Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11-08-2024 22:09
Static task
static1
Behavioral task
behavioral1
Sample
69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe
Resource
win7-20240705-en
General
-
Target
69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe
-
Size
95KB
-
MD5
3380cb5005b0b076fc984b1729655cca
-
SHA1
40ff49d92054eb71167d4c90d38a525b82a51fd4
-
SHA256
69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e
-
SHA512
5db406f61e1cce6f2ed4609dc88fbe5059f4bb15dd9b1ff5b048cb6b15257c523c2790845e1bf51ce3e0a775e68a3c24699fe5c5c42f0a8cef266cd0a097e909
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoLuePjDYlR3hnjKXIQSe9oEY+n:ymb3NkkiQ3mdBjFoLucjDilOZhoy
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4100-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 jjjjd.exe 4912 hbtnhb.exe 2104 bhhbbb.exe 1940 xflfflr.exe 4284 thntth.exe 1924 jppjd.exe 2964 9ffxrlf.exe 2000 tnthbn.exe 1480 nhbtnn.exe 2560 pdvvj.exe 3996 jdjdd.exe 448 rlfxrlf.exe 2568 nhbtnh.exe 4404 hnnbtn.exe 4256 pdjdp.exe 980 rllfxrl.exe 940 flxxfxf.exe 3904 btnbbn.exe 368 pdjvd.exe 2476 pjdvd.exe 1084 rflxrlf.exe 5112 5nthbt.exe 556 pjpvp.exe 4136 djddv.exe 3296 xrrfrrl.exe 3112 xrrlfxx.exe 4028 1nnhbt.exe 2284 7jjdv.exe 1728 lffxffl.exe 4140 xlrlffx.exe 2444 hbbbbn.exe 1804 vjpjv.exe 4312 jpjpv.exe 840 rlxrlrr.exe 1568 7nhbth.exe 4328 hhhbtn.exe 752 dddjv.exe 2488 fxxxlxx.exe 3288 lffxffx.exe 2916 1nthbb.exe 1460 vpvpd.exe 2104 pdjdv.exe 4636 lrxlfxr.exe 552 3xlffxr.exe 4284 bnbnnh.exe 1924 tbtbbh.exe 1036 pjdvj.exe 4172 7pjdp.exe 5012 lrrlfff.exe 3304 7tttnn.exe 2688 nnhnbb.exe 4984 dvdpv.exe 2040 pjjpj.exe 3696 3rlfrrf.exe 2316 nbbbbn.exe 820 dpjdp.exe 5060 djjpv.exe 4256 hhhbbh.exe 4416 ddjvp.exe 1008 llfllxr.exe 4496 fffflfx.exe 2596 hhhtnb.exe 4972 nbbtnn.exe 3040 dvpvj.exe -
resource yara_rule behavioral2/memory/4100-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 1996 4100 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 84 PID 4100 wrote to memory of 1996 4100 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 84 PID 4100 wrote to memory of 1996 4100 69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe 84 PID 1996 wrote to memory of 4912 1996 jjjjd.exe 85 PID 1996 wrote to memory of 4912 1996 jjjjd.exe 85 PID 1996 wrote to memory of 4912 1996 jjjjd.exe 85 PID 4912 wrote to memory of 2104 4912 hbtnhb.exe 86 PID 4912 wrote to memory of 2104 4912 hbtnhb.exe 86 PID 4912 wrote to memory of 2104 4912 hbtnhb.exe 86 PID 2104 wrote to memory of 1940 2104 bhhbbb.exe 87 PID 2104 wrote to memory of 1940 2104 bhhbbb.exe 87 PID 2104 wrote to memory of 1940 2104 bhhbbb.exe 87 PID 1940 wrote to memory of 4284 1940 xflfflr.exe 88 PID 1940 wrote to memory of 4284 1940 xflfflr.exe 88 PID 1940 wrote to memory of 4284 1940 xflfflr.exe 88 PID 4284 wrote to memory of 1924 4284 thntth.exe 89 PID 4284 wrote to memory of 1924 4284 thntth.exe 89 PID 4284 wrote to memory of 1924 4284 thntth.exe 89 PID 1924 wrote to memory of 2964 1924 jppjd.exe 90 PID 1924 wrote to memory of 2964 1924 jppjd.exe 90 PID 1924 wrote to memory of 2964 1924 jppjd.exe 90 PID 2964 wrote to memory of 2000 2964 9ffxrlf.exe 