Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe
Resource
win7-20240903-en
General
-
Target
23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe
-
Size
61KB
-
MD5
84d82e678089ecf0ed6dd7a856c30058
-
SHA1
af7250d1bcae509be6cc7214d43dddcc3eef88ed
-
SHA256
23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa
-
SHA512
19a3b444a881dcb736a2b41f0aa3e1bd6b3a628958880f9fa3735e77eb614e7cf1173a7425d61928e77064febf58686835e6e6065cf47b5db44072105814727d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+byF:ymb3NkkiQ3mdBjF+3TpG
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2140-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2664-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4540-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pvpjj.exebbtbbb.exe7nbttt.exe9lxfflr.exexlrrlll.exejdjjd.exe9ntttt.exennnnnt.exevpdvv.exexrfffff.exe3htntt.exepjjdj.exexxxfflf.exexrxxxll.exehnhnth.exevvpjd.exefffxrxx.exebthhhn.exepppvd.exevjpjj.exehthtnt.exe1nthbn.exejdvvp.exe1lrrllr.exetnbhhh.exe7vvvj.exellxxxxf.exebhhhth.exejddpp.exe5rxrlxl.exehnhhhh.exenbhtth.exevpppd.exexrrrxff.exeflflfrx.exennthbt.exepdjvv.exedpvvd.exerlrfllr.exenhbbbb.exepjdvd.exejvjjd.exelxlfxxx.exehbhhbh.exehntbtb.exe1dpjp.exelrlrrfr.exe7httbh.exejvddp.exethtttb.exejvdvv.exe5vppp.exerxlfxxx.exebtnnnn.exebbhnbn.exe3djvp.exehtntbn.exeddddd.exeflrrxrx.exenhtbhn.exevjpvp.exe7jpvv.exexrrrlff.exebbnhnh.exepid process 4972 pvpjj.exe 3716 bbtbbb.exe 5076 7nbttt.exe 1236 9lxfflr.exe 3748 xlrrlll.exe 4640 jdjjd.exe 2036 9ntttt.exe 4652 nnnnnt.exe 2664 vpdvv.exe 2372 xrfffff.exe 5004 3htntt.exe 2740 pjjdj.exe 4804 xxxfflf.exe 4228 xrxxxll.exe 4540 hnhnth.exe 1940 vvpjd.exe 4124 fffxrxx.exe 208 bthhhn.exe 3452 pppvd.exe 5028 vjpjj.exe 988 hthtnt.exe 3044 1nthbn.exe 4472 jdvvp.exe 4856 1lrrllr.exe 3448 tnbhhh.exe 3860 7vvvj.exe 920 llxxxxf.exe 1260 bhhhth.exe 2308 jddpp.exe 952 5rxrlxl.exe 1804 hnhhhh.exe 1932 nbhtth.exe 3608 vpppd.exe 3948 xrrrxff.exe 2028 flflfrx.exe 2648 nnthbt.exe 1896 pdjvv.exe 2680 dpvvd.exe 1580 rlrfllr.exe 2132 nhbbbb.exe 4076 pjdvd.exe 4084 jvjjd.exe 4780 lxlfxxx.exe 536 hbhhbh.exe 2412 hntbtb.exe 468 1dpjp.exe 4624 lrlrrfr.exe 4668 7httbh.exe 2056 jvddp.exe 4120 thtttb.exe 220 jvdvv.exe 4848 5vppp.exe 320 rxlfxxx.exe 2228 btnnnn.exe 2880 bbhnbn.exe 1240 3djvp.exe 4256 htntbn.exe 4908 ddddd.exe 2964 flrrxrx.exe 3228 nhtbhn.exe 4132 vjpvp.exe 3324 7jpvv.exe 4976 xrrrlff.exe 2420 bbnhnh.exe -
Processes:
resource yara_rule behavioral2/memory/2140-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2664-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4540-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bhnttb.exelffxrll.exehhtbtb.exebtnnnn.exexlxrrxf.exebhttnt.exejjdvd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjdvd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exepvpjj.exebbtbbb.exe7nbttt.exe9lxfflr.exexlrrlll.exejdjjd.exe9ntttt.exennnnnt.exevpdvv.exexrfffff.exe3htntt.exepjjdj.exexxxfflf.exexrxxxll.exehnhnth.exevvpjd.exefffxrxx.exebthhhn.exepppvd.exevjpjj.exehthtnt.exedescription