Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 06:42
Static task
static1
Behavioral task
behavioral1
Sample
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe
Resource
win7-20240903-en
General
-
Target
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe
-
Size
75KB
-
MD5
3b2cfa78ac01b81ef92a5aca15213f52
-
SHA1
31a8050eaa5aa43c3cb9adab4e6ec3bbf5ea778d
-
SHA256
4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce
-
SHA512
df725d212f9174c192b66510349d7cd663262b71b37dc523cb1dbdd16a0f6f62b8c4fc2aa9883f6003cbd226ca62b66f104013932a7b8be99483d9a708839136
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qiImgS5ih6:ymb3NkkiQ3mdBjFIj+qiImgS5ih6
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4504-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2364 tnhtnh.exe 2044 djjdp.exe 3672 dpjvj.exe 1336 xllfxxr.exe 1084 5tthbt.exe 3228 jppjd.exe 3264 frxxxxx.exe 4856 ttbbhn.exe 2540 dvvjv.exe 4108 pddpj.exe 1724 xllfrlx.exe 1316 3bbntn.exe 3680 vjjpv.exe 3504 bbnbnb.exe 3704 thtttt.exe 2032 vjdjj.exe 4420 jddjp.exe 3720 9xfxlxr.exe 3692 tbbbtt.exe 2560 vppjv.exe 440 bbbhhh.exe 2212 vvvjv.exe 2816 ffrrxll.exe 2268 flrrlrl.exe 1312 nbbthh.exe 2932 vpdvj.exe 1468 xrlfxrr.exe 1328 fxrxrxr.exe 2024 ntntht.exe 1296 vddjv.exe 2324 jvpdv.exe 744 5xffffr.exe 2520 9nhbtn.exe 4268 7jjdp.exe 3260 pjvpd.exe 3600 rxllxlr.exe 1684 ntnbtn.exe 3564 htbnhb.exe 2076 pvpvv.exe 2908 vppjv.exe 1136 frrlxlx.exe 3636 llrrrrl.exe 1372 5bhtnh.exe 1064 jdpjv.exe 4036 1jjjv.exe 1400 lxxrffx.exe 3668 fxlrxrx.exe 2860 9nnhbn.exe 4396 pdpjp.exe 4488 dvddd.exe 4316 xrrlxxr.exe 972 bnnhbb.exe 3592 3nnbnh.exe 1336 pdvvj.exe 3672 jpvpp.exe 1644 xrlxrrr.exe 2340 bnnhnh.exe 1456 hbbttn.exe 4800 3dpdv.exe 2736 flfxrlf.exe 2836 xrfxrlf.exe 4824 hbtthh.exe 1148 thbtnn.exe 4144 jpjdp.exe -
resource yara_rule behavioral2/memory/4504-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3xxrfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5fxxxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4504 wrote to memory of 2364 4504 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 82 PID 4504 wrote to memory of 2364 4504 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 82 PID 4504 wrote to memory of 2364 4504 4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe 82 PID 2364 wrote to memory of 2044 2364 tnhtnh.exe 83 PID 2364 wrote to memory of 2044 2364 tnhtnh.exe 83 PID 2364 wrote to memory of 2044 2364 tnhtnh.exe 83 PID 2044 wrote to memory of 3672 2044 djjdp.exe 84 PID 2044 wrote to memory of 3672 2044 djjdp.exe 84 PID 2044 wrote to memory of 3672 2044 djjdp.exe 84 PID 3672 wrote to memory of 1336 3672 dpjvj.exe 85 PID 3672 wrote to memory of 1336 3672 dpjvj.exe 85 PID 3672 wrote to memory of 1336 3672 dpjvj.exe 85 PID 1336 wrote to memory of 1084 1336 xllfxxr.exe 86 PID 1336 wrote to memory of 1084 1336 xllfxxr.exe 86 PID 1336 wrote to memory of 1084 1336 xllfxxr.exe 86 PID 1084 wrote to memory of 3228 1084 5tthbt.exe 87 PID 1084 wrote to memory of 3228 1084 5tthbt.exe 87 PID 1084 wrote to memory of 3228 1084 5tthbt.exe 87 PID 3228 wrote to memory of 3264 3228 jppjd.exe 88 PID 3228 wrote to memory of 3264 3228 jppjd.exe 88 PID 3228 wrote to memory of 3264 3228 jppjd.exe 88 PID 3264 wrote to