Analysis
-
max time kernel
120s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
13-09-2024 13:40
Behavioral task
behavioral1
Sample
d1d9c6ee0c7fa2d23669418de934e520N.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
d1d9c6ee0c7fa2d23669418de934e520N.exe
-
Size
485KB
-
MD5
d1d9c6ee0c7fa2d23669418de934e520
-
SHA1
59c64305a81d540e0c111feabdc28c36d7e3c7ab
-
SHA256
5c2e835f484d05b71071c7d0bff557f2f18c285954d8b10593f49bea36861f3c
-
SHA512
10a7acefe086e086fec22eacddaebc8b90a08b1b4c03741cbcf9dcfb31dcdbfbffade771ac179080d8231b449484068f1372c31ad7fefe95a47d6e9750f86fd0
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVZL:n3C9ytvngQjgtvngSV3CPobNVh
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/1480-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-76-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-68-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4208 dvjdv.exe 1348 7dvpj.exe 3560 9lxrlfx.exe 5088 tnthbt.exe 2400 jdjdp.exe 3512 hnnnhb.exe 2272 dvvjd.exe 2484 rxxxfxr.exe 4760 1htbtt.exe 1464 jddpj.exe 1264 frrlxrl.exe 3188 tthbth.exe 1488 pjdvj.exe 1628 pjpdv.exe 2696 lrllxxr.exe 3008 hbbtnn.exe 3824 jdjdv.exe 1032 vjdvp.exe 2224 9jvpv.exe 3500 5tnhbb.exe 4548 lllxrrl.exe 3544 3djvp.exe 856 rlfxllf.exe 756 jpjvv.exe 2492 hnnhnt.exe 4136 3jdvj.exe 888 9flfxxx.exe 2948 lxlfxrr.exe 5112 7nthtt.exe 3772 xfrfxxr.exe 2044 rfllfxx.exe 2332 nnhbtn.exe 4412 rrrfxrf.exe 1468 lrrlxrf.exe 2848 tnnntn.exe 4016 5pjdd.exe 3820 llxlrll.exe 2592 hnhbtt.exe 548 pdddv.exe 3924 vvpjj.exe 436 rffxrrl.exe 2716 btbtnt.exe 3360 1dvpd.exe 4376 3jpdv.exe 1188 fxfxxrr.exe 3804 tnnhbt.exe 4760 ppdvp.exe 1836 5vdvj.exe 2032 1rrlllf.exe 2320 nhhbtn.exe 2728 vddvj.exe 244 7djvv.exe 652 fxxlffr.exe 4380 1bnhbb.exe 3976 dvdpp.exe 1116 pjjdv.exe 3232 llrlfff.exe 4184 hhbttn.exe 1440 djjdp.exe 3524 5llfffr.exe 1032 5rrfrlx.exe 2368 htthbb.exe 3500 jvpjd.exe 3984 frrfrrf.exe -
resource yara_rule behavioral2/memory/1480-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1htntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5jpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxlfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbnnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnnhnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1480 wrote to memory of 4208 1480 d1d9c6ee0c7fa2d23669418de934e520N.exe 83 PID 1480 wrote to memory of 4208 1480 d1d9c6ee0c7fa2d23669418de934e520N.exe 83 PID 1480 wrote to memory of 4208 1480 d1d9c6ee0c7fa2d23669418de934e520N.exe 83 PID 4208 wrote to memory of 1348 4208 dvjdv.exe 84 PID 4208 wrote to memory of 1348 4208 dvjdv.exe 84 PID 4208 wrote to memory of 1348 4208 dvjdv.exe 84 PID 1348 wrote to memory of 3560 1348 7dvpj.exe 85 PID 1348 wrote to memory of 3560 1348 7dvpj.exe 85 PID 1348 wrote to memory of 3560 1348 7dvpj.exe 85 PID 3560 wrote to memory of 5088 3560 9lxrlfx.exe 87 PID 3560 wrote to memory of 5088 3560 9lxrlfx.exe 87 PID 3560 wrote to memory of 5088 3560 9lxrlfx.exe 87 PID 5088 wrote to memory of 2400 5088 tnthbt.exe 88 PID 5088 wrote to memory of 2400 5088 tnthbt.exe 88 PID 5088 wrote to memory of 2400 5088 tnthbt.exe 88 PID 2400 wrote to memory of 3512 2400 jdjdp.exe 89 PID 2400 wrote to memory of 3512 2400 jdjdp.exe 89 PID 2400 wrote to memory of 3512 2400 jdjdp.exe 89 PID 3512 wrote to memory