Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2024 17:22
Static task
static1
Behavioral task
behavioral1
Sample
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe
Resource
win7-20240903-en
General
-
Target
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe
-
Size
89KB
-
MD5
f891b4e0104d419684830cfb7653df6e
-
SHA1
0558b2f23024e30754c82a8ea2450a9a923f5ba8
-
SHA256
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995
-
SHA512
8499aef9637c0e483905a2d61e7e66f9a10d56a400d2292159bfd921b786fb16bc7bd8618eb20e809612ae303b4fbbf09781ae576a6fe827d6f712b14288ae50
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vhdW/:ymb3NkkiQ3mdBjFo6Pfgy3dbc/hdW/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4952-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1516-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1876-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1708-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1752-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bntnnh.exepjjdv.exexxfflxx.exe7htnhh.exetnnbhh.exerlrfxfx.exe9lfxrrl.exenhhbbt.exejpppd.exe9lxrllx.exentbttt.exejvddp.exedpddd.exetnnntb.exe9jdvv.exexllfxxx.exetnnhbb.exelflfxrr.exe9hnhnh.exexxxxrrr.exeffrllll.exevpvpj.exejvjjj.exexxrxxll.exethtbtt.exejddvp.exe7jpjd.exerxfxxxf.exenhhhbh.exe3hhbtt.exe1dppd.exelrxrlll.exebbbtnh.exefxxxrrr.exe7bbbhh.exehnnbtt.exeddddp.exepjpjv.exenttthh.exe1bbbtt.exe1ppdp.exerxxxxxr.exefxxxrxr.exehhtnhn.exebbtthh.exedvpjd.exevjvpd.exexxlrrfl.exehbhbbb.exe1nbtnn.exepjdvp.exe3vpjd.exelrxrffx.exellrlrrl.exebhnnnn.exejdvpp.exevpjdv.exexfrlxxr.exe9xffffl.exe7hbnhh.exeppdpp.exepdjdv.exefxlflfl.exe3flfxxr.exepid process 1516 bntnnh.exe 2844 pjjdv.exe 4156 xxfflxx.exe 1880 7htnhh.exe 4468 tnnbhh.exe 4024 rlrfxfx.exe 1876 9lfxrrl.exe 1068 nhhbbt.exe 720 jpppd.exe 3176 9lxrllx.exe 3456 ntbttt.exe 1228 jvddp.exe 1840 dpddd.exe 1540 tnnntb.exe 2392 9jdvv.exe 4548 xllfxxx.exe 3692 tnnhbb.exe 408 lflfxrr.exe 2588 9hnhnh.exe 1264 xxxxrrr.exe 3768 ffrllll.exe 1580 vpvpj.exe 2468 jvjjj.exe 1708 xxrxxll.exe 4068 thtbtt.exe 3188 jddvp.exe 1752 7jpjd.exe 1988 rxfxxxf.exe 2308 nhhhbh.exe 5068 3hhbtt.exe 2164 1dppd.exe 4008 lrxrlll.exe 1664 bbbtnh.exe 1684 fxxxrrr.exe 4340 7bbbhh.exe 3524 hnnbtt.exe 2516 ddddp.exe 2288 pjpjv.exe 4604 nttthh.exe 1548 1bbbtt.exe 4312 1ppdp.exe 3608 rxxxxxr.exe 3928 fxxxrxr.exe 3584 hhtnhn.exe 3720 bbtthh.exe 4560 dvpjd.exe 1084 vjvpd.exe 1332 xxlrrfl.exe 1944 hbhbbb.exe 216 1nbtnn.exe 4976 pjdvp.exe 4132 3vpjd.exe 4492 lrxrffx.exe 3480 llrlrrl.exe 2432 bhnnnn.exe 3440 jdvpp.exe 3400 vpjdv.exe 940 xfrlxxr.exe 1604 9xffffl.exe 1436 7hbnhh.exe 1660 ppdpp.exe 4488 pdjdv.exe 1744 fxlflfl.exe 2532 3flfxxr.exe -
Processes:
resource yara_rule behavioral2/memory/4952-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1876-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3692-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1708-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1752-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
