Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-12-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe
Resource
win7-20240729-en
General
-
Target
c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe
-
Size
83KB
-
MD5
543c7f7d1487155127f9cb6d98fb04d8
-
SHA1
66886af8238289b6ae961059b098368fc223dce1
-
SHA256
c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47
-
SHA512
0afe03166403d4ab6b42d622b56f11e598adfb4fb43138ac54aa893025952481cc41e67e44d3a265895a93f7de9518477c4bab73aab9022f1efb491b27fe5e77
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89Q7:ymb3NkkiQ3mdBjFIIp9L9QrrA8k
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/3364-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/632-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3500 1jvpp.exe 3628 rflfrlx.exe 632 hththh.exe 1432 pjdvp.exe 1420 lrrfxrf.exe 2400 1nnnbt.exe 2152 7djvv.exe 1292 lxxlfxr.exe 1108 hnnbbt.exe 1232 thtnbb.exe 2468 jddpp.exe 3360 dvvvj.exe 720 fflffxf.exe 2940 thbtnn.exe 5052 jvvjv.exe 404 xxxlxrl.exe 2908 xllxlfx.exe 2024 ththtb.exe 2756 jvdvj.exe 772 lxrffxr.exe 2340 thhthb.exe 1764 nbnhbb.exe 5088 vjdvd.exe 3848 xffxlrf.exe 4948 tnnbtn.exe 1368 dpvjv.exe 1848 ddjvp.exe 3492 frfrlfl.exe 4952 btnnhb.exe 4372 jjdjv.exe 1084 tnhthb.exe 4880 hbtnbt.exe 4600 jddvj.exe 1428 pvpjj.exe 3308 nbhhtt.exe 4608 pvdvd.exe 4200 9ddpd.exe 1896 fxrlxxr.exe 2432 xfrlfxl.exe 316 thbthh.exe 4572 jddvj.exe 3628 lffrlll.exe 2372 lxrlxfx.exe 632 nhnhbh.exe 4332 jddpd.exe 4292 fllxrlf.exe 2636 nttnbb.exe 2400 btnhtt.exe 1616 vpdvj.exe 4140 nhntbh.exe 2780 djdvj.exe 2652 3rlfffx.exe 4964 xfllfff.exe 1964 btbbhh.exe 2520 djpdp.exe 2300 xxffxxr.exe 3568 fxlrlfr.exe 1704 nbtbtb.exe 720 tttnnh.exe 4704 pdvpj.exe 3392 lrlfrlf.exe 3012 rfxrllf.exe 3912 nnhhbt.exe 4936 lxxrfxr.exe -
resource yara_rule behavioral2/memory/3364-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3hhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhtnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5nhbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxrffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3364 wrote to memory of 3500 3364 c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe 83 PID 3364 wrote to memory of 3500 3364 c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe 83 PID 3364 wrote to memory of 3500 3364 c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe 83 PID 3500 wrote to memory of 3628 3500 1jvpp.exe 84 PID 3500 wrote to memory of 3628 3500 1jvpp.exe 84 PID 3500 wrote to memory of 3628 3500 1jvpp.exe 84 PID 3628 wrote to memory of 632 3628 rflfrlx.exe 85 PID 3628 wrote to memory of 632 3628 rflfrlx.exe 85 PID 3628 wrote to memory of 632 3628 rflfrlx.exe 85 PID 632 wrote to memory of 1432 632 hththh.exe 86 PID 632 wrote to memory of 1432 632 hththh.exe 86 PID 632 wrote to memory of 1432 632 hththh.exe 86 PID 1432 wrote to memory of 1420 1432 pjdvp.exe 87 PID 1432 wrote to memory of 1420 1432 pjdvp.exe 87 PID 1432 wrote to memory of 1420 1432 pjdvp.exe 87 PID 1420 wrote to memory of 2400 1420 lrrfxrf.exe 88 PID 1420 wrote to memory of 2400 1420 lrrfxrf.exe 88 PID 1420 wrote to memory of 2400 1420 lrrfxrf.exe 88 PID 2400 wrote to memory of 2152 2400 1nnnbt.exe 89 PID 