Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 09:20
Static task
static1
Behavioral task
behavioral1
Sample
665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe
Resource
win7-20240903-en
General
-
Target
665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe
-
Size
75KB
-
MD5
b7f69c53be6094db14af1ff834a1ae70
-
SHA1
e1ca6b42d31e6cbba701b12cc48ba599ce86246c
-
SHA256
665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48
-
SHA512
f2287ca08dcc70f7396a5665b09bd1a0ac78e5608a01d1ceb0ff349c4386e7f5f17f5b78ca534321041bf9016092f0283192a67054541658e0c61b70ea17aade
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89OGvrFVHmPi:ymb3NkkiQ3mdBjFIvl358nLA89OMFVHD
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 22 IoCs
resource yara_rule behavioral2/memory/4880-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2472-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/100-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4188-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2036 pjpdj.exe 4040 lrrfrrl.exe 1736 bhhhbn.exe 3220 jdpjd.exe 952 fllffxx.exe 2484 bthbnt.exe 1572 dpvpv.exe 3188 lrxxfll.exe 2620 bbhbnt.exe 3224 jjjdv.exe 4188 llxlfxx.exe 100 vpvvd.exe 3860 jvdpj.exe 4900 bbhhhn.exe 4760 dddvd.exe 3732 9rxxxlr.exe 2844 nbntht.exe 3696 jpppp.exe 4736 rxxrlxf.exe 4836 rffllfr.exe 1528 bbhtbh.exe 2400 jpdpp.exe 2472 rflffff.exe 4432 bhbthn.exe 1304 dpvpp.exe 4768 fxfxlff.exe 1232 rxxffrf.exe 1896 tthbbb.exe 3352 ddpvv.exe 1004 llfrrlx.exe 3200 nhtnbb.exe 1300 7dvpj.exe 1936 xfrlxxr.exe 4932 rxrflrr.exe 4360 bttthn.exe 1756 vdddp.exe 4880 fxxxrrf.exe 1260 bbhhtb.exe 2896 3nntbb.exe 2168 dvjjj.exe 2292 rrxxffr.exe 3436 nhhbtt.exe 992 pvvdv.exe 4496 lxxrrlr.exe 2624 nhhhhh.exe 2176 ntbttb.exe 3004 jjvpp.exe 1952 frlfrlf.exe 540 bnnhhh.exe 3556 nnhbnn.exe 4756 pvjdj.exe 2800 lrlxrlf.exe 3860 rfrxrfl.exe 2464 hbbbhh.exe 3320 dvdpv.exe 1064 3vpjd.exe 4180 1frrrff.exe 3748 hhtttb.exe 4860 tbhhnn.exe 4736 pvjjp.exe 1584 pdvvd.exe 4884 5rlrllf.exe 2400 bhbnhn.exe 1824 hhhhhb.exe -
resource yara_rule behavioral2/memory/4880-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2472-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4188-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-3-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntthbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvpdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7nhhbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllffxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhntb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfxlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlflfr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxfrrfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5lxfrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnbnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxllxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1nthbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nthtnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thbtbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhhhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dpdjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffrrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhhtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbhhnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffllr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4880 wrote to memory of 2036 4880 665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe 84 PID 4880 wrote to memory of 2036 4880 665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe 84 PID 