Analysis
-
max time kernel
117s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe
Resource
win7-20240903-en
General
-
Target
e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe
-
Size
80KB
-
MD5
8c912c3bd66714d2a81aa750edb65be0
-
SHA1
16d4982bdc8466b2986af09f010dfef45ac762c6
-
SHA256
e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbf
-
SHA512
5f0419cd678fb98bd2684c8517bc30b81df0d157791091d4c24b44f9a5885cf59a770e562720c1e437ce3c5f9a338ed16bf6c93ebaebdffff0036d8833a6b8e4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JxJe:ymb3NkkiQ3mdBjFIWeFGyAsJe
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral2/memory/708-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/312-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1100-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/840-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3800-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1996 jvjjd.exe 2228 rrrlffx.exe 5104 tbbttt.exe 1244 5ppjd.exe 312 djppj.exe 1496 9lffxrr.exe 2140 thbbnn.exe 3660 dpvpj.exe 3200 xflllll.exe 1384 bbhhhh.exe 3464 ntbttb.exe 1100 vdjjd.exe 4444 1fffxxr.exe 3060 1htnhh.exe 4752 pvdpj.exe 1548 fxxxrrr.exe 712 tnbnbh.exe 640 nthbbb.exe 364 jjjjd.exe 4772 lrfxrrl.exe 216 xrlfrlr.exe 2952 btnnht.exe 840 jvdpp.exe 844 5fxlfxl.exe 3136 bnnhbt.exe 3800 7bhbtn.exe 2972 jdjjv.exe 4504 1xrxrxr.exe 4412 9flrlrl.exe 3936 bbbttt.exe 536 jdjvv.exe 3840 rxlxrff.exe 4596 xffxxxr.exe 2372 5nbbnn.exe 3752 ppdvv.exe 1388 vddvv.exe 3372 dvdvj.exe 2472 lffrlfr.exe 4756 tnnhbt.exe 4620 ddjjd.exe 3900 1xrxrfx.exe 1008 lfrlffx.exe 2368 hbnhhh.exe 4240 hnhtbt.exe 1264 dpvvp.exe 2132 rxfxxrf.exe 2908 nntbtb.exe 1384 pvjjp.exe 4128 rrxrllr.exe 3064 1frlxxx.exe 556 7tbtnn.exe 868 pdppv.exe 2440 dpvpj.exe 1528 flfxxxr.exe 3148 lxlrrrf.exe 1204 1tnntn.exe 2188 7vpdv.exe 2352 vvdvv.exe 2616 xrrllll.exe 3352 rlllfff.exe 2952 nnhhnn.exe 3548 9djdv.exe 1480 3djjd.exe 3712 xxxrxxl.exe -
resource yara_rule behavioral2/memory/708-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/312-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1100-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/840-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3800-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tthhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hntttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3fxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vppjj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 708 wrote to memory of 1996 708 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 84 PID 708 wrote to memory of 1996 708 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 84 PID 708 wrote to memory of 1996 708 e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe 84 PID 1996 wrote to memory of 2228 1996 jvjjd.exe 85 PID 1996 wrote to memory of 2228 1996 jvjjd.exe 85 PID 1996 wrote to memory of 2228 1996 jvjjd.exe 85 PID 2228 wrote to memory of 5104 2228 rrrlffx.exe 86 PID 2228 wrote to memory of 5104 2228 rrrlffx.exe 86 PID 2228 wrote to memory of 5104 2228 rrrlffx.exe 86 PID 5104 wrote to memory of 1244 5104 tbbttt.exe 87 PID 5104 wrote to memory of 1244 5104 tbbttt.exe 87 PID 5104 wrote to memory of 1244 5104 tbbttt.exe 87 PID 1244 wrote to memory of 312 