Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 03:28
Static task
static1
Behavioral task
behavioral1
Sample
d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe
Resource
win7-20241010-en
General
-
Target
d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe
-
Size
60KB
-
MD5
31df9368bcaad524c0d9467a56a78450
-
SHA1
2cdbeb9c0ccfb102f1b1e81b53ffb0fe0c9cbd9f
-
SHA256
d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348
-
SHA512
29f12a8a24551e1ba51fad1fdb1ea59f13442d8c1c657050e771dce3462ad383688003828739cabb22e7dd5888a462c693b0832ec259fca27c3e0adf28975ea8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFaEul:ymb3NkkiQ3mdBjFIvIFaEu
Malware Config
Signatures
-
Detect Blackmoon payload 21 IoCs
resource yara_rule behavioral2/memory/4340-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4556-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/32-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4556 7xlfllr.exe 4348 nnnhbb.exe 3524 pvdvp.exe 4984 lxfxlll.exe 1964 fxrffxr.exe 1060 bbhhnn.exe 1860 vvvpp.exe 3388 5rxrxxf.exe 3092 tbbnnh.exe 2352 pjdpp.exe 32 vpdvj.exe 3576 ffllrxx.exe 448 rlrrrlr.exe 4628 nnhhbb.exe 4732 vvpvv.exe 2436 lffffll.exe 3064 lflfrfx.exe 1892 tntnnt.exe 4428 btttnn.exe 4980 jdjdd.exe 3236 5djjd.exe 1188 fxffllx.exe 2948 lxllflf.exe 3056 5hbbtt.exe 1088 5jpjj.exe 3952 pjpdv.exe 1456 lxfxrrl.exe 1760 nbbttt.exe 2740 tnbtbt.exe 3004 pppjj.exe 3940 lrllxff.exe 2612 nntttt.exe 3320 jpppd.exe 2408 ppjdp.exe 5104 lrxxfrr.exe 2848 9rxrrrx.exe 1112 hbnnhh.exe 1524 nntbtt.exe 800 ddpdv.exe 4376 xlrrlxx.exe 716 nnttnn.exe 4556 ttnntt.exe 4172 djddp.exe 3144 rlrfrxf.exe 3908 fxxrrrx.exe 3480 tbnhbb.exe 3904 dvddd.exe 3224 pddvj.exe 400 7jdvv.exe 3956 rxxllff.exe 5000 bhhbtn.exe 2868 thbttn.exe 2352 vvdpv.exe 2480 jdjdv.exe 960 7lrllrr.exe 3576 rflfxxr.exe 4836 nbttth.exe 3472 btttbb.exe 3168 jddpj.exe 1812 dvvvp.exe 384 xffrrrl.exe 1980 llxxxfx.exe 1892 frxllxf.exe 3936 hhhbbb.exe -
resource yara_rule behavioral2/memory/4340-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4556-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/32-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhbtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpvdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxllxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nnhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1djdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfxrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4340 wrote to memory of 4556 4340 d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe 84 PID 4340 wrote to memory of 4556 4340 d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe 84 PID 4340 wrote to memory of 4556 4340 d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe 84 PID 4556 wrote to memory of 4348 4556 7xlfllr.exe 85 PID 4556 wrote to memory of 4348 4556 7xlfllr.exe 85 PID 4556 wrote to memory of 4348 4556 7xlfllr.exe 85 PID 4348 wrote to memory of 3524 4348 nnnhbb.exe 86 PID 4348 wrote to memory of 3524 4348 nnnhbb.exe 86 PID 4348 wrote to memory of 3524 4348 nnnhbb.exe 86 PID 3524 wrote to memory of 4984 3524 pvdvp.exe 87 PID 3524 wrote to memory of 4984 3524 pvdvp.exe 87 PID 3524 wrote to memory of 4984 3524 pvdvp.exe 87 PID 4984 wrote to memory of 1964 4984 lxfxlll.exe 88 PID 4984 wrote to memory of 1964 4984 lxfxlll.exe 