4880 wrote to memory of 2036 4880 665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe 84 PID 2036 wrote to memory of 4040 2036 pjpdj.exe 85 PID 2036 wrote to memory of 4040 2036 pjpdj.exe 85 PID 2036 wrote to memory of 4040 2036 pjpdj.exe 85 PID 4040 wrote to memory of 1736 4040 lrrfrrl.exe 86 PID 4040 wrote to memory of 1736 4040 lrrfrrl.exe 86 PID 4040 wrote to memory of 1736 4040 lrrfrrl.exe 86 PID 1736 wrote to memory of 3220 1736 bhhhbn.exe 87 PID 1736 wrote to memory of 3220 1736 bhhhbn.exe 87 PID 1736 wrote to memory of 3220 1736 bhhhbn.exe 87 PID 3220 wrote to memory of 952 3220 jdpjd.exe 88 PID 3220 wrote to memory of 952 3220 jdpjd.exe 88 PID 3220 wrote to memory of 952 3220 jdpjd.exe 88 PID 952 wrote to memory of 2484 952 fllffxx.exe 90 PID 952 wrote to memory of 2484 952 fllffxx.exe 90 PID 952 wrote to memory of 2484 952 fllffxx.exe 90 PID 2484 wrote to memory of 1572 2484 bthbnt.exe 91 PID 2484 wrote to memory of 1572 2484 bthbnt.exe 91 PID 2484 wrote to memory of 1572 2484 bthbnt.exe 91 PID 1572 wrote to memory of 3188 1572 dpvpv.exe 92 PID 1572 wrote to memory of 3188 1572 dpvpv.exe 92 PID 1572 wrote to memory of 3188 1572 dpvpv.exe 92 PID 3188 wrote to memory of 2620 3188 lrxxfll.exe 653 PID 3188 wrote to memory of 2620 3188 lrxxfll.exe 653 PID 3188 wrote to memory of 2620 3188 lrxxfll.exe 653 PID 2620 wrote to memory of 3224 2620 bbhbnt.exe 94 PID 2620 wrote to memory of 3224 2620 bbhbnt.exe 94 PID 2620 wrote to memory of 3224 2620 bbhbnt.exe 94 PID 3224 wrote to memory of 4188 3224 jjjdv.exe 96 PID 3224 wrote to memory of 4188 3224 jjjdv.exe 96 PID 3224 wrote to memory of 4188 3224 jjjdv.exe 96 PID 4188 wrote to memory of 100 4188 llxlfxx.exe 97 PID 4188 wrote to memory of 100 4188 llxlfxx.exe 97 PID 4188 wrote to memory of 100 4188 llxlfxx.exe 97 PID 100 wrote to memory of 3860 100 vpvvd.exe 98 PID 100 wrote to memory of 3860 100 vpvvd.exe 98 PID 100 wrote to memory of 3860 100 vpvvd.exe 98 PID 3860 wrote to memory of 4900 3860 jvdpj.exe 99 PID 3860 wrote to memory of 4900 3860 jvdpj.exe 99 PID 3860 wrote to memory of 4900 3860 jvdpj.exe 99 PID 4900 wrote to memory of 4760 4900 bbhhhn.exe 100 PID 4900 wrote to memory of 4760 4900 bbhhhn.exe 100 PID 4900 wrote to memory of 4760 4900 bbhhhn.exe 100 PID 4760 wrote to memory of 3732 4760 dddvd.exe 101 PID 4760 wrote to memory of 3732 4760 dddvd.exe 101 PID 4760 wrote to memory of 3732 4760 dddvd.exe 101 PID 3732 wrote to memory of 2844 3732 9rxxxlr.exe 103 PID 3732 wrote to memory of 2844 3732 9rxxxlr.exe 103 PID 3732 wrote to memory of 2844 3732 9rxxxlr.exe 103 PID 2844 wrote to memory of 3696 2844 nbntht.exe 104 PID 2844 wrote to memory of 3696 2844 nbntht.exe 104 PID 2844 wrote to memory of 3696 2844 nbntht.exe 104 PID 3696 wrote to memory of 4736 3696 jpppp.exe 105 PID 3696 wrote to memory of 4736 3696 jpppp.exe 105 PID 3696 wrote to memory of 4736 3696 jpppp.exe 105 PID 4736 wrote to memory of 4836 4736 rxxrlxf.exe 106 PID 4736 wrote to memory of 4836 4736 rxxrlxf.exe 106 PID 4736 wrote to memory of 4836 4736 rxxrlxf.exe 106 PID 4836 wrote to memory of 1528 4836 rffllfr.exe 693 PID 4836 wrote to memory of 1528 4836 rffllfr.exe 693 PID 4836 wrote to memory of 1528 4836 rffllfr.exe 693 PID 1528 wrote to memory of 2400 1528 bbhtbh.exe 149
Processes
-