91 PID 2964 wrote to memory of 2000 2964 9ffxrlf.exe 91 PID 2964 wrote to memory of 2000 2964 9ffxrlf.exe 91 PID 2000 wrote to memory of 1480 2000 tnthbn.exe 92 PID 2000 wrote to memory of 1480 2000 tnthbn.exe 92 PID 2000 wrote to memory of 1480 2000 tnthbn.exe 92 PID 1480 wrote to memory of 2560 1480 nhbtnn.exe 93 PID 1480 wrote to memory of 2560 1480 nhbtnn.exe 93 PID 1480 wrote to memory of 2560 1480 nhbtnn.exe 93 PID 2560 wrote to memory of 3996 2560 pdvvj.exe 94 PID 2560 wrote to memory of 3996 2560 pdvvj.exe 94 PID 2560 wrote to memory of 3996 2560 pdvvj.exe 94 PID 3996 wrote to memory of 448 3996 jdjdd.exe 95 PID 3996 wrote to memory of 448 3996 jdjdd.exe 95 PID 3996 wrote to memory of 448 3996 jdjdd.exe 95 PID 448 wrote to memory of 2568 448 rlfxrlf.exe 96 PID 448 wrote to memory of 2568 448 rlfxrlf.exe 96 PID 448 wrote to memory of 2568 448 rlfxrlf.exe 96 PID 2568 wrote to memory of 4404 2568 nhbtnh.exe 97 PID 2568 wrote to memory of 4404 2568 nhbtnh.exe 97 PID 2568 wrote to memory of 4404 2568 nhbtnh.exe 97 PID 4404 wrote to memory of 4256 4404 hnnbtn.exe 98 PID 4404 wrote to memory of 4256 4404 hnnbtn.exe 98 PID 4404 wrote to memory of 4256 4404 hnnbtn.exe 98 PID 4256 wrote to memory of 980 4256 pdjdp.exe 99 PID 4256 wrote to memory of 980 4256 pdjdp.exe 99 PID 4256 wrote to memory of 980 4256 pdjdp.exe 99 PID 980 wrote to memory of 940 980 rllfxrl.exe 100 PID 980 wrote to memory of 940 980 rllfxrl.exe 100 PID 980 wrote to memory of 940 980 rllfxrl.exe 100 PID 940 wrote to memory of 3904 940 flxxfxf.exe 102 PID 940 wrote to memory of 3904 940 flxxfxf.exe 102 PID 940 wrote to memory of 3904 940 flxxfxf.exe 102 PID 3904 wrote to memory of 368 3904 btnbbn.exe 103 PID 3904 wrote to memory of 368 3904 btnbbn.exe 103 PID 3904 wrote to memory of 368 3904 btnbbn.exe 103 PID 368 wrote to memory of 2476 368 pdjvd.exe 104 PID 368 wrote to memory of 2476 368 pdjvd.exe 104 PID 368 wrote to memory of 2476 368 pdjvd.exe 104 PID 2476 wrote to memory of 1084 2476 pjdvd.exe 105 PID 2476 wrote to memory of 1084 2476 pjdvd.exe 105 PID 2476 wrote to memory of 1084 2476 pjdvd.exe 105 PID 1084 wrote to memory of 5112 1084 rflxrlf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe"C:\Users\Admin\AppData\Local\Temp\69ce4bf2edda73e81efe50cb14d6e559fd234588157bcc3937f9072298a7a41e.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
\??\c:\jjjjd.exec:\jjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\hbtnhb.exec:\hbtnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\bhhbbb.exec:\bhhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\xflfflr.exec:\xflfflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\thntth.exec:\thntth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\jppjd.exec:\jppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\9ffxrlf.exec:\9ffxrlf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\tnthbn.exec:\tnthbn.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nhbtnn.exec:\nhbtnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\pdvvj.exec:\pdvvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\jdjdd.exec:\jdjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nhbtnh.exec:\nhbtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\hnnbtn.exec:\hnnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\pdjdp.exec:\pdjdp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\rllfxrl.exec:\rllfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:980 -
