Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 17:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9ab6059369ffcc6ce9b33deeb3c96990N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
9ab6059369ffcc6ce9b33deeb3c96990N.exe
-
Size
74KB
-
MD5
9ab6059369ffcc6ce9b33deeb3c96990
-
SHA1
5864c89d38f65a65e6e2eb938aa034c913034f76
-
SHA256
43ef8eb3c9791d5ecefc99008e995846c5beaf50add92468684511d213305697
-
SHA512
7c0579e2ab098754812af10d25167caecac4309979c7a8fdecbc61bfdc1455389f877470271ffe472d9a611a81d84674565627a082ee8bd88a95a23e3021bbef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPN:ymb3NkkiQ3mdBjFIvl358nLA89OMFVH8
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/5040-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3696-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/940-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1476-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1096-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1036 nbnbnn.exe 4564 dvvpd.exe 3696 5xfxxxr.exe 1344 3llxrrl.exe 232 nbhbth.exe 2964 7dvpp.exe 824 dvdpj.exe 940 xllfffx.exe 64 hhtttn.exe 2896 vvvpp.exe 3148 xlfllxr.exe 1692 7hnnhn.exe 1476 5pdvp.exe 5044 xlrlrrr.exe 1648 htbbtn.exe 3608 hbbthh.exe 3552 jjjjj.exe 3784 xrxrllf.exe 2116 tttbhb.exe 4904 vdvpp.exe 4480 jjpjd.exe 4948 frlrrfl.exe 4936 7hhbtt.exe 3580 pjdvv.exe 1096 rxxrfff.exe 3672 xlllfll.exe 2308 nnhhhb.exe 3476 hnbbtt.exe 1080 dvvpd.exe 5016 vvjvp.exe 4576 flxrlff.exe 4516 3tbhbb.exe 2696 7thhbh.exe 1084 pjjdd.exe 2656 rlrrffl.exe 1532 xllfxxf.exe 4720 1ttnhn.exe 732 bbtnnt.exe 4448 ppvvv.exe 4536 jdpdv.exe 3196 xfxrrrl.exe 4588 rrfffff.exe 4292 bnhhhh.exe 3168 jjvjd.exe 820 dvddv.exe 3680 1lfxrll.exe 1380 5lllxxr.exe 404 htnnhh.exe 2348 hbtnnn.exe 3500 jdjjv.exe 1004 vdjdp.exe 536 xlrfffx.exe 4460 hbnntt.exe 2528 tntnhh.exe 1848 pvvvj.exe 1108 lxfxrrr.exe 1580 lrxrxxr.exe 1340 nnttbb.exe 3628 1thbhb.exe 3164 pjjjp.exe 1192 pjpjj.exe 3380 xlrrllf.exe 1368 rrxrffx.exe 2600 tbhbhb.exe -
resource yara_rule behavioral2/memory/5040-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3696-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/940-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1476-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1096-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xffxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3lrlxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5040 wrote to memory of 1036 5040 9ab6059369ffcc6ce9b33deeb3c96990N.exe 83 PID 5040 wrote to memory of 1036 5040 9ab6059369ffcc6ce9b33deeb3c96990N.exe 83 PID 5040 wrote to memory of 1036 5040 9ab6059369ffcc6ce9b33deeb3c96990N.exe 83 PID 1036 wrote to memory of 4564 1036 nbnbnn.exe 84 PID 1036 wrote to memory of 4564 1036 nbnbnn.exe 84 PID 1036 wrote to memory of 4564 1036 nbnbnn.exe 84 PID 4564 wrote to memory of 3696 4564 dvvpd.exe 85 PID 4564 wrote to memory of 3696 4564 dvvpd.exe 85 PID 4564 wrote to memory of 3696 4564 dvvpd.exe 85 PID 3696 wrote to memory of 1344 3696 5xfxxxr.exe 86 PID 3696 wrote to memory of 1344 3696 5xfxxxr.exe 86 PID 3696 wrote to memory of 1344 3696 5xfxxxr.exe 86 PID 1344 wrote to memory of 232 1344 3llxrrl.exe 87 PID 1344 wrote to memory of 232 1344 3llxrrl.exe 87 PID 1344 wrote to memory of 232 1344 3llxrrl.exe 