Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
02-08-2024 17:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bcd59a5d5abce27dc93da68869cab0a0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
bcd59a5d5abce27dc93da68869cab0a0N.exe
-
Size
67KB
-
MD5
bcd59a5d5abce27dc93da68869cab0a0
-
SHA1
9784ea18923646c33e031e75859a1556ac61d2f4
-
SHA256
7cfe0092b2321f7b90b56e25b6134b0d7022cb38f9453dfdb2a7ff87358f6d57
-
SHA512
cd455fedbbebc88b86c8a1e612e5bdb3ccc0778072e8bcb23a9b4d75b5b6172a14ccda78adb920afe583f8f58e5353c9b869b2ce17c6d939b8ed1ea53801e8af
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCO:ymb3NkkiQ3mdBjFIyna
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4448-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2404-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-79-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2404 rfrlxrf.exe 2072 fffrfxr.exe 3000 bthbtn.exe 5036 3jdpv.exe 3612 jvdpp.exe 2832 7xxrlfx.exe 2428 frxllfl.exe 2432 hbbthb.exe 3560 ththbt.exe 1488 9dvpv.exe 1516 ppjdv.exe 2704 fllfrlx.exe 3252 bbtnhb.exe 5104 1dvjv.exe 3924 lrfxfxr.exe 3568 7nhbbt.exe 1880 hhhbtt.exe 5000 pjjdp.exe 3888 xfxrffx.exe 4116 lxrllfr.exe 4360 5nnnbn.exe 1456 pjdvj.exe 1844 frfrlff.exe 1328 hbtnhb.exe 4268 bnnhnn.exe 4460 dvpjd.exe 1196 1lrffxx.exe 3788 7hhbtt.exe 2260 tntntn.exe 3904 xxrlfxr.exe 3064 nbbtnn.exe 2648 rxxrrlf.exe 2736 rfxrlfr.exe 4296 nbnhtn.exe 4236 rxlfxxr.exe 1192 btnhbh.exe 2156 vpjdp.exe 2708 7ffrxxr.exe 1992 lfrlxrf.exe 3652 nbhbbt.exe 3828 htthhb.exe 4608 jjpdv.exe 2588 lxffxrl.exe 4536 fllffxr.exe 4356 tntnbb.exe 2500 jvvjv.exe 3300 dvdvj.exe 4328 9lfxrrr.exe 4704 nhnhnh.exe 4376 pjvpj.exe 2384 9pdvd.exe 5036 fxxlrrf.exe 4648 7thhbt.exe 4612 pppjd.exe 4832 lxxrfxr.exe 4956 bnhtnh.exe 5080 nhbtbb.exe 3140 jvddj.exe 2212 flrfrrr.exe 4080 rlfffxf.exe 5032 thhbbb.exe 4784 btnhhb.exe 2820 pjjdj.exe 532 lffrfxr.exe -
resource yara_rule behavioral2/memory/4448-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2404-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1516-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btttnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flfrffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4448 wrote to memory of 2404 4448 bcd59a5d5abce27dc93da68869cab0a0N.exe 82 PID 4448 wrote to memory of 2404 4448 bcd59a5d5abce27dc93da68869cab0a0N.exe 82 PID 4448 wrote to memory of 2404 4448 bcd59a5d5abce27dc93da68869cab0a0N.exe 82 PID 2404 wrote to memory of 2072 2404 rfrlxrf.exe 83 PID 2404 wrote to memory of 2072 2404 rfrlxrf.exe 83 PID 2404 wrote to memory of 2072 2404 rfrlxrf.exe 83 PID 2072 wrote to memory of 3000 2072 fffrfxr.exe 84 PID 2072 wrote to memory of 3000 2072 fffrfxr.exe 84 PID 2072 wrote to memory of 3000 2072 fffrfxr.exe 84 PID 3000 wrote to memory of 5036 3000 bthbtn.exe 85 PID 3000 wrote to memory of 5036 3000 bthbtn.exe 85 PID 3000 wrote to memory of 5036 3000 bthbtn.exe 85 PID 5036 wrote to memory of 3612 5036 3jdpv.exe 86 PID 5036 wrote to memory of 3612 5036 3jdpv.exe 86 PID 5036 wrote to memory of 3612 5036 3jdpv.exe 86 PID 3612 wrote to memory of 2832 3612 jvdpp.exe 87 PID 3612 wrote to memory of 2832 3612 jvdpp.exe 87 PID 3612 wrote to memory of 2832 3612 jvdpp.exe 87 PID 2832 wrote to memory of 