Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2024, 03:10
Static task
static1
Behavioral task
behavioral1
Sample
9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe
Resource
win7-20240903-en
General
-
Target
9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe
-
Size
365KB
-
MD5
10aa7bd1a363c8ac486edbf1c5bd7a10
-
SHA1
eeab7455518cc98a7a4d9a5690741e8b58fe5be0
-
SHA256
9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132d
-
SHA512
532cabb14f16da94856c783d4f1963fa093f948cffa5efacd73af55739d2b798dc6b17b67e9a636388e9ef22320589c53603bbded39e91455b54f1f77a25edc1
-
SSDEEP
6144:n3C9BRo7tvnJ99T/KZEL3RUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhG:n3C9ytvnVXFUXoSWlnwJv90aKToFqwfk
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/3132-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2872-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2080-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1552-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2812-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3588 pvpjj.exe 404 jjvpd.exe 2872 rrxxfff.exe 1880 frrllff.exe 4124 vvppp.exe 1684 frrlffx.exe 916 nhnhbt.exe 3204 jdvvv.exe 1368 dvpdv.exe 2680 bbhnhh.exe 4976 xxlllll.exe 3828 bnbttt.exe 2080 dvdvv.exe 1552 tbbthh.exe 5000 djppp.exe 4720 bbtbhh.exe 4996 vvvpd.exe 3252 rrxrrlf.exe 4988 pvdpj.exe 2332 llrflfx.exe 2812 bhbntt.exe 2628 9jpjp.exe 624 frfrlxf.exe 1796 tbnbtt.exe 3704 jpvjj.exe 3196 flrrflx.exe 396 jdddj.exe 3996 xfrffff.exe 2204 bbtttn.exe 2344 jjddv.exe 4992 xrfxrlf.exe 2340 djpjj.exe 4896 djjdv.exe 2216 rlllfff.exe 1936 fxrrllf.exe 828 ttnttt.exe 4836 9xfxrrl.exe 5076 frfxrrl.exe 3404 nbnhhh.exe 4200 dvjvj.exe 5108 xrxxrrr.exe 4540 dvdvv.exe 960 1dvjj.exe 1804 lflfxxr.exe 3076 nnnnhn.exe 4360 jvvpj.exe 880 lfllfff.exe 316 hhtnhb.exe 4340 bbnbhb.exe 2756 jvjvv.exe 2588 1vdvj.exe 4680 xxrlxrr.exe 3588 btnbtn.exe 968 thtnhh.exe 3284 dvjjp.exe 3176 rlfxxxr.exe 3792 5tbttt.exe 116 1vdvd.exe 4452 dvvdd.exe 1180 lffxffl.exe 916 tbnhht.exe 1128 dvdjv.exe 1028 jpddv.exe 3400 rlrlllf.exe -
resource yara_rule behavioral2/memory/3132-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2872-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2080-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1552-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2812-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxlxlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9lfxlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhtbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xxrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3bthtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3132 wrote to memory of 3588 3132 9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe 82 PID 3132 wrote to memory of 3588 3132 9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe 82 PID 3132 wrote to memory of 3588 3132 9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe 82 PID 3588 wrote to memory of 404 3588 pvpjj.exe 83 PID 3588 wrote to memory of 404 3588 pvpjj.exe 83 PID 3588 wrote to memory of 404 3588 pvpjj.exe 83 PID 404 wrote to memory of 2872 404 jjvpd.exe 84 PID 404 wrote to memory of 2872 404 jjvpd.exe 84 PID 404 wrote to memory of 2872 404 jjvpd.exe 84 PID 2872 wrote to memory of 1880 2872 rrxxfff.exe 85 PID 2872 wrote to memory of 1880 2872 rrxxfff.exe 