Analysis
-
max time kernel
120s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 17:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe
-
Size
70KB
-
MD5
bea6ae7f8ece893c6b457b53aeb342d0
-
SHA1
3818e647df7ae4cc654df225f365ca547648ba8b
-
SHA256
c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643
-
SHA512
1612067ac58b23238bc75657ebba7293134af65b83d7e8ca58ed3dc92d5b69703626327b8a344b8d531744754ea5b9c9c7a3db3061b349acffc9d46a701e099c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3Aa:ymb3NkkiQ3mdBjFI46TQa
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4088-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/320-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1700 vddvd.exe 664 lflfffr.exe 3052 ffllfff.exe 2816 fllllll.exe 112 3hhbhn.exe 320 dvddd.exe 1660 5frlrrl.exe 64 lxfxrfx.exe 1888 1vvvv.exe 2236 3vpvp.exe 3704 1llfxfr.exe 952 hhbbtt.exe 4552 vvvvp.exe 4896 rxflrrx.exe 4408 nbbhhb.exe 3584 vdjjd.exe 4596 vddpp.exe 4532 btbthn.exe 912 9hbttt.exe 4180 vdddd.exe 1232 ppppp.exe 1500 fxffffx.exe 4040 hhnhtt.exe 3096 5hhbbh.exe 3560 vdppp.exe 4072 5vjdv.exe 232 rlxrffx.exe 4512 bntbtt.exe 1076 9djjv.exe 920 rrxrlrr.exe 3728 rlrrlrl.exe 4468 nnbttn.exe 3716 hnhhbb.exe 2032 9jjdv.exe 1272 3pvdj.exe 368 rrxrxxf.exe 4892 7lrlffr.exe 2132 hnhhhh.exe 432 nnbhnb.exe 2820 5dvvv.exe 4348 5rxrlrr.exe 3748 tntttb.exe 2536 bttnnn.exe 4632 pvddv.exe 1624 5rxxxxx.exe 2700 nhhhhh.exe 4420 pvdjp.exe 3192 ttbbhh.exe 1096 nhnnbb.exe 5028 vvvvp.exe 2724 rrfffff.exe 4960 xllflfl.exe 2452 pvvjp.exe 4832 9tnntt.exe 3492 vjjjp.exe 2000 llffxxx.exe 312 nbtnnh.exe 1660 vjjjd.exe 3612 jjjjd.exe 64 frllrrr.exe 3752 3rlfllf.exe 5040 3dvdp.exe 1420 pvvvp.exe 2316 lrrlllf.exe -
resource yara_rule behavioral2/memory/4088-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/320-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4532-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrlfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1tnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hnhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fflfrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flllfrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4088 wrote to memory of 1700 4088 c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe 83 PID 4088 wrote to memory of 1700 4088 c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe 83 PID 4088 wrote to memory of 1700 4088 c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe 83 PID 1700 wrote to memory of 664 1700 vddvd.exe 84 PID 1700 wrote to memory of 664 1700 vddvd.exe 84 PID 1700 wrote to memory of 664 1700 vddvd.exe 84 PID 664 wrote to memory of 3052 664 lflfffr.exe 85 PID 664 wrote to memory of 3052 664 lflfffr.exe 85 PID 664 wrote to memory of 3052 664 lflfffr.exe 85 PID 3052 wrote to memory of 2816 3052 ffllfff.exe 86 PID 3052 wrote to memory of 2816 3052 ffllfff.exe 86 PID 3052 wrote to memory of 2816 3052 ffllfff.exe 86 PID 2816 wrote to memory of 112 2816 fllllll.exe 87 PID 2816 wrote to memory of 112 2816 fllllll.exe 87 PID 2816 wrote to memory of 112 2816 fllllll.exe 87 PID 112 wrote to memory of 320 112 3hhbhn.exe 88 PID 112 wrote to memory of 320 112 3hhbhn.exe 88 PID 112 wrote to memory of 320 112 3hhbhn.exe 88 PID 320 