2428 2832 7xxrlfx.exe 88 PID 2832 wrote to memory of 2428 2832 7xxrlfx.exe 88 PID 2832 wrote to memory of 2428 2832 7xxrlfx.exe 88 PID 2428 wrote to memory of 2432 2428 frxllfl.exe 89 PID 2428 wrote to memory of 2432 2428 frxllfl.exe 89 PID 2428 wrote to memory of 2432 2428 frxllfl.exe 89 PID 2432 wrote to memory of 3560 2432 hbbthb.exe 90 PID 2432 wrote to memory of 3560 2432 hbbthb.exe 90 PID 2432 wrote to memory of 3560 2432 hbbthb.exe 90 PID 3560 wrote to memory of 1488 3560 ththbt.exe 91 PID 3560 wrote to memory of 1488 3560 ththbt.exe 91 PID 3560 wrote to memory of 1488 3560 ththbt.exe 91 PID 1488 wrote to memory of 1516 1488 9dvpv.exe 92 PID 1488 wrote to memory of 1516 1488 9dvpv.exe 92 PID 1488 wrote to memory of 1516 1488 9dvpv.exe 92 PID 1516 wrote to memory of 2704 1516 ppjdv.exe 94 PID 1516 wrote to memory of 2704 1516 ppjdv.exe 94 PID 1516 wrote to memory of 2704 1516 ppjdv.exe 94 PID 2704 wrote to memory of 3252 2704 fllfrlx.exe 95 PID 2704 wrote to memory of 3252 2704 fllfrlx.exe 95 PID 2704 wrote to memory of 3252 2704 fllfrlx.exe 95 PID 3252 wrote to memory of 5104 3252 bbtnhb.exe 96 PID 3252 wrote to memory of 5104 3252 bbtnhb.exe 96 PID 3252 wrote to memory of 5104 3252 bbtnhb.exe 96 PID 5104 wrote to memory of 3924 5104 1dvjv.exe 97 PID 5104 wrote to memory of 3924 5104 1dvjv.exe 97 PID 5104 wrote to memory of 3924 5104 1dvjv.exe 97 PID 3924 wrote to memory of 3568 3924 lrfxfxr.exe 98 PID 3924 wrote to memory of 3568 3924 lrfxfxr.exe 98 PID 3924 wrote to memory of 3568 3924 lrfxfxr.exe 98 PID 3568 wrote to memory of 1880 3568 7nhbbt.exe 99 PID 3568 wrote to memory of 1880 3568 7nhbbt.exe 99 PID 3568 wrote to memory of 1880 3568 7nhbbt.exe 99 PID 1880 wrote to memory of 5000 1880 hhhbtt.exe 100 PID 1880 wrote to memory of 5000 1880 hhhbtt.exe 100 PID 1880 wrote to memory of 5000 1880 hhhbtt.exe 100 PID 5000 wrote to memory of 3888 5000 pjjdp.exe 101 PID 5000 wrote to memory of 3888 5000 pjjdp.exe 101 PID 5000 wrote to memory of 3888 5000 pjjdp.exe 101 PID 3888 wrote to memory of 4116 3888 xfxrffx.exe 102 PID 3888 wrote to memory of 4116 3888 xfxrffx.exe 102 PID 3888 wrote to memory of 4116 3888 xfxrffx.exe 102 PID 4116 wrote to memory of 4360 4116 lxrllfr.exe 104 PID 4116 wrote to memory of 4360 4116 lxrllfr.exe 104 PID 4116 wrote to memory of 4360 4116 lxrllfr.exe 104 PID 4360 wrote to memory of 1456 4360 5nnnbn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcd59a5d5abce27dc93da68869cab0a0N.exe"C:\Users\Admin\AppData\Local\Temp\bcd59a5d5abce27dc93da68869cab0a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\rfrlxrf.exec:\rfrlxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
\??\c:\fffrfxr.exec:\fffrfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\bthbtn.exec:\bthbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\3jdpv.exec:\3jdpv.