Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05-09-2024 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee1f72111c0cedfbd9c336326b09a7a0N.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
ee1f72111c0cedfbd9c336326b09a7a0N.exe
-
Size
64KB
-
MD5
ee1f72111c0cedfbd9c336326b09a7a0
-
SHA1
39c552d056486d65884f18b575e80002f4febf55
-
SHA256
b0c0ff30c0e52ec86e184ca94f809557a39ae9837d57d107dc3d9533f98c541f
-
SHA512
17f47863480fadd4afbaacc2065bbba5d52cdb75969eacc6228e6395895d9ebe3f0be73f6cfff9226b955c4fd140e131d2d055b5c8cf769db9f09509c92148e8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qPt31:ymb3NkkiQ3mdBjFIj+qX
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2072-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/660-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1992-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3464 jjjjd.exe 208 pjvpd.exe 3896 fffxrrx.exe 3636 ttbtnn.exe 3580 dvvdd.exe 4764 lfllfff.exe 660 hthtbb.exe 5084 dpvvp.exe 3200 pdvpv.exe 1992 llfrllf.exe 1368 bnnnhn.exe 4564 9dvvp.exe 2320 jdddv.exe 2932 7rxrlll.exe 1472 hbnnnn.exe 4836 dvjdv.exe 2908 rllffff.exe 4036 hbhhbb.exe 1388 tnttbh.exe 4292 dvdvv.exe 4532 lfffxxx.exe 3844 btnbhn.exe 2632 nbnnhb.exe 1208 5djdv.exe 2304 jdddv.exe 2548 lfllfff.exe 1344 3nnnnb.exe 3260 nbbnhb.exe 3740 jdjjj.exe 2208 rrfffxr.exe 1436 rxflrxx.exe 1580 tnbbnn.exe 4988 nthbnb.exe 2492 dvppd.exe 4800 3djjd.exe 3212 lxfxlrl.exe 2508 bntnhh.exe 4352 hbhhnt.exe 2800 dddvp.exe 468 frxrflf.exe 2368 7rrlxff.exe 3256 bbhhbh.exe 2016 nhnhnn.exe 3768 pjjjd.exe 1032 fffxrrr.exe 2804 ffxrrxx.exe 3204 xrlfrxr.exe 3276 9btnnn.exe 4764 nhnhhh.exe 4288 jpppj.exe 4272 jvjdd.exe 2920 rxxxrrr.exe 3200 ffllffx.exe 4668 ttbbhh.exe 2464 hbbbth.exe 1868 pvjdv.exe 4240 1jjdv.exe 3868 xlxrllr.exe 1904 fxlllff.exe 3820 htnntt.exe 2932 hthbtt.exe 732 ppvvd.exe 4200 dpvpd.exe 4904 lfffxxr.exe -
resource yara_rule behavioral2/memory/2072-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/660-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1992-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfflllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3djjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rrrrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2072 wrote to memory of 3464 2072 ee1f72111c0cedfbd9c336326b09a7a0N.exe 83 PID 2072 wrote to memory of 3464 2072 ee1f72111c0cedfbd9c336326b09a7a0N.exe 83 PID 2072 wrote to memory of 3464 2072 ee1f72111c0cedfbd9c336326b09a7a0N.exe 83 PID 3464 wrote to memory of 208 3464 jjjjd.exe 84 PID 3464 wrote to memory of 208 3464 jjjjd.exe 84 PID 3464 wrote to memory of 208 3464 jjjjd.exe 84 PID 208 wrote to memory of 3896 208 pjvpd.exe 85 PID 208 wrote to memory of 3896 208 pjvpd.exe 85 PID 208 wrote to memory of 3896 208 pjvpd.exe 85 PID 3896 wrote to memory of 3636 3896 fffxrrx.exe 86 PID 3896 wrote to memory of 3636 3896 fffxrrx.exe 86 PID 3896 wrote to memory of 3636 3896 fffxrrx.exe 86 PID 3636 wrote to memory of 3580 3636 ttbtnn.exe 87 PID 3636 wrote to memory of 3580 3636 ttbtnn.exe 87 PID 3636 wrote to memory of 3580 3636 ttbtnn.exe 87 PID 3580 wrote to memory of 4764 3580 dvvdd.exe 88 PID 3580 wrote to memory of 4764 3580 dvvdd.exe 88 PID 3580 wrote to memory of 4764 3580 dvvdd.exe 88 PID 4764 wrote to memory of 