Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 00:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
150 seconds
General
-
Target
041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe
-
Size
232KB
-
MD5
041667adfcb9e1fc858368972dd64415
-
SHA1
0020a43748a3524dfe3bb27d60737b01f3ba8a54
-
SHA256
e414315b3de7900b1fa8319b5529830faf67c2909ea2795441d1ab9906fc5dbd
-
SHA512
3618ffa8ff037165ba6383a77807ba73d567cf7e3989f180883f0fcc090cb99dbb05ceca9741e36fee8d179e6b136f3353d61c086de4899b487588da9f21e267
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QNVrAIwsX:n3C9BRo7MlrWKo+l0r5wsX
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2504-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2716-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2332-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2972 bhbhht.exe 2716 ddvjd.exe 800 rrfxxxr.exe 3116 vjpdd.exe 2332 lrlxfll.exe 4740 bhnhnn.exe 4492 jdpjj.exe 232 rlfrlfx.exe 4940 thttnt.exe 4208 pvvvv.exe 912 rlxxxfx.exe 4408 hthhhh.exe 4336 dddpj.exe 3244 lrrrllx.exe 600 hthbtn.exe 4848 lffxxxx.exe 4024 3lrllrr.exe 3168 ttnnnb.exe 4976 vjvjv.exe 4988 1frlxxl.exe 752 bhhbnb.exe 2888 dpvvv.exe 5004 xrfxrrr.exe 2768 nnntnh.exe 512 jjpjj.exe 1120 hbttbb.exe 1568 ppdvp.exe 1456 rxrlfxr.exe 1864 ttttnn.exe 2084 vpjdv.exe 428 rrlfxxx.exe 3156 bbbbtt.exe 2896 pdpvp.exe 1420 jvjvv.exe 1516 rlrlfxr.exe 4832 bnnnhh.exe 4312 hnhbbb.exe 1256 jvddd.exe 2504 lllfxrr.exe 3904 frrlffx.exe 2860 thhhbt.exe 908 bhhhbt.exe 3680 pvvjp.exe 376 3lflffx.exe 2456 thtnbt.exe 2140 httnhb.exe 1388 pddvp.exe 4816 ffxlxrf.exe 2440 lxfxllf.exe 2808 bbtbnt.exe 232 dpjvd.exe 2156 vjvdp.exe 4824 frrrlrl.exe 4184 1tnhhb.exe 2280 bhthtn.exe 868 pvdvv.exe 4336 frfffrr.exe 4936 nhhbth.exe 1976 nhhhtn.exe 4456 dvddd.exe 464 lxffxxx.exe 3980 nnnnhh.exe 1944 bbbhbb.exe 1540 pdjdv.exe -
resource yara_rule behavioral2/memory/2504-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2716-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2332-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnntnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2972 2504 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 84 PID 2504 wrote to memory of 2972 2504 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 84 PID 2504 wrote to memory of 2972 2504 041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe 84 PID 2972 wrote to memory of 2716 2972 bhbhht.exe 85 PID 2972 wrote to memory of 2716 2972 bhbhht.exe 85 PID 2972 wrote to memory of 2716 2972 bhbhht.exe 85 PID 2716 wrote to memory of 800 2716 ddvjd.exe 86 PID 2716 wrote to memory of 800 2716 ddvjd.exe 86 PID 2716 wrote to memory of 800 2716 ddvjd.exe 86 PID 800 wrote to memory of 3116 800 rrfxxxr.exe 87 PID 800 wrote to memory of 3116 800 rrfxxxr.exe 87 PID 800 wrote to memory of 3116 800 rrfxxxr.exe 87 PID 3116 wrote to memory of 2332 3116 vjpdd.exe 88 PID 3116 wrote to memory of 2332 3116 vjpdd.exe 88 PID 3116 wrote to memory of 2332 3116 vjpdd.exe 88 PID 2332 wrote to memory of 4740 2332 lrlxfll.exe 89 PID 2332 wrote to memory of 4740 2332 lrlxfll.exe 89 PID 2332 wrote to memory of 4740 2332 lrlxfll.exe 89 PID 4740 wrote to memory of 4492 4740 