86 PID 3624 wrote to memory of 1276 3624 rfxrrll.exe 86 PID 3624 wrote to memory of 1276 3624 rfxrrll.exe 86 PID 1276 wrote to memory of 1920 1276 jddvp.exe 87 PID 1276 wrote to memory of 1920 1276 jddvp.exe 87 PID 1276 wrote to memory of 1920 1276 jddvp.exe 87 PID 1920 wrote to memory of 2332 1920 1jpjj.exe 88 PID 1920 wrote to memory of 2332 1920 1jpjj.exe 88 PID 1920 wrote to memory of 2332 1920 1jpjj.exe 88 PID 2332 wrote to memory of 1824 2332 xllxrrf.exe 89 PID 2332 wrote to memory of 1824 2332 xllxrrf.exe 89 PID 2332 wrote to memory of 1824 2332 xllxrrf.exe 89 PID 1824 wrote to memory of 2200 1824 hhbbbh.exe 90 PID 1824 wrote to memory of 2200 1824 hhbbbh.exe 90 PID 1824 wrote to memory of 2200 1824 hhbbbh.exe 90 PID 2200 wrote to memory of 2984 2200 5fxxrxr.exe 91 PID 2200 wrote to memory of 2984 2200 5fxxrxr.exe 91 PID 2200 wrote to memory of 2984 2200 5fxxrxr.exe 91 PID 2984 wrote to memory of 4184 2984 1tttbb.exe 92 PID 2984 wrote to memory of 4184 2984 1tttbb.exe 92 PID 2984 wrote to memory of 4184 2984 1tttbb.exe 92 PID 4184 wrote to memory of 2368 4184 vdddd.exe 93 PID 4184 wrote to memory of 2368 4184 vdddd.exe 93 PID 4184 wrote to memory of 2368 4184 vdddd.exe 93 PID 2368 wrote to memory of 3172 2368 bhntnt.exe 94 PID 2368 wrote to memory of 3172 2368 bhntnt.exe 94 PID 2368 wrote to memory of 3172 2368 bhntnt.exe 94 PID 3172 wrote to memory of 3248 3172 bttnhh.exe 95 PID 3172 wrote to memory of 3248 3172 bttnhh.exe 95 PID 3172 wrote to memory of 3248 3172 bttnhh.exe 95 PID 3248 wrote to memory of 1980 3248 rlrrrrf.exe 96 PID 3248 wrote to memory of 1980 3248 rlrrrrf.exe 96 PID 3248 wrote to memory of 1980 3248 rlrrrrf.exe 96 PID 1980 wrote to memory of 640 1980 tbthtt.exe 97 PID 1980 wrote to memory of 640 1980 tbthtt.exe 97 PID 1980 wrote to memory of 640 1980 tbthtt.exe 97 PID 640 wrote to memory of 4464 640 7dddd.exe 98 PID 640 wrote to memory of 4464 640 7dddd.exe 98 PID 640 wrote to memory of 4464 640 7dddd.exe 98 PID 4464 wrote to memory of 4076 4464 fxfxrrl.exe 99 PID 4464 wrote to memory of 4076 4464 fxfxrrl.exe 99 PID 4464 wrote to memory of 4076 4464 fxfxrrl.exe 99 PID 4076 wrote to memory of 3116 4076 bthhhh.exe 100 PID 4076 wrote to memory of 3116 4076 bthhhh.exe 100 PID 4076 wrote to memory of 3116 4076 bthhhh.exe 100 PID 3116 wrote to memory of 4960 3116 ddpjj.exe 101 PID 3116 wrote to memory of 4960 3116 ddpjj.exe 101 PID 3116 wrote to memory of 4960 3116 ddpjj.exe 101 PID 4960 wrote to memory of 3808 4960 ddvvp.exe 102 PID 4960 wrote to memory of 3808 4960 ddvvp.exe 102 PID 4960 wrote to memory of 3808 4960 ddvvp.exe 102 PID 3808 wrote to memory of 988 3808 hhbthn.exe 103 PID 3808 wrote to memory of 988 3808 hhbthn.exe 103 PID 3808 wrote to memory of 988 3808 hhbthn.exe 103 PID 988 wrote to memory of 2224 988 ppppj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe"C:\Users\Admin\AppData\Local\Temp\e34caa9af060bd19e7d5f86e1dbd41795695d240840437ac7e9fc9d4c6a97126.