pid process target process PID 2140 wrote to memory of 4972 2140 23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe pvpjj.exe PID 2140 wrote to memory of 4972 2140 23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe pvpjj.exe PID 2140 wrote to memory of 4972 2140 23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe pvpjj.exe PID 4972 wrote to memory of 3716 4972 pvpjj.exe bbtbbb.exe PID 4972 wrote to memory of 3716 4972 pvpjj.exe bbtbbb.exe PID 4972 wrote to memory of 3716 4972 pvpjj.exe bbtbbb.exe PID 3716 wrote to memory of 5076 3716 bbtbbb.exe 7nbttt.exe PID 3716 wrote to memory of 5076 3716 bbtbbb.exe 7nbttt.exe PID 3716 wrote to memory of 5076 3716 bbtbbb.exe 7nbttt.exe PID 5076 wrote to memory of 1236 5076 7nbttt.exe 9lxfflr.exe PID 5076 wrote to memory of 1236 5076 7nbttt.exe 9lxfflr.exe PID 5076 wrote to memory of 1236 5076 7nbttt.exe 9lxfflr.exe PID 1236 wrote to memory of 3748 1236 9lxfflr.exe xlrrlll.exe PID 1236 wrote to memory of 3748 1236 9lxfflr.exe xlrrlll.exe PID 1236 wrote to memory of 3748 1236 9lxfflr.exe xlrrlll.exe PID 3748 wrote to memory of 4640 3748 xlrrlll.exe jdjjd.exe PID 3748 wrote to memory of 4640 3748 xlrrlll.exe jdjjd.exe PID 3748 wrote to memory of 4640 3748 xlrrlll.exe jdjjd.exe PID 4640 wrote to memory of 2036 4640 jdjjd.exe 9ntttt.exe PID 4640 wrote to memory of 2036 4640 jdjjd.exe 9ntttt.exe PID 4640 wrote to memory of 2036 4640 jdjjd.exe 9ntttt.exe PID 2036 wrote to memory of 4652 2036 9ntttt.exe nnnnnt.exe PID 2036 wrote to memory of 4652 2036 9ntttt.exe nnnnnt.exe PID 2036 wrote to memory of 4652 2036 9ntttt.exe nnnnnt.exe PID 4652 wrote to memory of 2664 4652 nnnnnt.exe vpdvv.exe PID 4652 wrote to memory of 2664 4652 nnnnnt.exe vpdvv.exe PID 4652 wrote to memory of 2664 4652 nnnnnt.exe vpdvv.exe PID 2664 wrote to memory of 2372 2664 vpdvv.exe xrfffff.exe PID 2664 wrote to memory of 2372 2664 vpdvv.exe xrfffff.exe PID 2664 wrote to memory of 2372 2664 vpdvv.exe xrfffff.exe PID 2372 wrote to memory of 5004 2372 xrfffff.exe 3htntt.exe PID 2372 wrote to memory of 5004 2372 xrfffff.exe 3htntt.exe PID 2372 wrote to memory of 5004 2372 xrfffff.exe 3htntt.exe PID 5004 wrote to memory of 2740 5004 3htntt.exe pjjdj.exe PID 5004 wrote to memory of 2740 5004 3htntt.exe pjjdj.exe PID 5004 wrote to memory of 2740 5004 3htntt.exe pjjdj.exe PID 2740 wrote to memory of 4804 2740 pjjdj.exe xxxfflf.exe PID 2740 wrote to memory of 4804 2740 pjjdj.exe xxxfflf.exe PID 2740 wrote to memory of 4804 2740 pjjdj.exe xxxfflf.exe PID 4804 wrote to memory of 4228 4804 xxxfflf.exe xrxxxll.exe PID 4804 wrote to memory of 4228 4804 xxxfflf.exe xrxxxll.exe PID 4804 wrote to memory of 4228 4804 xxxfflf.exe xrxxxll.exe PID 4228 wrote to memory of 4540 4228 xrxxxll.exe