2400 wrote to memory of 2152 2400 1nnnbt.exe 89 PID 2400 wrote to memory of 2152 2400 1nnnbt.exe 89 PID 2152 wrote to memory of 1292 2152 7djvv.exe 90 PID 2152 wrote to memory of 1292 2152 7djvv.exe 90 PID 2152 wrote to memory of 1292 2152 7djvv.exe 90 PID 1292 wrote to memory of 1108 1292 lxxlfxr.exe 91 PID 1292 wrote to memory of 1108 1292 lxxlfxr.exe 91 PID 1292 wrote to memory of 1108 1292 lxxlfxr.exe 91 PID 1108 wrote to memory of 1232 1108 hnnbbt.exe 92 PID 1108 wrote to memory of 1232 1108 hnnbbt.exe 92 PID 1108 wrote to memory of 1232 1108 hnnbbt.exe 92 PID 1232 wrote to memory of 2468 1232 thtnbb.exe 93 PID 1232 wrote to memory of 2468 1232 thtnbb.exe 93 PID 1232 wrote to memory of 2468 1232 thtnbb.exe 93 PID 2468 wrote to memory of 3360 2468 jddpp.exe 94 PID 2468 wrote to memory of 3360 2468 jddpp.exe 94 PID 2468 wrote to memory of 3360 2468 jddpp.exe 94 PID 3360 wrote to memory of 720 3360 dvvvj.exe 95 PID 3360 wrote to memory of 720 3360 dvvvj.exe 95 PID 3360 wrote to memory of 720 3360 dvvvj.exe 95 PID 720 wrote to memory of 2940 720 fflffxf.exe 96 PID 720 wrote to memory of 2940 720 fflffxf.exe 96 PID 720 wrote to memory of 2940 720 fflffxf.exe 96 PID 2940 wrote to memory of 5052 2940 thbtnn.exe 97 PID 2940 wrote to memory of 5052 2940 thbtnn.exe 97 PID 2940 wrote to memory of 5052 2940 thbtnn.exe 97 PID 5052 wrote to memory of 404 5052 jvvjv.exe 98 PID 5052 wrote to memory of 404 5052 jvvjv.exe 98 PID 5052 wrote to memory of 404 5052 jvvjv.exe 98 PID 404 wrote to memory of 2908 404 xxxlxrl.exe 99 PID 404 wrote to memory of 2908 404 xxxlxrl.exe 99 PID 404 wrote to memory of 2908 404 xxxlxrl.exe 99 PID 2908 wrote to memory of 2024 2908 xllxlfx.exe 100 PID 2908 wrote to memory of 2024 2908 xllxlfx.exe 100 PID 2908 wrote to memory of 2024 2908 xllxlfx.exe 100 PID 2024 wrote to memory of 2756 2024 ththtb.exe 101 PID 2024 wrote to memory of 2756 2024 ththtb.exe 101 PID 2024 wrote to memory of 2756 2024 ththtb.exe 101 PID 2756 wrote to memory of 772 2756 jvdvj.exe 102 PID 2756 wrote to memory of 772 2756 jvdvj.exe 102 PID 2756 wrote to memory of 772 2756 jvdvj.exe 102 PID 772 wrote to memory of 2340 772 lxrffxr.exe 103 PID 772 wrote to memory of 2340 772 lxrffxr.exe 103 PID 772 wrote to memory of 2340 772 lxrffxr.exe 103 PID 2340 wrote to memory of 1764 2340 thhthb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe"C:\Users\Admin\AppData\Local\Temp\c4260fb2a49485c8cfda8980a4f6c66d5a0b7e722a6382dc1650facb3f9f9b47.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\1jvpp.exec:\1jvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\rflfrlx.exec:\rflfrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\hththh.exec:\hththh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\pjdvp.exec:\pjdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\lrrfxrf.exec:\lrrfxrf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\1nnnbt.exec:\1nnnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\7djvv.exec:\7djvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\hnnbbt.exec:\hnnbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\thtnbb.exec:\thtnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\jddpp.exec:\jddpp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