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\nbbbbb.exec:\nbbbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\ppjjj.exec:\ppjjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\rfxrrll.exec:\rfxrrll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\jddvp.exec:\jddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\1jpjj.exec:\1jpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\xllxrrf.exec:\xllxrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\hhbbbh.exec:\hhbbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\5fxxrxr.exec:\5fxxrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\1tttbb.exec:\1tttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\vdddd.exec:\vdddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\bhntnt.exec:\bhntnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bttnhh.exec:\bttnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\tbthtt.exec:\tbthtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\7dddd.exec:\7dddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\bthhhh.exec:\bthhhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\ddpjj.exec:\ddpjj.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\ddvvp.exec:\ddvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\hhbthn.exec:\hhbthn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\ppppj.exec:\ppppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\lffxxxx.exec:\lffxxxx.exe23⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bnnttb.exec:\bnnttb.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\dvvjd.exec:\dvvjd.exe25⤵
- Executes dropped EXE
PID:4208 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe26⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ntttnn.exec:\ntttnn.exe27⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jjjdv.exec:\jjjdv.exe28⤵
- Executes dropped EXE
PID:1700 -
\??\c:\tbbbhn.exec:\tbbbhn.exe29⤵
- Executes dropped EXE
PID:2572 -
\??\c:\bbbttt.exec:\bbbttt.exe30⤵
- Executes dropped EXE
PID:3680 -
\??\c:\djddj.exec:\djddj.exe31⤵
- Executes dropped EXE
PID:2992 -
\??\c:\rrlffff.exec:\rrlffff.exe32⤵
- Executes dropped EXE
PID:1924 -
\??\c:\7bhbhh.exec:\7bhbhh.exe33⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jvddd.exec:\jvddd.exe34⤵
- Executes dropped EXE
PID:3096 -
\??\c:\fxlxrfr.exec:\fxlxrfr.exe35⤵
- Executes dropped EXE
PID:2504 -
\??\c:\bnnbbt.exec:\bnnbbt.exe36⤵
- Executes dropped EXE
PID:1080 -
\??\c:\thnnhn.exec:\thnnhn.exe37⤵
- Executes dropped EXE
PID:4796 -
\??\c:\tnhttn.exec:\tnhttn.exe38⤵
- Executes dropped EXE
PID:3240 -
\??\c:\ddjjd.exec:\ddjjd.exe39⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xfxxrrf.exec:\xfxxrrf.exe40⤵
- Executes dropped EXE
PID:4952 -
\??\c:\llfxfff.exec:\llfxfff.exe41⤵
- Executes dropped EXE
PID:3708 -
\??\c:\9thbhb.exec:\9thbhb.exe42⤵
- Executes dropped EXE
PID:2272 -
\??\c:\1jppj.exec:\1jppj.exe43⤵
- Executes dropped EXE
PID:3900 -
\??\c:\xrrrlll.exec:\xrrrlll.exe44⤵
- Executes dropped EXE
PID:440 -
\??\c:\httttn.exec:\httttn.exe45⤵
- Executes dropped EXE
PID:4920 -
\??\c:\pjjjd.exec:\pjjjd.exe46⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lrrlflf.exec:\lrrlflf.exe47⤵
- Executes dropped EXE
PID:4420 -
\??\c:\hthhht.exec:\hthhht.exe48⤵
- Executes dropped EXE
PID:4908 -
\??\c:\7jddd.exec:\7jddd.exe49⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xlrfxlf.exec:\xlrfxlf.exe50⤵
- Executes dropped EXE
PID:2072 -
\??\c:\bthhbn.exec:\bthhbn.exe51⤵
- Executes dropped EXE
PID:2196 -
\??\c:\rflrffl.exec:\rflrffl.exe52⤵
- Executes dropped EXE
PID:3404 -
\??\c:\jjjjj.exec:\jjjjj.exe53⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vpjdv.exec:\vpjdv.exe54⤵
- Executes dropped EXE
PID:4676 -
\??\c:\rxfxffx.exec:\rxfxffx.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\1thbtt.exec:\1thbtt.exe56⤵
- Executes dropped EXE
PID:2460 -
\??\c:\djjjj.exec:\djjjj.exe57⤵
