Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe
-
Size
53KB
-
MD5
f3622e4e42e6f564563caac3d1962a6f
-
SHA1
adc685342fc780f8a57438415418df24368d7112
-
SHA256
eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f
-
SHA512
77733aa15f07624fd471ce384486947e2a219cf80dec9a3ef5ff19fce0f5ee7c014b542d1f13185ea79b711f37c08579ac7d7befd3b8114e96a64d80cecfbed4
-
SSDEEP
1536:mAocdpeVoBDulhzHMb7xNAa04Mcg5IKvlW:0cdpeeBSHHMHLf9RyIT
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2728-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3236-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3532-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1376-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-246-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-253-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-303-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-333-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-344-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-381-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2172-385-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-398-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-411-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-427-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-440-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1180-447-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-451-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-467-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-477-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-493-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-527-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-540-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-655-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-680-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-723-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-742-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-818-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/712-856-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-925-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-944-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-972-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-1183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 5060 5xxlllx.exe 3124 hnbhhb.exe 4400 hhbttn.exe 924 dppjp.exe 1092 flffrlx.exe 1008 flrfxrf.exe 3236 bthbnn.exe 4172 ddppd.exe 1616 rrlfrxr.exe 744 bbbtnh.exe 4140 9hthhb.exe 1584 vvvdv.exe 4464 rrrrxxr.exe 2248 hnbthb.exe 2368 pjpjd.exe 3532 jvvpd.exe 1376 xxrlfxr.exe 4700 3pjdj.exe 4160 7jdpd.exe 848 rrlxllf.exe 448 ntbthb.exe 588 ppddj.exe 772 ppjdd.exe 2484 tthbnh.exe 1900 bbhbbb.exe 1104 pjpvj.exe 2976 llxlxfr.exe 1956 xllrllx.exe 5036 tnhbth.exe 2036 vjjdv.exe 4984 lflfxlr.exe 3144 nhhtnn.exe 3380 pjvpj.exe 4372 rrrxllf.exe 2172 htbttt.exe 1968 9hhbnn.exe 1976 3pdjd.exe 4600 lffxrxr.exe 464 rlrlrrr.exe 1952 9bhntb.exe 3284 tnhhbh.exe 2304 jvddp.exe 4308 xxrlllf.exe 4300 rllfxrr.exe 2728 nbtnbt.exe 3884 jjdvj.exe 2712 3dvpd.exe 2300 xffrffx.exe 4400 5lllrff.exe 2704 bhtnnn.exe 1972 hbthhh.exe 3336 jjvvd.exe 1008 pjvpv.exe 1180 xllxrrx.exe 3016 ttbhhn.exe 4172 nnnhtt.exe 4416 dpvpj.exe 3020 7vjdv.exe 1676 xxrlfxr.exe 4856 hntnhh.exe 2780 djvvv.exe 4228 vppjd.exe 1960 xlrxxxr.exe 4624 fflrlff.