Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 01:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe
-
Size
61KB
-
MD5
6955fdc4736ce413c92e6ebcea171b21
-
SHA1
5f87449da30f84dfd5751ce4987ac98af6088781
-
SHA256
6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b
-
SHA512
ffbb1351aada01b8ab4a398aebfd8b5293fc42360e352dcac1db4eb7ba559a5b6a81d250f58f46c725c9eb86d622867351ac55fbabd74a0b547127ee0be088c9
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+byS:ymb3NkkiQ3mdBjF+3TpV
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/4028-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-42-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-214-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4268 nhbbhb.exe 5032 dvjvp.exe 3572 dvvvj.exe 1248 frxlfxr.exe 3492 nhhbtn.exe 4852 9djvj.exe 3476 xrxrrxr.exe 5028 bnbbtt.exe 3644 pppjd.exe 4844 htntnh.exe 3388 vjdvv.exe 316 5llfrrl.exe 4468 ffllfrr.exe 2588 thhhbh.exe 4548 5jjjv.exe 2984 pdvpj.exe 3488 rlffxfr.exe 3324 bhhnnb.exe 5088 djjpj.exe 3844 hhnhhh.exe 5036 1lrlfll.exe 2864 pvddd.exe 2560 3lllxxx.exe 2732 rrfxrrr.exe 4796 3ntnhb.exe 876 1lffrxx.exe 1776 rrrllrr.exe 4328 thtnhb.exe 2956 jpvpv.exe 3516 rxlxrlx.exe 2084 bthhtt.exe 2368 hhntnh.exe 1744 7pppd.exe 2356 lffxrxr.exe 1572 jvvvp.exe 3780 djjvp.exe 2248 lfxrfff.exe 3880 rflfxrl.exe 3020 tbtttt.exe 4408 vpjdv.exe 3908 lfffrlf.exe 1792 1nhbtt.exe 1464 tntnbb.exe 868 vvjvv.exe 4788 xrrlxxf.exe 4428 1lrlxrx.exe 224 3bhbbb.exe 5060 vppjv.exe 3632 7lrlxrl.exe 3696 htttnn.exe 1528 5jvjj.exe 3636 rxffxrr.exe 4948 rrxxxxr.exe 8 tbhtnh.exe 5112 jdjdd.exe 4988 5djdp.exe 3704 fxxrlfx.exe 3224 ddvpd.exe 5000 xfrlfxx.exe 3076 bbbttt.exe 1200 tbtttt.exe 1904 vvvpd.exe 4844 frxrfxx.exe 1476 3lflfff.exe -
resource yara_rule behavioral2/memory/4028-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-214-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhbhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxffxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xfffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9frllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4028 wrote to memory of 4268 4028 6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe 82 PID 4028 wrote to memory of 4268 4028 6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe 82 PID 4028 wrote to memory of 4268 4028 6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe 82 PID 4268 wrote to memory of 5032 4268 nhbbhb.exe 83 PID 4268 wrote to memory of 5032 4268 nhbbhb.exe 83 PID 4268 wrote to memory of 5032 4268 nhbbhb.exe 83 PID 5032 wrote to memory of 3572 5032 dvjvp.exe 84 PID 5032 wrote to memory of 3572 5032 dvjvp.exe 84 PID 5032 wrote to memory of 3572 5032 dvjvp.exe 84 PID 3572 wrote to memory of 1248 3572 dvvvj.exe 85 PID 3572 wrote to memory of 1248 3572 dvvvj.exe 85 PID 3572 wrote to memory of 1248 3572 dvvvj.exe 85 PID 1248 wrote to memory of 3492 1248 frxlfxr.exe 86 PID 1248 wrote to memory of 3492 1248 frxlfxr.exe 86 PID 1248 wrote to memory of 3492 1248 frxlfxr.exe 86 PID 3492 wrote to memory of 4852 3492 nhhbtn.exe 87 PID 3492 wrote to memory of 4852 3492 nhhbtn.exe 87 PID 3492 wrote to memory of 4852 3492 nhhbtn.exe 87 PID 4852 wrote to memory of 3476 