- Executes dropped EXE
PID:2332 -
\??\c:\fxrfxfl.exec:\fxrfxfl.exe58⤵
- Executes dropped EXE
PID:2844 -
\??\c:\bnnbbt.exec:\bnnbbt.exe59⤵
- Executes dropped EXE
PID:1368 -
\??\c:\3btnnt.exec:\3btnnt.exe60⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xlflflf.exec:\xlflflf.exe61⤵
- Executes dropped EXE
PID:2200 -
\??\c:\xfxxrxl.exec:\xfxxrxl.exe62⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hbbtht.exec:\hbbtht.exe63⤵
- Executes dropped EXE
PID:4144 -
\??\c:\djjpd.exec:\djjpd.exe64⤵
- Executes dropped EXE
PID:2664 -
\??\c:\xfrxfrl.exec:\xfrxfrl.exe65⤵
- Executes dropped EXE
PID:1932 -
\??\c:\tntttn.exec:\tntttn.exe66⤵PID:2464
-
\??\c:\1bhhnn.exec:\1bhhnn.exe67⤵
- System Location Discovery: System Language Discovery
PID:5092 -
\??\c:\vdpdv.exec:\vdpdv.exe68⤵PID:3604
-
\??\c:\lflfxfx.exec:\lflfxfx.exe69⤵PID:4728
-
\??\c:\bbtttt.exec:\bbtttt.exe70⤵PID:4188
-
\??\c:\jdpjd.exec:\jdpjd.exe71⤵PID:2028
-
\??\c:\dvjpv.exec:\dvjpv.exe72⤵PID:4076
-
\??\c:\lxrrffr.exec:\lxrrffr.exe73⤵PID:2744
-
\??\c:\tntttt.exec:\tntttt.exe74⤵PID:4284
-
\??\c:\vvjjv.exec:\vvjjv.exe75⤵PID:4960
-
\??\c:\ddvdv.exec:\ddvdv.exe76⤵
- System Location Discovery: System Language Discovery
PID:3424 -
\??\c:\xxffrxl.exec:\xxffrxl.exe77⤵PID:2180
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe78⤵PID:2224
-
\??\c:\thbbbb.exec:\thbbbb.exe79⤵PID:3752
-
\??\c:\ddjjj.exec:\ddjjj.exe80⤵PID:4704
-
\??\c:\jpdvp.exec:\jpdvp.exe81⤵PID:4976
-
\??\c:\3xffxxr.exec:\3xffxxr.exe82⤵PID:5052
-
\??\c:\hhbbbn.exec:\hhbbbn.exe83⤵PID:1768
-
\??\c:\nbtnhb.exec:\nbtnhb.exe84⤵PID:2484
-
\??\c:\5pjvv.exec:\5pjvv.exe85⤵PID:3596
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe86⤵PID:316
-
\??\c:\ntbbtn.exec:\ntbbtn.exe87⤵PID:3504
-
\??\c:\bntttn.exec:\bntttn.exe88⤵PID:2452
-
\??\c:\nbhnnt.exec:\nbhnnt.exe89⤵PID:1532
-
\??\c:\hhhhbh.exec:\hhhhbh.exe90⤵
- System Location Discovery: System Language Discovery
PID:3588 -
\??\c:\pjvvp.exec:\pjvvp.exe91⤵PID:3908
-
\??\c:\fllfffx.exec:\fllfffx.exe92⤵PID:1624
-
\??\c:\nhhnbh.exec:\nhhnbh.exe93⤵PID:1436
-
\??\c:\nnttbn.exec:\nnttbn.exe94⤵PID:3920
-
\??\c:\vdppd.exec:\vdppd.exe95⤵PID:1576
-
\??\c:\lxflflf.exec:\lxflflf.exe96⤵PID:1608
-
\??\c:\fllllrr.exec:\fllllrr.exe97⤵PID:4484
-
\??\c:\tbtthh.exec:\tbtthh.exe98⤵PID:4916
-
\??\c:\jpjpj.exec:\jpjpj.exe99⤵PID:2892
-
\??\c:\ddvdd.exec:\ddvdd.exe100⤵PID:1144
-
\??\c:\rffffll.exec:\rffffll.exe101⤵PID:3164
-
\??\c:\xfxxlrr.exec:\xfxxlrr.exe102⤵PID:800
-
\??\c:\htntbb.exec:\htntbb.exe103⤵PID:1280
-
\??\c:\tbbbtt.exec:\tbbbtt.exe104⤵PID:3688
-
\??\c:\vdvjd.exec:\vdvjd.exe105⤵PID:216
-
\??\c:\fxfffff.exec:\fxfffff.exe106⤵PID:732
-
\??\c:\rfllrrr.exec:\rfllrrr.exe107⤵PID:1168
-
\??\c:\7btttb.exec:\7btttb.exe108⤵PID:4160
-
\??\c:\hnnnhn.exec:\hnnnhn.exe109⤵PID:5108
-
\??\c:\dvjjj.exec:\dvjjj.exe110⤵PID:556
-
\??\c:\xxfffll.exec:\xxfffll.exe111⤵PID:2860
-
\??\c:\bnbbbh.exec:\bnbbbh.exe112⤵PID:2856
-
\??\c:\hhhhhn.exec:\hhhhhn.exe113⤵PID:3484
-
\??\c:\jpvjp.exec:\jpvjp.exe114⤵PID:4144
-
\??\c:\9rxxxff.exec:\9rxxxff.exe115⤵PID:2664
-
\??\c:\bttnnh.exec:\bttnnh.exe116⤵PID:1932
-
\??\c:\jjpvd.exec:\jjpvd.exe117⤵PID:4892
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe118⤵PID:4444
-
\??\c:\nbnbhb.exec:\nbnbhb.exe119⤵PID:3836
-
\??\c:\pppvv.exec:\pppvv.exe120⤵PID:960
-
\??\c:\xfllfll.exec:\xfllfll.exe121⤵PID:4464
-
\??\c:\nhhbbb.exec:\nhhbbb.exe122⤵PID:3628
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-