of 2272 3512 hnnnhb.exe 90 PID 3512 wrote to memory of 2272 3512 hnnnhb.exe 90 PID 3512 wrote to memory of 2272 3512 hnnnhb.exe 90 PID 2272 wrote to memory of 2484 2272 dvvjd.exe 91 PID 2272 wrote to memory of 2484 2272 dvvjd.exe 91 PID 2272 wrote to memory of 2484 2272 dvvjd.exe 91 PID 2484 wrote to memory of 4760 2484 rxxxfxr.exe 92 PID 2484 wrote to memory of 4760 2484 rxxxfxr.exe 92 PID 2484 wrote to memory of 4760 2484 rxxxfxr.exe 92 PID 4760 wrote to memory of 1464 4760 1htbtt.exe 93 PID 4760 wrote to memory of 1464 4760 1htbtt.exe 93 PID 4760 wrote to memory of 1464 4760 1htbtt.exe 93 PID 1464 wrote to memory of 1264 1464 jddpj.exe 94 PID 1464 wrote to memory of 1264 1464 jddpj.exe 94 PID 1464 wrote to memory of 1264 1464 jddpj.exe 94 PID 1264 wrote to memory of 3188 1264 frrlxrl.exe 95 PID 1264 wrote to memory of 3188 1264 frrlxrl.exe 95 PID 1264 wrote to memory of 3188 1264 frrlxrl.exe 95 PID 3188 wrote to memory of 1488 3188 tthbth.exe 97 PID 3188 wrote to memory of 1488 3188 tthbth.exe 97 PID 3188 wrote to memory of 1488 3188 tthbth.exe 97 PID 1488 wrote to memory of 1628 1488 pjdvj.exe 98 PID 1488 wrote to memory of 1628 1488 pjdvj.exe 98 PID 1488 wrote to memory of 1628 1488 pjdvj.exe 98 PID 1628 wrote to memory of 2696 1628 pjpdv.exe 99 PID 1628 wrote to memory of 2696 1628 pjpdv.exe 99 PID 1628 wrote to memory of 2696 1628 pjpdv.exe 99 PID 2696 wrote to memory of 3008 2696 lrllxxr.exe 101 PID 2696 wrote to memory of 3008 2696 lrllxxr.exe 101 PID 2696 wrote to memory of 3008 2696 lrllxxr.exe 101 PID 3008 wrote to memory of 3824 3008 hbbtnn.exe 102 PID 3008 wrote to memory of 3824 3008 hbbtnn.exe 102 PID 3008 wrote to memory of 3824 3008 hbbtnn.exe 102 PID 3824 wrote to memory of 1032 3824 jdjdv.exe 103 PID 3824 wrote to memory of 1032 3824 jdjdv.exe 103 PID 3824 wrote to memory of 1032 3824 jdjdv.exe 103 PID 1032 wrote to memory of 2224 1032 vjdvp.exe 104 PID 1032 wrote to memory of 2224 1032 vjdvp.exe 104 PID 1032 wrote to memory of 2224 1032 vjdvp.exe 104 PID 2224 wrote to memory of 3500 2224 9jvpv.exe 105 PID 2224 wrote to memory of 3500 2224 9jvpv.exe 105 PID 2224 wrote to memory of 3500 2224 9jvpv.exe 105 PID 3500 wrote to memory of 4548 3500 5tnhbb.exe 106 PID 3500 wrote to memory of 4548 3500 5tnhbb.exe 106 PID 3500 wrote to memory of 4548 3500 5tnhbb.exe 106 PID 4548 wrote to memory of 3544 4548 lllxrrl.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1d9c6ee0c7fa2d23669418de934e520N.exe"C:\Users\Admin\AppData\Local\Temp\d1d9c6ee0c7fa2d23669418de934e520N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\dvjdv.exec:\dvjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\7dvpj.exec:\7dvpj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\9lxrlfx.exec:\9lxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\tnthbt.exec:\tnthbt.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\jdjdp.exec:\jdjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hnnnhb.exec:\hnnnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\dvvjd.exec:\dvvjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rxxxfxr.exec:\rxxxfxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\1htbtt.exec:\1htbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\jddpj.exec:\jddpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\frrlxrl.exec:\frrlxrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