hnhnth.exe PID 4228 wrote to memory of 4540 4228 xrxxxll.exe hnhnth.exe PID 4228 wrote to memory of 4540 4228 xrxxxll.exe hnhnth.exe PID 4540 wrote to memory of 1940 4540 hnhnth.exe vvpjd.exe PID 4540 wrote to memory of 1940 4540 hnhnth.exe vvpjd.exe PID 4540 wrote to memory of 1940 4540 hnhnth.exe vvpjd.exe PID 1940 wrote to memory of 4124 1940 vvpjd.exe fffxrxx.exe PID 1940 wrote to memory of 4124 1940 vvpjd.exe fffxrxx.exe PID 1940 wrote to memory of 4124 1940 vvpjd.exe fffxrxx.exe PID 4124 wrote to memory of 208 4124 fffxrxx.exe bthhhn.exe PID 4124 wrote to memory of 208 4124 fffxrxx.exe bthhhn.exe PID 4124 wrote to memory of 208 4124 fffxrxx.exe bthhhn.exe PID 208 wrote to memory of 3452 208 bthhhn.exe pppvd.exe PID 208 wrote to memory of 3452 208 bthhhn.exe pppvd.exe PID 208 wrote to memory of 3452 208 bthhhn.exe pppvd.exe PID 3452 wrote to memory of 5028 3452 pppvd.exe vjpjj.exe PID 3452 wrote to memory of 5028 3452 pppvd.exe vjpjj.exe PID 3452 wrote to memory of 5028 3452 pppvd.exe vjpjj.exe PID 5028 wrote to memory of 988 5028 vjpjj.exe hthtnt.exe PID 5028 wrote to memory of 988 5028 vjpjj.exe hthtnt.exe PID 5028 wrote to memory of 988 5028 vjpjj.exe hthtnt.exe PID 988 wrote to memory of 3044 988 hthtnt.exe 1nthbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe"C:\Users\Admin\AppData\Local\Temp\23de7a760be2ed247bdfa849785acfe683552e69b0ef3a6166858eb15e566baa.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pvpjj.exec:\pvpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\bbtbbb.exec:\bbtbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\7nbttt.exec:\7nbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\9lxfflr.exec:\9lxfflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\xlrrlll.exec:\xlrrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\jdjjd.exec:\jdjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\9ntttt.exec:\9ntttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\nnnnnt.exec:\nnnnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\vpdvv.exec:\vpdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\xrfffff.exec:\xrfffff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\3htntt.exec:\3htntt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\pjjdj.exec:\pjjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\xxxfflf.exec:\xxxfflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\xrxxxll.exec:\xrxxxll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\hnhnth.exec:\hnhnth.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\vvpjd.exec:\vvpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\fffxrxx.exec:\fffxrxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\bthhhn.exec:\bthhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\pppvd.exec:\pppvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\vjpjj.exec:\vjpjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\hthtnt.exec:\hthtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\1nthbn.exec:\1nthbn.exe23⤵
