Analysis
-
max time kernel
120s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/10/2024, 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe
-
Size
70KB
-
MD5
e20a6572f96cbf5076c5dd1fe52bc450
-
SHA1
ea30ec4440c0189c645e9f5b164c0ce4985d11ae
-
SHA256
96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718e
-
SHA512
edc6b0c84a4c86124e5fa3a57ea478fa4f9fc52ae3453e9942caa971440b9035e96a6d51a29ee8e356ef52bc32f998f89e668d7e48ca5fc598619d9b9209f2fd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjy:ymb3NkkiQ3mdBjFI4VC
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4308-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3672-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1324-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4036-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3672 bbbnht.exe 5044 jpjdv.exe 2364 llrrrrl.exe 4688 rlfxxxr.exe 4856 djvvp.exe 208 hnhbbn.exe 1348 vvvpj.exe 1324 fxffxff.exe 2416 hbhhtb.exe 3264 3tnntb.exe 3028 dvddv.exe 1096 7rrlflf.exe 2736 7ffffll.exe 3936 tthhtt.exe 1152 vjppp.exe 3752 pjpjd.exe 2420 frfxxff.exe 3276 nnnhhh.exe 2436 ddjjp.exe 5060 vdddp.exe 4552 rxrllrl.exe 2780 rlrlrrx.exe 4036 ttnntb.exe 4768 pjvvp.exe 4420 xrxxxff.exe 2236 7bhhhn.exe 2632 7bnhnn.exe 3504 pppjj.exe 824 xrllxxr.exe 3328 xfrrrrl.exe 4756 tnttnt.exe 1620 5lffrrr.exe 3916 tthhnt.exe 3312 ddppp.exe 452 xrffffr.exe 2060 ttnhnn.exe 1868 7dppp.exe 1780 xrrlxxx.exe 4124 fxfrrrr.exe 4364 thhbtt.exe 116 tbhhhn.exe 4764 pdvpd.exe 2144 bbbttb.exe 2940 jjjdv.exe 4908 dddjd.exe 4416 bbbbbh.exe 4272 rlrrlxx.exe 1084 xflllrr.exe 1916 nntbbh.exe 1416 djdvv.exe 3840 ddjdp.exe 4328 3ffxrxr.exe 3128 pjvjj.exe 3692 dpjjv.exe 2544 fffxxrx.exe 4572 xrrrllf.exe 2052 tntnbn.exe 3108 pjjdd.exe 4372 vppjj.exe 1480 5fxrlll.exe 4692 frxxrlr.exe 3688 thnhbb.exe 2392 pjdvp.exe 2416 dpvpj.exe -
resource yara_rule behavioral2/memory/4308-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3672-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1324-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3028-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3936-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4036-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxrrxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhnbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3tnntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxlfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4308 wrote to memory of 3672 4308 96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe 82 PID 4308 wrote to memory of 3672 4308 96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe 82 PID 4308 wrote to memory of 3672 4308 96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe 82 PID 3672 wrote to memory of 5044 3672 bbbnht.exe 83 PID 3672 wrote to memory of 5044 3672 bbbnht.exe 83 PID 3672 wrote to memory of 5044 3672 bbbnht.exe 83 PID 5044 wrote to memory of 2364 5044 jpjdv.exe 84 PID 5044 wrote to memory of 2364 5044 jpjdv.exe 84 PID 5044 wrote to memory of 2364 5044 jpjdv.exe 84 PID 2364 wrote to memory of 4688 2364 llrrrrl.exe 85 PID 2364 wrote to memory of 4688 2364 llrrrrl.exe 85 PID 2364 wrote to memory of 4688 2364 llrrrrl.exe 85 PID 4688 wrote to memory of 4856 4688 rlfxxxr.exe 86 PID 4688 wrote to memory of 4856 4688 rlfxxxr.exe 86 