85 PID 2872 wrote to memory of 1880 2872 rrxxfff.exe 85 PID 1880 wrote to memory of 4124 1880 frrllff.exe 86 PID 1880 wrote to memory of 4124 1880 frrllff.exe 86 PID 1880 wrote to memory of 4124 1880 frrllff.exe 86 PID 4124 wrote to memory of 1684 4124 vvppp.exe 87 PID 4124 wrote to memory of 1684 4124 vvppp.exe 87 PID 4124 wrote to memory of 1684 4124 vvppp.exe 87 PID 1684 wrote to memory of 916 1684 frrlffx.exe 88 PID 1684 wrote to memory of 916 1684 frrlffx.exe 88 PID 1684 wrote to memory of 916 1684 frrlffx.exe 88 PID 916 wrote to memory of 3204 916 nhnhbt.exe 89 PID 916 wrote to memory of 3204 916 nhnhbt.exe 89 PID 916 wrote to memory of 3204 916 nhnhbt.exe 89 PID 3204 wrote to memory of 1368 3204 jdvvv.exe 90 PID 3204 wrote to memory of 1368 3204 jdvvv.exe 90 PID 3204 wrote to memory of 1368 3204 jdvvv.exe 90 PID 1368 wrote to memory of 2680 1368 dvpdv.exe 91 PID 1368 wrote to memory of 2680 1368 dvpdv.exe 91 PID 1368 wrote to memory of 2680 1368 dvpdv.exe 91 PID 2680 wrote to memory of 4976 2680 bbhnhh.exe 92 PID 2680 wrote to memory of 4976 2680 bbhnhh.exe 92 PID 2680 wrote to memory of 4976 2680 bbhnhh.exe 92 PID 4976 wrote to memory of 3828 4976 xxlllll.exe 93 PID 4976 wrote to memory of 3828 4976 xxlllll.exe 93 PID 4976 wrote to memory of 3828 4976 xxlllll.exe 93 PID 3828 wrote to memory of 2080 3828 bnbttt.exe 94 PID 3828 wrote to memory of 2080 3828 bnbttt.exe 94 PID 3828 wrote to memory of 2080 3828 bnbttt.exe 94 PID 2080 wrote to memory of 1552 2080 dvdvv.exe 95 PID 2080 wrote to memory of 1552 2080 dvdvv.exe 95 PID 2080 wrote to memory of 1552 2080 dvdvv.exe 95 PID 1552 wrote to memory of 5000 1552 tbbthh.exe 96 PID 1552 wrote to memory of 5000 1552 tbbthh.exe 96 PID 1552 wrote to memory of 5000 1552 tbbthh.exe 96 PID 5000 wrote to memory of 4720 5000 djppp.exe 97 PID 5000 wrote to memory of 4720 5000 djppp.exe 97 PID 5000 wrote to memory of 4720 5000 djppp.exe 97 PID 4720 wrote to memory of 4996 4720 bbtbhh.exe 98 PID 4720 wrote to memory of 4996 4720 bbtbhh.exe 98 PID 4720 wrote to memory of 4996 4720 bbtbhh.exe 98 PID 4996 wrote to memory of 3252 4996 vvvpd.exe 99 PID 4996 wrote to memory of 3252 4996 vvvpd.exe 99 PID 4996 wrote to memory of 3252 4996 vvvpd.exe 99 PID 3252 wrote to memory of 4988 3252 rrxrrlf.exe 100 PID 3252 wrote to memory of 4988 3252 rrxrrlf.exe 100 PID 3252 wrote to memory of 4988 3252 rrxrrlf.exe 100 PID 4988 wrote to memory of 2332 4988 pvdpj.exe 101 PID 4988 wrote to memory of 2332 4988 pvdpj.exe 101 PID 4988 wrote to memory of 2332 4988 pvdpj.exe 101 PID 2332 wrote to memory of 2812 2332 llrflfx.exe 102 PID 2332 wrote to memory of 2812 2332 llrflfx.exe 102 PID 2332 wrote to memory of 2812 2332 llrflfx.exe 102 PID 2812 wrote to memory of 2628 2812 bhbntt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe"C:\Users\Admin\AppData\Local\Temp\9bb5071f2a1e80bcf20e755abd579bbcc20c9416521d201014f0863cb0b5132dN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\pvpjj.exec:\pvpjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\jjvpd.exec:\jjvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\rrxxfff.exec:\rrxxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872 -