wrote to memory of 1660 320 dvddd.exe 89 PID 320 wrote to memory of 1660 320 dvddd.exe 89 PID 320 wrote to memory of 1660 320 dvddd.exe 89 PID 1660 wrote to memory of 64 1660 5frlrrl.exe 90 PID 1660 wrote to memory of 64 1660 5frlrrl.exe 90 PID 1660 wrote to memory of 64 1660 5frlrrl.exe 90 PID 64 wrote to memory of 1888 64 lxfxrfx.exe 91 PID 64 wrote to memory of 1888 64 lxfxrfx.exe 91 PID 64 wrote to memory of 1888 64 lxfxrfx.exe 91 PID 1888 wrote to memory of 2236 1888 1vvvv.exe 92 PID 1888 wrote to memory of 2236 1888 1vvvv.exe 92 PID 1888 wrote to memory of 2236 1888 1vvvv.exe 92 PID 2236 wrote to memory of 3704 2236 3vpvp.exe 93 PID 2236 wrote to memory of 3704 2236 3vpvp.exe 93 PID 2236 wrote to memory of 3704 2236 3vpvp.exe 93 PID 3704 wrote to memory of 952 3704 1llfxfr.exe 94 PID 3704 wrote to memory of 952 3704 1llfxfr.exe 94 PID 3704 wrote to memory of 952 3704 1llfxfr.exe 94 PID 952 wrote to memory of 4552 952 hhbbtt.exe 95 PID 952 wrote to memory of 4552 952 hhbbtt.exe 95 PID 952 wrote to memory of 4552 952 hhbbtt.exe 95 PID 4552 wrote to memory of 4896 4552 vvvvp.exe 96 PID 4552 wrote to memory of 4896 4552 vvvvp.exe 96 PID 4552 wrote to memory of 4896 4552 vvvvp.exe 96 PID 4896 wrote to memory of 4408 4896 rxflrrx.exe 97 PID 4896 wrote to memory of 4408 4896 rxflrrx.exe 97 PID 4896 wrote to memory of 4408 4896 rxflrrx.exe 97 PID 4408 wrote to memory of 3584 4408 nbbhhb.exe 98 PID 4408 wrote to memory of 3584 4408 nbbhhb.exe 98 PID 4408 wrote to memory of 3584 4408 nbbhhb.exe 98 PID 3584 wrote to memory of 4596 3584 vdjjd.exe 99 PID 3584 wrote to memory of 4596 3584 vdjjd.exe 99 PID 3584 wrote to memory of 4596 3584 vdjjd.exe 99 PID 4596 wrote to memory of 4532 4596 vddpp.exe 100 PID 4596 wrote to memory of 4532 4596 vddpp.exe 100 PID 4596 wrote to memory of 4532 4596 vddpp.exe 100 PID 4532 wrote to memory of 912 4532 btbthn.exe 101 PID 4532 wrote to memory of 912 4532 btbthn.exe 101 PID 4532 wrote to memory of 912 4532 btbthn.exe 101 PID 912 wrote to memory of 4180 912 9hbttt.exe 102 PID 912 wrote to memory of 4180 912 9hbttt.exe 102 PID 912 wrote to memory of 4180 912 9hbttt.exe 102 PID 4180 wrote to memory of 1232 4180 vdddd.exe 103 PID 4180 wrote to memory of 1232 4180 vdddd.exe 103 PID 4180 wrote to memory of 1232 4180 vdddd.exe 103 PID 1232 wrote to memory of 1500 1232 ppppp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe"C:\Users\Admin\AppData\Local\Temp\c056c7646d380e1bcaa8701681af7496170c1e33d6daf5bacb68f89d72414643N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\vddvd.exec:\vddvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\lflfffr.exec:\lflfffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\ffllfff.exec:\ffllfff.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\fllllll.exec:\fllllll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\3hhbhn.exec:\3hhbhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\dvddd.exec:\dvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\5frlrrl.exec:\5frlrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\lxfxrfx.exec:\lxfxrfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\1vvvv.exec:\1vvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\3vpvp.exec:\3vpvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