jddjv.exennhbbt.exehhtbnn.exehttttn.exehhttnn.exerrffllr.exetntthh.exettnnbb.exevjvpd.exevdpdv.exe9xrlxxx.exelrxrllf.exetnnhhh.exe5bhbtt.exenhtntt.exerfllfxf.exettbbtt.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httttn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbtt.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exebntnnh.exepjjdv.exexxfflxx.exe7htnhh.exetnnbhh.exerlrfxfx.exe9lfxrrl.exenhhbbt.exejpppd.exe9lxrllx.exentbttt.exejvddp.exedpddd.exetnnntb.exe9jdvv.exexllfxxx.exetnnhbb.exelflfxrr.exe9hnhnh.exexxxxrrr.exeffrllll.exedescription pid process target process PID 4952 wrote to memory of 1516 4952 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe bntnnh.exe PID 4952 wrote to memory of 1516 4952 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe bntnnh.exe PID 4952 wrote to memory of 1516 4952 f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe bntnnh.exe PID 1516 wrote to memory of 2844 1516 bntnnh.exe pjjdv.exe PID 1516 wrote to memory of 2844 1516 bntnnh.exe pjjdv.exe PID 1516 wrote to memory of 2844 1516 bntnnh.exe pjjdv.exe PID 2844 wrote to memory of 4156 2844 pjjdv.exe xxfflxx.exe PID 2844 wrote to memory of 4156 2844 pjjdv.exe xxfflxx.exe PID 2844 wrote to memory of 4156 2844 pjjdv.exe xxfflxx.exe PID 4156 wrote to memory of 1880 4156 xxfflxx.exe 7htnhh.exe PID 4156 wrote to memory of 1880 4156 xxfflxx.exe 7htnhh.exe PID 4156 wrote to memory of 1880 4156 xxfflxx.exe 7htnhh.exe PID 1880 wrote to memory of 4468 1880 7htnhh.exe tnnbhh.exe PID 1880 wrote to memory of 4468 1880 7htnhh.exe tnnbhh.exe PID 1880 wrote to memory of 4468 1880 7htnhh.exe tnnbhh.exe PID 4468 wrote to memory of 4024 4468 tnnbhh.exe rlrfxfx.exe PID 4468 wrote to memory of 4024 4468 tnnbhh.exe rlrfxfx.exe PID 4468 wrote to memory of 4024 4468 tnnbhh.exe rlrfxfx.exe PID 4024 wrote to memory of 1876 4024 rlrfxfx.exe 9lfxrrl.exe PID 4024 wrote to memory of 1876 4024 rlrfxfx.exe 9lfxrrl.exe PID 4024 wrote to memory of 1876 4024 rlrfxfx.exe 9lfxrrl.exe PID 1876 wrote to memory of 1068 1876 9lfxrrl.exe nhhbbt.exe PID 1876 wrote to memory of 1068 1876 9lfxrrl.exe nhhbbt.exe PID 1876 wrote to memory of 1068 1876 9lfxrrl.exe nhhbbt.exe PID 1068 wrote to memory of 720 1068 nhhbbt.exe jpppd.exe PID 1068 wrote to memory of 720 1068 nhhbbt.exe jpppd.exe PID 1068 wrote to memory of 720 1068 nhhbbt.exe jpppd.exe PID 720 wrote to memory of 3176 720 jpppd.exe 9lxrllx.exe PID 720 wrote to memory of 3176 720 jpppd.exe 9lxrllx.exe PID 720 wrote to memory of 3176 720 jpppd.exe 9lxrllx.exe PID 3176 wrote to memory of 3456 3176 9lxrllx.exe ntbttt.exe PID 3176 wrote to memory of 3456 3176 9lxrllx.exe ntbttt.exe PID 3176 wrote to memory of 3456 3176 9lxrllx.exe ntbttt.exe PID 3456 wrote to memory of 1228 3456 ntbttt.exe jvddp.exe PID 3456 wrote to memory of 1228 3456 ntbttt.exe jvddp.exe PID 3456 wrote to memory of 1228 3456 ntbttt.exe jvddp.exe PID 1228 wrote to memory of 1840 1228 jvddp.exe dpddd.exe PID 1228 wrote