C:\Users\Admin\AppData\Local\Temp\665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe"C:\Users\Admin\AppData\Local\Temp\665e2c1ba6da46930f6751a2c984dac5a83082e54efe5bd9f24fae53d082da48N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\pjpdj.exec:\pjpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\lrrfrrl.exec:\lrrfrrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\bhhhbn.exec:\bhhhbn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\jdpjd.exec:\jdpjd.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\fllffxx.exec:\fllffxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\bthbnt.exec:\bthbnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\dpvpv.exec:\dpvpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\lrxxfll.exec:\lrxxfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\bbhbnt.exec:\bbhbnt.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\jjjdv.exec:\jjjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\llxlfxx.exec:\llxlfxx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\vpvvd.exec:\vpvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:100 -
\??\c:\jvdpj.exec:\jvdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
\??\c:\bbhhhn.exec:\bbhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\dddvd.exec:\dddvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\9rxxxlr.exec:\9rxxxlr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\nbntht.exec:\nbntht.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\jpppp.exec:\jpppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\rxxrlxf.exec:\rxxrlxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\rffllfr.exec:\rffllfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\bbhtbh.exec:\bbhtbh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\jpdpp.exec:\jpdpp.exe23⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rflffff.exec:\rflffff.exe24⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bhbthn.exec:\bhbthn.exe25⤵
- Executes dropped EXE
PID:4432 -
\??\c:\dpvpp.exec:\dpvpp.exe26⤵
- Executes dropped EXE
PID:1304 -
\??\c:\fxfxlff.exec:\fxfxlff.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4768 -
\??\c:\rxxffrf.exec:\rxxffrf.exe28⤵
- Executes dropped EXE
PID:1232 -
\??\c:\tthbbb.exec:\tthbbb.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\ddpvv.exec:\ddpvv.exe30⤵
- Executes dropped EXE
PID:3352 -
\??\c:\llfrrlx.exec:\llfrrlx.exe31⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nhtnbb.exec:\nhtnbb.exe32⤵
- Executes dropped EXE
PID:3200 -
\??\c:\7dvpj.exec:\7dvpj.exe33⤵
- Executes dropped EXE
PID:1300 -
\??\c:\xfrlxxr.exec:\xfrlxxr.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\rxrflrr.exec:\rxrflrr.exe35⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bttthn.exec:\bttthn.exe36⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vdddp.exec:\vdddp.exe37⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe38⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bbhhtb.exec:\bbhhtb.exe39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260 -
\??\c:\3nntbb.exec:\3nntbb.exe40⤵
- Executes dropped EXE
PID:2896 -
\??\c:\dvjjj.exec:\dvjjj.exe41⤵
- Executes dropped EXE
PID:2168 -
\??\c:\rrxxffr.exec:\rrxxffr.exe42⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhhbtt.exec:\nhhbtt.exe43⤵
- Executes dropped EXE
PID:3436 -
\??\c:\pvvdv.exec:\pvvdv.exe44⤵
- Executes dropped EXE
PID:992 -
\??\c:\lxxrrlr.exec:\lxxrrlr.exe45⤵
- Executes dropped EXE
PID:4496 -
\??\c:\nhhhhh.exec:\nhhhhh.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ntbttb.exec:\ntbttb.exe47⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjvpp.exec:\jjvpp.exe48⤵
- Executes dropped EXE
PID:3004 -
\??\c:\frlfrlf.exec:\frlfrlf.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\bnnhhh.exec:\bnnhhh.exe50⤵
- Executes dropped EXE
PID:540 -
\??\c:\nnhbnn.exec:\nnhbnn.exe51⤵
- Executes dropped EXE
PID:3556 -
\??\c:\pvjdj.exec:\pvjdj.exe52⤵
- Executes dropped EXE
PID:4756 -
\??\c:\lrlxrlf.exec:\lrlxrlf.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\rfrxrfl.exec:\rfrxrfl.exe54⤵