87 PID 232 wrote to memory of 2964 232 nbhbth.exe 88 PID 232 wrote to memory of 2964 232 nbhbth.exe 88 PID 232 wrote to memory of 2964 232 nbhbth.exe 88 PID 2964 wrote to memory of 824 2964 7dvpp.exe 89 PID 2964 wrote to memory of 824 2964 7dvpp.exe 89 PID 2964 wrote to memory of 824 2964 7dvpp.exe 89 PID 824 wrote to memory of 940 824 dvdpj.exe 90 PID 824 wrote to memory of 940 824 dvdpj.exe 90 PID 824 wrote to memory of 940 824 dvdpj.exe 90 PID 940 wrote to memory of 64 940 xllfffx.exe 91 PID 940 wrote to memory of 64 940 xllfffx.exe 91 PID 940 wrote to memory of 64 940 xllfffx.exe 91 PID 64 wrote to memory of 2896 64 hhtttn.exe 92 PID 64 wrote to memory of 2896 64 hhtttn.exe 92 PID 64 wrote to memory of 2896 64 hhtttn.exe 92 PID 2896 wrote to memory of 3148 2896 vvvpp.exe 93 PID 2896 wrote to memory of 3148 2896 vvvpp.exe 93 PID 2896 wrote to memory of 3148 2896 vvvpp.exe 93 PID 3148 wrote to memory of 1692 3148 xlfllxr.exe 94 PID 3148 wrote to memory of 1692 3148 xlfllxr.exe 94 PID 3148 wrote to memory of 1692 3148 xlfllxr.exe 94 PID 1692 wrote to memory of 1476 1692 7hnnhn.exe 95 PID 1692 wrote to memory of 1476 1692 7hnnhn.exe 95 PID 1692 wrote to memory of 1476 1692 7hnnhn.exe 95 PID 1476 wrote to memory of 5044 1476 5pdvp.exe 96 PID 1476 wrote to memory of 5044 1476 5pdvp.exe 96 PID 1476 wrote to memory of 5044 1476 5pdvp.exe 96 PID 5044 wrote to memory of 1648 5044 xlrlrrr.exe 97 PID 5044 wrote to memory of 1648 5044 xlrlrrr.exe 97 PID 5044 wrote to memory of 1648 5044 xlrlrrr.exe 97 PID 1648 wrote to memory of 3608 1648 htbbtn.exe 98 PID 1648 wrote to memory of 3608 1648 htbbtn.exe 98 PID 1648 wrote to memory of 3608 1648 htbbtn.exe 98 PID 3608 wrote to memory of 3552 3608 hbbthh.exe 99 PID 3608 wrote to memory of 3552 3608 hbbthh.exe 99 PID 3608 wrote to memory of 3552 3608 hbbthh.exe 99 PID 3552 wrote to memory of 3784 3552 jjjjj.exe 101 PID 3552 wrote to memory of 3784 3552 jjjjj.exe 101 PID 3552 wrote to memory of 3784 3552 jjjjj.exe 101 PID 3784 wrote to memory of 2116 3784 xrxrllf.exe 102 PID 3784 wrote to memory of 2116 3784 xrxrllf.exe 102 PID 3784 wrote to memory of 2116 3784 xrxrllf.exe 102 PID 2116 wrote to memory of 4904 2116 tttbhb.exe 103 PID 2116 wrote to memory of 4904 2116 tttbhb.exe 103 PID 2116 wrote to memory of 4904 2116 tttbhb.exe 103 PID 4904 wrote to memory of 4480 4904 vdvpp.exe 104 PID 4904 wrote to memory of 4480 4904 vdvpp.exe 104 PID 4904 wrote to memory of 4480 4904 vdvpp.exe 104 PID 4480 wrote to memory of 4948 4480 jjpjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ab6059369ffcc6ce9b33deeb3c96990N.exe"C:\Users\Admin\AppData\Local\Temp\9ab6059369ffcc6ce9b33deeb3c96990N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\nbnbnn.exec:\nbnbnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\dvvpd.exec:\dvvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\5xfxxxr.exec:\5xfxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\3llxrrl.exec:\3llxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\nbhbth.exec:\nbhbth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\7dvpp.exec:\7dvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\dvdpj.exec:\dvdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\xllfffx.exec:\xllfffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\hhtttn.exec:\hhtttn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\vvvpp.exec:\vvvpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\xlfllxr.exec:\xlfllxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\7hnnhn.exec:\7hnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5pdvp.exec:\5pdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