88 PID 4984 wrote to memory of 1964 4984 lxfxlll.exe 88 PID 1964 wrote to memory of 1060 1964 fxrffxr.exe 89 PID 1964 wrote to memory of 1060 1964 fxrffxr.exe 89 PID 1964 wrote to memory of 1060 1964 fxrffxr.exe 89 PID 1060 wrote to memory of 1860 1060 bbhhnn.exe 90 PID 1060 wrote to memory of 1860 1060 bbhhnn.exe 90 PID 1060 wrote to memory of 1860 1060 bbhhnn.exe 90 PID 1860 wrote to memory of 3388 1860 vvvpp.exe 91 PID 1860 wrote to memory of 3388 1860 vvvpp.exe 91 PID 1860 wrote to memory of 3388 1860 vvvpp.exe 91 PID 3388 wrote to memory of 3092 3388 5rxrxxf.exe 92 PID 3388 wrote to memory of 3092 3388 5rxrxxf.exe 92 PID 3388 wrote to memory of 3092 3388 5rxrxxf.exe 92 PID 3092 wrote to memory of 2352 3092 tbbnnh.exe 93 PID 3092 wrote to memory of 2352 3092 tbbnnh.exe 93 PID 3092 wrote to memory of 2352 3092 tbbnnh.exe 93 PID 2352 wrote to memory of 32 2352 pjdpp.exe 94 PID 2352 wrote to memory of 32 2352 pjdpp.exe 94 PID 2352 wrote to memory of 32 2352 pjdpp.exe 94 PID 32 wrote to memory of 3576 32 vpdvj.exe 95 PID 32 wrote to memory of 3576 32 vpdvj.exe 95 PID 32 wrote to memory of 3576 32 vpdvj.exe 95 PID 3576 wrote to memory of 448 3576 ffllrxx.exe 96 PID 3576 wrote to memory of 448 3576 ffllrxx.exe 96 PID 3576 wrote to memory of 448 3576 ffllrxx.exe 96 PID 448 wrote to memory of 4628 448 rlrrrlr.exe 97 PID 448 wrote to memory of 4628 448 rlrrrlr.exe 97 PID 448 wrote to memory of 4628 448 rlrrrlr.exe 97 PID 4628 wrote to memory of 4732 4628 nnhhbb.exe 98 PID 4628 wrote to memory of 4732 4628 nnhhbb.exe 98 PID 4628 wrote to memory of 4732 4628 nnhhbb.exe 98 PID 4732 wrote to memory of 2436 4732 vvpvv.exe 99 PID 4732 wrote to memory of 2436 4732 vvpvv.exe 99 PID 4732 wrote to memory of 2436 4732 vvpvv.exe 99 PID 2436 wrote to memory of 3064 2436 lffffll.exe 101 PID 2436 wrote to memory of 3064 2436 lffffll.exe 101 PID 2436 wrote to memory of 3064 2436 lffffll.exe 101 PID 3064 wrote to memory of 1892 3064 lflfrfx.exe 102 PID 3064 wrote to memory of 1892 3064 lflfrfx.exe 102 PID 3064 wrote to memory of 1892 3064 lflfrfx.exe 102 PID 1892 wrote to memory of 4428 1892 tntnnt.exe 103 PID 1892 wrote to memory of 4428 1892 tntnnt.exe 103 PID 1892 wrote to memory of 4428 1892 tntnnt.exe 103 PID 4428 wrote to memory of 4980 4428 btttnn.exe 104 PID 4428 wrote to memory of 4980 4428 btttnn.exe 104 PID 4428 wrote to memory of 4980 4428 btttnn.exe 104 PID 4980 wrote to memory of 3236 4980 jdjdd.exe 105 PID 4980 wrote to memory of 3236 4980 jdjdd.exe 105 PID 4980 wrote to memory of 3236 4980 jdjdd.exe 105 PID 3236 wrote to memory of 1188 3236 5djjd.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe"C:\Users\Admin\AppData\Local\Temp\d904a9b6b206b9b8949053788c189ba13b1b615706de859fd5c2f70092ce7348N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\7xlfllr.exec:\7xlfllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\nnnhbb.exec:\nnnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\pvdvp.exec:\pvdvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\lxfxlll.exec:\lxfxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\fxrffxr.exec:\fxrffxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\bbhhnn.exec:\bbhhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\vvvpp.exec:\vvvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\5rxrxxf.exec:\5rxrxxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\tbbnnh.exec:\tbbnnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\pjdpp.exec:\pjdpp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\vpdvj.exec:\vpdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:32 -