4852 9djvj.exe 88 PID 4852 wrote to memory of 3476 4852 9djvj.exe 88 PID 4852 wrote to memory of 3476 4852 9djvj.exe 88 PID 3476 wrote to memory of 5028 3476 xrxrrxr.exe 89 PID 3476 wrote to memory of 5028 3476 xrxrrxr.exe 89 PID 3476 wrote to memory of 5028 3476 xrxrrxr.exe 89 PID 5028 wrote to memory of 3644 5028 bnbbtt.exe 90 PID 5028 wrote to memory of 3644 5028 bnbbtt.exe 90 PID 5028 wrote to memory of 3644 5028 bnbbtt.exe 90 PID 3644 wrote to memory of 4844 3644 pppjd.exe 91 PID 3644 wrote to memory of 4844 3644 pppjd.exe 91 PID 3644 wrote to memory of 4844 3644 pppjd.exe 91 PID 4844 wrote to memory of 3388 4844 htntnh.exe 92 PID 4844 wrote to memory of 3388 4844 htntnh.exe 92 PID 4844 wrote to memory of 3388 4844 htntnh.exe 92 PID 3388 wrote to memory of 316 3388 vjdvv.exe 93 PID 3388 wrote to memory of 316 3388 vjdvv.exe 93 PID 3388 wrote to memory of 316 3388 vjdvv.exe 93 PID 316 wrote to memory of 4468 316 5llfrrl.exe 94 PID 316 wrote to memory of 4468 316 5llfrrl.exe 94 PID 316 wrote to memory of 4468 316 5llfrrl.exe 94 PID 4468 wrote to memory of 2588 4468 ffllfrr.exe 95 PID 4468 wrote to memory of 2588 4468 ffllfrr.exe 95 PID 4468 wrote to memory of 2588 4468 ffllfrr.exe 95 PID 2588 wrote to memory of 4548 2588 thhhbh.exe 96 PID 2588 wrote to memory of 4548 2588 thhhbh.exe 96 PID 2588 wrote to memory of 4548 2588 thhhbh.exe 96 PID 4548 wrote to memory of 2984 4548 5jjjv.exe 97 PID 4548 wrote to memory of 2984 4548 5jjjv.exe 97 PID 4548 wrote to memory of 2984 4548 5jjjv.exe 97 PID 2984 wrote to memory of 3488 2984 pdvpj.exe 98 PID 2984 wrote to memory of 3488 2984 pdvpj.exe 98 PID 2984 wrote to memory of 3488 2984 pdvpj.exe 98 PID 3488 wrote to memory of 3324 3488 rlffxfr.exe 99 PID 3488 wrote to memory of 3324 3488 rlffxfr.exe 99 PID 3488 wrote to memory of 3324 3488 rlffxfr.exe 99 PID 3324 wrote to memory of 5088 3324 bhhnnb.exe 100 PID 3324 wrote to memory of 5088 3324 bhhnnb.exe 100 PID 3324 wrote to memory of 5088 3324 bhhnnb.exe 100 PID 5088 wrote to memory of 3844 5088 djjpj.exe 101 PID 5088 wrote to memory of 3844 5088 djjpj.exe 101 PID 5088 wrote to memory of 3844 5088 djjpj.exe 101 PID 3844 wrote to memory of 5036 3844 hhnhhh.exe 102 PID 3844 wrote to memory of 5036 3844 hhnhhh.exe 102 PID 3844 wrote to memory of 5036 3844 hhnhhh.exe 102 PID 5036 wrote to memory of 2864 5036 1lrlfll.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe"C:\Users\Admin\AppData\Local\Temp\6bf6b1a8390fafa928fbac8c3ae42fde8ea362310e3756a02f58f1e85c486f2b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\nhbbhb.exec:\nhbbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\dvjvp.exec:\dvjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\dvvvj.exec:\dvvvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\frxlfxr.exec:\frxlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\nhhbtn.exec:\nhhbtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\9djvj.exec:\9djvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\xrxrrxr.exec:\xrxrrxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\bnbbtt.exec:\bnbbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\pppjd.exec:\pppjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\htntnh.exec:\htntnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\vjdvv.exec:\vjdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\5llfrrl.exec:\5llfrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\ffllfrr.exec:\ffllfrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\thhhbh.exec:\thhhbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\5jjjv.exec:\5jjjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\pdvpj.exec:\pdvpj.