1244 5ppjd.exe 88 PID 1244 wrote to memory of 312 1244 5ppjd.exe 88 PID 1244 wrote to memory of 312 1244 5ppjd.exe 88 PID 312 wrote to memory of 1496 312 djppj.exe 89 PID 312 wrote to memory of 1496 312 djppj.exe 89 PID 312 wrote to memory of 1496 312 djppj.exe 89 PID 1496 wrote to memory of 2140 1496 9lffxrr.exe 90 PID 1496 wrote to memory of 2140 1496 9lffxrr.exe 90 PID 1496 wrote to memory of 2140 1496 9lffxrr.exe 90 PID 2140 wrote to memory of 3660 2140 thbbnn.exe 91 PID 2140 wrote to memory of 3660 2140 thbbnn.exe 91 PID 2140 wrote to memory of 3660 2140 thbbnn.exe 91 PID 3660 wrote to memory of 3200 3660 dpvpj.exe 92 PID 3660 wrote to memory of 3200 3660 dpvpj.exe 92 PID 3660 wrote to memory of 3200 3660 dpvpj.exe 92 PID 3200 wrote to memory of 1384 3200 xflllll.exe 93 PID 3200 wrote to memory of 1384 3200 xflllll.exe 93 PID 3200 wrote to memory of 1384 3200 xflllll.exe 93 PID 1384 wrote to memory of 3464 1384 bbhhhh.exe 94 PID 1384 wrote to memory of 3464 1384 bbhhhh.exe 94 PID 1384 wrote to memory of 3464 1384 bbhhhh.exe 94 PID 3464 wrote to memory of 1100 3464 ntbttb.exe 95 PID 3464 wrote to memory of 1100 3464 ntbttb.exe 95 PID 3464 wrote to memory of 1100 3464 ntbttb.exe 95 PID 1100 wrote to memory of 4444 1100 vdjjd.exe 96 PID 1100 wrote to memory of 4444 1100 vdjjd.exe 96 PID 1100 wrote to memory of 4444 1100 vdjjd.exe 96 PID 4444 wrote to memory of 3060 4444 1fffxxr.exe 97 PID 4444 wrote to memory of 3060 4444 1fffxxr.exe 97 PID 4444 wrote to memory of 3060 4444 1fffxxr.exe 97 PID 3060 wrote to memory of 4752 3060 1htnhh.exe 98 PID 3060 wrote to memory of 4752 3060 1htnhh.exe 98 PID 3060 wrote to memory of 4752 3060 1htnhh.exe 98 PID 4752 wrote to memory of 1548 4752 pvdpj.exe 99 PID 4752 wrote to memory of 1548 4752 pvdpj.exe 99 PID 4752 wrote to memory of 1548 4752 pvdpj.exe 99 PID 1548 wrote to memory of 712 1548 fxxxrrr.exe 100 PID 1548 wrote to memory of 712 1548 fxxxrrr.exe 100 PID 1548 wrote to memory of 712 1548 fxxxrrr.exe 100 PID 712 wrote to memory of 640 712 tnbnbh.exe 101 PID 712 wrote to memory of 640 712 tnbnbh.exe 101 PID 712 wrote to memory of 640 712 tnbnbh.exe 101 PID 640 wrote to memory of 364 640 nthbbb.exe 102 PID 640 wrote to memory of 364 640 nthbbb.exe 102 PID 640 wrote to memory of 364 640 nthbbb.exe 102 PID 364 wrote to memory of 4772 364 jjjjd.exe 103 PID 364 wrote to memory of 4772 364 jjjjd.exe 103 PID 364 wrote to memory of 4772 364 jjjjd.exe 103 PID 4772 wrote to memory of 216 4772 lrfxrrl.exe 104 PID 4772 wrote to memory of 216 4772 lrfxrrl.exe 104 PID 4772 wrote to memory of 216 4772 lrfxrrl.exe 104 PID 216 wrote to memory of 2952 216 xrlfrlr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe"C:\Users\Admin\AppData\Local\Temp\e4665c18ab034d9b52c69c94797fc0658026db3f2a5db61221e2c536ff694bbfN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:708 -