\??\c:\tthbth.exec:\tthbth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\pjdvj.exec:\pjdvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\pjpdv.exec:\pjpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\lrllxxr.exec:\lrllxxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\hbbtnn.exec:\hbbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jdjdv.exec:\jdjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\vjdvp.exec:\vjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\9jvpv.exec:\9jvpv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\5tnhbb.exec:\5tnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\lllxrrl.exec:\lllxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\3djvp.exec:\3djvp.exe23⤵
- Executes dropped EXE
PID:3544 -
\??\c:\rlfxllf.exec:\rlfxllf.exe24⤵
- Executes dropped EXE
PID:856 -
\??\c:\jpjvv.exec:\jpjvv.exe25⤵
- Executes dropped EXE
PID:756 -
\??\c:\hnnhnt.exec:\hnnhnt.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2492 -
\??\c:\3jdvj.exec:\3jdvj.exe27⤵
- Executes dropped EXE
PID:4136 -
\??\c:\9flfxxx.exec:\9flfxxx.exe28⤵
- Executes dropped EXE
PID:888 -
\??\c:\lxlfxrr.exec:\lxlfxrr.exe29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
\??\c:\7nthtt.exec:\7nthtt.exe30⤵
- Executes dropped EXE
PID:5112 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe31⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rfllfxx.exec:\rfllfxx.exe32⤵
- Executes dropped EXE
PID:2044 -
\??\c:\nnhbtn.exec:\nnhbtn.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rrrfxrf.exec:\rrrfxrf.exe34⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lrrlxrf.exec:\lrrlxrf.exe35⤵
- Executes dropped EXE
PID:1468 -
\??\c:\tnnntn.exec:\tnnntn.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1djvj.exec:\1djvj.exe37⤵PID:2868
-
\??\c:\5pjdd.exec:\5pjdd.exe38⤵
- Executes dropped EXE
PID:4016 -
\??\c:\llxlrll.exec:\llxlrll.exe39⤵
- Executes dropped EXE
PID:3820 -
\??\c:\hnhbtt.exec:\hnhbtt.exe40⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pdddv.exec:\pdddv.exe41⤵
- Executes dropped EXE
PID:548 -
\??\c:\vvpjj.exec:\vvpjj.exe42⤵
- Executes dropped EXE
PID:3924 -
\??\c:\rffxrrl.exec:\rffxrrl.exe43⤵
- Executes dropped EXE
PID:436 -
\??\c:\btbtnt.exec:\btbtnt.exe44⤵
- Executes dropped EXE
PID:2716 -
\??\c:\1dvpd.exec:\1dvpd.exe45⤵
- Executes dropped EXE
PID:3360 -
\??\c:\3jpdv.exec:\3jpdv.exe46⤵
- Executes dropped EXE
PID:4376 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe47⤵
- Executes dropped EXE
PID:1188 -
\??\c:\tnnhbt.exec:\tnnhbt.exe48⤵
- Executes dropped EXE
PID:3804 -
\??\c:\ppdvp.exec:\ppdvp.exe49⤵
- Executes dropped EXE
PID:4760 -
\??\c:\5vdvj.exec:\5vdvj.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\1rrlllf.exec:\1rrlllf.exe51⤵
- Executes dropped EXE
PID:2032 -
\??\c:\nhhbtn.exec:\nhhbtn.exe52⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vddvj.exec:\vddvj.exe53⤵
- Executes dropped EXE
PID:2728 -
\??\c:\7djvv.exec:\7djvv.exe54⤵
- Executes dropped EXE
PID:244 -
\??\c:\fxxlffr.exec:\fxxlffr.exe55⤵
- Executes dropped EXE
PID:652 -
\??\c:\1bnhbb.exec:\1bnhbb.exe56⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4380 -
\??\c:\dvdpp.exec:\dvdpp.exe57⤵
- Executes dropped EXE
PID:3976 -
\??\c:\pjjdv.exec:\pjjdv.exe58⤵