memory of 4856 3264 frxxxxx.exe 89 PID 3264 wrote to memory of 4856 3264 frxxxxx.exe 89 PID 3264 wrote to memory of 4856 3264 frxxxxx.exe 89 PID 4856 wrote to memory of 2540 4856 ttbbhn.exe 90 PID 4856 wrote to memory of 2540 4856 ttbbhn.exe 90 PID 4856 wrote to memory of 2540 4856 ttbbhn.exe 90 PID 2540 wrote to memory of 4108 2540 dvvjv.exe 91 PID 2540 wrote to memory of 4108 2540 dvvjv.exe 91 PID 2540 wrote to memory of 4108 2540 dvvjv.exe 91 PID 4108 wrote to memory of 1724 4108 pddpj.exe 92 PID 4108 wrote to memory of 1724 4108 pddpj.exe 92 PID 4108 wrote to memory of 1724 4108 pddpj.exe 92 PID 1724 wrote to memory of 1316 1724 xllfrlx.exe 93 PID 1724 wrote to memory of 1316 1724 xllfrlx.exe 93 PID 1724 wrote to memory of 1316 1724 xllfrlx.exe 93 PID 1316 wrote to memory of 3680 1316 3bbntn.exe 94 PID 1316 wrote to memory of 3680 1316 3bbntn.exe 94 PID 1316 wrote to memory of 3680 1316 3bbntn.exe 94 PID 3680 wrote to memory of 3504 3680 vjjpv.exe 95 PID 3680 wrote to memory of 3504 3680 vjjpv.exe 95 PID 3680 wrote to memory of 3504 3680 vjjpv.exe 95 PID 3504 wrote to memory of 3704 3504 bbnbnb.exe 96 PID 3504 wrote to memory of 3704 3504 bbnbnb.exe 96 PID 3504 wrote to memory of 3704 3504 bbnbnb.exe 96 PID 3704 wrote to memory of 2032 3704 thtttt.exe 97 PID 3704 wrote to memory of 2032 3704 thtttt.exe 97 PID 3704 wrote to memory of 2032 3704 thtttt.exe 97 PID 2032 wrote to memory of 4420 2032 vjdjj.exe 98 PID 2032 wrote to memory of 4420 2032 vjdjj.exe 98 PID 2032 wrote to memory of 4420 2032 vjdjj.exe 98 PID 4420 wrote to memory of 3720 4420 jddjp.exe 99 PID 4420 wrote to memory of 3720 4420 jddjp.exe 99 PID 4420 wrote to memory of 3720 4420 jddjp.exe 99 PID 3720 wrote to memory of 3692 3720 9xfxlxr.exe 100 PID 3720 wrote to memory of 3692 3720 9xfxlxr.exe 100 PID 3720 wrote to memory of 3692 3720 9xfxlxr.exe 100 PID 3692 wrote to memory of 2560 3692 tbbbtt.exe 101 PID 3692 wrote to memory of 2560 3692 tbbbtt.exe 101 PID 3692 wrote to memory of 2560 3692 tbbbtt.exe 101 PID 2560 wrote to memory of 440 2560 vppjv.exe 102 PID 2560 wrote to memory of 440 2560 vppjv.exe 102 PID 2560 wrote to memory of 440 2560 vppjv.exe 102 PID 440 wrote to memory of 2212 440 bbbhhh.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe"C:\Users\Admin\AppData\Local\Temp\4dbd80c8481330cf6d45c49bb4b201a4e5e903587fd94b893215e09726ba6cce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\tnhtnh.exec:\tnhtnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\djjdp.exec:\djjdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\dpjvj.exec:\dpjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\xllfxxr.exec:\xllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\5tthbt.exec:\5tthbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\jppjd.exec:\jppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\frxxxxx.exec:\frxxxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\ttbbhn.exec:\ttbbhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\dvvjv.exec:\dvvjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\pddpj.exec:\pddpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\xllfrlx.exec:\xllfrlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\3bbntn.exec:\3bbntn