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpdjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nttnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 5060 2728 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 83 PID 2728 wrote to memory of 5060 2728 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 83 PID 2728 wrote to memory of 5060 2728 eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe 83 PID 5060 wrote to memory of 3124 5060 5xxlllx.exe 84 PID 5060 wrote to memory of 3124 5060 5xxlllx.exe 84 PID 5060 wrote to memory of 3124 5060 5xxlllx.exe 84 PID 3124 wrote to memory of 4400 3124 hnbhhb.exe 85 PID 3124 wrote to memory of 4400 3124 hnbhhb.exe 85 PID 3124 wrote to memory of 4400 3124 hnbhhb.exe 85 PID 4400 wrote to memory of 924 4400 hhbttn.exe 86 PID 4400 wrote to memory of 924 4400 hhbttn.exe 86 PID 4400 wrote to memory of 924 4400 hhbttn.exe 86 PID 924 wrote to memory of 1092 924 dppjp.exe 87 PID 924 wrote to memory of 1092 924 dppjp.exe 87 PID 924 wrote to memory of 1092 924 dppjp.exe 87 PID 1092 wrote to memory of 1008 1092 flffrlx.exe 88 PID 1092 wrote to memory of 1008 1092 flffrlx.exe 88 PID 1092 wrote to memory of 1008 1092 flffrlx.exe 88 PID 1008 wrote to memory of 3236 1008 flrfxrf.exe 89 PID 1008 wrote to memory of 3236 1008 flrfxrf.exe 89 PID 1008 wrote to memory of 3236 1008 flrfxrf.exe 89 PID 3236 wrote to memory of 4172 3236 bthbnn.exe 90 PID 3236 wrote to memory of 4172 3236 bthbnn.exe 90 PID 3236 wrote to memory of 4172 3236 bthbnn.exe 90 PID 4172 wrote to memory of 1616 4172 ddppd.exe 91 PID 4172 wrote to memory of 1616 4172 ddppd.exe 91 PID 4172 wrote to memory of 1616 4172 ddppd.exe 91 PID 1616 wrote to memory of 744 1616 rrlfrxr.exe 92 PID 1616 wrote to memory of 744 1616 rrlfrxr.exe 92 PID 1616 wrote to memory of 744 1616 rrlfrxr.exe 92 PID 744 wrote to memory of 4140 744 bbbtnh.exe 93 PID 744 wrote to memory of 4140 744 bbbtnh.exe 93 PID 744 wrote to memory of 4140 744 bbbtnh.exe 93 PID 4140 wrote to memory of 1584 4140 9hthhb.exe 94 PID 4140 wrote to memory of 1584 4140 9hthhb.exe 94 PID 4140 wrote to memory of 1584 4140 9hthhb.exe 94 PID 1584 wrote to memory of 4464 1584 vvvdv.exe 95 PID 1584 wrote to memory of 4464 1584 vvvdv.exe 95 PID 1584 wrote to memory of 4464 1584 vvvdv.exe 95 PID 4464 wrote to memory of 2248 4464 rrrrxxr.exe 96 PID 4464 wrote to memory of 2248 4464 rrrrxxr.exe 96 PID 4464 wrote to memory of 2248 4464 rrrrxxr.exe 96 PID 2248 wrote to memory of 2368 2248 hnbthb.exe 97 PID 2248 wrote to memory of 2368 2248 hnbthb.exe 97 PID 2248 wrote to memory of 2368 2248 hnbthb.exe 97 PID 2368 wrote to memory of 3532 2368 pjpjd.exe 98 PID 2368 wrote to memory of 3532 2368 pjpjd.exe 98 PID 2368 wrote to memory of 3532 2368 pjpjd.exe 98 PID 3532 wrote to memory of 1376 3532 jvvpd.exe 99 PID 3532 wrote to memory of 1376 3532 jvvpd.exe 99 PID 3532 wrote to memory of 1376 3532 jvvpd.exe 99 PID 1376 wrote to memory of 4700 1376 xxrlfxr.exe 100 PID 1376 wrote to memory of 4700 1376 xxrlfxr.exe 100 PID 1376 wrote to memory of 4700 1376 xxrlfxr.exe 100 PID 4700 wrote to memory of 4160 4700 3pjdj.exe 101 PID 4700 wrote to memory of 4160 4700 3pjdj.exe 101 PID 4700 wrote to memory of 4160 4700 3pjdj.exe 101 PID 4160 wrote to memory of 848 4160 7jdpd.exe 102 PID 4160 wrote to memory of 848 4160 7jdpd.exe 102 PID 4160 wrote to memory of 848 4160 7jdpd.exe 102 PID 848 wrote to memory of 448 848 rrlxllf.exe 103 PID 848 wrote to memory of 448 848 rrlxllf.exe 103 PID 848 wrote to memory of 448 848 rrlxllf.exe 103 PID 448 wrote to memory of 588 448 