\1llfxfr.exec:\1llfxfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\hhbbtt.exec:\hhbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\vvvvp.exec:\vvvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\rxflrrx.exec:\rxflrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\nbbhhb.exec:\nbbhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\vdjjd.exec:\vdjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\vddpp.exec:\vddpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\btbthn.exec:\btbthn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\9hbttt.exec:\9hbttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\vdddd.exec:\vdddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\ppppp.exec:\ppppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\fxffffx.exec:\fxffffx.exe23⤵
- Executes dropped EXE
PID:1500 -
\??\c:\hhnhtt.exec:\hhnhtt.exe24⤵
- Executes dropped EXE
PID:4040 -
\??\c:\5hhbbh.exec:\5hhbbh.exe25⤵
- Executes dropped EXE
PID:3096 -
\??\c:\vdppp.exec:\vdppp.exe26⤵
- Executes dropped EXE
PID:3560 -
\??\c:\5vjdv.exec:\5vjdv.exe27⤵
- Executes dropped EXE
PID:4072 -
\??\c:\rlxrffx.exec:\rlxrffx.exe28⤵
- Executes dropped EXE
PID:232 -
\??\c:\bntbtt.exec:\bntbtt.exe29⤵
- Executes dropped EXE
PID:4512 -
\??\c:\9djjv.exec:\9djjv.exe30⤵
- Executes dropped EXE
PID:1076 -
\??\c:\rrxrlrr.exec:\rrxrlrr.exe31⤵
- Executes dropped EXE
PID:920 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe32⤵
- Executes dropped EXE
PID:3728 -
\??\c:\nnbttn.exec:\nnbttn.exe33⤵
- Executes dropped EXE
PID:4468 -
\??\c:\hnhhbb.exec:\hnhhbb.exe34⤵
- Executes dropped EXE
PID:3716 -
\??\c:\9jjdv.exec:\9jjdv.exe35⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3pvdj.exec:\3pvdj.exe36⤵
- Executes dropped EXE
PID:1272 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe37⤵
- Executes dropped EXE
PID:368 -
\??\c:\7lrlffr.exec:\7lrlffr.exe38⤵
- Executes dropped EXE
PID:4892 -
\??\c:\hnhhhh.exec:\hnhhhh.exe39⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nnbhnb.exec:\nnbhnb.exe40⤵
- Executes dropped EXE
PID:432 -
\??\c:\5dvvv.exec:\5dvvv.exe41⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5rxrlrr.exec:\5rxrlrr.exe42⤵
- Executes dropped EXE
PID:4348 -
\??\c:\tntttb.exec:\tntttb.exe43⤵
- Executes dropped EXE
PID:3748 -
\??\c:\bttnnn.exec:\bttnnn.exe44⤵
- Executes dropped EXE
PID:2536 -
\??\c:\pvddv.exec:\pvddv.exe45⤵
- Executes dropped EXE
PID:4632 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe46⤵
- Executes dropped EXE
PID:1624 -
\??\c:\nhhhhh.exec:\nhhhhh.exe47⤵
- Executes dropped EXE
PID:2700 -
\??\c:\pvdjp.exec:\pvdjp.exe48⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4420 -
\??\c:\ttbbhh.exec:\ttbbhh.exe49⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nhnnbb.exec:\nhnnbb.exe50⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vvvvp.exec:\vvvvp.exe51⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rrfffff.exec:\rrfffff.exe52⤵
- Executes dropped EXE
PID:2724 -
\??\c:\xllflfl.exec:\xllflfl.exe53⤵
- Executes dropped EXE
PID:4960 -
\??\c:\pvvjp.exec:\pvvjp.exe54⤵
- Executes dropped EXE
PID:2452 -
\??\c:\9tnntt.exec:\9tnntt.exe55⤵
- Executes dropped EXE
PID:4832 -
\??\c:\vjjjp.exec:\vjjjp.exe56⤵
- Executes dropped EXE
PID:3492 -