bhnhnn.exe 90 PID 4740 wrote to memory of 4492 4740 bhnhnn.exe 90 PID 4740 wrote to memory of 4492 4740 bhnhnn.exe 90 PID 4492 wrote to memory of 232 4492 jdpjj.exe 91 PID 4492 wrote to memory of 232 4492 jdpjj.exe 91 PID 4492 wrote to memory of 232 4492 jdpjj.exe 91 PID 232 wrote to memory of 4940 232 rlfrlfx.exe 92 PID 232 wrote to memory of 4940 232 rlfrlfx.exe 92 PID 232 wrote to memory of 4940 232 rlfrlfx.exe 92 PID 4940 wrote to memory of 4208 4940 thttnt.exe 94 PID 4940 wrote to memory of 4208 4940 thttnt.exe 94 PID 4940 wrote to memory of 4208 4940 thttnt.exe 94 PID 4208 wrote to memory of 912 4208 pvvvv.exe 95 PID 4208 wrote to memory of 912 4208 pvvvv.exe 95 PID 4208 wrote to memory of 912 4208 pvvvv.exe 95 PID 912 wrote to memory of 4408 912 rlxxxfx.exe 96 PID 912 wrote to memory of 4408 912 rlxxxfx.exe 96 PID 912 wrote to memory of 4408 912 rlxxxfx.exe 96 PID 4408 wrote to memory of 4336 4408 hthhhh.exe 97 PID 4408 wrote to memory of 4336 4408 hthhhh.exe 97 PID 4408 wrote to memory of 4336 4408 hthhhh.exe 97 PID 4336 wrote to memory of 3244 4336 dddpj.exe 98 PID 4336 wrote to memory of 3244 4336 dddpj.exe 98 PID 4336 wrote to memory of 3244 4336 dddpj.exe 98 PID 3244 wrote to memory of 600 3244 lrrrllx.exe 99 PID 3244 wrote to memory of 600 3244 lrrrllx.exe 99 PID 3244 wrote to memory of 600 3244 lrrrllx.exe 99 PID 600 wrote to memory of 4848 600 hthbtn.exe 100 PID 600 wrote to memory of 4848 600 hthbtn.exe 100 PID 600 wrote to memory of 4848 600 hthbtn.exe 100 PID 4848 wrote to memory of 4024 4848 lffxxxx.exe 101 PID 4848 wrote to memory of 4024 4848 lffxxxx.exe 101 PID 4848 wrote to memory of 4024 4848 lffxxxx.exe 101 PID 4024 wrote to memory of 3168 4024 3lrllrr.exe 102 PID 4024 wrote to memory of 3168 4024 3lrllrr.exe 102 PID 4024 wrote to memory of 3168 4024 3lrllrr.exe 102 PID 3168 wrote to memory of 4976 3168 ttnnnb.exe 103 PID 3168 wrote to memory of 4976 3168 ttnnnb.exe 103 PID 3168 wrote to memory of 4976 3168 ttnnnb.exe 103 PID 4976 wrote to memory of 4988 4976 vjvjv.exe 104 PID 4976 wrote to memory of 4988 4976 vjvjv.exe 104 PID 4976 wrote to memory of 4988 4976 vjvjv.exe 104 PID 4988 wrote to memory of 752 4988 1frlxxl.exe 105 PID 4988 wrote to memory of 752 4988 1frlxxl.exe 105 PID 4988 wrote to memory of 752 4988 1frlxxl.exe 105 PID 752 wrote to memory of 2888 752 bhhbnb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\041667adfcb9e1fc858368972dd64415_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\bhbhht.exec:\bhbhht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\ddvjd.exec:\ddvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\vjpdd.exec:\vjpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\lrlxfll.exec:\lrlxfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\bhnhnn.exec:\bhnhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\jdpjj.exec:\jdpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\thttnt.exec:\thttnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\pvvvv.exec:\pvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\rlxxxfx.exec:\rlxxxfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\hthhhh.exec:\hthhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\dddpj.exec:\dddpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\lrrrllx.exec:\lrrrllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\hthbtn.exec:\hthbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:600 -