- Executes dropped EXE
PID:3860 -
\??\c:\hbbbhh.exec:\hbbbhh.exe55⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvdpv.exec:\dvdpv.exe56⤵
- Executes dropped EXE
PID:3320 -
\??\c:\3vpjd.exec:\3vpjd.exe57⤵
- Executes dropped EXE
PID:1064 -
\??\c:\1frrrff.exec:\1frrrff.exe58⤵
- Executes dropped EXE
PID:4180 -
\??\c:\hhtttb.exec:\hhtttb.exe59⤵
- Executes dropped EXE
PID:3748 -
\??\c:\tbhhnn.exec:\tbhhnn.exe60⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4860 -
\??\c:\pvjjp.exec:\pvjjp.exe61⤵
- Executes dropped EXE
PID:4736 -
\??\c:\pdvvd.exec:\pdvvd.exe62⤵
- Executes dropped EXE
PID:1584 -
\??\c:\5rlrllf.exec:\5rlrllf.exe63⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bhbnhn.exec:\bhbnhn.exe64⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhhhhb.exec:\hhhhhb.exe65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1824 -
\??\c:\vddvp.exec:\vddvp.exe66⤵PID:4344
-
\??\c:\vvdjj.exec:\vvdjj.exe67⤵PID:4964
-
\??\c:\fxrrffl.exec:\fxrrffl.exe68⤵PID:4612
-
\??\c:\hbtbhn.exec:\hbtbhn.exe69⤵PID:4116
-
\??\c:\3dppv.exec:\3dppv.exe70⤵
- System Location Discovery: System Language Discovery
PID:4424 -
\??\c:\pddvv.exec:\pddvv.exe71⤵PID:1016
-
\??\c:\lrrxlrf.exec:\lrrxlrf.exe72⤵PID:4988
-
\??\c:\xlfflxf.exec:\xlfflxf.exe73⤵PID:2980
-
\??\c:\hbbhnn.exec:\hbbhnn.exe74⤵PID:1264
-
\??\c:\ddjvd.exec:\ddjvd.exe75⤵PID:4752
-
\??\c:\xlxfflr.exec:\xlxfflr.exe76⤵
- System Location Discovery: System Language Discovery
PID:860 -
\??\c:\tnbbbb.exec:\tnbbbb.exe77⤵PID:3520
-
\??\c:\dpvvv.exec:\dpvvv.exe78⤵PID:4488
-
\??\c:\ppvdd.exec:\ppvdd.exe79⤵PID:3336
-
\??\c:\rflrrxf.exec:\rflrrxf.exe80⤵PID:664
-
\??\c:\hhbtbh.exec:\hhbtbh.exe81⤵PID:4208
-
\??\c:\thbtbh.exec:\thbtbh.exe82⤵PID:1736
-
\??\c:\dvjjj.exec:\dvjjj.exe83⤵PID:3772
-
\??\c:\lfllrrr.exec:\lfllrrr.exe84⤵PID:4592
-
\??\c:\vdjvd.exec:\vdjvd.exe85⤵
- System Location Discovery: System Language Discovery
PID:4108 -
\??\c:\5rrrlrl.exec:\5rrrlrl.exe86⤵PID:3652
-
\??\c:\bhtbht.exec:\bhtbht.exe87⤵PID:4536
-
\??\c:\dvdjv.exec:\dvdjv.exe88⤵PID:2204
-
\??\c:\jpddv.exec:\jpddv.exe89⤵PID:1892
-
\??\c:\rffxrlr.exec:\rffxrlr.exe90⤵PID:4148
-
\??\c:\rrflrxf.exec:\rrflrxf.exe91⤵PID:3032
-
\??\c:\bnbhhn.exec:\bnbhhn.exe92⤵PID:620
-
\??\c:\3nhnnt.exec:\3nhnnt.exe93⤵PID:2808
-
\??\c:\jjjvd.exec:\jjjvd.exe94⤵PID:3328
-
\??\c:\vjvdp.exec:\vjvdp.exe95⤵PID:4080
-
\??\c:\jvvvd.exec:\jvvvd.exe96⤵PID:3844
-
\??\c:\xlflxxx.exec:\xlflxxx.exe97⤵PID:4684
-
\??\c:\nnbnbn.exec:\nnbnbn.exe98⤵PID:3344
-
\??\c:\dvjjj.exec:\dvjjj.exe99⤵PID:3228
-
\??\c:\fllxxff.exec:\fllxxff.exe100⤵PID:1064
-
\??\c:\xrfffxf.exec:\xrfffxf.exe101⤵PID:2844
-
\??\c:\tbhntb.exec:\tbhntb.exe102⤵PID:3748
-
\??\c:\ttntth.exec:\ttntth.exe103⤵PID:2436
-
\??\c:\pvjjv.exec:\pvjjv.exe104⤵PID:4736
-
\??\c:\xxxlllf.exec:\xxxlllf.exe105⤵PID:3052
-
\??\c:\flrrrxl.exec:\flrrrxl.exe106⤵PID:1028
-
\??\c:\bbtbbh.exec:\bbtbbh.exe107⤵PID:4512
-
\??\c:\vdpdj.exec:\vdpdj.exe108⤵PID:1956
-
\??\c:\vddvv.exec:\vddvv.exe109⤵PID:1676
-
\??\c:\xfrxfff.exec:\xfrxfff.exe110⤵PID:1044
-
\??\c:\xlrrxff.exec:\xlrrxff.exe111⤵PID:4612
-
\??\c:\nbthtt.exec:\nbthtt.exe112⤵PID:3172
-
\??\c:\vvvpp.exec:\vvvpp.exe113⤵PID:3352
-
\??\c:\xfrxxxf.exec:\xfrxxxf.exe114⤵PID:3332
-
\??\c:\hbtbnb.exec:\hbtbnb.exe115⤵PID:1968
-
\??\c:\tnntht.exec:\tnntht.exe116⤵PID:1196
-
\??\c:\vjppj.exec:\vjppj.exe117⤵PID:4308
-
\??\c:\pjddj.exec:\pjddj.exe118⤵PID:4984
-
\??\c:\5xfflfx.exec:\5xfflfx.exe119⤵PID:380
-
\??\c:\nbnntn.exec:\nbnntn.exe120⤵PID:928
-
\??\c:\nhnnhn.exec:\nhnnhn.exe121⤵PID:3148
-
\??\c:\pjpjd.exec:\pjpjd.exe122⤵PID:1084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-