Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 14:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe
Resource
win7-20240903-en
7 signatures
150 seconds
General
-
Target
24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe
-
Size
71KB
-
MD5
c7316804de7cf76091d3a4a3bfc358e0
-
SHA1
a996bf13abde64bbd49a410ea20cbb7c090a1b76
-
SHA256
24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677
-
SHA512
32d83e3f3d4f15766a7d23c2638eb5fe53280f254d6faab4a04be74b2ea7824728e80d1db694e6953693230fb2a2f55b5504c35326fa341af19aa96e93d0ac2c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJ/RWPqBr4:ymb3NkkiQ3mdBjFIqsr4
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/5024-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2536-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1452-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2056 fllfrrl.exe 2744 5httnn.exe 1304 5vdvj.exe 2040 pvjvp.exe 4672 rlrlllr.exe 2308 7xlfffx.exe 2844 hhtnnn.exe 3836 pjpjd.exe 4048 ntbtnt.exe 4976 jvdvp.exe 5052 rfffxrr.exe 2792 5flfxxx.exe 3592 ntnntt.exe 3700 tbbbnt.exe 2536 jjdvp.exe 3936 9rxlxxr.exe 3716 nnnnbb.exe 512 fxfxllf.exe 736 xxxxllf.exe 1452 tnhnht.exe 1492 1jjdv.exe 2936 jdjvp.exe 2028 1fflllf.exe 4180 rxxrrll.exe 2584 5rrrrrr.exe 4516 bhtnhb.exe 1736 bttnhb.exe 4880 jdddj.exe 4652 xlrlffx.exe 3200 9btnhh.exe 1040 nhbhtt.exe 4052 pjjvp.exe 3776 jjvpv.exe 1204 xflfrrl.exe 4016 thbtbb.exe 3388 5jdjd.exe 3588 vjvjj.exe 3248 1rxxllf.exe 2024 lrxxrll.exe 3624 bnbbtt.exe 3120 7hnhtt.exe 3940 pddvp.exe 1064 ppdpj.exe 1712 xllfllx.exe 2964 7llfxrr.exe 4616 3pdjj.exe 5024 vdpvp.exe 1656 9llfffr.exe 1084 1fllrrf.exe 1592 tbbttt.exe 1428 ddvvd.exe 2040 lxrlfxr.exe 4628 3llrxxl.exe 3040 hhhhnt.exe 2308 1ddvd.exe 2976 pjvpj.exe 2644 9rlfrlf.exe 4324 bttnhh.exe 3836 7bhbnn.exe 4664 btnhbt.exe 2832 vpvpj.exe 3004 pvjvj.exe 3440 3lrlxxr.exe 5064 lrxfrrl.exe -
resource yara_rule behavioral2/memory/5024-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2536-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1452-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flffflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nhnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrfxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnn.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5024 wrote to memory of 2056 5024 24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe 83 PID 5024 wrote to memory of 2056 5024 24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe 83 PID 5024 wrote to memory of 2056 5024 24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe 83 PID 2056 wrote to memory of 2744 2056 fllfrrl.exe 84 PID 2056 wrote to memory of 2744 2056 fllfrrl.exe 84 PID 2056 wrote to memory of 2744 2056 fllfrrl.exe 84 PID 2744 wrote to memory of 1304 2744 5httnn.exe 85 PID 2744 wrote to memory of 1304 2744 5httnn.exe 85 PID 2744 wrote to memory of 1304 2744 5httnn.exe 85 PID 1304 wrote to memory of 2040 1304 5vdvj.exe 86 PID 1304 wrote to memory of 2040 1304 5vdvj.exe 86 PID 1304 wrote to memory of 2040 1304 5vdvj.exe 86 PID 2040 wrote to memory of 4672 2040 pvjvp.exe 87 PID 2040 wrote to memory of 4672 2040 pvjvp.exe 87 PID 2040 wrote to memory of 4672 2040 pvjvp.exe 87 PID 4672 wrote to memory of 2308 4672 rlrlllr.exe 88 PID 4672 