\??\c:\lffxxxx.exec:\lffxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\3lrllrr.exec:\3lrllrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\ttnnnb.exec:\ttnnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\vjvjv.exec:\vjvjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\1frlxxl.exec:\1frlxxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\bhhbnb.exec:\bhhbnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\dpvvv.exec:\dpvvv.exe23⤵
- Executes dropped EXE
PID:2888 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe24⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nnntnh.exec:\nnntnh.exe25⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jjpjj.exec:\jjpjj.exe26⤵
- Executes dropped EXE
PID:512 -
\??\c:\hbttbb.exec:\hbttbb.exe27⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ppdvp.exec:\ppdvp.exe28⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ttttnn.exec:\ttttnn.exe30⤵
- Executes dropped EXE
PID:1864 -
\??\c:\vpjdv.exec:\vpjdv.exe31⤵
- Executes dropped EXE
PID:2084 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe32⤵
- Executes dropped EXE
PID:428 -
\??\c:\bbbbtt.exec:\bbbbtt.exe33⤵
- Executes dropped EXE
PID:3156 -
\??\c:\pdpvp.exec:\pdpvp.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\jvjvv.exec:\jvjvv.exe35⤵
- Executes dropped EXE
PID:1420 -
\??\c:\rlrlfxr.exec:\rlrlfxr.exe36⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bnnnhh.exec:\bnnnhh.exe37⤵
- Executes dropped EXE
PID:4832 -
\??\c:\hnhbbb.exec:\hnhbbb.exe38⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jvddd.exec:\jvddd.exe39⤵
- Executes dropped EXE
PID:1256 -
\??\c:\lllfxrr.exec:\lllfxrr.exe40⤵
- Executes dropped EXE
PID:2504 -
\??\c:\frrlffx.exec:\frrlffx.exe41⤵
- Executes dropped EXE
PID:3904 -
\??\c:\thhhbt.exec:\thhhbt.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\bhhhbt.exec:\bhhhbt.exe43⤵
- Executes dropped EXE
PID:908 -
\??\c:\pvvjp.exec:\pvvjp.exe44⤵
- Executes dropped EXE
PID:3680 -
\??\c:\3lflffx.exec:\3lflffx.exe45⤵
- Executes dropped EXE
PID:376 -
\??\c:\thtnbt.exec:\thtnbt.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\httnhb.exec:\httnhb.exe47⤵
- Executes dropped EXE
PID:2140 -
\??\c:\pddvp.exec:\pddvp.exe48⤵
- Executes dropped EXE
PID:1388 -
\??\c:\ffxlxrf.exec:\ffxlxrf.exe49⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lxfxllf.exec:\lxfxllf.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bbtbnt.exec:\bbtbnt.exe51⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2808 -
\??\c:\dpjvd.exec:\dpjvd.exe52⤵
- Executes dropped EXE
PID:232 -
\??\c:\vjvdp.exec:\vjvdp.exe53⤵
- Executes dropped EXE
PID:2156 -
\??\c:\frrrlrl.exec:\frrrlrl.exe54⤵
- Executes dropped EXE
PID:4824 -
\??\c:\1tnhhb.exec:\1tnhhb.exe55⤵
- Executes dropped EXE
PID:4184 -
\??\c:\bhthtn.exec:\bhthtn.exe56⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pvdvv.exec:\pvdvv.exe57⤵
- Executes dropped EXE
PID:868 -
\??\c:\frfffrr.exec:\frfffrr.exe58⤵