to memory of 1840 1228 jvddp.exe dpddd.exe PID 1228 wrote to memory of 1840 1228 jvddp.exe dpddd.exe PID 1840 wrote to memory of 1540 1840 dpddd.exe tnnntb.exe PID 1840 wrote to memory of 1540 1840 dpddd.exe tnnntb.exe PID 1840 wrote to memory of 1540 1840 dpddd.exe tnnntb.exe PID 1540 wrote to memory of 2392 1540 tnnntb.exe 9jdvv.exe PID 1540 wrote to memory of 2392 1540 tnnntb.exe 9jdvv.exe PID 1540 wrote to memory of 2392 1540 tnnntb.exe 9jdvv.exe PID 2392 wrote to memory of 4548 2392 9jdvv.exe xllfxxx.exe PID 2392 wrote to memory of 4548 2392 9jdvv.exe xllfxxx.exe PID 2392 wrote to memory of 4548 2392 9jdvv.exe xllfxxx.exe PID 4548 wrote to memory of 3692 4548 xllfxxx.exe tnnhbb.exe PID 4548 wrote to memory of 3692 4548 xllfxxx.exe tnnhbb.exe PID 4548 wrote to memory of 3692 4548 xllfxxx.exe tnnhbb.exe PID 3692 wrote to memory of 408 3692 tnnhbb.exe lflfxrr.exe PID 3692 wrote to memory of 408 3692 tnnhbb.exe lflfxrr.exe PID 3692 wrote to memory of 408 3692 tnnhbb.exe lflfxrr.exe PID 408 wrote to memory of 2588 408 lflfxrr.exe 9hnhnh.exe PID 408 wrote to memory of 2588 408 lflfxrr.exe 9hnhnh.exe PID 408 wrote to memory of 2588 408 lflfxrr.exe 9hnhnh.exe PID 2588 wrote to memory of 1264 2588 9hnhnh.exe xxxxrrr.exe PID 2588 wrote to memory of 1264 2588 9hnhnh.exe xxxxrrr.exe PID 2588 wrote to memory of 1264 2588 9hnhnh.exe xxxxrrr.exe PID 1264 wrote to memory of 3768 1264 xxxxrrr.exe ffrllll.exe PID 1264 wrote to memory of 3768 1264 xxxxrrr.exe ffrllll.exe PID 1264 wrote to memory of 3768 1264 xxxxrrr.exe ffrllll.exe PID 3768 wrote to memory of 1580 3768 ffrllll.exe vpvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe"C:\Users\Admin\AppData\Local\Temp\f63c1573e9607c6635c9adfbcb79d4918e1fe502946222de8d06c59b1fb4a995.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\bntnnh.exec:\bntnnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\pjjdv.exec:\pjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\xxfflxx.exec:\xxfflxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\7htnhh.exec:\7htnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\tnnbhh.exec:\tnnbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\rlrfxfx.exec:\rlrfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\9lfxrrl.exec:\9lfxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\nhhbbt.exec:\nhhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\jpppd.exec:\jpppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\9lxrllx.exec:\9lxrllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\ntbttt.exec:\ntbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\jvddp.exec:\jvddp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\dpddd.exec:\dpddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\tnnntb.exec:\tnnntb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\9jdvv.exec:\9jdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\xllfxxx.exec:\xllfxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\tnnhbb.exec:\tnnhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\lflfxrr.exec:\lflfxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\9hnhnh.exec:\9hnhnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\ffrllll.exec:\ffrllll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3768 -
