Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe
Resource
win7-20240729-en
windows7-x64
6 signatures
120 seconds
General
-
Target
85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe
-
Size
64KB
-
MD5
51ce8c0199e3cee240748ccaaa1af470
-
SHA1
1bad9e71a2e4aab4368f352568540c0b7706fe66
-
SHA256
85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12e
-
SHA512
445c2454e77cdb70e5a816d199ed0f7f7085238666442e4c0a27c90b519f730adda046c7f64be99999c5725fc1769323b942178d742478e971644fff710e3ba3
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27U:ymb3NkkiQ3mdBjFI9l
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4928-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-21-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1388-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4056-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1864 7flfllr.exe 4860 flflxrf.exe 3744 nhhbbt.exe 4836 tnnnnn.exe 4028 jppjd.exe 1388 jjvpp.exe 2776 llffrff.exe 5060 1frfrlx.exe 4120 9pppp.exe 4676 ddjdd.exe 4112 7xfxxxf.exe 2556 3frrlll.exe 2136 ntnnnn.exe 736 vppjj.exe 2204 fxllrrx.exe 4776 9nnhhh.exe 3892 hntnnn.exe 3772 vdpjj.exe 2704 xrrrrxx.exe 1612 nhhhbh.exe 4088 nnttbb.exe 4660 jdpvj.exe 4428 dvdvp.exe 3724 rxrrlll.exe 1092 hbtbtt.exe 3272 pjdvp.exe 4056 xlrxlff.exe 4444 jjvpj.exe 3508 hbttth.exe 2644 pjppv.exe 2584 fxfxfll.exe 2900 thttnb.exe 4856 thbhbn.exe 4688 3jvpp.exe 1228 rfxrlrr.exe 536 ffffxxr.exe 1012 5hbbtb.exe 3324 bntbbn.exe 3012 jdppv.exe 2728 1xflxff.exe 2248 btbbhh.exe 2180 1vdvp.exe 3776 pdvdp.exe 4808 jvpjd.exe 3872 xrxrrfx.exe 4384 rfrxrxr.exe 4336 pdpjj.exe 2272 lfllfxr.exe 1660 rlrllll.exe 1688 hnbtnn.exe 3140 jjpjd.exe 628 lfrfrll.exe 2864 5lffxff.exe 5116 djvpp.exe 1560 ffflfxx.exe 636 tnbbtt.exe 4876 hhhbtt.exe 3984 7jpjj.exe 4884 rlrlffx.exe 3976 bhnnbt.exe 4644 dpvvj.exe 3000 jvpjv.exe 1144 fxfrrrx.exe 1112 bhnhnh.exe -
resource yara_rule behavioral2/memory/4928-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3744-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1388-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4056-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlrxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hnhthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4928 wrote to memory of 1864 4928 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 83 PID 4928 wrote to memory of 1864 4928 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 83 PID 4928 wrote to memory of 1864 4928 85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe 83 PID 1864 wrote to memory of 4860 1864 7flfllr.exe 84 PID 1864 wrote to memory of 4860 1864 7flfllr.exe 84 PID 1864 wrote to memory of 4860 1864 7flfllr.exe 84 PID 4860 wrote to memory of 3744 4860 flflxrf.exe 85 PID 4860 wrote to memory of 3744 4860 flflxrf.exe 85 PID 4860 wrote to memory of 3744 4860 flflxrf.exe 85 PID 3744 wrote to memory of 4836 3744 nhhbbt.exe 86 PID 3744 wrote to memory of 4836 3744 nhhbbt.exe 86 PID 3744 wrote to memory of 4836 3744 nhhbbt.exe 86 PID 4836 wrote to memory of 4028 4836 tnnnnn.exe 87 PID 4836 wrote to memory of 4028 4836 tnnnnn.exe 87 PID 4836 wrote to memory of 4028 4836 tnnnnn.exe 87 PID 4028 wrote to memory of 1388 4028 jppjd.exe 88 PID 4028 wrote to memory of 1388 4028 jppjd.exe 88 PID 