\??\c:\ffllrxx.exec:\ffllrxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\rlrrrlr.exec:\rlrrrlr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nnhhbb.exec:\nnhhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\vvpvv.exec:\vvpvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\lffffll.exec:\lffffll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\lflfrfx.exec:\lflfrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\tntnnt.exec:\tntnnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\btttnn.exec:\btttnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\jdjdd.exec:\jdjdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\5djjd.exec:\5djjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\fxffllx.exec:\fxffllx.exe23⤵
- Executes dropped EXE
PID:1188 -
\??\c:\lxllflf.exec:\lxllflf.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5hbbtt.exec:\5hbbtt.exe25⤵
- Executes dropped EXE
PID:3056 -
\??\c:\5jpjj.exec:\5jpjj.exe26⤵
- Executes dropped EXE
PID:1088 -
\??\c:\pjpdv.exec:\pjpdv.exe27⤵
- Executes dropped EXE
PID:3952 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe28⤵
- Executes dropped EXE
PID:1456 -
\??\c:\nbbttt.exec:\nbbttt.exe29⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tnbtbt.exec:\tnbtbt.exe30⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pppjj.exec:\pppjj.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lrllxff.exec:\lrllxff.exe32⤵
- Executes dropped EXE
PID:3940 -
\??\c:\nntttt.exec:\nntttt.exe33⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jpppd.exec:\jpppd.exe34⤵
- Executes dropped EXE
PID:3320 -
\??\c:\ppjdp.exec:\ppjdp.exe35⤵
- Executes dropped EXE
PID:2408 -
\??\c:\lrxxfrr.exec:\lrxxfrr.exe36⤵
- Executes dropped EXE
PID:5104 -
\??\c:\9rxrrrx.exec:\9rxrrrx.exe37⤵
- Executes dropped EXE
PID:2848 -
\??\c:\hbnnhh.exec:\hbnnhh.exe38⤵
- Executes dropped EXE
PID:1112 -
\??\c:\nntbtt.exec:\nntbtt.exe39⤵
- Executes dropped EXE
PID:1524 -
\??\c:\ddpdv.exec:\ddpdv.exe40⤵
- Executes dropped EXE
PID:800 -
\??\c:\xlrrlxx.exec:\xlrrlxx.exe41⤵
- Executes dropped EXE
PID:4376 -
\??\c:\nnttnn.exec:\nnttnn.exe42⤵
- Executes dropped EXE
PID:716 -
\??\c:\ttnntt.exec:\ttnntt.exe43⤵
- Executes dropped EXE
PID:4556 -
\??\c:\djddp.exec:\djddp.exe44⤵
- Executes dropped EXE
PID:4172 -
\??\c:\rlrfrxf.exec:\rlrfrxf.exe45⤵
- Executes dropped EXE
PID:3144 -
\??\c:\fxxrrrx.exec:\fxxrrrx.exe46⤵
- Executes dropped EXE
PID:3908 -
\??\c:\tbnhbb.exec:\tbnhbb.exe47⤵
- Executes dropped EXE
PID:3480 -
\??\c:\dvddd.exec:\dvddd.exe48⤵
- Executes dropped EXE
PID:3904 -
\??\c:\pddvj.exec:\pddvj.exe49⤵
- Executes dropped EXE
PID:3224 -
\??\c:\7jdvv.exec:\7jdvv.exe50⤵
- Executes dropped EXE
PID:400 -
\??\c:\rxxllff.exec:\rxxllff.exe51⤵
- Executes dropped EXE
PID:3956 -
\??\c:\bhhbtn.exec:\bhhbtn.exe52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5000 -
\??\c:\thbttn.exec:\thbttn.exe53⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vvdpv.exec:\vvdpv.exe54⤵
- Executes dropped EXE
PID:2352 -
\??\c:\jdjdv.exec:\jdjdv.exe55⤵
- Executes dropped EXE
PID:2480 -
\??\c:\7lrllrr.exec:\7lrllrr.exe56⤵
- Executes dropped EXE
PID:960 -