\??\c:\jvjjd.exec:\jvjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\rrrlffx.exec:\rrrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\tbbttt.exec:\tbbttt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\5ppjd.exec:\5ppjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\djppj.exec:\djppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\9lffxrr.exec:\9lffxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\thbbnn.exec:\thbbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\dpvpj.exec:\dpvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\xflllll.exec:\xflllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\bbhhhh.exec:\bbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\ntbttb.exec:\ntbttb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\vdjjd.exec:\vdjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\1fffxxr.exec:\1fffxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\1htnhh.exec:\1htnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\pvdpj.exec:\pvdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\tnbnbh.exec:\tnbnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
\??\c:\nthbbb.exec:\nthbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\jjjjd.exec:\jjjjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\xrlfrlr.exec:\xrlfrlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\btnnht.exec:\btnnht.exe23⤵
- Executes dropped EXE
PID:2952 -
\??\c:\jvdpp.exec:\jvdpp.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\5fxlfxl.exec:\5fxlfxl.exe25⤵
- Executes dropped EXE
PID:844 -
\??\c:\bnnhbt.exec:\bnnhbt.exe26⤵
- Executes dropped EXE
PID:3136 -
\??\c:\7bhbtn.exec:\7bhbtn.exe27⤵
- Executes dropped EXE
PID:3800 -
\??\c:\jdjjv.exec:\jdjjv.exe28⤵
- Executes dropped EXE
PID:2972 -
\??\c:\1xrxrxr.exec:\1xrxrxr.exe29⤵
- Executes dropped EXE
PID:4504 -
\??\c:\9flrlrl.exec:\9flrlrl.exe30⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bbbttt.exec:\bbbttt.exe31⤵
- Executes dropped EXE
PID:3936 -
\??\c:\jdjvv.exec:\jdjvv.exe32⤵
- Executes dropped EXE
PID:536 -
\??\c:\rxlxrff.exec:\rxlxrff.exe33⤵
- Executes dropped EXE
PID:3840 -
\??\c:\xffxxxr.exec:\xffxxxr.exe34⤵
- Executes dropped EXE
PID:4596 -
\??\c:\5nbbnn.exec:\5nbbnn.exe35⤵
- Executes dropped EXE
PID:2372 -
\??\c:\ppdvv.exec:\ppdvv.exe36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3752 -
\??\c:\vddvv.exec:\vddvv.exe37⤵
- Executes dropped EXE
PID:1388 -
\??\c:\dvdvj.exec:\dvdvj.exe38⤵
- Executes dropped EXE
PID:3372 -
\??\c:\lffrlfr.exec:\lffrlfr.exe39⤵
- Executes dropped EXE
PID:2472 -
\??\c:\tnnhbt.exec:\tnnhbt.exe40⤵
- Executes dropped EXE
PID:4756 -
\??\c:\ddjjd.exec:\ddjjd.exe41⤵
- Executes dropped EXE
PID:4620 -
\??\c:\1xrxrfx.exec:\1xrxrfx.exe42⤵
- Executes dropped EXE
PID:3900 -
\??\c:\lfrlffx.exec:\lfrlffx.exe43⤵
- Executes dropped EXE
PID:1008 -
\??\c:\hbnhhh.exec:\hbnhhh.exe44⤵
- Executes dropped EXE
PID:2368 -
\??\c:\hnhtbt.exec:\hnhtbt.exe45⤵
- Executes dropped EXE
PID:4240 -
\??\c:\dpvvp.exec:\dpvvp.exe46⤵
- Executes dropped EXE
PID:1264 -
\??\c:\rxfxxrf.exec:\rxfxxrf.exe47⤵
- Executes dropped EXE
PID:2132 -
\??\c:\nntbtb.exec:\nntbtb.exe48⤵
- Executes dropped EXE
PID:2908 -
\??\c:\pvjjp.exec:\pvjjp.exe49⤵
- Executes dropped EXE
PID:1384 -
\??\c:\rrxrllr.exec:\rrxrllr.exe50⤵
- Executes dropped EXE
PID:4128 -
\??\c:\1frlxxx.exec:\1frlxxx.exe51⤵
- Executes dropped EXE
PID:3064 -
\??\c:\7tbtnn.exec:\7tbtnn.exe52⤵
- Executes dropped EXE
PID:556 -
\??\c:\pdppv.exec:\pdppv.exe53⤵
- Executes dropped EXE
PID:868 -
\??\c:\dpvpj.exec:\dpvpj.exe54⤵
- Executes dropped EXE
PID:2440 -
\??\c:\flfxxxr.exec:\flfxxxr.exe55⤵
- Executes dropped EXE
PID:1528 -
\??\c:\lxlrrrf.exec:\lxlrrrf.exe56⤵
- Executes dropped EXE