- Executes dropped EXE
PID:4336 -
\??\c:\nhhbth.exec:\nhhbth.exe59⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nhhhtn.exec:\nhhhtn.exe60⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dvddd.exec:\dvddd.exe61⤵
- Executes dropped EXE
PID:4456 -
\??\c:\lxffxxx.exec:\lxffxxx.exe62⤵
- Executes dropped EXE
PID:464 -
\??\c:\nnnnhh.exec:\nnnnhh.exe63⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bbbhbb.exec:\bbbhbb.exe64⤵
- Executes dropped EXE
PID:1944 -
\??\c:\pdjdv.exec:\pdjdv.exe65⤵
- Executes dropped EXE
PID:1540 -
\??\c:\xlxlxlx.exec:\xlxlxlx.exe66⤵PID:2220
-
\??\c:\nthbhb.exec:\nthbhb.exe67⤵PID:4428
-
\??\c:\vppjv.exec:\vppjv.exe68⤵PID:3612
-
\??\c:\lrlrlxx.exec:\lrlrlxx.exe69⤵PID:1592
-
\??\c:\djdvj.exec:\djdvj.exe70⤵PID:820
-
\??\c:\fxrrlll.exec:\fxrrlll.exe71⤵PID:5004
-
\??\c:\bthhhn.exec:\bthhhn.exe72⤵PID:1184
-
\??\c:\nhhbbb.exec:\nhhbbb.exe73⤵PID:4480
-
\??\c:\9jdvp.exec:\9jdvp.exe74⤵PID:996
-
\??\c:\rfllffx.exec:\rfllffx.exe75⤵PID:1120
-
\??\c:\xxrrlll.exec:\xxrrlll.exe76⤵PID:1568
-
\??\c:\bnthhh.exec:\bnthhh.exe77⤵PID:2924
-
\??\c:\vjjdp.exec:\vjjdp.exe78⤵PID:4864
-
\??\c:\xfrlxrl.exec:\xfrlxrl.exe79⤵PID:5040
-
\??\c:\nnhbhn.exec:\nnhbhn.exe80⤵PID:2084
-
\??\c:\bbhttb.exec:\bbhttb.exe81⤵PID:3668
-
\??\c:\jvdpd.exec:\jvdpd.exe82⤵PID:4560
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe83⤵PID:3996
-
\??\c:\fxrllff.exec:\fxrllff.exe84⤵PID:3192
-
\??\c:\nhhbnh.exec:\nhhbnh.exe85⤵PID:404
-
\??\c:\nhnbbb.exec:\nhnbbb.exe86⤵PID:1060
-
\??\c:\dvdvd.exec:\dvdvd.exe87⤵PID:1676
-
\??\c:\lxxxxlr.exec:\lxxxxlr.exe88⤵PID:1828
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe89⤵PID:1532
-
\??\c:\tbhtbh.exec:\tbhtbh.exe90⤵PID:1984
-
\??\c:\vjdpj.exec:\vjdpj.exe91⤵PID:3632
-
\??\c:\jdjjp.exec:\jdjjp.exe92⤵PID:2464
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe93⤵PID:2852
-
\??\c:\htbbbb.exec:\htbbbb.exe94⤵PID:4584
-
\??\c:\btnnbt.exec:\btnnbt.exe95⤵PID:2072
-
\??\c:\7pjdp.exec:\7pjdp.exe96⤵PID:3552
-
\??\c:\3ffxxrx.exec:\3ffxxrx.exe97⤵PID:2548
-
\??\c:\ffrxrfl.exec:\ffrxrfl.exe98⤵PID:2052
-
\??\c:\ttbhnh.exec:\ttbhnh.exe99⤵PID:3524
-
\??\c:\tbhbbt.exec:\tbhbbt.exe100⤵PID:1896
-
\??\c:\frrxlxf.exec:\frrxlxf.exe101⤵PID:792
-
\??\c:\bttbtt.exec:\bttbtt.exe102⤵PID:4788
-
\??\c:\vjddj.exec:\vjddj.exe103⤵PID:4208
-
\??\c:\jdddv.exec:\jdddv.exe104⤵PID:2124
-
\??\c:\fxllrrx.exec:\fxllrrx.exe105⤵PID:1356
-
\??\c:\rrllrxx.exec:\rrllrxx.exe106⤵PID:1608
-
\??\c:\nhbttt.exec:\nhbttt.exe107⤵PID:3244
-
\??\c:\hntttt.exec:\hntttt.exe108⤵PID:3600
-
\??\c:\pdddp.exec:\pdddp.exe109⤵PID:1976
-
\??\c:\vdddv.exec:\vdddv.exe110⤵PID:4024
-
\??\c:\rrrrrxx.exec:\rrrrrxx.exe111⤵PID:2480
-
\??\c:\bhhbtn.exec:\bhhbtn.exe112⤵PID:3208
-
\??\c:\9bhhbb.exec:\9bhhbb.exe113⤵PID:1940
-
\??\c:\7jvvv.exec:\7jvvv.exe114⤵PID:2932
-
\??\c:\ppvdd.exec:\ppvdd.exe115⤵PID:752
-
\??\c:\xrffxfl.exec:\xrffxfl.exe116⤵PID:1620
-
\??\c:\lflxxlf.exec:\lflxxlf.exe117⤵PID:1500
-
\??\c:\bbnnnn.exec:\bbnnnn.exe118⤵PID:4872
-
\??\c:\ppppp.exec:\ppppp.exe119⤵PID:2404
-
\??\c:\pvjvp.exec:\pvjvp.exe120⤵PID:1160
-
\??\c:\lxxlllf.exec:\lxxlllf.exe121⤵PID:1004
-
\??\c:\rrfflxr.exec:\rrfflxr.exe122⤵PID:2252
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-