\??\c:\xlrlrrr.exec:\xlrlrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\htbbtn.exec:\htbbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\hbbthh.exec:\hbbthh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\jjjjj.exec:\jjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\xrxrllf.exec:\xrxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\tttbhb.exec:\tttbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\vdvpp.exec:\vdvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\jjpjd.exec:\jjpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\frlrrfl.exec:\frlrrfl.exe23⤵
- Executes dropped EXE
PID:4948 -
\??\c:\7hhbtt.exec:\7hhbtt.exe24⤵
- Executes dropped EXE
PID:4936 -
\??\c:\pjdvv.exec:\pjdvv.exe25⤵
- Executes dropped EXE
PID:3580 -
\??\c:\rxxrfff.exec:\rxxrfff.exe26⤵
- Executes dropped EXE
PID:1096 -
\??\c:\xlllfll.exec:\xlllfll.exe27⤵
- Executes dropped EXE
PID:3672 -
\??\c:\nnhhhb.exec:\nnhhhb.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\hnbbtt.exec:\hnbbtt.exe29⤵
- Executes dropped EXE
PID:3476 -
\??\c:\dvvpd.exec:\dvvpd.exe30⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vvjvp.exec:\vvjvp.exe31⤵
- Executes dropped EXE
PID:5016 -
\??\c:\flxrlff.exec:\flxrlff.exe32⤵
- Executes dropped EXE
PID:4576 -
\??\c:\3tbhbb.exec:\3tbhbb.exe33⤵
- Executes dropped EXE
PID:4516 -
\??\c:\7thhbh.exec:\7thhbh.exe34⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pjjdd.exec:\pjjdd.exe35⤵
- Executes dropped EXE
PID:1084 -
\??\c:\rlrrffl.exec:\rlrrffl.exe36⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xllfxxf.exec:\xllfxxf.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1ttnhn.exec:\1ttnhn.exe38⤵
- Executes dropped EXE
PID:4720 -
\??\c:\bbtnnt.exec:\bbtnnt.exe39⤵
- Executes dropped EXE
PID:732 -
\??\c:\ppvvv.exec:\ppvvv.exe40⤵
- Executes dropped EXE
PID:4448 -
\??\c:\jdpdv.exec:\jdpdv.exe41⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe42⤵
- Executes dropped EXE
PID:3196 -
\??\c:\rrfffff.exec:\rrfffff.exe43⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bnhhhh.exec:\bnhhhh.exe44⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jjvjd.exec:\jjvjd.exe45⤵
- Executes dropped EXE
PID:3168 -
\??\c:\dvddv.exec:\dvddv.exe46⤵
- Executes dropped EXE
PID:820 -
\??\c:\1lfxrll.exec:\1lfxrll.exe47⤵
- Executes dropped EXE
PID:3680 -
\??\c:\5lllxxr.exec:\5lllxxr.exe48⤵
- Executes dropped EXE
PID:1380 -
\??\c:\htnnhh.exec:\htnnhh.exe49⤵
- Executes dropped EXE
PID:404 -
\??\c:\hbtnnn.exec:\hbtnnn.exe50⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdjjv.exec:\jdjjv.exe51⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vdjdp.exec:\vdjdp.exe52⤵
- Executes dropped EXE
PID:1004 -
\??\c:\xlrfffx.exec:\xlrfffx.exe53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:536 -
\??\c:\hbnntt.exec:\hbnntt.exe54⤵
- Executes dropped EXE
PID:4460 -
\??\c:\tntnhh.exec:\tntnhh.exe55⤵
- Executes dropped EXE
PID:2528 -