PID 4688 wrote to memory of 4856 4688 rlfxxxr.exe 86 PID 4856 wrote to memory of 208 4856 djvvp.exe 87 PID 4856 wrote to memory of 208 4856 djvvp.exe 87 PID 4856 wrote to memory of 208 4856 djvvp.exe 87 PID 208 wrote to memory of 1348 208 hnhbbn.exe 88 PID 208 wrote to memory of 1348 208 hnhbbn.exe 88 PID 208 wrote to memory of 1348 208 hnhbbn.exe 88 PID 1348 wrote to memory of 1324 1348 vvvpj.exe 89 PID 1348 wrote to memory of 1324 1348 vvvpj.exe 89 PID 1348 wrote to memory of 1324 1348 vvvpj.exe 89 PID 1324 wrote to memory of 2416 1324 fxffxff.exe 90 PID 1324 wrote to memory of 2416 1324 fxffxff.exe 90 PID 1324 wrote to memory of 2416 1324 fxffxff.exe 90 PID 2416 wrote to memory of 3264 2416 hbhhtb.exe 91 PID 2416 wrote to memory of 3264 2416 hbhhtb.exe 91 PID 2416 wrote to memory of 3264 2416 hbhhtb.exe 91 PID 3264 wrote to memory of 3028 3264 3tnntb.exe 92 PID 3264 wrote to memory of 3028 3264 3tnntb.exe 92 PID 3264 wrote to memory of 3028 3264 3tnntb.exe 92 PID 3028 wrote to memory of 1096 3028 dvddv.exe 93 PID 3028 wrote to memory of 1096 3028 dvddv.exe 93 PID 3028 wrote to memory of 1096 3028 dvddv.exe 93 PID 1096 wrote to memory of 2736 1096 7rrlflf.exe 94 PID 1096 wrote to memory of 2736 1096 7rrlflf.exe 94 PID 1096 wrote to memory of 2736 1096 7rrlflf.exe 94 PID 2736 wrote to memory of 3936 2736 7ffffll.exe 95 PID 2736 wrote to memory of 3936 2736 7ffffll.exe 95 PID 2736 wrote to memory of 3936 2736 7ffffll.exe 95 PID 3936 wrote to memory of 1152 3936 tthhtt.exe 96 PID 3936 wrote to memory of 1152 3936 tthhtt.exe 96 PID 3936 wrote to memory of 1152 3936 tthhtt.exe 96 PID 1152 wrote to memory of 3752 1152 vjppp.exe 97 PID 1152 wrote to memory of 3752 1152 vjppp.exe 97 PID 1152 wrote to memory of 3752 1152 vjppp.exe 97 PID 3752 wrote to memory of 2420 3752 pjpjd.exe 98 PID 3752 wrote to memory of 2420 3752 pjpjd.exe 98 PID 3752 wrote to memory of 2420 3752 pjpjd.exe 98 PID 2420 wrote to memory of 3276 2420 frfxxff.exe 99 PID 2420 wrote to memory of 3276 2420 frfxxff.exe 99 PID 2420 wrote to memory of 3276 2420 frfxxff.exe 99 PID 3276 wrote to memory of 2436 3276 nnnhhh.exe 100 PID 3276 wrote to memory of 2436 3276 nnnhhh.exe 100 PID 3276 wrote to memory of 2436 3276 nnnhhh.exe 100 PID 2436 wrote to memory of 5060 2436 ddjjp.exe 101 PID 2436 wrote to memory of 5060 2436 ddjjp.exe 101 PID 2436 wrote to memory of 5060 2436 ddjjp.exe 101 PID 5060 wrote to memory of 4552 5060 vdddp.exe 102 PID 5060 wrote to memory of 4552 5060 vdddp.exe 102 PID 5060 wrote to memory of 4552 5060 vdddp.exe 102 PID 4552 wrote to memory of 2780 4552 rxrllrl.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe"C:\Users\Admin\AppData\Local\Temp\96ce1f090f21a6ba9fc85a6cdd7969601d259522a070a02f8856428de6a2718eN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\bbbnht.exec:\bbbnht.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\jpjdv.exec:\jpjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\llrrrrl.exec:\llrrrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\djvvp.exec:\djvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\hnhbbn.exec:\hnhbbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\vvvpj.exec:\vvvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\fxffxff.exec:\fxffxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\hbhhtb.exec:\hbhhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3tnntb.exec:\3tnntb.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\dvddv.exec:\dvddv.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\7rrlflf.exec:\7rrlflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