- Executes dropped EXE
PID:1116 -
\??\c:\llrlfff.exec:\llrlfff.exe59⤵
- Executes dropped EXE
PID:3232 -
\??\c:\hhbttn.exec:\hhbttn.exe60⤵
- Executes dropped EXE
PID:4184 -
\??\c:\djjdp.exec:\djjdp.exe61⤵
- Executes dropped EXE
PID:1440 -
\??\c:\5llfffr.exec:\5llfffr.exe62⤵
- Executes dropped EXE
PID:3524 -
\??\c:\5rrfrlx.exec:\5rrfrlx.exe63⤵
- Executes dropped EXE
PID:1032 -
\??\c:\htthbb.exec:\htthbb.exe64⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jvpjd.exec:\jvpjd.exe65⤵
- Executes dropped EXE
PID:3500 -
\??\c:\frrfrrf.exec:\frrfrrf.exe66⤵
- Executes dropped EXE
PID:3984 -
\??\c:\llxrlll.exec:\llxrlll.exe67⤵PID:4520
-
\??\c:\tbnnnn.exec:\tbnnnn.exe68⤵PID:4248
-
\??\c:\jjdpj.exec:\jjdpj.exe69⤵PID:4932
-
\??\c:\frlxlrf.exec:\frlxlrf.exe70⤵PID:2056
-
\??\c:\1llfrlf.exec:\1llfrlf.exe71⤵PID:4604
-
\??\c:\nbhtnn.exec:\nbhtnn.exe72⤵PID:3520
-
\??\c:\vpvjd.exec:\vpvjd.exe73⤵PID:3612
-
\??\c:\3flffrl.exec:\3flffrl.exe74⤵PID:4456
-
\??\c:\nthbnn.exec:\nthbnn.exe75⤵PID:3572
-
\??\c:\tttnbb.exec:\tttnbb.exe76⤵PID:1788
-
\??\c:\pjjdp.exec:\pjjdp.exe77⤵PID:4100
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe78⤵PID:2504
-
\??\c:\7hbnhb.exec:\7hbnhb.exe79⤵PID:3980
-
\??\c:\thhhbn.exec:\thhhbn.exe80⤵PID:5100
-
\??\c:\3pjvj.exec:\3pjvj.exe81⤵PID:3604
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe82⤵PID:4956
-
\??\c:\ttttnh.exec:\ttttnh.exe83⤵PID:3820
-
\??\c:\dddvj.exec:\dddvj.exe84⤵PID:3496
-
\??\c:\pjpdv.exec:\pjpdv.exe85⤵PID:1948
-
\??\c:\xfllxxl.exec:\xfllxxl.exe86⤵PID:5088
-
\??\c:\9nhtnh.exec:\9nhtnh.exe87⤵PID:1592
-
\??\c:\pjjvp.exec:\pjjvp.exe88⤵PID:3708
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe89⤵PID:4696
-
\??\c:\xllfrrr.exec:\xllfrrr.exe90⤵PID:4896
-
\??\c:\bttnhb.exec:\bttnhb.exe91⤵PID:4308
-
\??\c:\jddvp.exec:\jddvp.exe92⤵PID:2028
-
\??\c:\rrrfxfx.exec:\rrrfxfx.exe93⤵PID:1464
-
\??\c:\llfxrrl.exec:\llfxrrl.exe94⤵PID:1336
-
\??\c:\nbtnbt.exec:\nbtnbt.exe95⤵PID:640
-
\??\c:\vppjv.exec:\vppjv.exe96⤵PID:1760
-
\??\c:\7flxrrf.exec:\7flxrrf.exe97⤵PID:4616
-
\??\c:\thtnhb.exec:\thtnhb.exe98⤵PID:4036
-
\??\c:\9tnhtn.exec:\9tnhtn.exe99⤵PID:2052
-
\??\c:\vjpdp.exec:\vjpdp.exe100⤵PID:2000
-
\??\c:\llrllff.exec:\llrllff.exe101⤵PID:3728
-
\??\c:\7nhtnn.exec:\7nhtnn.exe102⤵PID:4128
-
\??\c:\dddvd.exec:\dddvd.exe103⤵PID:3656
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe104⤵PID:2924
-
\??\c:\7lllffr.exec:\7lllffr.exe105⤵PID:1476
-
\??\c:\tnnhhh.exec:\tnnhhh.exe106⤵PID:2084
-
\??\c:\vpvvp.exec:\vpvvp.exe107⤵PID:612
-
\??\c:\jdjvp.exec:\jdjvp.exe108⤵PID:4772
-
\??\c:\xxfxxff.exec:\xxfxxff.exe109⤵
- System Location Discovery: System Language Discovery
PID:4116 -
\??\c:\9nnhhn.exec:\9nnhhn.exe110⤵PID:4948
-
\??\c:\tttnhn.exec:\tttnhn.exe111⤵PID:3912
-
\??\c:\9jvvd.exec:\9jvvd.exe112⤵PID:1428
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe113⤵PID:4136
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe114⤵PID:888
-
\??\c:\ntbtnh.exec:\ntbtnh.exe115⤵PID:2948
-
\??\c:\jppvd.exec:\jppvd.exe116⤵PID:4508
-
\??\c:\frlrrfl.exec:\frlrrfl.exe117⤵PID:3772
-
\??\c:\3xffxxx.exec:\3xffxxx.exe118⤵PID:712
-
\??\c:\tbhhbb.exec:\tbhhbb.exe119⤵PID:2044
-
\??\c:\vppjp.exec:\vppjp.exe120⤵PID:4564
-
\??\c:\xxxrlll.exec:\xxxrlll.exe121⤵PID:4340
-
\??\c:\ttnnhb.exec:\ttnnhb.exe122⤵PID:4468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-