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rlffxfr.exec:\rlffxfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\bhhnnb.exec:\bhhnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\djjpj.exec:\djjpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\hhnhhh.exec:\hhnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\1lrlfll.exec:\1lrlfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\pvddd.exec:\pvddd.exe23⤵
- Executes dropped EXE
PID:2864 -
\??\c:\3lllxxx.exec:\3lllxxx.exe24⤵
- Executes dropped EXE
PID:2560 -
\??\c:\rrfxrrr.exec:\rrfxrrr.exe25⤵
- Executes dropped EXE
PID:2732 -
\??\c:\3ntnhb.exec:\3ntnhb.exe26⤵
- Executes dropped EXE
PID:4796 -
\??\c:\1lffrxx.exec:\1lffrxx.exe27⤵
- Executes dropped EXE
PID:876 -
\??\c:\rrrllrr.exec:\rrrllrr.exe28⤵
- Executes dropped EXE
PID:1776 -
\??\c:\thtnhb.exec:\thtnhb.exe29⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jpvpv.exec:\jpvpv.exe30⤵
- Executes dropped EXE
PID:2956 -
\??\c:\rxlxrlx.exec:\rxlxrlx.exe31⤵
- Executes dropped EXE
PID:3516 -
\??\c:\bthhtt.exec:\bthhtt.exe32⤵
- Executes dropped EXE
PID:2084 -
\??\c:\hhntnh.exec:\hhntnh.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\7pppd.exec:\7pppd.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lffxrxr.exec:\lffxrxr.exe35⤵
- Executes dropped EXE
PID:2356 -
\??\c:\jvvvp.exec:\jvvvp.exe36⤵
- Executes dropped EXE
PID:1572 -
\??\c:\djjvp.exec:\djjvp.exe37⤵
- Executes dropped EXE
PID:3780 -
\??\c:\lfxrfff.exec:\lfxrfff.exe38⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rflfxrl.exec:\rflfxrl.exe39⤵
- Executes dropped EXE
PID:3880 -
\??\c:\tbtttt.exec:\tbtttt.exe40⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vpjdv.exec:\vpjdv.exe41⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lfffrlf.exec:\lfffrlf.exe42⤵
- Executes dropped EXE
PID:3908 -
\??\c:\1nhbtt.exec:\1nhbtt.exe43⤵
- Executes dropped EXE
PID:1792 -
\??\c:\tntnbb.exec:\tntnbb.exe44⤵
- Executes dropped EXE
PID:1464 -
\??\c:\vvjvv.exec:\vvjvv.exe45⤵
- Executes dropped EXE
PID:868 -
\??\c:\xrrlxxf.exec:\xrrlxxf.exe46⤵
- Executes dropped EXE
PID:4788 -
\??\c:\1lrlxrx.exec:\1lrlxrx.exe47⤵
- Executes dropped EXE
PID:4428 -
\??\c:\3bhbbb.exec:\3bhbbb.exe48⤵
- Executes dropped EXE
PID:224 -
\??\c:\vppjv.exec:\vppjv.exe49⤵
- Executes dropped EXE
PID:5060 -
\??\c:\7lrlxrl.exec:\7lrlxrl.exe50⤵
- Executes dropped EXE
PID:3632 -
\??\c:\htttnn.exec:\htttnn.exe51⤵
- Executes dropped EXE
PID:3696 -
\??\c:\5jvjj.exec:\5jvjj.exe52⤵
- Executes dropped EXE
PID:1528 -
\??\c:\rxffxrr.exec:\rxffxrr.exe53⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe54⤵
- Executes dropped EXE
PID:4948 -
\??\c:\tbhtnh.exec:\tbhtnh.exe55⤵
- Executes dropped EXE
PID:8 -
\??\c:\jdjdd.exec:\jdjdd.exe56⤵
- Executes dropped EXE
PID:5112 -
\??\c:\5djdp.exec:\5djdp.exe57⤵
- Executes dropped EXE