- Executes dropped EXE
PID:3044 -
\??\c:\jdvvp.exec:\jdvvp.exe24⤵
- Executes dropped EXE
PID:4472 -
\??\c:\1lrrllr.exec:\1lrrllr.exe25⤵
- Executes dropped EXE
PID:4856 -
\??\c:\tnbhhh.exec:\tnbhhh.exe26⤵
- Executes dropped EXE
PID:3448 -
\??\c:\7vvvj.exec:\7vvvj.exe27⤵
- Executes dropped EXE
PID:3860 -
\??\c:\llxxxxf.exec:\llxxxxf.exe28⤵
- Executes dropped EXE
PID:920 -
\??\c:\bhhhth.exec:\bhhhth.exe29⤵
- Executes dropped EXE
PID:1260 -
\??\c:\jddpp.exec:\jddpp.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\5rxrlxl.exec:\5rxrlxl.exe31⤵
- Executes dropped EXE
PID:952 -
\??\c:\hnhhhh.exec:\hnhhhh.exe32⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nbhtth.exec:\nbhtth.exe33⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vpppd.exec:\vpppd.exe34⤵
- Executes dropped EXE
PID:3608 -
\??\c:\xrrrxff.exec:\xrrrxff.exe35⤵
- Executes dropped EXE
PID:3948 -
\??\c:\flflfrx.exec:\flflfrx.exe36⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nnthbt.exec:\nnthbt.exe37⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pdjvv.exec:\pdjvv.exe38⤵
- Executes dropped EXE
PID:1896 -
\??\c:\dpvvd.exec:\dpvvd.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rlrfllr.exec:\rlrfllr.exe40⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nhbbbb.exec:\nhbbbb.exe41⤵
- Executes dropped EXE
PID:2132 -
\??\c:\pjdvd.exec:\pjdvd.exe42⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jvjjd.exec:\jvjjd.exe43⤵
- Executes dropped EXE
PID:4084 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe44⤵
- Executes dropped EXE
PID:4780 -
\??\c:\hbhhbh.exec:\hbhhbh.exe45⤵
- Executes dropped EXE
PID:536 -
\??\c:\hntbtb.exec:\hntbtb.exe46⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1dpjp.exec:\1dpjp.exe47⤵
- Executes dropped EXE
PID:468 -
\??\c:\lrlrrfr.exec:\lrlrrfr.exe48⤵
- Executes dropped EXE
PID:4624 -
\??\c:\7httbh.exec:\7httbh.exe49⤵
- Executes dropped EXE
PID:4668 -
\??\c:\jvddp.exec:\jvddp.exe50⤵
- Executes dropped EXE
PID:2056 -
\??\c:\thtttb.exec:\thtttb.exe51⤵
- Executes dropped EXE
PID:4120 -
\??\c:\jvdvv.exec:\jvdvv.exe52⤵
- Executes dropped EXE
PID:220 -
\??\c:\5vppp.exec:\5vppp.exe53⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rxlfxxx.exec:\rxlfxxx.exe54⤵
- Executes dropped EXE
PID:320 -
\??\c:\btnnnn.exec:\btnnnn.exe55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
\??\c:\bbhnbn.exec:\bbhnbn.exe56⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3djvp.exec:\3djvp.exe57⤵
- Executes dropped EXE
PID:1240 -
\??\c:\htntbn.exec:\htntbn.exe58⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ddddd.exec:\ddddd.exe59⤵
- Executes dropped EXE
PID:4908 -
\??\c:\flrrxrx.exec:\flrrxrx.exe60⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nhtbhn.exec:\nhtbhn.exe61⤵
- Executes dropped EXE
PID:3228 -
\??\c:\vjpvp.exec:\vjpvp.exe62⤵