\dvvvj.exec:\dvvvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\fflffxf.exec:\fflffxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\thbtnn.exec:\thbtnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\jvvjv.exec:\jvvjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\xxxlxrl.exec:\xxxlxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\xllxlfx.exec:\xllxlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ththtb.exec:\ththtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\jvdvj.exec:\jvdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\lxrffxr.exec:\lxrffxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\thhthb.exec:\thhthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\nbnhbb.exec:\nbnhbb.exe23⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vjdvd.exec:\vjdvd.exe24⤵
- Executes dropped EXE
PID:5088 -
\??\c:\xffxlrf.exec:\xffxlrf.exe25⤵
- Executes dropped EXE
PID:3848 -
\??\c:\tnnbtn.exec:\tnnbtn.exe26⤵
- Executes dropped EXE
PID:4948 -
\??\c:\dpvjv.exec:\dpvjv.exe27⤵
- Executes dropped EXE
PID:1368 -
\??\c:\ddjvp.exec:\ddjvp.exe28⤵
- Executes dropped EXE
PID:1848 -
\??\c:\frfrlfl.exec:\frfrlfl.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3492 -
\??\c:\btnnhb.exec:\btnnhb.exe30⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jjdjv.exec:\jjdjv.exe31⤵
- Executes dropped EXE
PID:4372 -
\??\c:\tnhthb.exec:\tnhthb.exe32⤵
- Executes dropped EXE
PID:1084 -
\??\c:\hbtnbt.exec:\hbtnbt.exe33⤵
- Executes dropped EXE
PID:4880 -
\??\c:\jddvj.exec:\jddvj.exe34⤵
- Executes dropped EXE
PID:4600 -
\??\c:\pvpjj.exec:\pvpjj.exe35⤵
- Executes dropped EXE
PID:1428 -
\??\c:\nbhhtt.exec:\nbhhtt.exe36⤵
- Executes dropped EXE
PID:3308 -
\??\c:\pvdvd.exec:\pvdvd.exe37⤵
- Executes dropped EXE
PID:4608 -
\??\c:\9ddpd.exec:\9ddpd.exe38⤵
- Executes dropped EXE
PID:4200 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe39⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xfrlfxl.exec:\xfrlfxl.exe40⤵
- Executes dropped EXE
PID:2432 -
\??\c:\thbthh.exec:\thbthh.exe41⤵
- Executes dropped EXE
PID:316 -
\??\c:\jddvj.exec:\jddvj.exe42⤵
- Executes dropped EXE
PID:4572 -
\??\c:\lffrlll.exec:\lffrlll.exe43⤵
- Executes dropped EXE
PID:3628 -
\??\c:\lxrlxfx.exec:\lxrlxfx.exe44⤵
- Executes dropped EXE
PID:2372 -
\??\c:\nhnhbh.exec:\nhnhbh.exe45⤵
- Executes dropped EXE
PID:632 -
\??\c:\jddpd.exec:\jddpd.exe46⤵
- Executes dropped EXE
PID:4332 -
\??\c:\fllxrlf.exec:\fllxrlf.exe47⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nttnbb.exec:\nttnbb.exe48⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btnhtt.exec:\btnhtt.exe49⤵
- Executes dropped EXE
PID:2400 -
\??\c:\vpdvj.exec:\vpdvj.exe50⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nhntbh.exec:\nhntbh.exe51⤵
- Executes dropped EXE
PID:4140 -
\??\c:\djdvj.exec:\djdvj.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\3rlfffx.exec:\3rlfffx.exe53⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xfllfff.exec:\xfllfff.exe54⤵
- Executes dropped EXE
PID:4964 -
\??\c:\btbbhh.exec:\btbbhh.exe55⤵
- Executes dropped EXE
PID:1964 -
\??\c:\djpdp.exec:\djpdp.exe56⤵
- Executes dropped EXE
PID:2520 -
\??\c:\xxffxxr.exec:\xxffxxr.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\fxlrlfr.exec:\fxlrlfr.exe58⤵