PID:3148 -
\??\c:\1tnntn.exec:\1tnntn.exe57⤵
- Executes dropped EXE
PID:1204 -
\??\c:\7vpdv.exec:\7vpdv.exe58⤵
- Executes dropped EXE
PID:2188 -
\??\c:\vvdvv.exec:\vvdvv.exe59⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xrrllll.exec:\xrrllll.exe60⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rlllfff.exec:\rlllfff.exe61⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nnhhnn.exec:\nnhhnn.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9djdv.exec:\9djdv.exe63⤵
- Executes dropped EXE
PID:3548 -
\??\c:\3djjd.exec:\3djjd.exe64⤵
- Executes dropped EXE
PID:1480 -
\??\c:\xxxrxxl.exec:\xxxrxxl.exe65⤵
- Executes dropped EXE
PID:3712 -
\??\c:\flfxxxx.exec:\flfxxxx.exe66⤵PID:4704
-
\??\c:\bttbbb.exec:\bttbbb.exe67⤵PID:3332
-
\??\c:\hnnnnn.exec:\hnnnnn.exe68⤵PID:2028
-
\??\c:\nnhhbb.exec:\nnhhbb.exe69⤵PID:4504
-
\??\c:\jpvvp.exec:\jpvvp.exe70⤵PID:4460
-
\??\c:\vjppj.exec:\vjppj.exe71⤵PID:5072
-
\??\c:\5fffxxl.exec:\5fffxxl.exe72⤵PID:3328
-
\??\c:\nttnbt.exec:\nttnbt.exe73⤵PID:4432
-
\??\c:\hnnnbt.exec:\hnnnbt.exe74⤵PID:3988
-
\??\c:\jjjjv.exec:\jjjjv.exe75⤵PID:4056
-
\??\c:\5vjjd.exec:\5vjjd.exe76⤵PID:5096
-
\??\c:\xrffxxx.exec:\xrffxxx.exe77⤵PID:748
-
\??\c:\rxlfrrf.exec:\rxlfrrf.exe78⤵PID:2228
-
\??\c:\hntttt.exec:\hntttt.exe79⤵PID:836
-
\??\c:\hntnnn.exec:\hntnnn.exe80⤵PID:2300
-
\??\c:\vjdpd.exec:\vjdpd.exe81⤵PID:396
-
\??\c:\llxrrrr.exec:\llxrrrr.exe82⤵PID:1128
-
\??\c:\9rlfxxr.exec:\9rlfxxr.exe83⤵PID:1284
-
\??\c:\bhhbtt.exec:\bhhbtt.exe84⤵PID:1144
-
\??\c:\1nthhh.exec:\1nthhh.exe85⤵PID:1692
-
\??\c:\jdvvd.exec:\jdvvd.exe86⤵PID:4760
-
\??\c:\frllrrx.exec:\frllrrx.exe87⤵PID:3284
-
\??\c:\rxffxll.exec:\rxffxll.exe88⤵PID:2268
-
\??\c:\hbhhbb.exec:\hbhhbb.exe89⤵PID:3228
-
\??\c:\bbtthh.exec:\bbtthh.exe90⤵PID:4720
-
\??\c:\1ppjd.exec:\1ppjd.exe91⤵PID:1628
-
\??\c:\dvvjd.exec:\dvvjd.exe92⤵PID:752
-
\??\c:\frllfxr.exec:\frllfxr.exe93⤵PID:3644
-
\??\c:\llxfxfr.exec:\llxfxfr.exe94⤵PID:868
-
\??\c:\fxxllrf.exec:\fxxllrf.exe95⤵PID:3948
-
\??\c:\bhnbhb.exec:\bhnbhb.exe96⤵PID:3684
-
\??\c:\ddjjj.exec:\ddjjj.exe97⤵PID:184
-
\??\c:\1vvvd.exec:\1vvvd.exe98⤵PID:3148
-
\??\c:\fxffffr.exec:\fxffffr.exe99⤵PID:2544
-
\??\c:\7rxxrxl.exec:\7rxxrxl.exe100⤵PID:4268
-
\??\c:\htbbbh.exec:\htbbbh.exe101⤵PID:2480
-
\??\c:\pdjpj.exec:\pdjpj.exe102⤵PID:644
-
\??\c:\dvjdd.exec:\dvjdd.exe103⤵PID:2452
-
\??\c:\3rxxxff.exec:\3rxxxff.exe104⤵PID:3640
-
\??\c:\5vvvv.exec:\5vvvv.exe105⤵PID:1176
-
\??\c:\5jdpj.exec:\5jdpj.exe106⤵PID:3484
-
\??\c:\7fxlrlx.exec:\7fxlrlx.exe107⤵PID:5068
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe108⤵PID:4588
-
\??\c:\9hhtnn.exec:\9hhtnn.exe109⤵PID:1988
-
\??\c:\bnnnht.exec:\bnnnht.exe110⤵PID:3128
-
\??\c:\ddjjd.exec:\ddjjd.exe111⤵PID:2160
-
\??\c:\lxrxlfr.exec:\lxrxlfr.exe112⤵PID:3252
-
\??\c:\llffflf.exec:\llffflf.exe113⤵PID:1276
-
\??\c:\tthhbt.exec:\tthhbt.exe114⤵PID:3296
-
\??\c:\jddjj.exec:\jddjj.exe115⤵PID:3328
-
\??\c:\ffxfxrf.exec:\ffxfxrf.exe116⤵PID:3988
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe117⤵PID:3752
-
\??\c:\tntnhh.exec:\tntnhh.exe118⤵PID:4120
-
\??\c:\tnbtnt.exec:\tnbtnt.exe119⤵PID:1068
-
\??\c:\ppvvp.exec:\ppvvp.exe120⤵PID:3896
-
\??\c:\jjppj.exec:\jjppj.exe121⤵PID:4196
-
\??\c:\lrfxrrr.exec:\lrfxrrr.exe122⤵PID:3976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-