\??\c:\llffxxx.exec:\llffxxx.exe57⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nbtnnh.exec:\nbtnnh.exe58⤵
- Executes dropped EXE
PID:312 -
\??\c:\vjjjd.exec:\vjjjd.exe59⤵
- Executes dropped EXE
PID:1660 -
\??\c:\jjjjd.exec:\jjjjd.exe60⤵
- Executes dropped EXE
PID:3612 -
\??\c:\frllrrr.exec:\frllrrr.exe61⤵
- Executes dropped EXE
PID:64 -
\??\c:\3rlfllf.exec:\3rlfllf.exe62⤵
- Executes dropped EXE
PID:3752 -
\??\c:\3dvdp.exec:\3dvdp.exe63⤵
- Executes dropped EXE
PID:5040 -
\??\c:\pvvvp.exec:\pvvvp.exe64⤵
- Executes dropped EXE
PID:1420 -
\??\c:\lrrlllf.exec:\lrrlllf.exe65⤵
- Executes dropped EXE
PID:2316 -
\??\c:\1hhhbb.exec:\1hhhbb.exe66⤵PID:5000
-
\??\c:\nnthhh.exec:\nnthhh.exe67⤵PID:4472
-
\??\c:\vdppp.exec:\vdppp.exe68⤵
- System Location Discovery: System Language Discovery
PID:2508 -
\??\c:\5jppp.exec:\5jppp.exe69⤵PID:4320
-
\??\c:\3llfrrl.exec:\3llfrrl.exe70⤵PID:396
-
\??\c:\3hnhhn.exec:\3hnhhn.exe71⤵PID:4288
-
\??\c:\3bhbtb.exec:\3bhbtb.exe72⤵PID:2008
-
\??\c:\dvjdv.exec:\dvjdv.exe73⤵PID:2244
-
\??\c:\lrxxllx.exec:\lrxxllx.exe74⤵PID:4100
-
\??\c:\9rrrrxf.exec:\9rrrrxf.exe75⤵PID:3676
-
\??\c:\ttbbbh.exec:\ttbbbh.exe76⤵PID:4176
-
\??\c:\bbhhbb.exec:\bbhhbb.exe77⤵PID:2932
-
\??\c:\pvvvp.exec:\pvvvp.exe78⤵PID:1768
-
\??\c:\lrrllrl.exec:\lrrllrl.exe79⤵PID:2680
-
\??\c:\hbhbtt.exec:\hbhbtt.exe80⤵PID:1288
-
\??\c:\3tbbtb.exec:\3tbbtb.exe81⤵PID:1752
-
\??\c:\9djdd.exec:\9djdd.exe82⤵PID:1780
-
\??\c:\xfffflf.exec:\xfffflf.exe83⤵PID:3348
-
\??\c:\rfllffx.exec:\rfllffx.exe84⤵PID:1124
-
\??\c:\nnhbnn.exec:\nnhbnn.exe85⤵PID:3976
-
\??\c:\3hnbbt.exec:\3hnbbt.exe86⤵PID:4364
-
\??\c:\jppjj.exec:\jppjj.exe87⤵PID:1196
-
\??\c:\ddjdd.exec:\ddjdd.exe88⤵PID:1504
-
\??\c:\lxxxrxr.exec:\lxxxrxr.exe89⤵PID:3596
-
\??\c:\tnnnhh.exec:\tnnnhh.exe90⤵PID:3228
-
\??\c:\7btnnn.exec:\7btnnn.exe91⤵PID:5016
-
\??\c:\pjjjd.exec:\pjjjd.exe92⤵PID:1484
-
\??\c:\djjvd.exec:\djjvd.exe93⤵PID:2032
-
\??\c:\1rlllll.exec:\1rlllll.exe94⤵PID:4480
-
\??\c:\hhnhtn.exec:\hhnhtn.exe95⤵PID:3720
-
\??\c:\hbttnn.exec:\hbttnn.exe96⤵PID:5076
-
\??\c:\vdvpd.exec:\vdvpd.exe97⤵PID:3564
-
\??\c:\3pjjd.exec:\3pjjd.exe98⤵PID:4188
-
\??\c:\xxrrlxr.exec:\xxrrlxr.exe99⤵PID:960
-
\??\c:\tttnnn.exec:\tttnnn.exe100⤵PID:4348
-
\??\c:\hnbnhb.exec:\hnbnhb.exe101⤵PID:4820
-
\??\c:\dvddp.exec:\dvddp.exe102⤵PID:4504
-
\??\c:\xxrlffx.exec:\xxrlffx.exe103⤵PID:4388
-
\??\c:\vpjjv.exec:\vpjjv.exe104⤵PID:4352
-
\??\c:\3pjjj.exec:\3pjjj.exe105⤵PID:1084
-
\??\c:\xlrrllx.exec:\xlrrllx.exe106⤵PID:4088
-
\??\c:\5nbhbh.exec:\5nbhbh.exe107⤵PID:628
-
\??\c:\tbbbbh.exec:\tbbbbh.exe108⤵PID:2024
-
\??\c:\vpppp.exec:\vpppp.exe109⤵PID:2968
-
\??\c:\5vppj.exec:\5vppj.exe110⤵PID:2724
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe111⤵PID:3188
-
\??\c:\tntttt.exec:\tntttt.exe112⤵PID:4052
-
\??\c:\hbnnhh.exec:\hbnnhh.exe113⤵PID:4392
-
\??\c:\djdvd.exec:\djdvd.exe114⤵PID:2064
-
\??\c:\djjjd.exec:\djjjd.exe115⤵PID:3120
-
\??\c:\9rlfxxx.exec:\9rlfxxx.exe116⤵PID:3772
-
\??\c:\btbtnt.exec:\btbtnt.exe117⤵PID:1660
-
\??\c:\hhnnnn.exec:\hhnnnn.exe118⤵PID:3612
-
\??\c:\jdddd.exec:\jdddd.exe119⤵PID:3788
-
\??\c:\ppvvd.exec:\ppvvd.exe120⤵PID:3752
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe121⤵PID:3336
-
\??\c:\xfffxfx.exec:\xfffxfx.exe122⤵PID:4340
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-