- Executes dropped EXE
PID:3568 -
\??\c:\nbtbtb.exec:\nbtbtb.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\tttnnh.exec:\tttnnh.exe60⤵
- Executes dropped EXE
PID:720 -
\??\c:\pdvpj.exec:\pdvpj.exe61⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lrlfrlf.exec:\lrlfrlf.exe62⤵
- Executes dropped EXE
PID:3392 -
\??\c:\rfxrllf.exec:\rfxrllf.exe63⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nnhhbt.exec:\nnhhbt.exe64⤵
- Executes dropped EXE
PID:3912 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe65⤵
- Executes dropped EXE
PID:4936 -
\??\c:\3rlxlfx.exec:\3rlxlfx.exe66⤵PID:2024
-
\??\c:\bnnhtt.exec:\bnnhtt.exe67⤵PID:4116
-
\??\c:\1pvjp.exec:\1pvjp.exe68⤵PID:2760
-
\??\c:\lxflfxr.exec:\lxflfxr.exe69⤵PID:4460
-
\??\c:\fxfrlfr.exec:\fxfrlfr.exe70⤵PID:1032
-
\??\c:\bhnnbt.exec:\bhnnbt.exe71⤵PID:4980
-
\??\c:\hbtbnb.exec:\hbtbnb.exe72⤵PID:5088
-
\??\c:\9vvpj.exec:\9vvpj.exe73⤵PID:1648
-
\??\c:\rrlxxrx.exec:\rrlxxrx.exe74⤵PID:3424
-
\??\c:\5frlffx.exec:\5frlffx.exe75⤵PID:2036
-
\??\c:\5btnbb.exec:\5btnbb.exe76⤵PID:4944
-
\??\c:\jjpjd.exec:\jjpjd.exe77⤵PID:1848
-
\??\c:\dppdv.exec:\dppdv.exe78⤵PID:3584
-
\??\c:\7lfrllf.exec:\7lfrllf.exe79⤵PID:1904
-
\??\c:\rlxrffx.exec:\rlxrffx.exe80⤵PID:4904
-
\??\c:\5hbtnh.exec:\5hbtnh.exe81⤵PID:1540
-
\??\c:\btbttt.exec:\btbttt.exe82⤵PID:2612
-
\??\c:\pvpdv.exec:\pvpdv.exe83⤵PID:2184
-
\??\c:\lrrfrrl.exec:\lrrfrrl.exe84⤵PID:844
-
\??\c:\7tnnhb.exec:\7tnnhb.exe85⤵PID:2292
-
\??\c:\dvpjv.exec:\dvpjv.exe86⤵PID:4760
-
\??\c:\jvjdv.exec:\jvjdv.exe87⤵PID:2304
-
\??\c:\frrflfx.exec:\frrflfx.exe88⤵PID:5060
-
\??\c:\nhtnhh.exec:\nhtnhh.exe89⤵
- System Location Discovery: System Language Discovery
PID:4144 -
\??\c:\btnhtn.exec:\btnhtn.exe90⤵PID:3624
-
\??\c:\5ppjp.exec:\5ppjp.exe91⤵PID:1204
-
\??\c:\jdpjj.exec:\jdpjj.exe92⤵PID:1092
-
\??\c:\llxrfxr.exec:\llxrfxr.exe93⤵PID:4340
-
\??\c:\lxxrllf.exec:\lxxrllf.exe94⤵PID:3236
-
\??\c:\bbtthb.exec:\bbtthb.exe95⤵PID:1332
-
\??\c:\tnhbnh.exec:\tnhbnh.exe96⤵PID:4332
-
\??\c:\ppjpj.exec:\ppjpj.exe97⤵PID:5056
-
\??\c:\djvjd.exec:\djvjd.exe98⤵PID:4604
-
\??\c:\xffxlfx.exec:\xffxlfx.exe99⤵PID:2152
-
\??\c:\thhbnh.exec:\thhbnh.exe100⤵PID:3348
-
\??\c:\tnnhbb.exec:\tnnhbb.exe101⤵PID:3052
-
\??\c:\dppjv.exec:\dppjv.exe102⤵PID:3048
-
\??\c:\vpvjp.exec:\vpvjp.exe103⤵PID:4692
-
\??\c:\lrrlrrl.exec:\lrrlrrl.exe104⤵PID:996
-
\??\c:\bhhtnh.exec:\bhhtnh.exe105⤵PID:2468
-
\??\c:\thhthb.exec:\thhthb.exe106⤵PID:2248
-
\??\c:\1jdvj.exec:\1jdvj.exe107⤵PID:3532
-
\??\c:\jjdpj.exec:\jjdpj.exe108⤵PID:2396
-
\??\c:\lxxlxxf.exec:\lxxlxxf.exe109⤵PID:4168
-
\??\c:\rfrlfxl.exec:\rfrlfxl.exe110⤵PID:4700
-
\??\c:\bhhbnh.exec:\bhhbnh.exe111⤵PID:648
-
\??\c:\pdvpd.exec:\pdvpd.exe112⤵PID:848
-
\??\c:\rfxxlll.exec:\rfxxlll.exe113⤵PID:528
-
\??\c:\lflfllr.exec:\lflfllr.exe114⤵PID:3180
-
\??\c:\tnhtnb.exec:\tnhtnb.exe115⤵PID:3164
-
\??\c:\bbthtn.exec:\bbthtn.exe116⤵PID:1720
-
\??\c:\jpppj.exec:\jpppj.exe117⤵PID:2792
-
\??\c:\lxrrfxl.exec:\lxrrfxl.exe118⤵PID:4688
-
\??\c:\5rrfxxr.exec:\5rrfxxr.exe119⤵PID:2936
-
\??\c:\bhnhtn.exec:\bhnhtn.exe120⤵PID:1032
-
\??\c:\btthtt.exec:\btthtt.exe121⤵PID:1956
-
\??\c:\pvvjv.exec:\pvvjv.exe122⤵PID:3268
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-