\??\c:\flxxfxf.exec:\flxxfxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\btnbbn.exec:\btnbbn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\pdjvd.exec:\pdjvd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\pjdvd.exec:\pjdvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rflxrlf.exec:\rflxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\5nthbt.exec:\5nthbt.exe23⤵
- Executes dropped EXE
PID:5112 -
\??\c:\pjpvp.exec:\pjpvp.exe24⤵
- Executes dropped EXE
PID:556 -
\??\c:\djddv.exec:\djddv.exe25⤵
- Executes dropped EXE
PID:4136 -
\??\c:\xrrfrrl.exec:\xrrfrrl.exe26⤵
- Executes dropped EXE
PID:3296 -
\??\c:\xrrlfxx.exec:\xrrlfxx.exe27⤵
- Executes dropped EXE
PID:3112 -
\??\c:\1nnhbt.exec:\1nnhbt.exe28⤵
- Executes dropped EXE
PID:4028 -
\??\c:\7jjdv.exec:\7jjdv.exe29⤵
- Executes dropped EXE
PID:2284 -
\??\c:\lffxffl.exec:\lffxffl.exe30⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1728 -
\??\c:\xlrlffx.exec:\xlrlffx.exe31⤵
- Executes dropped EXE
PID:4140 -
\??\c:\hbbbbn.exec:\hbbbbn.exe32⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vjpjv.exec:\vjpjv.exe33⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jpjpv.exec:\jpjpv.exe34⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe35⤵
- Executes dropped EXE
PID:840 -
\??\c:\7nhbth.exec:\7nhbth.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\hhhbtn.exec:\hhhbtn.exe37⤵
- Executes dropped EXE
PID:4328 -
\??\c:\dddjv.exec:\dddjv.exe38⤵
- Executes dropped EXE
PID:752 -
\??\c:\fxxxlxx.exec:\fxxxlxx.exe39⤵
- Executes dropped EXE
PID:2488 -
\??\c:\lffxffx.exec:\lffxffx.exe40⤵
- Executes dropped EXE
PID:3288 -
\??\c:\1nthbb.exec:\1nthbb.exe41⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vpvpd.exec:\vpvpd.exe42⤵
- Executes dropped EXE
PID:1460 -
\??\c:\pdjdv.exec:\pdjdv.exe43⤵
- Executes dropped EXE
PID:2104 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe44⤵
- Executes dropped EXE
PID:4636 -
\??\c:\3xlffxr.exec:\3xlffxr.exe45⤵
- Executes dropped EXE
PID:552 -
\??\c:\bnbnnh.exec:\bnbnnh.exe46⤵
- Executes dropped EXE
PID:4284 -
\??\c:\tbtbbh.exec:\tbtbbh.exe47⤵
- Executes dropped EXE
PID:1924 -
\??\c:\pjdvj.exec:\pjdvj.exe48⤵
- Executes dropped EXE
PID:1036 -
\??\c:\7pjdp.exec:\7pjdp.exe49⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lrrlfff.exec:\lrrlfff.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5012 -
\??\c:\7tttnn.exec:\7tttnn.exe51⤵
- Executes dropped EXE
PID:3304 -
\??\c:\nnhnbb.exec:\nnhnbb.exe52⤵
- Executes dropped EXE
PID:2688 -
\??\c:\dvdpv.exec:\dvdpv.exe53⤵
- Executes dropped EXE
PID:4984 -
\??\c:\pjjpj.exec:\pjjpj.exe54⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3rlfrrf.exec:\3rlfrrf.exe55⤵
- Executes dropped EXE
PID:3696 -
\??\c:\nbbbbn.exec:\nbbbbn.exe56⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dpjdp.exec:\dpjdp.exe57⤵
- Executes dropped EXE
PID:820 -