\??\c:\vpvpj.exec:\vpvpj.exe23⤵
- Executes dropped EXE
PID:1580 -
\??\c:\jvjjj.exec:\jvjjj.exe24⤵
- Executes dropped EXE
PID:2468 -
\??\c:\xxrxxll.exec:\xxrxxll.exe25⤵
- Executes dropped EXE
PID:1708 -
\??\c:\thtbtt.exec:\thtbtt.exe26⤵
- Executes dropped EXE
PID:4068 -
\??\c:\jddvp.exec:\jddvp.exe27⤵
- Executes dropped EXE
PID:3188 -
\??\c:\7jpjd.exec:\7jpjd.exe28⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rxfxxxf.exec:\rxfxxxf.exe29⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhhhbh.exec:\nhhhbh.exe30⤵
- Executes dropped EXE
PID:2308 -
\??\c:\3hhbtt.exec:\3hhbtt.exe31⤵
- Executes dropped EXE
PID:5068 -
\??\c:\1dppd.exec:\1dppd.exe32⤵
- Executes dropped EXE
PID:2164 -
\??\c:\lrxrlll.exec:\lrxrlll.exe33⤵
- Executes dropped EXE
PID:4008 -
\??\c:\bbbtnh.exec:\bbbtnh.exe34⤵
- Executes dropped EXE
PID:1664 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe35⤵
- Executes dropped EXE
PID:1684 -
\??\c:\7bbbhh.exec:\7bbbhh.exe36⤵
- Executes dropped EXE
PID:4340 -
\??\c:\hnnbtt.exec:\hnnbtt.exe37⤵
- Executes dropped EXE
PID:3524 -
\??\c:\ddddp.exec:\ddddp.exe38⤵
- Executes dropped EXE
PID:2516 -
\??\c:\pjpjv.exec:\pjpjv.exe39⤵
- Executes dropped EXE
PID:2288 -
\??\c:\nttthh.exec:\nttthh.exe40⤵
- Executes dropped EXE
PID:4604 -
\??\c:\1bbbtt.exec:\1bbbtt.exe41⤵
- Executes dropped EXE
PID:1548 -
\??\c:\1ppdp.exec:\1ppdp.exe42⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe43⤵
- Executes dropped EXE
PID:3608 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe44⤵
- Executes dropped EXE
PID:3928 -
\??\c:\hhtnhn.exec:\hhtnhn.exe45⤵
- Executes dropped EXE
PID:3584 -
\??\c:\bbtthh.exec:\bbtthh.exe46⤵
- Executes dropped EXE
PID:3720 -
\??\c:\dvpjd.exec:\dvpjd.exe47⤵
- Executes dropped EXE
PID:4560 -
\??\c:\vjvpd.exec:\vjvpd.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1084 -
\??\c:\xxlrrfl.exec:\xxlrrfl.exe49⤵
- Executes dropped EXE
PID:1332 -
\??\c:\hbhbbb.exec:\hbhbbb.exe50⤵
- Executes dropped EXE
PID:1944 -
\??\c:\1nbtnn.exec:\1nbtnn.exe51⤵
- Executes dropped EXE
PID:216 -
\??\c:\pjdvp.exec:\pjdvp.exe52⤵
- Executes dropped EXE
PID:4976 -
\??\c:\3vpjd.exec:\3vpjd.exe53⤵
- Executes dropped EXE
PID:4132 -
\??\c:\lrxrffx.exec:\lrxrffx.exe54⤵
- Executes dropped EXE
PID:4492 -
\??\c:\llrlrrl.exec:\llrlrrl.exe55⤵
- Executes dropped EXE
PID:3480 -
\??\c:\bhnnnn.exec:\bhnnnn.exe56⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jdvpp.exec:\jdvpp.exe57⤵
- Executes dropped EXE
PID:3440 -
\??\c:\vpjdv.exec:\vpjdv.exe58⤵
- Executes dropped EXE
PID:3400 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe59⤵
- Executes dropped EXE
PID:940 -
\??\c:\9xffffl.exec:\9xffffl.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7hbnhh.exec:\7hbnhh.exe61⤵
- Executes dropped EXE