\??\c:\frrllff.exec:\frrllff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vvppp.exec:\vvppp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\frrlffx.exec:\frrlffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\nhnhbt.exec:\nhnhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\jdvvv.exec:\jdvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\dvpdv.exec:\dvpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\bbhnhh.exec:\bbhnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\xxlllll.exec:\xxlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\bnbttt.exec:\bnbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\dvdvv.exec:\dvdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\tbbthh.exec:\tbbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\djppp.exec:\djppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\bbtbhh.exec:\bbtbhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\vvvpd.exec:\vvvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rrxrrlf.exec:\rrxrrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\pvdpj.exec:\pvdpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\llrflfx.exec:\llrflfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\bhbntt.exec:\bhbntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\9jpjp.exec:\9jpjp.exe23⤵
- Executes dropped EXE
PID:2628 -
\??\c:\frfrlxf.exec:\frfrlxf.exe24⤵
- Executes dropped EXE
PID:624 -
\??\c:\tbnbtt.exec:\tbnbtt.exe25⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jpvjj.exec:\jpvjj.exe26⤵
- Executes dropped EXE
PID:3704 -
\??\c:\flrrflx.exec:\flrrflx.exe27⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jdddj.exec:\jdddj.exe28⤵
- Executes dropped EXE
PID:396 -
\??\c:\xfrffff.exec:\xfrffff.exe29⤵
- Executes dropped EXE
PID:3996 -
\??\c:\bbtttn.exec:\bbtttn.exe30⤵
- Executes dropped EXE
PID:2204 -
\??\c:\jjddv.exec:\jjddv.exe31⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe32⤵
- Executes dropped EXE
PID:4992 -
\??\c:\djpjj.exec:\djpjj.exe33⤵
- Executes dropped EXE
PID:2340 -
\??\c:\djjdv.exec:\djjdv.exe34⤵
- Executes dropped EXE
PID:4896 -
\??\c:\rlllfff.exec:\rlllfff.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\fxrrllf.exec:\fxrrllf.exe36⤵
- Executes dropped EXE
PID:1936 -
\??\c:\ttnttt.exec:\ttnttt.exe37⤵
- Executes dropped EXE
PID:828 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe38⤵
- Executes dropped EXE
PID:4836 -
\??\c:\frfxrrl.exec:\frfxrrl.exe39⤵
- Executes dropped EXE
PID:5076 -
\??\c:\nbnhhh.exec:\nbnhhh.exe40⤵
- Executes dropped EXE
PID:3404 -
\??\c:\dvjvj.exec:\dvjvj.exe41⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe42⤵
- Executes dropped EXE
PID:5108 -
\??\c:\dvdvv.exec:\dvdvv.exe43⤵
- Executes dropped EXE
PID:4540 -
\??\c:\1dvjj.exec:\1dvjj.exe44⤵
- Executes dropped EXE
PID:960 -
\??\c:\lflfxxr.exec:\lflfxxr.exe45⤵
- Executes dropped EXE
PID:1804 -
\??\c:\nnnnhn.exec:\nnnnhn.exe46⤵
- Executes dropped EXE
PID:3076 -
\??\c:\jvvpj.exec:\jvvpj.exe47⤵
- Executes dropped EXE
PID:4360 -
\??\c:\lfllfff.exec:\lfllfff.exe48⤵
- Executes dropped EXE
PID:880 -
\??\c:\hhtnhb.exec:\hhtnhb.exe49⤵
- Executes dropped EXE
PID:316 -
\??\c:\bbnbhb.exec:\bbnbhb.exe50⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jvjvv.exec:\jvjvv.exe51⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1vdvj.exec:\1vdvj.exe52⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xxrlxrr.exec:\xxrlxrr.exe53⤵
- Executes dropped EXE
PID:4680 -
\??\c:\btnbtn.exec:\btnbtn.exe54⤵
- Executes dropped EXE
PID:3588 -
\??\c:\thtnhh.exec:\thtnhh.exe55⤵
