Analysis
-
max time kernel
120s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2024, 11:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe
-
Size
78KB
-
MD5
a91b506999abf5fda35055b17cc8f450
-
SHA1
a3193a44ca59a0ea14cc1fc37ff2e6e428401157
-
SHA256
c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4
-
SHA512
81e910cc499d851da50fb5e62cdd4a62520e8d0faa459574978e59ba29f70817eac4c385799a4e964af2301dd6e8d7c19dc18d7396226e2c5a7b31fe50c0bf9c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7GTi3ldD5S:ymb3NkkiQ3mdBjFIWYB5S
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/2728-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-25-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/720-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3884 pjjdv.exe 3804 lrrlfff.exe 632 bntnbb.exe 1640 9btnbt.exe 756 fxfxrfx.exe 1616 nbbtnn.exe 1292 vpvpj.exe 832 lxffrfr.exe 4692 htttbt.exe 3068 5bnnhh.exe 720 7djvj.exe 2940 thbttn.exe 1048 dpvpd.exe 2480 pjjdv.exe 2908 7lrfxrf.exe 776 dpjjv.exe 2756 vpjjd.exe 2484 7fxrffx.exe 4460 3ntbtb.exe 2268 1djvp.exe 3356 rxllxrf.exe 4948 xrfxlll.exe 1368 nhbtnh.exe 1848 vvjpp.exe 3636 lxlffrx.exe 4796 nnhhnb.exe 4836 hhbthh.exe 4428 djjjd.exe 2824 rlllxxx.exe 4696 3fflfff.exe 1824 btntnn.exe 4316 jdjdp.exe 1744 rrxrlll.exe 2000 tntnnb.exe 4532 9dvjv.exe 3804 dvdvp.exe 2960 nnnnhh.exe 1972 bbbbtt.exe 3224 vjvjv.exe 4176 vjpjd.exe 2920 lflfxxx.exe 4604 nnnhtt.exe 2312 tnnhhh.exe 2652 vjvjv.exe 3048 jjjjd.exe 1964 rllffxx.exe 4900 bbnnhh.exe 1236 dpvpj.exe 720 vpdvd.exe 3236 xflfxll.exe 4016 btbhht.exe 404 bbbbtt.exe 4456 dvpdj.exe 2480 pjdvd.exe 448 frllffx.exe 396 fflrffx.exe 4552 3hbtnh.exe 1900 nbhtnn.exe 4732 jdvdj.exe 3976 flffxxf.exe 1708 nhhtnt.exe 1648 1tbhbb.exe 4412 djpjd.exe 384 xfflfxf.exe -
resource yara_rule behavioral2/memory/2728-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/720-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frfxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbtnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllfxrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 3884 2728 c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe 83 PID 2728 wrote to memory of 3884 2728 c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe 83 PID 2728 wrote to memory of 3884 2728 c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe 83 PID 3884 wrote to memory of 3804 3884 pjjdv.exe 84 PID 3884 wrote to memory of 3804 3884 pjjdv.exe 84 PID 3884 wrote to memory of 3804 3884 pjjdv.exe 84 PID 3804 wrote to memory of 632 3804 lrrlfff.exe 85 PID 3804 wrote to memory of 632 3804 lrrlfff.exe 85 PID 3804 wrote to memory of 632 3804 lrrlfff.exe 85 PID 632 wrote to memory of 1640 632 bntnbb.exe 87 PID 632 wrote to memory of 1640 632 bntnbb.exe 87 PID 632 wrote to memory of 1640 632 bntnbb.exe 87 PID 1640 wrote to memory of 756 1640 9btnbt.exe 88 PID 1640 wrote to memory of 756 1640 9btnbt.exe 88 PID 1640 wrote to memory of 756 1640 9btnbt.exe 88 PID 756 wrote to memory of 1616 756 fxfxrfx.exe 89 PID 756 wrote to memory of 1616 756 fxfxrfx.exe 89 PID 756 wrote to memory of 1616 756 fxfxrfx.exe 89 PID 1616 wrote to memory of 1292 1616 nbbtnn.exe 90 PID 1616 wrote to memory of 1292 1616 nbbtnn.exe 90 PID 1616 wrote