PID:4988 -
\??\c:\fxxrlfx.exec:\fxxrlfx.exe58⤵
- Executes dropped EXE
PID:3704 -
\??\c:\ddvpd.exec:\ddvpd.exe59⤵
- Executes dropped EXE
PID:3224 -
\??\c:\xfrlfxx.exec:\xfrlfxx.exe60⤵
- Executes dropped EXE
PID:5000 -
\??\c:\bbbttt.exec:\bbbttt.exe61⤵
- Executes dropped EXE
PID:3076 -
\??\c:\tbtttt.exec:\tbtttt.exe62⤵
- Executes dropped EXE
PID:1200 -
\??\c:\vvvpd.exec:\vvvpd.exe63⤵
- Executes dropped EXE
PID:1904 -
\??\c:\frxrfxx.exec:\frxrfxx.exe64⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3lflfff.exec:\3lflfff.exe65⤵
- Executes dropped EXE
PID:1476 -
\??\c:\nhhhnn.exec:\nhhhnn.exe66⤵PID:4044
-
\??\c:\1vddp.exec:\1vddp.exe67⤵PID:4064
-
\??\c:\7rllxxr.exec:\7rllxxr.exe68⤵PID:3456
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe69⤵PID:3040
-
\??\c:\ntbnhh.exec:\ntbnhh.exe70⤵PID:4548
-
\??\c:\pjjdd.exec:\pjjdd.exe71⤵PID:2032
-
\??\c:\5vjjp.exec:\5vjjp.exe72⤵PID:732
-
\??\c:\xfflffx.exec:\xfflffx.exe73⤵PID:3036
-
\??\c:\jpjpv.exec:\jpjpv.exe74⤵PID:1344
-
\??\c:\dvpjv.exec:\dvpjv.exe75⤵PID:548
-
\??\c:\rlrxxff.exec:\rlrxxff.exe76⤵PID:1708
-
\??\c:\9btnhh.exec:\9btnhh.exe77⤵PID:4736
-
\??\c:\ppvvv.exec:\ppvvv.exe78⤵PID:1480
-
\??\c:\fxflfff.exec:\fxflfff.exe79⤵PID:2180
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe80⤵PID:4780
-
\??\c:\tbhtnb.exec:\tbhtnb.exe81⤵PID:744
-
\??\c:\vpppj.exec:\vpppj.exe82⤵PID:5064
-
\??\c:\rflrxlx.exec:\rflrxlx.exe83⤵PID:4856
-
\??\c:\htnnbb.exec:\htnnbb.exe84⤵PID:4936
-
\??\c:\jdvdj.exec:\jdvdj.exe85⤵PID:1776
-
\??\c:\1vjdj.exec:\1vjdj.exe86⤵PID:4328
-
\??\c:\lflfxxx.exec:\lflfxxx.exe87⤵PID:776
-
\??\c:\ththtt.exec:\ththtt.exe88⤵PID:3516
-
\??\c:\thhttn.exec:\thhttn.exe89⤵PID:1216
-
\??\c:\3jjjj.exec:\3jjjj.exe90⤵PID:4860
-
\??\c:\3llfxrr.exec:\3llfxrr.exe91⤵PID:584
-
\??\c:\9rlrrlf.exec:\9rlrrlf.exe92⤵PID:2168
-
\??\c:\ntnnbb.exec:\ntnnbb.exe93⤵PID:840
-
\??\c:\dvjpp.exec:\dvjpp.exe94⤵PID:1572
-
\??\c:\rrxxxfx.exec:\rrxxxfx.exe95⤵PID:3780
-
\??\c:\frfrfxf.exec:\frfrfxf.exe96⤵PID:3440
-
\??\c:\lfrfxrr.exec:\lfrfxrr.exe97⤵PID:2996
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe98⤵PID:2712
-
\??\c:\pjjjj.exec:\pjjjj.exe99⤵PID:624
-
\??\c:\pjpjv.exec:\pjpjv.exe100⤵PID:4968
-
\??\c:\fxffxff.exec:\fxffxff.exe101⤵PID:1244
-
\??\c:\9ttthh.exec:\9ttthh.exe102⤵PID:4316
-
\??\c:\1vjpd.exec:\1vjpd.exe103⤵PID:2476
-
\??\c:\vjjjj.exec:\vjjjj.exe104⤵PID:2232
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe105⤵PID:2772
-
\??\c:\bbbtnn.exec:\bbbtnn.exe106⤵PID:4028
-
\??\c:\hthhnh.exec:\hthhnh.exe107⤵PID:1772
-
\??\c:\pjdpp.exec:\pjdpp.exe108⤵PID:5032
-
\??\c:\rffxrrr.exec:\rffxrrr.exe109⤵PID:4280
-
\??\c:\1xllxfr.exec:\1xllxfr.exe110⤵PID:3328
-
\??\c:\5hhbtt.exec:\5hhbtt.exe111⤵PID:3540
-
\??\c:\vvjdd.exec:\vvjdd.exe112⤵PID:3240
-
\??\c:\jdjdv.exec:\jdjdv.exe113⤵PID:3620
-
\??\c:\frlffff.exec:\frlffff.exe114⤵PID:5028
-
\??\c:\bnbhbb.exec:\bnbhbb.exe115⤵PID:1644
-
\??\c:\bntnnt.exec:\bntnnt.exe116⤵PID:1200
-
\??\c:\jjjjd.exec:\jjjjd.exe117⤵PID:2768
-
\??\c:\ppppv.exec:\ppppv.exe118⤵PID:216
-
\??\c:\lllrlxl.exec:\lllrlxl.exe119⤵PID:5044
-
\??\c:\btnnhh.exec:\btnnhh.exe120⤵PID:4468
-
\??\c:\nhtthh.exec:\nhtthh.exe121⤵PID:4424
-
\??\c:\pjpvv.exec:\pjpvv.exe122⤵PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-