\??\c:\pvvvj.exec:\pvvvj.exe56⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe57⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lrxrxxr.exec:\lrxrxxr.exe58⤵
- Executes dropped EXE
PID:1580 -
\??\c:\nnttbb.exec:\nnttbb.exe59⤵
- Executes dropped EXE
PID:1340 -
\??\c:\1thbhb.exec:\1thbhb.exe60⤵
- Executes dropped EXE
PID:3628 -
\??\c:\pjjjp.exec:\pjjjp.exe61⤵
- Executes dropped EXE
PID:3164 -
\??\c:\pjpjj.exec:\pjpjj.exe62⤵
- Executes dropped EXE
PID:1192 -
\??\c:\xlrrllf.exec:\xlrrllf.exe63⤵
- Executes dropped EXE
PID:3380 -
\??\c:\rrxrffx.exec:\rrxrffx.exe64⤵
- Executes dropped EXE
PID:1368 -
\??\c:\tbhbhb.exec:\tbhbhb.exe65⤵
- Executes dropped EXE
PID:2600 -
\??\c:\bntnnn.exec:\bntnnn.exe66⤵PID:3676
-
\??\c:\9btnhn.exec:\9btnhn.exe67⤵PID:3172
-
\??\c:\ppppj.exec:\ppppj.exe68⤵PID:644
-
\??\c:\pvddp.exec:\pvddp.exe69⤵PID:4916
-
\??\c:\lflfxlf.exec:\lflfxlf.exe70⤵PID:4624
-
\??\c:\1llfffx.exec:\1llfffx.exe71⤵PID:2904
-
\??\c:\9tnnhh.exec:\9tnnhh.exe72⤵PID:3400
-
\??\c:\nhnnhh.exec:\nhnnhh.exe73⤵PID:4708
-
\??\c:\vppjj.exec:\vppjj.exe74⤵PID:4936
-
\??\c:\ddvvv.exec:\ddvvv.exe75⤵PID:2016
-
\??\c:\5fffrrx.exec:\5fffrrx.exe76⤵PID:1116
-
\??\c:\xxffrrl.exec:\xxffrrl.exe77⤵PID:4420
-
\??\c:\3tbhhh.exec:\3tbhhh.exe78⤵PID:3916
-
\??\c:\tbhbtt.exec:\tbhbtt.exe79⤵PID:2760
-
\??\c:\ddjdv.exec:\ddjdv.exe80⤵PID:468
-
\??\c:\vvjdp.exec:\vvjdp.exe81⤵PID:540
-
\??\c:\rxflxxx.exec:\rxflxxx.exe82⤵PID:1492
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe83⤵PID:4596
-
\??\c:\nnhbbh.exec:\nnhbbh.exe84⤵PID:2628
-
\??\c:\nbbtnh.exec:\nbbtnh.exe85⤵PID:2244
-
\??\c:\7thbhh.exec:\7thbhh.exe86⤵PID:2364
-
\??\c:\jdddp.exec:\jdddp.exe87⤵PID:4964
-
\??\c:\3ppjj.exec:\3ppjj.exe88⤵PID:1688
-
\??\c:\lflfflx.exec:\lflfflx.exe89⤵PID:3140
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe90⤵PID:2460
-
\??\c:\7ttbbb.exec:\7ttbbb.exe91⤵PID:4604
-
\??\c:\9jjpv.exec:\9jjpv.exe92⤵PID:4400
-
\??\c:\vpvpj.exec:\vpvpj.exe93⤵PID:732
-
\??\c:\rlxrxxr.exec:\rlxrxxr.exe94⤵PID:4832
-
\??\c:\lrxrllf.exec:\lrxrllf.exe95⤵PID:3872
-
\??\c:\nbnhhn.exec:\nbnhhn.exe96⤵PID:3196
-
\??\c:\nhhhnb.exec:\nhhhnb.exe97⤵PID:1924
-
\??\c:\hhtbtt.exec:\hhtbtt.exe98⤵PID:4368
-
\??\c:\vpvpj.exec:\vpvpj.exe99⤵PID:3892
-
\??\c:\vvvpj.exec:\vvvpj.exe100⤵PID:4712
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe101⤵PID:2584
-
\??\c:\rlrxxrl.exec:\rlrxxrl.exe102⤵PID:2964
-
\??\c:\hhhbht.exec:\hhhbht.exe103⤵PID:2368
-
\??\c:\nttnhh.exec:\nttnhh.exe104⤵PID:924
-
\??\c:\vppvv.exec:\vppvv.exe105⤵PID:2412
-
\??\c:\jjdvp.exec:\jjdvp.exe106⤵PID:3436
-
\??\c:\7vvpp.exec:\7vvpp.exe107⤵PID:3780
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe108⤵PID:2772
-
\??\c:\fflfxfx.exec:\fflfxfx.exe109⤵PID:3032
-
\??\c:\nhbbtt.exec:\nhbbtt.exe110⤵PID:4364
-
\??\c:\dvvvj.exec:\dvvvj.exe111⤵PID:3528
-
\??\c:\3dpjj.exec:\3dpjj.exe112⤵PID:5060
-
\??\c:\xxrlffx.exec:\xxrlffx.exe113⤵PID:5072
-
\??\c:\ffllrrx.exec:\ffllrrx.exe114⤵PID:3532
-
\??\c:\nbbthb.exec:\nbbthb.exe115⤵PID:4764
-
\??\c:\nbnnhn.exec:\nbnnhn.exe116⤵PID:3920
-
\??\c:\1jdvv.exec:\1jdvv.exe117⤵PID:4600
-
\??\c:\3jjdp.exec:\3jjdp.exe118⤵PID:1700
-
\??\c:\dvvpj.exec:\dvvpj.exe119⤵PID:1616
-
\??\c:\1rfrrll.exec:\1rfrrll.exe120⤵PID:3028
-
\??\c:\9hhhbb.exec:\9hhhbb.exe121⤵PID:2516
-
\??\c:\1ntnnt.exec:\1ntnnt.exe122⤵PID:644
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-