4028 wrote to memory of 1388 4028 jppjd.exe 88 PID 1388 wrote to memory of 2776 1388 jjvpp.exe 89 PID 1388 wrote to memory of 2776 1388 jjvpp.exe 89 PID 1388 wrote to memory of 2776 1388 jjvpp.exe 89 PID 2776 wrote to memory of 5060 2776 llffrff.exe 90 PID 2776 wrote to memory of 5060 2776 llffrff.exe 90 PID 2776 wrote to memory of 5060 2776 llffrff.exe 90 PID 5060 wrote to memory of 4120 5060 1frfrlx.exe 91 PID 5060 wrote to memory of 4120 5060 1frfrlx.exe 91 PID 5060 wrote to memory of 4120 5060 1frfrlx.exe 91 PID 4120 wrote to memory of 4676 4120 9pppp.exe 92 PID 4120 wrote to memory of 4676 4120 9pppp.exe 92 PID 4120 wrote to memory of 4676 4120 9pppp.exe 92 PID 4676 wrote to memory of 4112 4676 ddjdd.exe 93 PID 4676 wrote to memory of 4112 4676 ddjdd.exe 93 PID 4676 wrote to memory of 4112 4676 ddjdd.exe 93 PID 4112 wrote to memory of 2556 4112 7xfxxxf.exe 94 PID 4112 wrote to memory of 2556 4112 7xfxxxf.exe 94 PID 4112 wrote to memory of 2556 4112 7xfxxxf.exe 94 PID 2556 wrote to memory of 2136 2556 3frrlll.exe 95 PID 2556 wrote to memory of 2136 2556 3frrlll.exe 95 PID 2556 wrote to memory of 2136 2556 3frrlll.exe 95 PID 2136 wrote to memory of 736 2136 ntnnnn.exe 96 PID 2136 wrote to memory of 736 2136 ntnnnn.exe 96 PID 2136 wrote to memory of 736 2136 ntnnnn.exe 96 PID 736 wrote to memory of 2204 736 vppjj.exe 97 PID 736 wrote to memory of 2204 736 vppjj.exe 97 PID 736 wrote to memory of 2204 736 vppjj.exe 97 PID 2204 wrote to memory of 4776 2204 fxllrrx.exe 98 PID 2204 wrote to memory of 4776 2204 fxllrrx.exe 98 PID 2204 wrote to memory of 4776 2204 fxllrrx.exe 98 PID 4776 wrote to memory of 3892 4776 9nnhhh.exe 99 PID 4776 wrote to memory of 3892 4776 9nnhhh.exe 99 PID 4776 wrote to memory of 3892 4776 9nnhhh.exe 99 PID 3892 wrote to memory of 3772 3892 hntnnn.exe 100 PID 3892 wrote to memory of 3772 3892 hntnnn.exe 100 PID 3892 wrote to memory of 3772 3892 hntnnn.exe 100 PID 3772 wrote to memory of 2704 3772 vdpjj.exe 101 PID 3772 wrote to memory of 2704 3772 vdpjj.exe 101 PID 3772 wrote to memory of 2704 3772 vdpjj.exe 101 PID 2704 wrote to memory of 1612 2704 xrrrrxx.exe 102 PID 2704 wrote to memory of 1612 2704 xrrrrxx.exe 102 PID 2704 wrote to memory of 1612 2704 xrrrrxx.exe 102 PID 1612 wrote to memory of 4088 1612 nhhhbh.exe 103 PID 1612 wrote to memory of 4088 1612 nhhhbh.exe 103 PID 1612 wrote to memory of 4088 1612 nhhhbh.exe 103 PID 4088 wrote to memory of 4660 4088 nnttbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe"C:\Users\Admin\AppData\Local\Temp\85a4a9178d988070f38d67bd4fd990e7432fc6dc261436c4b467a530df41a12eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\7flfllr.exec:\7flfllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\flflxrf.exec:\flflxrf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\nhhbbt.exec:\nhhbbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\tnnnnn.exec:\tnnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\jppjd.exec:\jppjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\jjvpp.exec:\jjvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\llffrff.exec:\llffrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\1frfrlx.exec:\1frfrlx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\9pppp.exec:\9pppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