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\jvdpp.exec:\jvdpp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\7xxrlfx.exec:\7xxrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\frxllfl.exec:\frxllfl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hbbthb.exec:\hbbthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\ththbt.exec:\ththbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\9dvpv.exec:\9dvpv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\ppjdv.exec:\ppjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\fllfrlx.exec:\fllfrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\bbtnhb.exec:\bbtnhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\1dvjv.exec:\1dvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\lrfxfxr.exec:\lrfxfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\7nhbbt.exec:\7nhbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\hhhbtt.exec:\hhhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\pjjdp.exec:\pjjdp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\xfxrffx.exec:\xfxrffx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\lxrllfr.exec:\lxrllfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\5nnnbn.exec:\5nnnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\pjdvj.exec:\pjdvj.exe23⤵
- Executes dropped EXE
PID:1456 -
\??\c:\frfrlff.exec:\frfrlff.exe24⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hbtnhb.exec:\hbtnhb.exe25⤵
- Executes dropped EXE
PID:1328 -
\??\c:\bnnhnn.exec:\bnnhnn.exe26⤵
- Executes dropped EXE
PID:4268 -
\??\c:\dvpjd.exec:\dvpjd.exe27⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1lrffxx.exec:\1lrffxx.exe28⤵
- Executes dropped EXE
PID:1196 -
\??\c:\7hhbtt.exec:\7hhbtt.exe29⤵
- Executes dropped EXE
PID:3788 -
\??\c:\tntntn.exec:\tntntn.exe30⤵
- Executes dropped EXE
PID:2260 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe31⤵
- Executes dropped EXE
PID:3904 -
\??\c:\nbbtnn.exec:\nbbtnn.exe32⤵
- Executes dropped EXE
PID:3064 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe33⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rfxrlfr.exec:\rfxrlfr.exe34⤵
- Executes dropped EXE
PID:2736 -
\??\c:\nbnhtn.exec:\nbnhtn.exe35⤵
- Executes dropped EXE
PID:4296 -
\??\c:\rxlfxxr.exec:\rxlfxxr.exe36⤵
- Executes dropped EXE
PID:4236 -
\??\c:\btnhbh.exec:\btnhbh.exe37⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vpjdp.exec:\vpjdp.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\7ffrxxr.exec:\7ffrxxr.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfrlxrf.exec:\lfrlxrf.exe40⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nbhbbt.exec:\nbhbbt.exe41⤵
- Executes dropped EXE
PID:3652 -
\??\c:\htthhb.exec:\htthhb.exe42⤵
- Executes dropped EXE
PID:3828 -
\??\c:\jjpdv.exec:\jjpdv.exe43⤵
- Executes dropped EXE
PID:4608 -
\??\c:\lxffxrl.exec:\lxffxrl.exe44⤵
- Executes dropped EXE
PID:2588 -
\??\c:\fllffxr.exec:\fllffxr.exe45⤵
- Executes dropped EXE
PID:4536 -
\??\c:\tntnbb.exec:\tntnbb.exe46⤵
- Executes dropped EXE
PID:4356 -
\??\c:\jvvjv.exec:\jvvjv.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\dvdvj.exec:\dvdvj.exe48⤵
- Executes dropped EXE
PID:3300 -
\??\c:\9lfxrrr.exec:\9lfxrrr.exe49⤵
- Executes dropped EXE
PID:4328 -
\??\c:\nhnhnh.exec:\nhnhnh.exe50⤵
- Executes dropped EXE
PID:4704 -
\??\c:\pjvpj.exec:\pjvpj.exe51⤵
- Executes dropped EXE
PID:4376 -
\??\c:\9pdvd.exec:\9pdvd.exe52⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxxlrrf.exec:\fxxlrrf.exe53⤵
- Executes dropped EXE
PID:5036 -
\??\c:\7thhbt.exec:\7thhbt.exe54⤵
- Executes dropped EXE
PID:4648 -
\??\c:\pppjd.exec:\pppjd.exe55⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe56⤵
- Executes dropped EXE
PID:4832 -