ntbthb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe"C:\Users\Admin\AppData\Local\Temp\eeb3700ee8411f5e443a216be195118854eba93c051874cc970a09f0f08b1d7f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5xxlllx.exec:\5xxlllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\hnbhhb.exec:\hnbhhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\hhbttn.exec:\hhbttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\dppjp.exec:\dppjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\flffrlx.exec:\flffrlx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\flrfxrf.exec:\flrfxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\bthbnn.exec:\bthbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\ddppd.exec:\ddppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\bbbtnh.exec:\bbbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\9hthhb.exec:\9hthhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\vvvdv.exec:\vvvdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\rrrrxxr.exec:\rrrrxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\hnbthb.exec:\hnbthb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\pjpjd.exec:\pjpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\jvvpd.exec:\jvvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\3pjdj.exec:\3pjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\7jdpd.exec:\7jdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\rrlxllf.exec:\rrlxllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\ntbthb.exec:\ntbthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\ppddj.exec:\ppddj.exe23⤵
- Executes dropped EXE
PID:588 -
\??\c:\ppjdd.exec:\ppjdd.exe24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:772 -
\??\c:\tthbnh.exec:\tthbnh.exe25⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bbhbbb.exec:\bbhbbb.exe26⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pjpvj.exec:\pjpvj.exe27⤵
- Executes dropped EXE
PID:1104 -
\??\c:\llxlxfr.exec:\llxlxfr.exe28⤵
- Executes dropped EXE
PID:2976 -
\??\c:\xllrllx.exec:\xllrllx.exe29⤵
- Executes dropped EXE
PID:1956 -
\??\c:\tnhbth.exec:\tnhbth.exe30⤵
- Executes dropped EXE
PID:5036 -
\??\c:\vjjdv.exec:\vjjdv.exe31⤵
- Executes dropped EXE
PID:2036 -
\??\c:\lflfxlr.exec:\lflfxlr.exe32⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nhhtnn.exec:\nhhtnn.exe33⤵
- Executes dropped EXE
PID:3144 -
\??\c:\pjvpj.exec:\pjvpj.exe34⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rrrxllf.exec:\rrrxllf.exe35⤵
- Executes dropped EXE
PID:4372 -
\??\c:\htbttt.exec:\htbttt.exe36⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9hhbnn.exec:\9hhbnn.exe37⤵
- Executes dropped EXE
PID:1968 -
\??\c:\3pdjd.exec:\3pdjd.exe38⤵
- Executes dropped EXE
PID:1976 -
\??\c:\lffxrxr.exec:\lffxrxr.exe39⤵
- Executes dropped EXE
PID:4600 -
\??\c:\rlrlrrr.exec:\rlrlrrr.exe40⤵
- Executes dropped EXE
PID:464 -
\??\c:\9bhntb.exec:\9bhntb.exe41⤵
- Executes dropped EXE
PID:1952 -
\??\c:\tnhhbh.exec:\tnhhbh.exe42⤵
- Executes dropped EXE
PID:3284 -
\??\c:\jvddp.exec:\jvddp.exe43⤵
- Executes dropped EXE
PID:2304 -
\??\c:\xxrlllf.exec:\xxrlllf.exe44⤵
- Executes dropped EXE
PID:4308 -
\??\c:\rllfxrr.exec:\rllfxrr.exe45⤵
- Executes dropped EXE
PID:4300 -
\??\c:\nbtnbt.exec:\nbtnbt.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jjdvj.exec:\jjdvj.exe47⤵
- Executes dropped EXE
PID:3884 -
\??\c:\3dvpd.exec:\3dvpd.exe48⤵
- Executes dropped EXE
PID:2712 -
\??\c:\xffrffx.exec:\xffrffx.exe49⤵
- Executes dropped EXE
PID:2300 -
\??\c:\5lllrff.exec:\5lllrff.exe50⤵
- Executes dropped EXE
PID:4400 -
\??\c:\bhtnnn.exec:\bhtnnn.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704 -
\??\c:\hbthhh.exec:\hbthhh.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\jjvvd.exec:\jjvvd.exe53⤵
- Executes dropped EXE
PID:3336 -