\ddjdd.exec:\ddjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\7xfxxxf.exec:\7xfxxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\3frrlll.exec:\3frrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\ntnnnn.exec:\ntnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\vppjj.exec:\vppjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\fxllrrx.exec:\fxllrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\9nnhhh.exec:\9nnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\hntnnn.exec:\hntnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\vdpjj.exec:\vdpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\nhhhbh.exec:\nhhhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nnttbb.exec:\nnttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\jdpvj.exec:\jdpvj.exe23⤵
- Executes dropped EXE
PID:4660 -
\??\c:\dvdvp.exec:\dvdvp.exe24⤵
- Executes dropped EXE
PID:4428 -
\??\c:\rxrrlll.exec:\rxrrlll.exe25⤵
- Executes dropped EXE
PID:3724 -
\??\c:\hbtbtt.exec:\hbtbtt.exe26⤵
- Executes dropped EXE
PID:1092 -
\??\c:\pjdvp.exec:\pjdvp.exe27⤵
- Executes dropped EXE
PID:3272 -
\??\c:\xlrxlff.exec:\xlrxlff.exe28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4056 -
\??\c:\jjvpj.exec:\jjvpj.exe29⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hbttth.exec:\hbttth.exe30⤵
- Executes dropped EXE
PID:3508 -
\??\c:\pjppv.exec:\pjppv.exe31⤵
- Executes dropped EXE
PID:2644 -
\??\c:\fxfxfll.exec:\fxfxfll.exe32⤵
- Executes dropped EXE
PID:2584 -
\??\c:\thttnb.exec:\thttnb.exe33⤵
- Executes dropped EXE
PID:2900 -
\??\c:\thbhbn.exec:\thbhbn.exe34⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3jvpp.exec:\3jvpp.exe35⤵
- Executes dropped EXE
PID:4688 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe36⤵
- Executes dropped EXE
PID:1228 -
\??\c:\ffffxxr.exec:\ffffxxr.exe37⤵
- Executes dropped EXE
PID:536 -
\??\c:\5hbbtb.exec:\5hbbtb.exe38⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bntbbn.exec:\bntbbn.exe39⤵
- Executes dropped EXE
PID:3324 -
\??\c:\jdppv.exec:\jdppv.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\1xflxff.exec:\1xflxff.exe41⤵
- Executes dropped EXE
PID:2728 -
\??\c:\btbbhh.exec:\btbbhh.exe42⤵
- Executes dropped EXE
PID:2248 -
\??\c:\1vdvp.exec:\1vdvp.exe43⤵
- Executes dropped EXE
PID:2180 -
\??\c:\pdvdp.exec:\pdvdp.exe44⤵
- Executes dropped EXE
PID:3776 -
\??\c:\jvpjd.exec:\jvpjd.exe45⤵
- Executes dropped EXE
PID:4808 -
\??\c:\xrxrrfx.exec:\xrxrrfx.exe46⤵
- Executes dropped EXE
PID:3872 -
\??\c:\rfrxrxr.exec:\rfrxrxr.exe47⤵
- Executes dropped EXE
PID:4384 -
\??\c:\pdpjj.exec:\pdpjj.exe48⤵
- Executes dropped EXE
PID:4336 -
\??\c:\lfllfxr.exec:\lfllfxr.exe49⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rlrllll.exec:\rlrllll.exe50⤵
- Executes dropped EXE
PID:1660 -
\??\c:\hnbtnn.exec:\hnbtnn.exe51⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jjpjd.exec:\jjpjd.exe52⤵
- Executes dropped EXE
PID:3140 -
\??\c:\lfrfrll.exec:\lfrfrll.exe53⤵
- Executes dropped EXE
PID:628 -
\??\c:\5lffxff.exec:\5lffxff.exe54⤵
- Executes dropped EXE
PID:2864 -
\??\c:\djvpp.exec:\djvpp.exe55⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ffflfxx.exec:\ffflfxx.exe56⤵
- Executes dropped EXE
PID:1560 -
\??\c:\tnbbtt.exec:\tnbbtt.exe57⤵
- Executes dropped EXE
PID:636 -