\??\c:\bnhtnh.exec:\bnhtnh.exe57⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nhbtbb.exec:\nhbtbb.exe58⤵
- Executes dropped EXE
PID:5080 -
\??\c:\jvddj.exec:\jvddj.exe59⤵
- Executes dropped EXE
PID:3140 -
\??\c:\flrfrrr.exec:\flrfrrr.exe60⤵
- Executes dropped EXE
PID:2212 -
\??\c:\rlfffxf.exec:\rlfffxf.exe61⤵
- Executes dropped EXE
PID:4080 -
\??\c:\thhbbb.exec:\thhbbb.exe62⤵
- Executes dropped EXE
PID:5032 -
\??\c:\btnhhb.exec:\btnhhb.exe63⤵
- Executes dropped EXE
PID:4784 -
\??\c:\pjjdj.exec:\pjjdj.exe64⤵
- Executes dropped EXE
PID:2820 -
\??\c:\lffrfxr.exec:\lffrfxr.exe65⤵
- Executes dropped EXE
PID:532 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe66⤵PID:1428
-
\??\c:\hnnhtt.exec:\hnnhtt.exe67⤵PID:1852
-
\??\c:\tbthbb.exec:\tbthbb.exe68⤵PID:2472
-
\??\c:\jppjp.exec:\jppjp.exe69⤵PID:764
-
\??\c:\jvddd.exec:\jvddd.exe70⤵PID:4756
-
\??\c:\lxfrlfr.exec:\lxfrlfr.exe71⤵PID:4384
-
\??\c:\xfxxxrl.exec:\xfxxxrl.exe72⤵PID:4876
-
\??\c:\5btnbt.exec:\5btnbt.exe73⤵PID:2296
-
\??\c:\dvdvv.exec:\dvdvv.exe74⤵PID:3068
-
\??\c:\fxfxfrx.exec:\fxfxfrx.exe75⤵PID:1912
-
\??\c:\lfxrlfx.exec:\lfxrlfx.exe76⤵PID:4552
-
\??\c:\1tbntn.exec:\1tbntn.exe77⤵PID:1492
-
\??\c:\tbtntn.exec:\tbtntn.exe78⤵PID:1840
-
\??\c:\hnnbnn.exec:\hnnbnn.exe79⤵PID:1124
-
\??\c:\pdjdp.exec:\pdjdp.exe80⤵PID:1328
-
\??\c:\1xxlfxl.exec:\1xxlfxl.exe81⤵PID:4284
-
\??\c:\llrlffl.exec:\llrlffl.exe82⤵PID:876
-
\??\c:\nbtnhh.exec:\nbtnhh.exe83⤵PID:456
-
\??\c:\vpjdp.exec:\vpjdp.exe84⤵PID:208
-
\??\c:\pjjdp.exec:\pjjdp.exe85⤵PID:392
-
\??\c:\fxxrlxx.exec:\fxxrlxx.exe86⤵PID:3600
-
\??\c:\fxrfrrf.exec:\fxrfrrf.exe87⤵PID:3508
-
\??\c:\btthtn.exec:\btthtn.exe88⤵PID:1688
-
\??\c:\hbbthb.exec:\hbbthb.exe89⤵PID:3064
-
\??\c:\vpdvd.exec:\vpdvd.exe90⤵PID:3152
-
\??\c:\1vvjv.exec:\1vvjv.exe91⤵PID:4920
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe92⤵PID:3900
-
\??\c:\rxfffff.exec:\rxfffff.exe93⤵PID:3248
-
\??\c:\nnttnn.exec:\nnttnn.exe94⤵PID:1192
-
\??\c:\bbthbb.exec:\bbthbb.exe95⤵PID:2156
-
\??\c:\dpdvj.exec:\dpdvj.exe96⤵PID:4808
-
\??\c:\vvddv.exec:\vvddv.exe97⤵PID:3692
-
\??\c:\rfllfxr.exec:\rfllfxr.exe98⤵PID:2544
-
\??\c:\vpvpp.exec:\vpvpp.exe99⤵PID:4108
-
\??\c:\fxxrllf.exec:\fxxrllf.exe100⤵PID:4708
-
\??\c:\flfrlxx.exec:\flfrlxx.exe101⤵PID:4140
-
\??\c:\1nhhbt.exec:\1nhhbt.exe102⤵PID:4496
-
\??\c:\thhbbt.exec:\thhbbt.exe103⤵PID:2372
-
\??\c:\jdjdv.exec:\jdjdv.exe104⤵PID:4760
-
\??\c:\1fffxxx.exec:\1fffxxx.exe105⤵PID:3384
-
\??\c:\tbbntn.exec:\tbbntn.exe106⤵PID:4048
-
\??\c:\btnbhb.exec:\btnbhb.exe107⤵PID:2540
-
\??\c:\1dvpj.exec:\1dvpj.exe108⤵PID:920
-
\??\c:\vdjvj.exec:\vdjvj.exe109⤵PID:1352
-
\??\c:\flfxlfx.exec:\flfxlfx.exe110⤵PID:4120
-
\??\c:\lxxrlfr.exec:\lxxrlfr.exe111⤵PID:3852
-
\??\c:\btthhh.exec:\btthhh.exe112⤵PID:2512
-
\??\c:\tnnhnh.exec:\tnnhnh.exe113⤵PID:1512
-
\??\c:\jjjdj.exec:\jjjdj.exe114⤵PID:4864
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe115⤵PID:2968
-
\??\c:\lxfxxrx.exec:\lxfxxrx.exe116⤵PID:4940
-
\??\c:\ntbnbt.exec:\ntbnbt.exe117⤵PID:3848
-
\??\c:\hbbtnh.exec:\hbbtnh.exe118⤵PID:2108
-
\??\c:\dpjdd.exec:\dpjdd.exe119⤵PID:3304
-
\??\c:\xlfrffx.exec:\xlfrffx.exe120⤵PID:352
-
\??\c:\xlfxxlf.exec:\xlfxxlf.exe121⤵PID:3024
-
\??\c:\btnhtn.exec:\btnhtn.exe122⤵PID:1240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-