to memory of 1292 1616 nbbtnn.exe 90 PID 1292 wrote to memory of 832 1292 vpvpj.exe 91 PID 1292 wrote to memory of 832 1292 vpvpj.exe 91 PID 1292 wrote to memory of 832 1292 vpvpj.exe 91 PID 832 wrote to memory of 4692 832 lxffrfr.exe 93 PID 832 wrote to memory of 4692 832 lxffrfr.exe 93 PID 832 wrote to memory of 4692 832 lxffrfr.exe 93 PID 4692 wrote to memory of 3068 4692 htttbt.exe 94 PID 4692 wrote to memory of 3068 4692 htttbt.exe 94 PID 4692 wrote to memory of 3068 4692 htttbt.exe 94 PID 3068 wrote to memory of 720 3068 5bnnhh.exe 95 PID 3068 wrote to memory of 720 3068 5bnnhh.exe 95 PID 3068 wrote to memory of 720 3068 5bnnhh.exe 95 PID 720 wrote to memory of 2940 720 7djvj.exe 96 PID 720 wrote to memory of 2940 720 7djvj.exe 96 PID 720 wrote to memory of 2940 720 7djvj.exe 96 PID 2940 wrote to memory of 1048 2940 thbttn.exe 97 PID 2940 wrote to memory of 1048 2940 thbttn.exe 97 PID 2940 wrote to memory of 1048 2940 thbttn.exe 97 PID 1048 wrote to memory of 2480 1048 dpvpd.exe 98 PID 1048 wrote to memory of 2480 1048 dpvpd.exe 98 PID 1048 wrote to memory of 2480 1048 dpvpd.exe 98 PID 2480 wrote to memory of 2908 2480 pjjdv.exe 99 PID 2480 wrote to memory of 2908 2480 pjjdv.exe 99 PID 2480 wrote to memory of 2908 2480 pjjdv.exe 99 PID 2908 wrote to memory of 776 2908 7lrfxrf.exe 100 PID 2908 wrote to memory of 776 2908 7lrfxrf.exe 100 PID 2908 wrote to memory of 776 2908 7lrfxrf.exe 100 PID 776 wrote to memory of 2756 776 dpjjv.exe 101 PID 776 wrote to memory of 2756 776 dpjjv.exe 101 PID 776 wrote to memory of 2756 776 dpjjv.exe 101 PID 2756 wrote to memory of 2484 2756 vpjjd.exe 103 PID 2756 wrote to memory of 2484 2756 vpjjd.exe 103 PID 2756 wrote to memory of 2484 2756 vpjjd.exe 103 PID 2484 wrote to memory of 4460 2484 7fxrffx.exe 104 PID 2484 wrote to memory of 4460 2484 7fxrffx.exe 104 PID 2484 wrote to memory of 4460 2484 7fxrffx.exe 104 PID 4460 wrote to memory of 2268 4460 3ntbtb.exe 105 PID 4460 wrote to memory of 2268 4460 3ntbtb.exe 105 PID 4460 wrote to memory of 2268 4460 3ntbtb.exe 105 PID 2268 wrote to memory of 3356 2268 1djvp.exe 106 PID 2268 wrote to memory of 3356 2268 1djvp.exe 106 PID 2268 wrote to memory of 3356 2268 1djvp.exe 106 PID 3356 wrote to memory of 4948 3356 rxllxrf.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe"C:\Users\Admin\AppData\Local\Temp\c9947f4bcfcbb2cd66e8b210e71508b7a632e5489a0226aa614f4bcfe8eb85c4N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\pjjdv.exec:\pjjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\lrrlfff.exec:\lrrlfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\bntnbb.exec:\bntnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\9btnbt.exec:\9btnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\fxfxrfx.exec:\fxfxrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\nbbtnn.exec:\nbbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\vpvpj.exec:\vpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\lxffrfr.exec:\lxffrfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