- Executes dropped EXE
PID:968 -
\??\c:\dvjjp.exec:\dvjjp.exe56⤵
- Executes dropped EXE
PID:3284 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe57⤵
- Executes dropped EXE
PID:3176 -
\??\c:\5tbttt.exec:\5tbttt.exe58⤵
- Executes dropped EXE
PID:3792 -
\??\c:\1vdvd.exec:\1vdvd.exe59⤵
- Executes dropped EXE
PID:116 -
\??\c:\dvvdd.exec:\dvvdd.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4452 -
\??\c:\lffxffl.exec:\lffxffl.exe61⤵
- Executes dropped EXE
PID:1180 -
\??\c:\tbnhht.exec:\tbnhht.exe62⤵
- Executes dropped EXE
PID:916 -
\??\c:\dvdjv.exec:\dvdjv.exe63⤵
- Executes dropped EXE
PID:1128 -
\??\c:\jpddv.exec:\jpddv.exe64⤵
- Executes dropped EXE
PID:1028 -
\??\c:\rlrlllf.exec:\rlrlllf.exe65⤵
- Executes dropped EXE
PID:3400 -
\??\c:\hhhbbb.exec:\hhhbbb.exe66⤵PID:1608
-
\??\c:\thnnhh.exec:\thnnhh.exe67⤵PID:3228
-
\??\c:\ddpjv.exec:\ddpjv.exe68⤵PID:1900
-
\??\c:\vppjv.exec:\vppjv.exe69⤵PID:4972
-
\??\c:\rllflrl.exec:\rllflrl.exe70⤵PID:3828
-
\??\c:\hbbbnn.exec:\hbbbnn.exe71⤵PID:5068
-
\??\c:\dvdjp.exec:\dvdjp.exe72⤵PID:5012
-
\??\c:\3xflflx.exec:\3xflflx.exe73⤵PID:2504
-
\??\c:\tbbtbt.exec:\tbbtbt.exe74⤵PID:3356
-
\??\c:\btnhtt.exec:\btnhtt.exe75⤵PID:388
-
\??\c:\pvjdd.exec:\pvjdd.exe76⤵PID:3988
-
\??\c:\xlrffxf.exec:\xlrffxf.exe77⤵PID:3252
-
\??\c:\tthbnn.exec:\tthbnn.exe78⤵PID:1440
-
\??\c:\hbthbb.exec:\hbthbb.exe79⤵PID:3336
-
\??\c:\vvpjp.exec:\vvpjp.exe80⤵PID:3512
-
\??\c:\flffxxr.exec:\flffxxr.exe81⤵PID:3696
-
\??\c:\hbbnhh.exec:\hbbnhh.exe82⤵PID:4576
-
\??\c:\dppjj.exec:\dppjj.exe83⤵PID:4488
-
\??\c:\pjjdv.exec:\pjjdv.exe84⤵PID:4484
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe85⤵PID:3824
-
\??\c:\llxlxrf.exec:\llxlxrf.exe86⤵PID:2640
-
\??\c:\htttht.exec:\htttht.exe87⤵PID:1044
-
\??\c:\dpjpj.exec:\dpjpj.exe88⤵PID:4864
-
\??\c:\fxfxrrx.exec:\fxfxrrx.exe89⤵PID:4516
-
\??\c:\rlflrfx.exec:\rlflrfx.exe90⤵PID:2644
-
\??\c:\bnhbtn.exec:\bnhbtn.exe91⤵PID:1564
-
\??\c:\ddvpp.exec:\ddvpp.exe92⤵PID:4068
-
\??\c:\jvvpj.exec:\jvvpj.exe93⤵PID:3540
-
\??\c:\9fllxrx.exec:\9fllxrx.exe94⤵PID:1568
-
\??\c:\ttnnhh.exec:\ttnnhh.exe95⤵PID:1000
-
\??\c:\htntnh.exec:\htntnh.exe96⤵PID:1764
-
\??\c:\dpppj.exec:\dpppj.exe97⤵PID:456
-
\??\c:\lxfxlff.exec:\lxfxlff.exe98⤵PID:2312
-
\??\c:\3nhhbt.exec:\3nhhbt.exe99⤵PID:2696
-
\??\c:\ddjvp.exec:\ddjvp.exe100⤵PID:2624
-
\??\c:\7vvdv.exec:\7vvdv.exe101⤵PID:4508
-
\??\c:\xrlffff.exec:\xrlffff.exe102⤵PID:3020
-
\??\c:\tnthnh.exec:\tnthnh.exe103⤵PID:664
-
\??\c:\jdvpp.exec:\jdvpp.exe104⤵PID:5108
-
\??\c:\5djdv.exec:\5djdv.exe105⤵PID:4380
-
\??\c:\lxrlfxx.exec:\lxrlfxx.exe106⤵PID:512
-
\??\c:\nbntnh.exec:\nbntnh.exe107⤵PID:4288
-
\??\c:\tttttn.exec:\tttttn.exe108⤵PID:3076
-
\??\c:\ppjdv.exec:\ppjdv.exe109⤵PID:2944
-
\??\c:\5vvpj.exec:\5vvpj.exe110⤵PID:4676
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe111⤵PID:4332
-
\??\c:\hbnnnn.exec:\hbnnnn.exe112⤵PID:2228
-
\??\c:\pjjjd.exec:\pjjjd.exe113⤵PID:4196
-
\??\c:\1lrrlrl.exec:\1lrrlrl.exe114⤵PID:4528
-
\??\c:\xfrlllx.exec:\xfrlllx.exe115⤵PID:1672
-
\??\c:\nhnhhh.exec:\nhnhhh.exe116⤵PID:1832
-
\??\c:\ththnb.exec:\ththnb.exe117⤵PID:968
-
\??\c:\pjjpj.exec:\pjjpj.exe118⤵PID:2896
-
\??\c:\ffrlxlf.exec:\ffrlxlf.exe119⤵PID:4140
-
\??\c:\nntbtn.exec:\nntbtn.exe120⤵PID:2096
-
\??\c:\jdvvv.exec:\jdvvv.exe121⤵PID:116
-
\??\c:\rxlxfxx.exec:\rxlxfxx.exe122⤵PID:428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-