\??\c:\rflfxxr.exec:\rflfxxr.exe57⤵
- Executes dropped EXE
PID:3576 -
\??\c:\nbttth.exec:\nbttth.exe58⤵
- Executes dropped EXE
PID:4836 -
\??\c:\btttbb.exec:\btttbb.exe59⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jddpj.exec:\jddpj.exe60⤵
- Executes dropped EXE
PID:3168 -
\??\c:\dvvvp.exec:\dvvvp.exe61⤵
- Executes dropped EXE
PID:1812 -
\??\c:\xffrrrl.exec:\xffrrrl.exe62⤵
- Executes dropped EXE
PID:384 -
\??\c:\llxxxfx.exec:\llxxxfx.exe63⤵
- Executes dropped EXE
PID:1980 -
\??\c:\frxllxf.exec:\frxllxf.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1892 -
\??\c:\hhhbbb.exec:\hhhbbb.exe65⤵
- Executes dropped EXE
PID:3936 -
\??\c:\vppvp.exec:\vppvp.exe66⤵PID:1864
-
\??\c:\vppjj.exec:\vppjj.exe67⤵PID:4876
-
\??\c:\xrxrlxx.exec:\xrxrlxx.exe68⤵PID:4604
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe69⤵
- System Location Discovery: System Language Discovery
PID:2596 -
\??\c:\5xflfff.exec:\5xflfff.exe70⤵PID:1188
-
\??\c:\bbbnnb.exec:\bbbnnb.exe71⤵PID:2948
-
\??\c:\thhttb.exec:\thhttb.exe72⤵PID:348
-
\??\c:\9dddv.exec:\9dddv.exe73⤵PID:2356
-
\??\c:\pjjpp.exec:\pjjpp.exe74⤵PID:5016
-
\??\c:\rflfxrx.exec:\rflfxrx.exe75⤵PID:3316
-
\??\c:\xxfxxxf.exec:\xxfxxxf.exe76⤵PID:4584
-
\??\c:\xllllll.exec:\xllllll.exe77⤵PID:4068
-
\??\c:\htnnbb.exec:\htnnbb.exe78⤵PID:4508
-
\??\c:\vpvvp.exec:\vpvvp.exe79⤵PID:2688
-
\??\c:\rxrrlrl.exec:\rxrrlrl.exe80⤵PID:5028
-
\??\c:\nttnnn.exec:\nttnnn.exe81⤵PID:5084
-
\??\c:\tnntnb.exec:\tnntnb.exe82⤵PID:2764
-
\??\c:\vjjjj.exec:\vjjjj.exe83⤵PID:3320
-
\??\c:\rrxxxff.exec:\rrxxxff.exe84⤵PID:2492
-
\??\c:\1frrrxx.exec:\1frrrxx.exe85⤵PID:5104
-
\??\c:\ttnhhh.exec:\ttnhhh.exe86⤵PID:3932
-
\??\c:\hnttnh.exec:\hnttnh.exe87⤵PID:1960
-
\??\c:\nhhhbb.exec:\nhhhbb.exe88⤵PID:3504
-
\??\c:\ddddv.exec:\ddddv.exe89⤵PID:4540
-
\??\c:\9jvpj.exec:\9jvpj.exe90⤵PID:2364
-
\??\c:\fxllrrx.exec:\fxllrrx.exe91⤵PID:4308
-
\??\c:\tnnbbb.exec:\tnnbbb.exe92⤵PID:4172
-
\??\c:\bthhtt.exec:\bthhtt.exe93⤵PID:3060
-
\??\c:\1rfrrxx.exec:\1rfrrxx.exe94⤵PID:3948
-
\??\c:\1rfxffx.exec:\1rfxffx.exe95⤵PID:2276
-
\??\c:\bhnnhh.exec:\bhnnhh.exe96⤵PID:3180
-
\??\c:\hbttbb.exec:\hbttbb.exe97⤵PID:3092
-
\??\c:\hbttnn.exec:\hbttnn.exe98⤵PID:1220
-
\??\c:\vdjdd.exec:\vdjdd.exe99⤵PID:536
-
\??\c:\9llfxxr.exec:\9llfxxr.exe100⤵PID:3164
-
\??\c:\rffxrrl.exec:\rffxrrl.exe101⤵PID:3740
-
\??\c:\llrrxrx.exec:\llrrxrx.exe102⤵PID:3408
-
\??\c:\9nhhtt.exec:\9nhhtt.exe103⤵PID:3576
-
\??\c:\nhhbnn.exec:\nhhbnn.exe104⤵PID:4060
-
\??\c:\dpjvp.exec:\dpjvp.exe105⤵PID:2288
-
\??\c:\pjpjd.exec:\pjpjd.exe106⤵PID:4044
-
\??\c:\lxxlffx.exec:\lxxlffx.exe107⤵PID:1824
-
\??\c:\htnnbn.exec:\htnnbn.exe108⤵PID:384
-
\??\c:\ddvvj.exec:\ddvvj.exe109⤵PID:2752
-
\??\c:\rrfxxfl.exec:\rrfxxfl.exe110⤵PID:1892
-
\??\c:\btbtnh.exec:\btbtnh.exe111⤵PID:1080
-
\??\c:\1bnbnn.exec:\1bnbnn.exe112⤵PID:1864
-
\??\c:\dvjdd.exec:\dvjdd.exe113⤵PID:4876
-
\??\c:\jjjpd.exec:\jjjpd.exe114⤵PID:4604
-
\??\c:\5rfxrrl.exec:\5rfxrrl.exe115⤵PID:2932
-
\??\c:\hhhnbn.exec:\hhhnbn.exe116⤵PID:3280
-
\??\c:\dvdvd.exec:\dvdvd.exe117⤵PID:3056
-
\??\c:\rfxlxxr.exec:\rfxlxxr.exe118⤵PID:2096
-
\??\c:\bhhhbn.exec:\bhhhbn.exe119⤵
- System Location Discovery: System Language Discovery
PID:2888 -
\??\c:\nbhbnn.exec:\nbhbnn.exe120⤵PID:5016
-
\??\c:\pvjjj.exec:\pvjjj.exe121⤵PID:1536
-
\??\c:\5flfxrl.exec:\5flfxrl.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-