\??\c:\7ffffll.exec:\7ffffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\tthhtt.exec:\tthhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\vjppp.exec:\vjppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pjpjd.exec:\pjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\frfxxff.exec:\frfxxff.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nnnhhh.exec:\nnnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\ddjjp.exec:\ddjjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\vdddp.exec:\vdddp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\rxrllrl.exec:\rxrllrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe23⤵
- Executes dropped EXE
PID:2780 -
\??\c:\ttnntb.exec:\ttnntb.exe24⤵
- Executes dropped EXE
PID:4036 -
\??\c:\pjvvp.exec:\pjvvp.exe25⤵
- Executes dropped EXE
PID:4768 -
\??\c:\xrxxxff.exec:\xrxxxff.exe26⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7bhhhn.exec:\7bhhhn.exe27⤵
- Executes dropped EXE
PID:2236 -
\??\c:\7bnhnn.exec:\7bnhnn.exe28⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pppjj.exec:\pppjj.exe29⤵
- Executes dropped EXE
PID:3504 -
\??\c:\xrllxxr.exec:\xrllxxr.exe30⤵
- Executes dropped EXE
PID:824 -
\??\c:\xfrrrrl.exec:\xfrrrrl.exe31⤵
- Executes dropped EXE
PID:3328 -
\??\c:\tnttnt.exec:\tnttnt.exe32⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5lffrrr.exec:\5lffrrr.exe33⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tthhnt.exec:\tthhnt.exe34⤵
- Executes dropped EXE
PID:3916 -
\??\c:\ddppp.exec:\ddppp.exe35⤵
- Executes dropped EXE
PID:3312 -
\??\c:\xrffffr.exec:\xrffffr.exe36⤵
- Executes dropped EXE
PID:452 -
\??\c:\ttnhnn.exec:\ttnhnn.exe37⤵
- Executes dropped EXE
PID:2060 -
\??\c:\7dppp.exec:\7dppp.exe38⤵
- Executes dropped EXE
PID:1868 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe39⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fxfrrrr.exec:\fxfrrrr.exe40⤵
- Executes dropped EXE
PID:4124 -
\??\c:\thhbtt.exec:\thhbtt.exe41⤵
- Executes dropped EXE
PID:4364 -
\??\c:\tbhhhn.exec:\tbhhhn.exe42⤵
- Executes dropped EXE
PID:116 -
\??\c:\pdvpd.exec:\pdvpd.exe43⤵
- Executes dropped EXE
PID:4764 -
\??\c:\bbbttb.exec:\bbbttb.exe44⤵
- Executes dropped EXE
PID:2144 -
\??\c:\jjjdv.exec:\jjjdv.exe45⤵
- Executes dropped EXE
PID:2940 -
\??\c:\dddjd.exec:\dddjd.exe46⤵
- Executes dropped EXE
PID:4908 -
\??\c:\bbbbbh.exec:\bbbbbh.exe47⤵
- Executes dropped EXE
PID:4416 -
\??\c:\rlrrlxx.exec:\rlrrlxx.exe48⤵
- Executes dropped EXE
PID:4272 -
\??\c:\xflllrr.exec:\xflllrr.exe49⤵
- Executes dropped EXE
PID:1084 -
\??\c:\nntbbh.exec:\nntbbh.exe50⤵
- Executes dropped EXE
PID:1916 -
\??\c:\djdvv.exec:\djdvv.exe51⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ddjdp.exec:\ddjdp.exe52⤵
- Executes dropped EXE
PID:3840 -
\??\c:\3ffxrxr.exec:\3ffxrxr.exe53⤵
- Executes dropped EXE
PID:4328 -
\??\c:\pjvjj.exec:\pjvjj.exe54⤵
- Executes dropped EXE
PID:3128 -
\??\c:\dpjjv.exec:\dpjjv.exe55⤵
- Executes dropped EXE
PID:3692 -
\??\c:\fffxxrx.exec:\fffxxrx.exe56⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xrrrllf.exec:\xrrrllf.exe57⤵