- Executes dropped EXE
PID:4132 -
\??\c:\7jpvv.exec:\7jpvv.exe63⤵
- Executes dropped EXE
PID:3324 -
\??\c:\xrrrlff.exec:\xrrrlff.exe64⤵
- Executes dropped EXE
PID:4976 -
\??\c:\bbnhnh.exec:\bbnhnh.exe65⤵
- Executes dropped EXE
PID:2420 -
\??\c:\jpddp.exec:\jpddp.exe66⤵PID:3656
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe67⤵PID:4232
-
\??\c:\tthnhn.exec:\tthnhn.exe68⤵PID:380
-
\??\c:\jpdvv.exec:\jpdvv.exe69⤵PID:2332
-
\??\c:\3llrfrl.exec:\3llrfrl.exe70⤵PID:3480
-
\??\c:\rflllll.exec:\rflllll.exe71⤵PID:3416
-
\??\c:\nbhhhh.exec:\nbhhhh.exe72⤵PID:1508
-
\??\c:\fxxxffr.exec:\fxxxffr.exe73⤵PID:4604
-
\??\c:\bhtthh.exec:\bhtthh.exe74⤵PID:1740
-
\??\c:\1vjjv.exec:\1vjjv.exe75⤵PID:1464
-
\??\c:\ddvpd.exec:\ddvpd.exe76⤵PID:3972
-
\??\c:\xxlrlxr.exec:\xxlrlxr.exe77⤵PID:1628
-
\??\c:\nnnnhn.exec:\nnnnhn.exe78⤵PID:2968
-
\??\c:\nnbhhh.exec:\nnbhhh.exe79⤵PID:2884
-
\??\c:\3dvvv.exec:\3dvvv.exe80⤵PID:4292
-
\??\c:\rlrrxff.exec:\rlrrxff.exe81⤵PID:4904
-
\??\c:\nhhbbh.exec:\nhhbbh.exe82⤵PID:3024
-
\??\c:\jjdjj.exec:\jjdjj.exe83⤵PID:896
-
\??\c:\rrlfrxr.exec:\rrlfrxr.exe84⤵PID:3664
-
\??\c:\1tnbbh.exec:\1tnbbh.exe85⤵PID:1260
-
\??\c:\pdpjj.exec:\pdpjj.exe86⤵PID:2452
-
\??\c:\xllllfl.exec:\xllllfl.exe87⤵PID:1696
-
\??\c:\hthbtb.exec:\hthbtb.exe88⤵PID:100
-
\??\c:\nnnhbb.exec:\nnnhbb.exe89⤵PID:60
-
\??\c:\7pppj.exec:\7pppj.exe90⤵PID:1868
-
\??\c:\ffxxllx.exec:\ffxxllx.exe91⤵PID:2624
-
\??\c:\thnnhh.exec:\thnnhh.exe92⤵PID:4432
-
\??\c:\bnhtnn.exec:\bnhtnn.exe93⤵PID:4860
-
\??\c:\vpjdv.exec:\vpjdv.exe94⤵PID:3076
-
\??\c:\rflrxfl.exec:\rflrxfl.exe95⤵PID:4112
-
\??\c:\tbhnnt.exec:\tbhnnt.exe96⤵PID:964
-
\??\c:\pvdjd.exec:\pvdjd.exe97⤵PID:4252
-
\??\c:\xxlrxrx.exec:\xxlrxrx.exe98⤵PID:2352
-
\??\c:\nhbbtb.exec:\nhbbtb.exe99⤵PID:2464
-
\??\c:\htnbtb.exec:\htnbtb.exe100⤵PID:4396
-
\??\c:\vdjpp.exec:\vdjpp.exe101⤵PID:4572
-
\??\c:\frrfrlf.exec:\frrfrlf.exe102⤵PID:1660
-
\??\c:\llfffff.exec:\llfffff.exe103⤵PID:4440
-
\??\c:\9ttttb.exec:\9ttttb.exe104⤵PID:2244
-
\??\c:\7nhbtt.exec:\7nhbtt.exe105⤵PID:184
-
\??\c:\vpdvp.exec:\vpdvp.exe106⤵PID:4120
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe107⤵PID:5080
-
\??\c:\lflffll.exec:\lflffll.exe108⤵PID:4940
-
\??\c:\nnhhbb.exec:\nnhhbb.exe109⤵PID:4736
-
\??\c:\jvddd.exec:\jvddd.exe110⤵PID:3264
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe111⤵PID:4392
-
\??\c:\3rxrllf.exec:\3rxrllf.exe112⤵PID:3736
-
\??\c:\bntnnh.exec:\bntnnh.exe113⤵PID:4116
-
\??\c:\3djjj.exec:\3djjj.exe114⤵PID:3136
-
\??\c:\ppvvp.exec:\ppvvp.exe115⤵PID:5084
-
\??\c:\rxxrxlr.exec:\rxxrxlr.exe116⤵PID:784
-
\??\c:\bbnnhb.exec:\bbnnhb.exe117⤵PID:1860
-
\??\c:\ntttnt.exec:\ntttnt.exe118⤵PID:3200
-
\??\c:\jdpjd.exec:\jdpjd.exe119⤵PID:3692
-
\??\c:\jvpvp.exec:\jvpvp.exe120⤵PID:1076
-
\??\c:\llllfff.exec:\llllfff.exe121⤵PID:3416
-
\??\c:\nhbbhn.exec:\nhbbhn.exe122⤵PID:1508
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-