\??\c:\hhhbtt.exec:\hhhbtt.exe58⤵
- Executes dropped EXE
PID:4876 -
\??\c:\7jpjj.exec:\7jpjj.exe59⤵
- Executes dropped EXE
PID:3984 -
\??\c:\rlrlffx.exec:\rlrlffx.exe60⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bhnnbt.exec:\bhnnbt.exe61⤵
- Executes dropped EXE
PID:3976 -
\??\c:\dpvvj.exec:\dpvvj.exe62⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jvpjv.exec:\jvpjv.exe63⤵
- Executes dropped EXE
PID:3000 -
\??\c:\fxfrrrx.exec:\fxfrrrx.exe64⤵
- Executes dropped EXE
PID:1144 -
\??\c:\bhnhnh.exec:\bhnhnh.exe65⤵
- Executes dropped EXE
PID:1112 -
\??\c:\ttbbtn.exec:\ttbbtn.exe66⤵PID:1784
-
\??\c:\pjjpd.exec:\pjjpd.exe67⤵PID:2556
-
\??\c:\xrrlflf.exec:\xrrlflf.exe68⤵PID:1568
-
\??\c:\xrxlrll.exec:\xrxlrll.exe69⤵PID:1480
-
\??\c:\nhbtnn.exec:\nhbtnn.exe70⤵PID:4368
-
\??\c:\lfffxxx.exec:\lfffxxx.exe71⤵PID:3016
-
\??\c:\tnhtnn.exec:\tnhtnn.exe72⤵
- System Location Discovery: System Language Discovery
PID:2176 -
\??\c:\btbbtt.exec:\btbbtt.exe73⤵PID:4864
-
\??\c:\ddvvv.exec:\ddvvv.exe74⤵PID:2980
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe75⤵PID:3648
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe76⤵PID:2704
-
\??\c:\nhbtnh.exec:\nhbtnh.exe77⤵PID:1684
-
\??\c:\hbnntb.exec:\hbnntb.exe78⤵PID:4708
-
\??\c:\pjjdp.exec:\pjjdp.exe79⤵PID:4244
-
\??\c:\rllfrrl.exec:\rllfrrl.exe80⤵PID:4544
-
\??\c:\lffxlfx.exec:\lffxlfx.exe81⤵PID:1100
-
\??\c:\tbnhbb.exec:\tbnhbb.exe82⤵PID:624
-
\??\c:\7ddvp.exec:\7ddvp.exe83⤵PID:2960
-
\??\c:\1jdvj.exec:\1jdvj.exe84⤵PID:4104
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe85⤵PID:5112
-
\??\c:\7btnnh.exec:\7btnnh.exe86⤵PID:2600
-
\??\c:\pjpjv.exec:\pjpjv.exe87⤵PID:3552
-
\??\c:\vppjv.exec:\vppjv.exe88⤵PID:4064
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe89⤵PID:1180
-
\??\c:\rxxlxrf.exec:\rxxlxrf.exe90⤵PID:860
-
\??\c:\bnnhhb.exec:\bnnhhb.exe91⤵PID:4980
-
\??\c:\5thbnn.exec:\5thbnn.exe92⤵PID:4824
-
\??\c:\3djjv.exec:\3djjv.exe93⤵PID:3572
-
\??\c:\rxxrffx.exec:\rxxrffx.exe94⤵PID:3500
-
\??\c:\rffxrrr.exec:\rffxrrr.exe95⤵PID:4272
-
\??\c:\hhhbnh.exec:\hhhbnh.exe96⤵PID:752
-
\??\c:\bbbnbb.exec:\bbbnbb.exe97⤵PID:1564
-
\??\c:\jpvjd.exec:\jpvjd.exe98⤵PID:3388
-
\??\c:\1xfxrxx.exec:\1xfxrxx.exe99⤵PID:5088
-
\??\c:\htbttn.exec:\htbttn.exe100⤵PID:1616
-
\??\c:\tbhbbh.exec:\tbhbbh.exe101⤵PID:4200
-
\??\c:\jdjdp.exec:\jdjdp.exe102⤵PID:3908
-
\??\c:\jdvpd.exec:\jdvpd.exe103⤵PID:4516
-
\??\c:\rlfxlrl.exec:\rlfxlrl.exe104⤵PID:4328
-
\??\c:\7xflfff.exec:\7xflfff.exe105⤵PID:4360
-
\??\c:\9ttnnb.exec:\9ttnnb.exe106⤵PID:4408
-
\??\c:\5jjdp.exec:\5jjdp.exe107⤵PID:2816
-
\??\c:\7pvpd.exec:\7pvpd.exe108⤵PID:1336
-
\??\c:\1flfrfx.exec:\1flfrfx.exe109⤵PID:688
-
\??\c:\tttbth.exec:\tttbth.exe110⤵PID:4564
-
\??\c:\bnhbtn.exec:\bnhbtn.exe111⤵PID:1588
-
\??\c:\vvjvd.exec:\vvjvd.exe112⤵PID:4848
-
\??\c:\ddvpv.exec:\ddvpv.exe113⤵PID:1512
-
\??\c:\lxllfxr.exec:\lxllfxr.exe114⤵PID:836
-
\??\c:\1flfxrf.exec:\1flfxrf.exe115⤵PID:3896
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe116⤵PID:3676
-
\??\c:\nntttb.exec:\nntttb.exe117⤵PID:2356
-
\??\c:\pdpjd.exec:\pdpjd.exe118⤵PID:2300
-
\??\c:\lffxrlx.exec:\lffxrlx.exe119⤵PID:1556
-
\??\c:\tntbbh.exec:\tntbbh.exe120⤵PID:3084
-
\??\c:\pjvvj.exec:\pjvvj.exe121⤵PID:264
-
\??\c:\jpvpj.exec:\jpvpj.exe122⤵PID:4304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-