\??\c:\htttbt.exec:\htttbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\5bnnhh.exec:\5bnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7djvj.exec:\7djvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\thbttn.exec:\thbttn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\dpvpd.exec:\dpvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\pjjdv.exec:\pjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\7lrfxrf.exec:\7lrfxrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\dpjjv.exec:\dpjjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\vpjjd.exec:\vpjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\7fxrffx.exec:\7fxrffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\3ntbtb.exec:\3ntbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\1djvp.exec:\1djvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\rxllxrf.exec:\rxllxrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\xrfxlll.exec:\xrfxlll.exe23⤵
- Executes dropped EXE
PID:4948 -
\??\c:\nhbtnh.exec:\nhbtnh.exe24⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vvjpp.exec:\vvjpp.exe25⤵
- Executes dropped EXE
PID:1848 -
\??\c:\lxlffrx.exec:\lxlffrx.exe26⤵
- Executes dropped EXE
PID:3636 -
\??\c:\nnhhnb.exec:\nnhhnb.exe27⤵
- Executes dropped EXE
PID:4796 -
\??\c:\hhbthh.exec:\hhbthh.exe28⤵
- Executes dropped EXE
PID:4836 -
\??\c:\djjjd.exec:\djjjd.exe29⤵
- Executes dropped EXE
PID:4428 -
\??\c:\rlllxxx.exec:\rlllxxx.exe30⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3fflfff.exec:\3fflfff.exe31⤵
- Executes dropped EXE
PID:4696 -
\??\c:\btntnn.exec:\btntnn.exe32⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jdjdp.exec:\jdjdp.exe33⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rrxrlll.exec:\rrxrlll.exe34⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tntnnb.exec:\tntnnb.exe35⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9dvjv.exec:\9dvjv.exe36⤵
- Executes dropped EXE
PID:4532 -
\??\c:\dvdvp.exec:\dvdvp.exe37⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nnnnhh.exec:\nnnnhh.exe38⤵
- Executes dropped EXE
PID:2960 -
\??\c:\bbbbtt.exec:\bbbbtt.exe39⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjvjv.exec:\vjvjv.exe40⤵
- Executes dropped EXE
PID:3224 -
\??\c:\vjpjd.exec:\vjpjd.exe41⤵
- Executes dropped EXE
PID:4176 -
\??\c:\lflfxxx.exec:\lflfxxx.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\nnnhtt.exec:\nnnhtt.exe43⤵
- Executes dropped EXE
PID:4604 -
\??\c:\tnnhhh.exec:\tnnhhh.exe44⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vjvjv.exec:\vjvjv.exe45⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjjjd.exec:\jjjjd.exe46⤵
- Executes dropped EXE
PID:3048 -
\??\c:\rllffxx.exec:\rllffxx.exe47⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bbnnhh.exec:\bbnnhh.exe48⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dpvpj.exec:\dpvpj.exe49⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vpdvd.exec:\vpdvd.exe50⤵
- Executes dropped EXE
PID:720 -
\??\c:\xflfxll.exec:\xflfxll.exe51⤵
- Executes dropped EXE
PID:3236 -
\??\c:\btbhht.exec:\btbhht.exe52⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bbbbtt.exec:\bbbbtt.exe53⤵
- Executes dropped EXE
PID:404 -
\??\c:\dvpdj.exec:\dvpdj.exe54⤵
- Executes dropped EXE
PID:4456 -
\??\c:\pjdvd.exec:\pjdvd.exe55⤵
- Executes dropped EXE
PID:2480 -
\??\c:\frllffx.exec:\frllffx.exe56⤵
- Executes dropped EXE
PID:448 -
\??\c:\fflrffx.exec:\fflrffx.exe57⤵
- Executes dropped EXE
PID:396 -