wrote to memory of 2308 4672 rlrlllr.exe 88 PID 4672 wrote to memory of 2308 4672 rlrlllr.exe 88 PID 2308 wrote to memory of 2844 2308 7xlfffx.exe 89 PID 2308 wrote to memory of 2844 2308 7xlfffx.exe 89 PID 2308 wrote to memory of 2844 2308 7xlfffx.exe 89 PID 2844 wrote to memory of 3836 2844 hhtnnn.exe 90 PID 2844 wrote to memory of 3836 2844 hhtnnn.exe 90 PID 2844 wrote to memory of 3836 2844 hhtnnn.exe 90 PID 3836 wrote to memory of 4048 3836 pjpjd.exe 91 PID 3836 wrote to memory of 4048 3836 pjpjd.exe 91 PID 3836 wrote to memory of 4048 3836 pjpjd.exe 91 PID 4048 wrote to memory of 4976 4048 ntbtnt.exe 92 PID 4048 wrote to memory of 4976 4048 ntbtnt.exe 92 PID 4048 wrote to memory of 4976 4048 ntbtnt.exe 92 PID 4976 wrote to memory of 5052 4976 jvdvp.exe 93 PID 4976 wrote to memory of 5052 4976 jvdvp.exe 93 PID 4976 wrote to memory of 5052 4976 jvdvp.exe 93 PID 5052 wrote to memory of 2792 5052 rfffxrr.exe 94 PID 5052 wrote to memory of 2792 5052 rfffxrr.exe 94 PID 5052 wrote to memory of 2792 5052 rfffxrr.exe 94 PID 2792 wrote to memory of 3592 2792 5flfxxx.exe 95 PID 2792 wrote to memory of 3592 2792 5flfxxx.exe 95 PID 2792 wrote to memory of 3592 2792 5flfxxx.exe 95 PID 3592 wrote to memory of 3700 3592 ntnntt.exe 96 PID 3592 wrote to memory of 3700 3592 ntnntt.exe 96 PID 3592 wrote to memory of 3700 3592 ntnntt.exe 96 PID 3700 wrote to memory of 2536 3700 tbbbnt.exe 97 PID 3700 wrote to memory of 2536 3700 tbbbnt.exe 97 PID 3700 wrote to memory of 2536 3700 tbbbnt.exe 97 PID 2536 wrote to memory of 3936 2536 jjdvp.exe 98 PID 2536 wrote to memory of 3936 2536 jjdvp.exe 98 PID 2536 wrote to memory of 3936 2536 jjdvp.exe 98 PID 3936 wrote to memory of 3716 3936 9rxlxxr.exe 99 PID 3936 wrote to memory of 3716 3936 9rxlxxr.exe 99 PID 3936 wrote to memory of 3716 3936 9rxlxxr.exe 99 PID 3716 wrote to memory of 512 3716 nnnnbb.exe 100 PID 3716 wrote to memory of 512 3716 nnnnbb.exe 100 PID 3716 wrote to memory of 512 3716 nnnnbb.exe 100 PID 512 wrote to memory of 736 512 fxfxllf.exe 101 PID 512 wrote to memory of 736 512 fxfxllf.exe 101 PID 512 wrote to memory of 736 512 fxfxllf.exe 101 PID 736 wrote to memory of 1452 736 xxxxllf.exe 102 PID 736 wrote to memory of 1452 736 xxxxllf.exe 102 PID 736 wrote to memory of 1452 736 xxxxllf.exe 102 PID 1452 wrote to memory of 1492 1452 tnhnht.exe 103 PID 1452 wrote to memory of 1492 1452 tnhnht.exe 103 PID 1452 wrote to memory of 1492 1452 tnhnht.exe 103 PID 1492 wrote to memory of 2936 1492 1jjdv.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe"C:\Users\Admin\AppData\Local\Temp\24185db1c6fcfd9c58962835bcf6c35f4127478243112665a33312a935ae4677.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\fllfrrl.exec:\fllfrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\5httnn.exec:\5httnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\5vdvj.exec:\5vdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\pvjvp.exec:\pvjvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\rlrlllr.exec:\rlrlllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\7xlfffx.exec:\7xlfffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\hhtnnn.exec:\hhtnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pjpjd.exec:\pjpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\ntbtnt.exec:\ntbtnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\jvdvp.exec:\jvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\rfffxrr.exec:\rfffxrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\5flfxxx.exec:\5flfxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\ntnntt.exec:\ntnntt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\tbbbnt.exec:\tbbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\jjdvp.exec:\jjdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\9rxlxxr.exec:\9rxlxxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\nnnnbb.exec:\nnnnbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\fxfxllf.exec:\fxfxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\xxxxllf.exec:\xxxxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\tnhnht.exec:\tnhnht.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\1jjdv.exec:\1jjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\jdjvp.exec:\jdjvp.exe23⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1fflllf.exec:\1fflllf.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\rxxrrll.exec:\rxxrrll.exe25⤵
- Executes dropped EXE
PID:4180 -
\??\c:\5rrrrrr.exec:\5rrrrrr.exe26⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bhtnhb.exec:\bhtnhb.exe27⤵
- Executes dropped EXE
PID:4516 -
\??\c:\bttnhb.exec:\bttnhb.exe28⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jdddj.exec:\jdddj.exe29⤵
- Executes dropped EXE
PID:4880 -
\??\c:\xlrlffx.exec:\xlrlffx.exe30⤵
- Executes dropped EXE
PID:4652 -
\??\c:\9btnhh.exec:\9btnhh.exe31⤵
- Executes dropped EXE
PID:3200 -
\??\c:\nhbhtt.exec:\nhbhtt.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\pjjvp.exec:\pjjvp.exe33⤵
- Executes dropped EXE
PID:4052 -
\??\c:\jjvpv.exec:\jjvpv.exe34⤵
- Executes dropped EXE
PID:3776 -
\??\c:\xflfrrl.exec:\xflfrrl.exe35⤵
- Executes dropped EXE
PID:1204 -
\??\c:\thbtbb.exec:\thbtbb.exe36⤵
- Executes dropped EXE
PID:4016 -
\??\c:\5jdjd.exec:\5jdjd.exe37⤵
- Executes dropped EXE
PID:3388 -
\??\c:\vjvjj.exec:\vjvjj.exe38⤵
- Executes dropped EXE
PID:3588 -
\??\c:\1rxxllf.exec:\1rxxllf.exe39⤵
- Executes dropped EXE
PID:3248 -
\??\c:\lrxxrll.exec:\lrxxrll.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\bnbbtt.exec:\bnbbtt.exe41⤵
- Executes dropped EXE
PID:3624 -
\??\c:\7hnhtt.exec:\7hnhtt.exe42⤵
- Executes dropped EXE
PID:3120 -
\??\c:\pddvp.exec:\pddvp.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\ppdpj.exec:\ppdpj.exe44⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xllfllx.exec:\xllfllx.exe45⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7llfxrr.exec:\7llfxrr.exe46⤵
- Executes dropped EXE
PID:2964 -
\??\c:\3pdjj.exec:\3pdjj.exe47⤵
- Executes dropped EXE
PID:4616 -
\??\c:\vdpvp.exec:\vdpvp.exe48⤵
- Executes dropped EXE
PID:5024 -
\??\c:\9llfffr.exec:\9llfffr.exe49⤵
- Executes dropped EXE
PID:1656 -
\??\c:\1fllrrf.exec:\1fllrrf.exe50⤵
- Executes dropped EXE
PID:1084 -
\??\c:\tbbttt.exec:\tbbttt.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ddvvd.exec:\ddvvd.exe52⤵
- Executes dropped EXE
PID:1428 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe53⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3llrxxl.exec:\3llrxxl.exe54⤵
- Executes dropped EXE
PID:4628 -
\??\c:\hhhhnt.exec:\hhhhnt.exe55⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1ddvd.exec:\1ddvd.exe56⤵