\??\c:\djjpv.exec:\djjpv.exe58⤵
- Executes dropped EXE
PID:5060 -
\??\c:\hhhbbh.exec:\hhhbbh.exe59⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ddjvp.exec:\ddjvp.exe60⤵
- Executes dropped EXE
PID:4416 -
\??\c:\llfllxr.exec:\llfllxr.exe61⤵
- Executes dropped EXE
PID:1008 -
\??\c:\fffflfx.exec:\fffflfx.exe62⤵
- Executes dropped EXE
PID:4496 -
\??\c:\hhhtnb.exec:\hhhtnb.exe63⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nbbtnn.exec:\nbbtnn.exe64⤵
- Executes dropped EXE
PID:4972 -
\??\c:\dvpvj.exec:\dvpvj.exe65⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe66⤵PID:964
-
\??\c:\tnhhhh.exec:\tnhhhh.exe67⤵PID:2100
-
\??\c:\ffxlfrl.exec:\ffxlfrl.exe68⤵PID:4484
-
\??\c:\nhhtht.exec:\nhhtht.exe69⤵PID:1820
-
\??\c:\dppjv.exec:\dppjv.exe70⤵PID:5112
-
\??\c:\rlffrxr.exec:\rlffrxr.exe71⤵PID:916
-
\??\c:\bbbthb.exec:\bbbthb.exe72⤵PID:3532
-
\??\c:\1vjvp.exec:\1vjvp.exe73⤵PID:4792
-
\??\c:\xxfxffx.exec:\xxfxffx.exe74⤵PID:1164
-
\??\c:\frxrrrr.exec:\frxrrrr.exe75⤵PID:1096
-
\??\c:\7nbthh.exec:\7nbthh.exe76⤵PID:2152
-
\??\c:\tnnhbt.exec:\tnnhbt.exe77⤵PID:3376
-
\??\c:\jvvpj.exec:\jvvpj.exe78⤵PID:3452
-
\??\c:\rlfrffx.exec:\rlfrffx.exe79⤵PID:2844
-
\??\c:\5rrrrxx.exec:\5rrrrxx.exe80⤵PID:4744
-
\??\c:\nntbnn.exec:\nntbnn.exe81⤵PID:4368
-
\??\c:\vdjjv.exec:\vdjjv.exe82⤵PID:4536
-
\??\c:\3jpjv.exec:\3jpjv.exe83⤵PID:60
-
\??\c:\frfrrll.exec:\frfrrll.exe84⤵PID:4312
-
\??\c:\rlffxxl.exec:\rlffxxl.exe85⤵PID:840
-
\??\c:\9thbnh.exec:\9thbnh.exe86⤵PID:1568
-
\??\c:\jdpdd.exec:\jdpdd.exe87⤵PID:3960
-
\??\c:\vdjdj.exec:\vdjdj.exe88⤵PID:1536
-
\??\c:\xlrxlxf.exec:\xlrxlxf.exe89⤵PID:4472
-
\??\c:\3rrlrlf.exec:\3rrlrlf.exe90⤵PID:4004
-
\??\c:\hhhbtn.exec:\hhhbtn.exe91⤵PID:216
-
\??\c:\vvvvp.exec:\vvvvp.exe92⤵PID:4988
-
\??\c:\vjjvj.exec:\vjjvj.exe93⤵PID:3140
-
\??\c:\llrlrrf.exec:\llrlrrf.exe94⤵PID:1168
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe95⤵PID:3972
-
\??\c:\thhtnh.exec:\thhtnh.exe96⤵PID:2972
-
\??\c:\vppdp.exec:\vppdp.exe97⤵PID:3740
-
\??\c:\jvvpj.exec:\jvvpj.exe98⤵PID:2296
-
\??\c:\lfxlfxl.exec:\lfxlfxl.exe99⤵PID:4964
-
\??\c:\9lrlxxf.exec:\9lrlxxf.exe100⤵PID:2852
-
\??\c:\htnhbt.exec:\htnhbt.exe101⤵PID:4444
-
\??\c:\nthbtn.exec:\nthbtn.exe102⤵PID:1752
-
\??\c:\9pjvj.exec:\9pjvj.exe103⤵PID:4104
-
\??\c:\jdpjd.exec:\jdpjd.exe104⤵PID:3108
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe105⤵PID:3848
-
\??\c:\7hhbnn.exec:\7hhbnn.exe106⤵PID:2984
-
\??\c:\btnhhh.exec:\btnhhh.exe107⤵PID:3056
-
\??\c:\vvvjj.exec:\vvvjj.exe108⤵PID:1612
-
\??\c:\ddvvp.exec:\ddvvp.exe109⤵PID:4400
-
\??\c:\xlfxlxl.exec:\xlfxlxl.exe110⤵PID:4932
-
\??\c:\frrflfx.exec:\frrflfx.exe111⤵PID:1692
-
\??\c:\1nnhnt.exec:\1nnhnt.exe112⤵PID:2320
-
\??\c:\3tbbnb.exec:\3tbbnb.exe113⤵PID:2896
-
\??\c:\jdvpd.exec:\jdvpd.exe114⤵PID:952
-
\??\c:\dvjvd.exec:\dvjvd.exe115⤵PID:368
-
\??\c:\llffrfx.exec:\llffrfx.exe116⤵PID:3640
-
\??\c:\3bhbnt.exec:\3bhbnt.exe117⤵PID:464
-
\??\c:\3thtnh.exec:\3thtnh.exe118⤵PID:3516
-
\??\c:\pjdpd.exec:\pjdpd.exe119⤵PID:2036
-
\??\c:\pdvjv.exec:\pdvjv.exe120⤵PID:916
-
\??\c:\lllfxrl.exec:\lllfxrl.exe121⤵PID:1816
-
\??\c:\btntnn.exec:\btntnn.exe122⤵PID:2512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-