PID:1436 -
\??\c:\ppdpp.exec:\ppdpp.exe62⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdjdv.exec:\pdjdv.exe63⤵
- Executes dropped EXE
PID:4488 -
\??\c:\fxlflfl.exec:\fxlflfl.exe64⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3flfxxr.exec:\3flfxxr.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vpdjd.exec:\vpdjd.exe66⤵PID:4540
-
\??\c:\rllfxxr.exec:\rllfxxr.exe67⤵PID:3820
-
\??\c:\lxfffxx.exec:\lxfffxx.exe68⤵PID:3576
-
\??\c:\ttnnbb.exec:\ttnnbb.exe69⤵
- System Location Discovery: System Language Discovery
PID:3268 -
\??\c:\tnhthh.exec:\tnhthh.exe70⤵PID:2644
-
\??\c:\vppdv.exec:\vppdv.exe71⤵PID:5092
-
\??\c:\dvdvp.exec:\dvdvp.exe72⤵PID:2244
-
\??\c:\xlrrllr.exec:\xlrrllr.exe73⤵PID:3428
-
\??\c:\3hhbbh.exec:\3hhbbh.exe74⤵PID:1056
-
\??\c:\hhtnnn.exec:\hhtnnn.exe75⤵PID:796
-
\??\c:\vpjpd.exec:\vpjpd.exe76⤵PID:4856
-
\??\c:\7ddpd.exec:\7ddpd.exe77⤵PID:2204
-
\??\c:\xlxrlll.exec:\xlxrlll.exe78⤵PID:4596
-
\??\c:\ntbbnn.exec:\ntbbnn.exe79⤵PID:1932
-
\??\c:\nhnhbt.exec:\nhnhbt.exe80⤵PID:3284
-
\??\c:\pjvvp.exec:\pjvvp.exe81⤵PID:2508
-
\??\c:\jvjpj.exec:\jvjpj.exe82⤵PID:3276
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe83⤵PID:3788
-
\??\c:\tbbbtt.exec:\tbbbtt.exe84⤵PID:1076
-
\??\c:\btbttt.exec:\btbttt.exe85⤵PID:708
-
\??\c:\dvdvv.exec:\dvdvv.exe86⤵PID:3652
-
\??\c:\1xxrfff.exec:\1xxrfff.exe87⤵PID:5100
-
\??\c:\xlrlfff.exec:\xlrlfff.exe88⤵PID:3964
-
\??\c:\5nnhhh.exec:\5nnhhh.exe89⤵PID:3760
-
\??\c:\dvjjj.exec:\dvjjj.exe90⤵PID:4388
-
\??\c:\jpvpj.exec:\jpvpj.exe91⤵PID:1208
-
\??\c:\frxrllf.exec:\frxrllf.exe92⤵PID:4008
-
\??\c:\llrlffx.exec:\llrlffx.exe93⤵PID:1416
-
\??\c:\tbhbtt.exec:\tbhbtt.exe94⤵PID:400
-
\??\c:\9vdvv.exec:\9vdvv.exe95⤵PID:4752
-
\??\c:\jvpjd.exec:\jvpjd.exe96⤵PID:1888
-
\??\c:\xrrlxlf.exec:\xrrlxlf.exe97⤵PID:1400
-
\??\c:\fxflrxr.exec:\fxflrxr.exe98⤵PID:2352
-
\??\c:\bbhbtt.exec:\bbhbtt.exe99⤵PID:2028
-
\??\c:\vpjjd.exec:\vpjjd.exe100⤵PID:4808
-
\??\c:\jvjdp.exec:\jvjdp.exe101⤵PID:804
-
\??\c:\lrlrlff.exec:\lrlrlff.exe102⤵PID:3000
-
\??\c:\nhbnhh.exec:\nhbnhh.exe103⤵PID:3632
-
\??\c:\tbhhtb.exec:\tbhhtb.exe104⤵PID:4444
-
\??\c:\7ddvp.exec:\7ddvp.exe105⤵PID:1352
-
\??\c:\dvjdv.exec:\dvjdv.exe106⤵PID:3172
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe107⤵PID:3732
-
\??\c:\nnnnnn.exec:\nnnnnn.exe108⤵PID:2992
-
\??\c:\bhhntn.exec:\bhhntn.exe109⤵PID:2300
-
\??\c:\ppvpj.exec:\ppvpj.exe110⤵PID:3040
-
\??\c:\jdppd.exec:\jdppd.exe111⤵PID:1816
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe112⤵PID:448
-
\??\c:\frfxxlf.exec:\frfxxlf.exe113⤵PID:4544
-
\??\c:\htbbbh.exec:\htbbbh.exe114⤵PID:3228
-
\??\c:\ttnhbb.exec:\ttnhbb.exe115⤵PID:1504
-
\??\c:\vvpjj.exec:\vvpjj.exe116⤵PID:1720
-
\??\c:\dvdvj.exec:\dvdvj.exe117⤵PID:1120
-
\??\c:\xrrlffx.exec:\xrrlffx.exe118⤵PID:4176
-
\??\c:\btnhbb.exec:\btnhbb.exe119⤵PID:1064
-
\??\c:\thnhtt.exec:\thnhtt.exe120⤵PID:1948
-
\??\c:\pppjd.exec:\pppjd.exe121⤵PID:2568
-
\??\c:\1pjjp.exec:\1pjjp.exe122⤵PID:4000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-