\??\c:\pjvpv.exec:\pjvpv.exe54⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xllxrrx.exec:\xllxrrx.exe55⤵
- Executes dropped EXE
PID:1180 -
\??\c:\ttbhhn.exec:\ttbhhn.exe56⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nnnhtt.exec:\nnnhtt.exe57⤵
- Executes dropped EXE
PID:4172 -
\??\c:\dpvpj.exec:\dpvpj.exe58⤵
- Executes dropped EXE
PID:4416 -
\??\c:\7vjdv.exec:\7vjdv.exe59⤵
- Executes dropped EXE
PID:3020 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe60⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hntnhh.exec:\hntnhh.exe61⤵
- Executes dropped EXE
PID:4856 -
\??\c:\djvvv.exec:\djvvv.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2780 -
\??\c:\vppjd.exec:\vppjd.exe63⤵
- Executes dropped EXE
PID:4228 -
\??\c:\xlrxxxr.exec:\xlrxxxr.exe64⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fflrlff.exec:\fflrlff.exe65⤵
- Executes dropped EXE
PID:4624 -
\??\c:\hhtbnb.exec:\hhtbnb.exe66⤵PID:3572
-
\??\c:\3nbttb.exec:\3nbttb.exe67⤵PID:2248
-
\??\c:\vdvpj.exec:\vdvpj.exe68⤵PID:1200
-
\??\c:\fxxxffx.exec:\fxxxffx.exe69⤵PID:1596
-
\??\c:\7rlfxrf.exec:\7rlfxrf.exe70⤵PID:4168
-
\??\c:\ttntnh.exec:\ttntnh.exe71⤵PID:4844
-
\??\c:\jddvj.exec:\jddvj.exe72⤵PID:3012
-
\??\c:\nnnnhb.exec:\nnnnhb.exe73⤵PID:5084
-
\??\c:\btnthb.exec:\btnthb.exe74⤵PID:1944
-
\??\c:\pjvpp.exec:\pjvpp.exe75⤵PID:4616
-
\??\c:\lrxrlrr.exec:\lrxrlrr.exe76⤵PID:4936
-
\??\c:\lrffllf.exec:\lrffllf.exe77⤵PID:3844
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe78⤵PID:4676
-
\??\c:\pdvvj.exec:\pdvvj.exe79⤵PID:772
-
\??\c:\9ppvp.exec:\9ppvp.exe80⤵PID:2936
-
\??\c:\rlllxxx.exec:\rlllxxx.exe81⤵PID:2464
-
\??\c:\7hbtnh.exec:\7hbtnh.exe82⤵PID:3128
-
\??\c:\tttttn.exec:\tttttn.exe83⤵PID:4948
-
\??\c:\9pppd.exec:\9pppd.exe84⤵PID:1364
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe85⤵PID:2380
-
\??\c:\5xrlxxl.exec:\5xrlxxl.exe86⤵PID:5036
-
\??\c:\1tntnn.exec:\1tntnn.exe87⤵PID:3492
-
\??\c:\7nhbhh.exec:\7nhbhh.exe88⤵
- System Location Discovery: System Language Discovery
PID:3636 -
\??\c:\jjpjp.exec:\jjpjp.exe89⤵PID:4268
-
\??\c:\lxffxlf.exec:\lxffxlf.exe90⤵PID:2752
-
\??\c:\nnnntb.exec:\nnnntb.exe91⤵PID:3024
-
\??\c:\bntnhh.exec:\bntnhh.exe92⤵PID:4904
-
\??\c:\vvjpv.exec:\vvjpv.exe93⤵PID:2172
-
\??\c:\llffxxx.exec:\llffxxx.exe94⤵PID:208
-
\??\c:\rfflfrr.exec:\rfflfrr.exe95⤵PID:2720
-
\??\c:\5tbbhn.exec:\5tbbhn.exe96⤵PID:4696
-
\??\c:\hbnhbb.exec:\hbnhbb.exe97⤵PID:264
-
\??\c:\jdvvj.exec:\jdvvj.exe98⤵PID:2360
-
\??\c:\rlxxxrr.exec:\rlxxxrr.exe99⤵PID:1156
-
\??\c:\llrrrrr.exec:\llrrrrr.exe100⤵PID:3920
-
\??\c:\3hhhbt.exec:\3hhhbt.exe101⤵PID:4812
-
\??\c:\ddpjj.exec:\ddpjj.exe102⤵PID:5060
-
\??\c:\9jpjd.exec:\9jpjd.exe103⤵PID:5016
-
\??\c:\ffffxxx.exec:\ffffxxx.exe104⤵PID:996
-
\??\c:\tthtnt.exec:\tthtnt.exe105⤵PID:1460
-
\??\c:\hhnhtt.exec:\hhnhtt.exe106⤵PID:2372
-
\??\c:\pjpjj.exec:\pjpjj.exe107⤵PID:1264
-
\??\c:\fxxrlll.exec:\fxxrlll.exe108⤵PID:1076
-
\??\c:\lfffxxx.exec:\lfffxxx.exe109⤵PID:1972
-
\??\c:\1hnhhb.exec:\1hnhhb.exe110⤵PID:3364
-
\??\c:\ddvpj.exec:\ddvpj.exe111⤵PID:3816
-
\??\c:\7jjjv.exec:\7jjjv.exe112⤵PID:1180
-
\??\c:\ffxrxfr.exec:\ffxrxfr.exe113⤵PID:3016
-
\??\c:\nbhhbn.exec:\nbhhbn.exe114⤵PID:5024
-
\??\c:\9tttnt.exec:\9tttnt.exe115⤵PID:1644
-
\??\c:\pvdpp.exec:\pvdpp.exe116⤵PID:744
-
\??\c:\pvvvv.exec:\pvvvv.exe117⤵PID:3236
-
\??\c:\rrffllx.exec:\rrffllx.exe118⤵PID:4140
-
\??\c:\hhnnht.exec:\hhnnht.exe119⤵PID:1360
-
\??\c:\bthbtt.exec:\bthbtt.exe120⤵PID:2520
-
\??\c:\jjdpp.exec:\jjdpp.exe121⤵PID:5040
-
\??\c:\5jjdv.exec:\5jjdv.exe122⤵PID:3360
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-