660 4764 lfllfff.exe 89 PID 4764 wrote to memory of 660 4764 lfllfff.exe 89 PID 4764 wrote to memory of 660 4764 lfllfff.exe 89 PID 660 wrote to memory of 5084 660 hthtbb.exe 91 PID 660 wrote to memory of 5084 660 hthtbb.exe 91 PID 660 wrote to memory of 5084 660 hthtbb.exe 91 PID 5084 wrote to memory of 3200 5084 dpvvp.exe 92 PID 5084 wrote to memory of 3200 5084 dpvvp.exe 92 PID 5084 wrote to memory of 3200 5084 dpvvp.exe 92 PID 3200 wrote to memory of 1992 3200 pdvpv.exe 93 PID 3200 wrote to memory of 1992 3200 pdvpv.exe 93 PID 3200 wrote to memory of 1992 3200 pdvpv.exe 93 PID 1992 wrote to memory of 1368 1992 llfrllf.exe 94 PID 1992 wrote to memory of 1368 1992 llfrllf.exe 94 PID 1992 wrote to memory of 1368 1992 llfrllf.exe 94 PID 1368 wrote to memory of 4564 1368 bnnnhn.exe 95 PID 1368 wrote to memory of 4564 1368 bnnnhn.exe 95 PID 1368 wrote to memory of 4564 1368 bnnnhn.exe 95 PID 4564 wrote to memory of 2320 4564 9dvvp.exe 96 PID 4564 wrote to memory of 2320 4564 9dvvp.exe 96 PID 4564 wrote to memory of 2320 4564 9dvvp.exe 96 PID 2320 wrote to memory of 2932 2320 jdddv.exe 97 PID 2320 wrote to memory of 2932 2320 jdddv.exe 97 PID 2320 wrote to memory of 2932 2320 jdddv.exe 97 PID 2932 wrote to memory of 1472 2932 7rxrlll.exe 99 PID 2932 wrote to memory of 1472 2932 7rxrlll.exe 99 PID 2932 wrote to memory of 1472 2932 7rxrlll.exe 99 PID 1472 wrote to memory of 4836 1472 hbnnnn.exe 100 PID 1472 wrote to memory of 4836 1472 hbnnnn.exe 100 PID 1472 wrote to memory of 4836 1472 hbnnnn.exe 100 PID 4836 wrote to memory of 2908 4836 dvjdv.exe 101 PID 4836 wrote to memory of 2908 4836 dvjdv.exe 101 PID 4836 wrote to memory of 2908 4836 dvjdv.exe 101 PID 2908 wrote to memory of 4036 2908 rllffff.exe 102 PID 2908 wrote to memory of 4036 2908 rllffff.exe 102 PID 2908 wrote to memory of 4036 2908 rllffff.exe 102 PID 4036 wrote to memory of 1388 4036 hbhhbb.exe 104 PID 4036 wrote to memory of 1388 4036 hbhhbb.exe 104 PID 4036 wrote to memory of 1388 4036 hbhhbb.exe 104 PID 1388 wrote to memory of 4292 1388 tnttbh.exe 105 PID 1388 wrote to memory of 4292 1388 tnttbh.exe 105 PID 1388 wrote to memory of 4292 1388 tnttbh.exe 105 PID 4292 wrote to memory of 4532 4292 dvdvv.exe 106 PID 4292 wrote to memory of 4532 4292 dvdvv.exe 106 PID 4292 wrote to memory of 4532 4292 dvdvv.exe 106 PID 4532 wrote to memory of 3844 4532 lfffxxx.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee1f72111c0cedfbd9c336326b09a7a0N.exe"C:\Users\Admin\AppData\Local\Temp\ee1f72111c0cedfbd9c336326b09a7a0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\jjjjd.exec:\jjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\pjvpd.exec:\pjvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\fffxrrx.exec:\fffxrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\ttbtnn.exec:\ttbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\dvvdd.exec:\dvvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\lfllfff.exec:\lfllfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\hthtbb.exec:\hthtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\dpvvp.exec:\dpvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\pdvpv.exec:\pdvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\llfrllf.exec:\llfrllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bnnnhn.exec:\bnnnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\9dvvp.exec:\9dvvp.exe13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\jdddv.exec:\jdddv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\7rxrlll.exec:\7rxrlll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hbnnnn.exec:\hbnnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\dvjdv.exec:\dvjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\rllffff.exec:\rllffff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\hbhhbb.exec:\hbhhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\tnttbh.exec:\tnttbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\dvdvv.exec:\dvdvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\lfffxxx.exec:\lfffxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\btnbhn.exec:\btnbhn.exe23⤵
- Executes dropped EXE
PID:3844 -
\??\c:\nbnnhb.exec:\nbnnhb.exe24⤵
- Executes dropped EXE
PID:2632 -
\??\c:\5djdv.exec:\5djdv.exe25⤵
- Executes dropped EXE
PID:1208 -
\??\c:\jdddv.exec:\jdddv.exe26⤵
- Executes dropped EXE
PID:2304 -
\??\c:\lfllfff.exec:\lfllfff.exe27⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3nnnnb.exec:\3nnnnb.exe28⤵
- Executes dropped EXE
PID:1344 -
\??\c:\nbbnhb.exec:\nbbnhb.exe29⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jdjjj.exec:\jdjjj.exe30⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rrfffxr.exec:\rrfffxr.exe31⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rxflrxx.exec:\rxflrxx.exe32⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tnbbnn.exec:\tnbbnn.exe33⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nthbnb.exec:\nthbnb.exe34⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dvppd.exec:\dvppd.exe35⤵
- Executes dropped EXE
PID:2492 -
\??\c:\3djjd.exec:\3djjd.exe36⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lxfxlrl.exec:\lxfxlrl.exe37⤵
- Executes dropped EXE
PID:3212 -
\??\c:\bntnhh.exec:\bntnhh.exe38⤵
- Executes dropped EXE
PID:2508 -
\??\c:\hbhhnt.exec:\hbhhnt.exe39⤵
- Executes dropped EXE
PID:4352 -
\??\c:\dddvp.exec:\dddvp.exe40⤵
- Executes dropped EXE
PID:2800 -
\??\c:\frxrflf.exec:\frxrflf.exe41⤵
- Executes dropped EXE
PID:468 -
\??\c:\7rrlxff.exec:\7rrlxff.exe42⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bbhhbh.exec:\bbhhbh.exe43⤵
- Executes dropped EXE
PID:3256 -
\??\c:\nhnhnn.exec:\nhnhnn.exe44⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pjjjd.exec:\pjjjd.exe45⤵
- Executes dropped EXE
PID:3768 -
\??\c:\fffxrrr.exec:\fffxrrr.exe46⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ffxrrxx.exec:\ffxrrxx.exe47⤵
- Executes dropped EXE
PID:2804 -
\??\c:\xrlfrxr.exec:\xrlfrxr.exe48⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9btnnn.exec:\9btnnn.exe49⤵
- Executes dropped EXE
PID:3276 -
\??\c:\nhnhhh.exec:\nhnhhh.exe50⤵
- Executes dropped EXE
PID:4764 -
\??\c:\jpppj.exec:\jpppj.exe51⤵
- Executes dropped EXE
PID:4288 -
\??\c:\jvjdd.exec:\jvjdd.exe52⤵
- Executes dropped EXE
PID:4272 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe53⤵
- Executes dropped EXE
PID:2920 -
\??\c:\ffllffx.exec:\ffllffx.exe54⤵
- Executes dropped EXE
PID:3200 -
\??\c:\ttbbhh.exec:\ttbbhh.exe55⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hbbbth.exec:\hbbbth.exe56⤵
- Executes dropped EXE
PID:2464 -
\??\c:\pvjdv.exec:\pvjdv.exe57⤵