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\vjjpv.exec:\vjjpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\bbnbnb.exec:\bbnbnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\thtttt.exec:\thtttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\vjdjj.exec:\vjdjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jddjp.exec:\jddjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\9xfxlxr.exec:\9xfxlxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\tbbbtt.exec:\tbbbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\vppjv.exec:\vppjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\bbbhhh.exec:\bbbhhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\vvvjv.exec:\vvvjv.exe23⤵
- Executes dropped EXE
PID:2212 -
\??\c:\ffrrxll.exec:\ffrrxll.exe24⤵
- Executes dropped EXE
PID:2816 -
\??\c:\flrrlrl.exec:\flrrlrl.exe25⤵
- Executes dropped EXE
PID:2268 -
\??\c:\nbbthh.exec:\nbbthh.exe26⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vpdvj.exec:\vpdvj.exe27⤵
- Executes dropped EXE
PID:2932 -
\??\c:\xrlfxrr.exec:\xrlfxrr.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\fxrxrxr.exec:\fxrxrxr.exe29⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ntntht.exec:\ntntht.exe30⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vddjv.exec:\vddjv.exe31⤵
- Executes dropped EXE
PID:1296 -
\??\c:\jvpdv.exec:\jvpdv.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5xffffr.exec:\5xffffr.exe33⤵
- Executes dropped EXE
PID:744 -
\??\c:\9nhbtn.exec:\9nhbtn.exe34⤵
- Executes dropped EXE
PID:2520 -
\??\c:\7jjdp.exec:\7jjdp.exe35⤵
- Executes dropped EXE
PID:4268 -
\??\c:\pjvpd.exec:\pjvpd.exe36⤵
- Executes dropped EXE
PID:3260 -
\??\c:\rxllxlr.exec:\rxllxlr.exe37⤵
- Executes dropped EXE
PID:3600 -
\??\c:\ntnbtn.exec:\ntnbtn.exe38⤵
- Executes dropped EXE
PID:1684 -
\??\c:\htbnhb.exec:\htbnhb.exe39⤵
- Executes dropped EXE
PID:3564 -
\??\c:\pvpvv.exec:\pvpvv.exe40⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vppjv.exec:\vppjv.exe41⤵
- Executes dropped EXE
PID:2908 -
\??\c:\frrlxlx.exec:\frrlxlx.exe42⤵
- Executes dropped EXE
PID:1136 -
\??\c:\llrrrrl.exec:\llrrrrl.exe43⤵
- Executes dropped EXE
PID:3636 -
\??\c:\5bhtnh.exec:\5bhtnh.exe44⤵
- Executes dropped EXE
PID:1372 -
\??\c:\jdpjv.exec:\jdpjv.exe45⤵
- Executes dropped EXE
PID:1064 -
\??\c:\1jjjv.exec:\1jjjv.exe46⤵
- Executes dropped EXE
PID:4036 -
\??\c:\lxxrffx.exec:\lxxrffx.exe47⤵
- Executes dropped EXE
PID:1400 -
\??\c:\fxlrxrx.exec:\fxlrxrx.exe48⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9nnhbn.exec:\9nnhbn.exe49⤵
- Executes dropped EXE
PID:2860 -
\??\c:\pdpjp.exec:\pdpjp.exe50⤵
- Executes dropped EXE
PID:4396 -
\??\c:\dvddd.exec:\dvddd.exe51⤵
- Executes dropped EXE
PID:4488 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe52⤵
- Executes dropped EXE
PID:4316 -
\??\c:\bnnhbb.exec:\bnnhbb.exe53⤵
- Executes dropped EXE
PID:972 -
\??\c:\3nnbnh.exec:\3nnbnh.exe54⤵
- Executes dropped EXE
PID:3592 -
\??\c:\pdvvj.exec:\pdvvj.exe55⤵
- Executes dropped EXE
PID:1336 -
\??\c:\jpvpp.exec:\jpvpp.exe56⤵
- Executes dropped EXE
PID:3672 -
\??\c:\xrlxrrr.exec:\xrlxrrr.exe57⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bnnhnh.exec:\bnnhnh.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\hbbttn.exec:\hbbttn.exe59⤵