\??\c:\3hbtnh.exec:\3hbtnh.exe58⤵
- Executes dropped EXE
PID:4552 -
\??\c:\nbhtnn.exec:\nbhtnn.exe59⤵
- Executes dropped EXE
PID:1900 -
\??\c:\jdvdj.exec:\jdvdj.exe60⤵
- Executes dropped EXE
PID:4732 -
\??\c:\flffxxf.exec:\flffxxf.exe61⤵
- Executes dropped EXE
PID:3976 -
\??\c:\nhhtnt.exec:\nhhtnt.exe62⤵
- Executes dropped EXE
PID:1708 -
\??\c:\1tbhbb.exec:\1tbhbb.exe63⤵
- Executes dropped EXE
PID:1648 -
\??\c:\djpjd.exec:\djpjd.exe64⤵
- Executes dropped EXE
PID:4412 -
\??\c:\xfflfxf.exec:\xfflfxf.exe65⤵
- Executes dropped EXE
PID:384 -
\??\c:\nhnhtn.exec:\nhnhtn.exe66⤵PID:1368
-
\??\c:\jvjdp.exec:\jvjdp.exe67⤵PID:116
-
\??\c:\jpdvp.exec:\jpdvp.exe68⤵PID:3416
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe69⤵PID:4904
-
\??\c:\lffxlrr.exec:\lffxlrr.exe70⤵PID:1084
-
\??\c:\hhttht.exec:\hhttht.exe71⤵PID:1540
-
\??\c:\3pjjp.exec:\3pjjp.exe72⤵PID:916
-
\??\c:\llxflxr.exec:\llxflxr.exe73⤵PID:3872
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe74⤵PID:2360
-
\??\c:\httnnn.exec:\httnnn.exe75⤵PID:4324
-
\??\c:\pvvpp.exec:\pvvpp.exe76⤵PID:4800
-
\??\c:\vpvpj.exec:\vpvpj.exe77⤵PID:3624
-
\??\c:\xflffxl.exec:\xflffxl.exe78⤵PID:5060
-
\??\c:\7bbthh.exec:\7bbthh.exe79⤵PID:4024
-
\??\c:\pdjjd.exec:\pdjjd.exe80⤵PID:2664
-
\??\c:\dddvj.exec:\dddvj.exe81⤵PID:1460
-
\??\c:\3xrrlrl.exec:\3xrrlrl.exe82⤵PID:5028
-
\??\c:\hbhbtt.exec:\hbhbtt.exe83⤵PID:2292
-
\??\c:\7hbtbb.exec:\7hbtbb.exe84⤵PID:1180
-
\??\c:\pjjdd.exec:\pjjdd.exe85⤵PID:3348
-
\??\c:\frrrrrf.exec:\frrrrrf.exe86⤵PID:2920
-
\??\c:\tttttb.exec:\tttttb.exe87⤵PID:3940
-
\??\c:\hhhbnn.exec:\hhhbnn.exe88⤵PID:5024
-
\??\c:\lxflrxx.exec:\lxflrxx.exe89⤵PID:2076
-
\??\c:\lfxlfll.exec:\lfxlfll.exe90⤵PID:4576
-
\??\c:\dvppj.exec:\dvppj.exe91⤵PID:3532
-
\??\c:\1frflxl.exec:\1frflxl.exe92⤵PID:5040
-
\??\c:\ffxxxfx.exec:\ffxxxfx.exe93⤵PID:5052
-
\??\c:\7tthbt.exec:\7tthbt.exe94⤵PID:4336
-
\??\c:\pvjvj.exec:\pvjvj.exe95⤵PID:3392
-
\??\c:\fflrrxf.exec:\fflrrxf.exe96⤵PID:3020
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe97⤵PID:4160
-
\??\c:\3ntnhn.exec:\3ntnhn.exe98⤵PID:4276
-
\??\c:\pjjdd.exec:\pjjdd.exe99⤵PID:848
-
\??\c:\5lrlfff.exec:\5lrlfff.exe100⤵PID:4044
-
\??\c:\hbtnbt.exec:\hbtnbt.exe101⤵
- System Location Discovery: System Language Discovery
PID:3008 -
\??\c:\ttnbtn.exec:\ttnbtn.exe102⤵PID:2756
-
\??\c:\dvvdv.exec:\dvvdv.exe103⤵PID:2252
-
\??\c:\lrxrrrx.exec:\lrxrrrx.exe104⤵PID:2996
-
\??\c:\vdvpv.exec:\vdvpv.exe105⤵PID:2268
-
\??\c:\lxllrfr.exec:\lxllrfr.exe106⤵PID:2800
-
\??\c:\llrrlrl.exec:\llrrlrl.exe107⤵PID:3356
-
\??\c:\bhhnhh.exec:\bhhnhh.exe108⤵PID:3004
-
\??\c:\thhbtn.exec:\thhbtn.exe109⤵PID:4944
-
\??\c:\vdpvp.exec:\vdpvp.exe110⤵PID:3000
-
\??\c:\7rrrllf.exec:\7rrrllf.exe111⤵PID:3656
-
\??\c:\rflfxxr.exec:\rflfxxr.exe112⤵PID:3024
-
\??\c:\hthttn.exec:\hthttn.exe113⤵PID:1060
-
\??\c:\jvddv.exec:\jvddv.exe114⤵PID:3320
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe115⤵PID:4600
-
\??\c:\tnthbt.exec:\tnthbt.exe116⤵PID:464
-
\??\c:\jddvj.exec:\jddvj.exe117⤵PID:3872
-
\??\c:\jdvjd.exec:\jdvjd.exe118⤵PID:64
-
\??\c:\7xlffxf.exec:\7xlffxf.exe119⤵PID:316
-
\??\c:\bnnhbt.exec:\bnnhbt.exe120⤵PID:996
-
\??\c:\nhttnh.exec:\nhttnh.exe121⤵PID:2712
-
\??\c:\ppvvp.exec:\ppvvp.exe122⤵PID:1204
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-