- Executes dropped EXE
PID:2308 -
\??\c:\pjvpj.exec:\pjvpj.exe57⤵
- Executes dropped EXE
PID:2976 -
\??\c:\9rlfrlf.exec:\9rlfrlf.exe58⤵
- Executes dropped EXE
PID:2644 -
\??\c:\bttnhh.exec:\bttnhh.exe59⤵
- Executes dropped EXE
PID:4324 -
\??\c:\7bhbnn.exec:\7bhbnn.exe60⤵
- Executes dropped EXE
PID:3836 -
\??\c:\btnhbt.exec:\btnhbt.exe61⤵
- Executes dropped EXE
PID:4664 -
\??\c:\vpvpj.exec:\vpvpj.exe62⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pvjvj.exec:\pvjvj.exe63⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3lrlxxr.exec:\3lrlxxr.exe64⤵
- Executes dropped EXE
PID:3440 -
\??\c:\lrxfrrl.exec:\lrxfrrl.exe65⤵
- Executes dropped EXE
PID:5064 -
\??\c:\bbnhbb.exec:\bbnhbb.exe66⤵PID:3420
-
\??\c:\9htbnn.exec:\9htbnn.exe67⤵PID:936
-
\??\c:\hthbtt.exec:\hthbtt.exe68⤵PID:836
-
\??\c:\9jdvd.exec:\9jdvd.exe69⤵PID:3560
-
\??\c:\fxfxrxr.exec:\fxfxrxr.exe70⤵PID:4928
-
\??\c:\fxflrrx.exec:\fxflrrx.exe71⤵PID:3840
-
\??\c:\3hnhbb.exec:\3hnhbb.exe72⤵PID:4252
-
\??\c:\bbhbnn.exec:\bbhbnn.exe73⤵
- System Location Discovery: System Language Discovery
PID:5112 -
\??\c:\vpjdd.exec:\vpjdd.exe74⤵PID:1028
-
\??\c:\vjppj.exec:\vjppj.exe75⤵PID:2560
-
\??\c:\9rlfrlr.exec:\9rlfrlr.exe76⤵PID:1580
-
\??\c:\7rfxffx.exec:\7rfxffx.exe77⤵PID:1452
-
\??\c:\thtntn.exec:\thtntn.exe78⤵PID:1492
-
\??\c:\jdvpj.exec:\jdvpj.exe79⤵PID:2888
-
\??\c:\3jvpv.exec:\3jvpv.exe80⤵PID:5100
-
\??\c:\9xxrffx.exec:\9xxrffx.exe81⤵PID:4732
-
\??\c:\xrllfxx.exec:\xrllfxx.exe82⤵PID:1072
-
\??\c:\5ttnhh.exec:\5ttnhh.exe83⤵PID:4188
-
\??\c:\bntbbb.exec:\bntbbb.exe84⤵PID:4444
-
\??\c:\jdppj.exec:\jdppj.exe85⤵PID:376
-
\??\c:\vddvj.exec:\vddvj.exe86⤵PID:4588
-
\??\c:\lfxrffx.exec:\lfxrffx.exe87⤵PID:3692
-
\??\c:\vjdvj.exec:\vjdvj.exe88⤵PID:1600
-
\??\c:\vjppj.exec:\vjppj.exe89⤵PID:2880
-
\??\c:\7rlxxrl.exec:\7rlxxrl.exe90⤵PID:4192
-
\??\c:\bhhnhb.exec:\bhhnhb.exe91⤵PID:1916
-
\??\c:\bnttnt.exec:\bnttnt.exe92⤵PID:3488
-
\??\c:\vjvpj.exec:\vjvpj.exe93⤵PID:4704
-
\??\c:\vjdvj.exec:\vjdvj.exe94⤵PID:1196
-
\??\c:\rlrxxlr.exec:\rlrxxlr.exe95⤵PID:1076
-
\??\c:\lffxrrl.exec:\lffxrrl.exe96⤵PID:4408
-
\??\c:\nhbtbb.exec:\nhbtbb.exe97⤵PID:1208
-
\??\c:\7nttnn.exec:\7nttnn.exe98⤵PID:640
-
\??\c:\9vjdv.exec:\9vjdv.exe99⤵PID:4396
-
\??\c:\7jjdj.exec:\7jjdj.exe100⤵PID:3624
-
\??\c:\7rlfrll.exec:\7rlfrll.exe101⤵PID:3272
-
\??\c:\7ffxrrf.exec:\7ffxrrf.exe102⤵PID:764
-
\??\c:\9nhhbt.exec:\9nhhbt.exe103⤵PID:1480
-
\??\c:\hbhbhb.exec:\hbhbhb.exe104⤵PID:4436
-
\??\c:\3dvpd.exec:\3dvpd.exe105⤵PID:2424
-
\??\c:\vpvvv.exec:\vpvvv.exe106⤵PID:1468
-
\??\c:\rfrflll.exec:\rfrflll.exe107⤵PID:3328
-
\??\c:\xrxxfff.exec:\xrxxfff.exe108⤵PID:4176
-
\??\c:\ntbbtn.exec:\ntbbtn.exe109⤵PID:868
-
\??\c:\3bhbnn.exec:\3bhbnn.exe110⤵PID:3556
-
\??\c:\pjpjd.exec:\pjpjd.exe111⤵PID:3332
-
\??\c:\vvvvd.exec:\vvvvd.exe112⤵PID:3976
-
\??\c:\tnnnhh.exec:\tnnnhh.exe113⤵PID:2688
-
\??\c:\hnnhtt.exec:\hnnhtt.exe114⤵PID:2012
-
\??\c:\1djdp.exec:\1djdp.exe115⤵PID:4860
-
\??\c:\jjpvp.exec:\jjpvp.exe116⤵PID:2556
-
\??\c:\9lrlllf.exec:\9lrlllf.exe117⤵PID:556
-
\??\c:\xrxffff.exec:\xrxffff.exe118⤵PID:3444
-
\??\c:\htbtnn.exec:\htbtnn.exe119⤵PID:2272
-
\??\c:\9bhthh.exec:\9bhthh.exe120⤵PID:4976
-
\??\c:\ppjjv.exec:\ppjjv.exe121⤵PID:392
-
\??\c:\pppdp.exec:\pppdp.exe122⤵PID:432
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-