- Executes dropped EXE
PID:1868 -
\??\c:\1jjdv.exec:\1jjdv.exe58⤵
- Executes dropped EXE
PID:4240 -
\??\c:\xlxrllr.exec:\xlxrllr.exe59⤵
- Executes dropped EXE
PID:3868 -
\??\c:\fxlllff.exec:\fxlllff.exe60⤵
- Executes dropped EXE
PID:1904 -
\??\c:\htnntt.exec:\htnntt.exe61⤵
- Executes dropped EXE
PID:3820 -
\??\c:\hthbtt.exec:\hthbtt.exe62⤵
- Executes dropped EXE
PID:2932 -
\??\c:\ppvvd.exec:\ppvvd.exe63⤵
- Executes dropped EXE
PID:732 -
\??\c:\dpvpd.exec:\dpvpd.exe64⤵
- Executes dropped EXE
PID:4200 -
\??\c:\lfffxxr.exec:\lfffxxr.exe65⤵
- Executes dropped EXE
PID:4904 -
\??\c:\llrlffr.exec:\llrlffr.exe66⤵PID:4992
-
\??\c:\bhnttt.exec:\bhnttt.exe67⤵PID:3576
-
\??\c:\dvddd.exec:\dvddd.exe68⤵PID:1996
-
\??\c:\djdjd.exec:\djdjd.exe69⤵PID:452
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:3140
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe71⤵PID:2496
-
\??\c:\hntbbb.exec:\hntbbb.exe72⤵PID:3048
-
\??\c:\hhnnhn.exec:\hhnnhn.exe73⤵PID:3240
-
\??\c:\jddvj.exec:\jddvj.exe74⤵PID:3916
-
\??\c:\jjjjd.exec:\jjjjd.exe75⤵PID:1176
-
\??\c:\3vddp.exec:\3vddp.exe76⤵PID:2064
-
\??\c:\lxfxllx.exec:\lxfxllx.exe77⤵PID:1208
-
\??\c:\ntttnn.exec:\ntttnn.exe78⤵PID:2304
-
\??\c:\hntnbb.exec:\hntnbb.exe79⤵PID:2548
-
\??\c:\dvvpj.exec:\dvvpj.exe80⤵PID:444
-
\??\c:\dpppd.exec:\dpppd.exe81⤵PID:948
-
\??\c:\pdppp.exec:\pdppp.exe82⤵PID:4056
-
\??\c:\lxrrfxx.exec:\lxrrfxx.exe83⤵PID:4828
-
\??\c:\lxxxxxr.exec:\lxxxxxr.exe84⤵PID:3064
-
\??\c:\tttnnn.exec:\tttnnn.exe85⤵PID:1876
-
\??\c:\tbbhtt.exec:\tbbhtt.exe86⤵PID:5048
-
\??\c:\ppdvp.exec:\ppdvp.exe87⤵PID:1580
-
\??\c:\jjjdv.exec:\jjjdv.exe88⤵PID:4976
-
\??\c:\thhhhn.exec:\thhhhn.exe89⤵PID:2492
-
\??\c:\vpvdv.exec:\vpvdv.exe90⤵PID:4568
-
\??\c:\jdpjp.exec:\jdpjp.exe91⤵PID:1584
-
\??\c:\pjpdv.exec:\pjpdv.exe92⤵PID:4116
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe93⤵PID:2792
-
\??\c:\fxfxlll.exec:\fxfxlll.exe94⤵PID:3108
-
\??\c:\btbtnn.exec:\btbtnn.exe95⤵PID:4548
-
\??\c:\vdvvj.exec:\vdvvj.exe96⤵PID:4892
-
\??\c:\jddvv.exec:\jddvv.exe97⤵PID:4776
-
\??\c:\flllfff.exec:\flllfff.exe98⤵PID:628
-
\??\c:\rxlllff.exec:\rxlllff.exe99⤵PID:3764
-
\??\c:\hhtthh.exec:\hhtthh.exe100⤵PID:1712
-
\??\c:\pjjjj.exec:\pjjjj.exe101⤵PID:1564
-
\??\c:\fxfrxlr.exec:\fxfrxlr.exe102⤵PID:2680
-
\??\c:\fxfllrr.exec:\fxfllrr.exe103⤵PID:932
-
\??\c:\llllfll.exec:\llllfll.exe104⤵PID:2400
-
\??\c:\bbhhnt.exec:\bbhhnt.exe105⤵PID:100
-
\??\c:\3nthbh.exec:\3nthbh.exe106⤵PID:3236
-
\??\c:\jjppp.exec:\jjppp.exe107⤵PID:3680
-
\??\c:\pppjd.exec:\pppjd.exe108⤵PID:2036
-
\??\c:\flflrrx.exec:\flflrrx.exe109⤵PID:1368
-
\??\c:\lflffff.exec:\lflffff.exe110⤵PID:1416
-
\??\c:\nbbnbt.exec:\nbbnbt.exe111⤵PID:4416
-
\??\c:\nbbhhn.exec:\nbbhhn.exe112⤵PID:2980
-
\??\c:\vdjdv.exec:\vdjdv.exe113⤵PID:776
-
\??\c:\jdjdv.exec:\jdjdv.exe114⤵PID:2712
-
\??\c:\rxxxxfr.exec:\rxxxxfr.exe115⤵PID:220
-
\??\c:\xfflllf.exec:\xfflllf.exe116⤵
- System Location Discovery: System Language Discovery
PID:312 -
\??\c:\thtbnn.exec:\thtbnn.exe117⤵PID:1888
-
\??\c:\ttnhbb.exec:\ttnhbb.exe118⤵PID:4700
-
\??\c:\pjvpj.exec:\pjvpj.exe119⤵PID:4840
-
\??\c:\jpvvj.exec:\jpvvj.exe120⤵PID:4784
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe121⤵PID:2260
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe122⤵PID:3984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-