- Executes dropped EXE
PID:4572 -
\??\c:\tntnbn.exec:\tntnbn.exe58⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pjjdd.exec:\pjjdd.exe59⤵
- Executes dropped EXE
PID:3108 -
\??\c:\vppjj.exec:\vppjj.exe60⤵
- Executes dropped EXE
PID:4372 -
\??\c:\5fxrlll.exec:\5fxrlll.exe61⤵
- Executes dropped EXE
PID:1480 -
\??\c:\frxxrlr.exec:\frxxrlr.exe62⤵
- Executes dropped EXE
PID:4692 -
\??\c:\thnhbb.exec:\thnhbb.exe63⤵
- Executes dropped EXE
PID:3688 -
\??\c:\pjdvp.exec:\pjdvp.exe64⤵
- Executes dropped EXE
PID:2392 -
\??\c:\dpvpj.exec:\dpvpj.exe65⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9flfrrr.exec:\9flfrrr.exe66⤵PID:1744
-
\??\c:\hbbthh.exec:\hbbthh.exe67⤵PID:1360
-
\??\c:\hbnbth.exec:\hbnbth.exe68⤵PID:3028
-
\??\c:\dvvpj.exec:\dvvpj.exe69⤵PID:3024
-
\??\c:\xffxrrl.exec:\xffxrrl.exe70⤵PID:4508
-
\??\c:\flxxxxx.exec:\flxxxxx.exe71⤵PID:2156
-
\??\c:\nhtnhn.exec:\nhtnhn.exe72⤵PID:2008
-
\??\c:\pppjj.exec:\pppjj.exe73⤵PID:1152
-
\??\c:\jjjjp.exec:\jjjjp.exe74⤵PID:3752
-
\??\c:\xlxrlrx.exec:\xlxrlrx.exe75⤵PID:2420
-
\??\c:\tbbbtt.exec:\tbbbtt.exe76⤵PID:3104
-
\??\c:\9hnhbt.exec:\9hnhbt.exe77⤵PID:2264
-
\??\c:\pjpjd.exec:\pjpjd.exe78⤵
- System Location Discovery: System Language Discovery
PID:4044 -
\??\c:\pvjpv.exec:\pvjpv.exe79⤵PID:3524
-
\??\c:\lfrllrx.exec:\lfrllrx.exe80⤵PID:4108
-
\??\c:\bttnhb.exec:\bttnhb.exe81⤵PID:624
-
\??\c:\3nbbtb.exec:\3nbbtb.exe82⤵PID:3296
-
\??\c:\pvdpj.exec:\pvdpj.exe83⤵PID:4752
-
\??\c:\fffxfrl.exec:\fffxfrl.exe84⤵PID:4804
-
\??\c:\lfxxlrf.exec:\lfxxlrf.exe85⤵PID:432
-
\??\c:\3ttnhh.exec:\3ttnhh.exe86⤵PID:3228
-
\??\c:\5tbbtt.exec:\5tbbtt.exe87⤵PID:1560
-
\??\c:\dvvvp.exec:\dvvvp.exe88⤵PID:2236
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe89⤵PID:3844
-
\??\c:\9bhhhh.exec:\9bhhhh.exe90⤵PID:2908
-
\??\c:\nhnhbh.exec:\nhnhbh.exe91⤵PID:3588
-
\??\c:\vpppp.exec:\vpppp.exe92⤵PID:3964
-
\??\c:\lllrfll.exec:\lllrfll.exe93⤵PID:3328
-
\??\c:\xrxfffx.exec:\xrxfffx.exe94⤵PID:2068
-
\??\c:\1nnnnn.exec:\1nnnnn.exe95⤵PID:2128
-
\??\c:\jdpjj.exec:\jdpjj.exe96⤵PID:2840
-
\??\c:\ddjpj.exec:\ddjpj.exe97⤵PID:5040
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe98⤵PID:4672
-
\??\c:\rlrrxfl.exec:\rlrrxfl.exe99⤵PID:4896
-
\??\c:\djpvv.exec:\djpvv.exe100⤵PID:4380
-
\??\c:\1lllrxf.exec:\1lllrxf.exe101⤵PID:2548
-
\??\c:\1lxxflx.exec:\1lxxflx.exe102⤵PID:1880
-
\??\c:\nbbbbt.exec:\nbbbbt.exe103⤵PID:1700
-
\??\c:\dvjjv.exec:\dvjjv.exe104⤵PID:4364
-
\??\c:\djppj.exec:\djppj.exe105⤵PID:3232
-
\??\c:\3fxxxff.exec:\3fxxxff.exe106⤵PID:388
-
\??\c:\fxllfff.exec:\fxllfff.exe107⤵PID:5116
-
\??\c:\ttbttb.exec:\ttbttb.exe108⤵PID:1824
-
\??\c:\bttttt.exec:\bttttt.exe109⤵PID:3904
-
\??\c:\dppjv.exec:\dppjv.exe110⤵PID:4280
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe111⤵PID:3952
-
\??\c:\ttbbhn.exec:\ttbbhn.exe112⤵PID:1084
-
\??\c:\thnnnt.exec:\thnnnt.exe113⤵PID:3672
-
\??\c:\vvddv.exec:\vvddv.exe114⤵PID:4716
-
\??\c:\lrrrxll.exec:\lrrrxll.exe115⤵PID:1032
-
\??\c:\lrxxrxl.exec:\lrxxrxl.exe116⤵PID:2364
-
\??\c:\bbbhhh.exec:\bbbhhh.exe117⤵PID:4688
-
\??\c:\jjjpv.exec:\jjjpv.exe118⤵PID:5104
-
\??\c:\jjdpd.exec:\jjdpd.exe119⤵PID:4852
-
\??\c:\rlxxflf.exec:\rlxxflf.exe120⤵PID:4068
-
\??\c:\ntbnnt.exec:\ntbnnt.exe121⤵PID:4560
-
\??\c:\tntnhh.exec:\tntnhh.exe122⤵PID:4980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-