- Executes dropped EXE
PID:1456 -
\??\c:\3dpdv.exec:\3dpdv.exe60⤵
- Executes dropped EXE
PID:4800 -
\??\c:\flfxrlf.exec:\flfxrlf.exe61⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe62⤵
- Executes dropped EXE
PID:2836 -
\??\c:\hbtthh.exec:\hbtthh.exe63⤵
- Executes dropped EXE
PID:4824 -
\??\c:\thbtnn.exec:\thbtnn.exe64⤵
- Executes dropped EXE
PID:1148 -
\??\c:\jpjdp.exec:\jpjdp.exe65⤵
- Executes dropped EXE
PID:4144 -
\??\c:\jdjjd.exec:\jdjjd.exe66⤵PID:1292
-
\??\c:\xrfxlxr.exec:\xrfxlxr.exe67⤵PID:2240
-
\??\c:\lxxrlfr.exec:\lxxrlfr.exe68⤵PID:4756
-
\??\c:\tnhhbt.exec:\tnhhbt.exe69⤵PID:3744
-
\??\c:\bnhbtt.exec:\bnhbtt.exe70⤵PID:2564
-
\??\c:\jjdvp.exec:\jjdvp.exe71⤵PID:4032
-
\??\c:\frrxllx.exec:\frrxllx.exe72⤵PID:264
-
\??\c:\lfflfxf.exec:\lfflfxf.exe73⤵PID:2536
-
\??\c:\ntnnhb.exec:\ntnnhb.exe74⤵PID:3540
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe75⤵PID:4168
-
\??\c:\bnnbnn.exec:\bnnbnn.exe76⤵PID:5016
-
\??\c:\nbnntb.exec:\nbnntb.exe77⤵
- System Location Discovery: System Language Discovery
PID:3772 -
\??\c:\jpppd.exec:\jpppd.exe78⤵PID:4964
-
\??\c:\vpdvj.exec:\vpdvj.exe79⤵PID:5020
-
\??\c:\fffxllr.exec:\fffxllr.exe80⤵PID:3692
-
\??\c:\xxfxrfx.exec:\xxfxrfx.exe81⤵PID:1252
-
\??\c:\tbbthh.exec:\tbbthh.exe82⤵PID:2416
-
\??\c:\tbbttt.exec:\tbbttt.exe83⤵PID:2212
-
\??\c:\pjjdp.exec:\pjjdp.exe84⤵PID:1448
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe85⤵PID:64
-
\??\c:\lxffxxr.exec:\lxffxxr.exe86⤵PID:4176
-
\??\c:\nbhbtn.exec:\nbhbtn.exe87⤵PID:4916
-
\??\c:\thhttn.exec:\thhttn.exe88⤵PID:2400
-
\??\c:\jdpjd.exec:\jdpjd.exe89⤵PID:5048
-
\??\c:\djvjd.exec:\djvjd.exe90⤵PID:1168
-
\??\c:\fxxlrlr.exec:\fxxlrlr.exe91⤵PID:4912
-
\??\c:\bnhbtn.exec:\bnhbtn.exe92⤵PID:1480
-
\??\c:\hbnnhn.exec:\hbnnhn.exe93⤵PID:1536
-
\??\c:\jdvdv.exec:\jdvdv.exe94⤵PID:1192
-
\??\c:\llxrllr.exec:\llxrllr.exe95⤵PID:3468
-
\??\c:\lxxxxxx.exec:\lxxxxxx.exe96⤵PID:540
-
\??\c:\hbbtnh.exec:\hbbtnh.exe97⤵PID:2356
-
\??\c:\jjpjv.exec:\jjpjv.exe98⤵PID:4268
-
\??\c:\vjjdp.exec:\vjjdp.exe99⤵PID:1232
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe100⤵PID:3600
-
\??\c:\lflfllf.exec:\lflfllf.exe101⤵PID:1684
-
\??\c:\bntnhh.exec:\bntnhh.exe102⤵PID:1420
-
\??\c:\vdpdp.exec:\vdpdp.exe103⤵PID:1620
-
\??\c:\pjpjv.exec:\pjpjv.exe104⤵PID:2908
-
\??\c:\dpvjd.exec:\dpvjd.exe105⤵PID:3528
-
\??\c:\frlfxrr.exec:\frlfxrr.exe106⤵PID:3536
-
\??\c:\3nbbnn.exec:\3nbbnn.exe107⤵PID:4128
-
\??\c:\bntnhh.exec:\bntnhh.exe108⤵PID:1064
-
\??\c:\1dpjv.exec:\1dpjv.exe109⤵PID:3928
-
\??\c:\pppjv.exec:\pppjv.exe110⤵PID:3708
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe111⤵PID:4760
-
\??\c:\fxfxfff.exec:\fxfxfff.exe112⤵PID:2112
-
\??\c:\hhthtn.exec:\hhthtn.exe113⤵PID:336
-
\??\c:\hnhbhn.exec:\hnhbhn.exe114⤵PID:2604
-
\??\c:\jpvdp.exec:\jpvdp.exe115⤵PID:2752
-
\??\c:\dpvjv.exec:\dpvjv.exe116⤵PID:972
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe117⤵PID:916
-
\??\c:\tnhhbb.exec:\tnhhbb.exe118⤵PID:3696
-
\??\c:\ttbtbb.exec:\ttbtbb.exe119⤵
- System Location Discovery: System Language Discovery
PID:3724 -
\??\c:\5ddvp.exec:\5ddvp.exe120⤵PID:840
-
\??\c:\5llflfl.exec:\5llflfl.exe121⤵PID:4628
-
\??\c:\lrrrllf.exec:\lrrrllf.exe122⤵PID:4360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-