Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2024 05:08
Static task
static1
Behavioral task
behavioral1
Sample
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
Resource
win7-20240903-en
General
-
Target
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe
-
Size
82KB
-
MD5
e3a9a82f7c138c77e2b1716a5a6164b3
-
SHA1
c78a2245fb1d97d0cbfd5fdd415fe467e623a900
-
SHA256
e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb
-
SHA512
0456800a2a89493e2db62f3d3c6f1f2e13a00af64190f2d12cf17e6cad0d7ff9daf44a507e3aea221cef0dab6fbac6e9d6b70beba9ce8407e6fd1d7a830a6fae
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgygQwKjiawEmB5Gt9:ymb3NkkiQ3mdBjFo73thgQ/wEkc
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/2604-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2468 flxxxrr.exe 916 bnntth.exe 5060 nbbbht.exe 2340 flrxrxl.exe 3872 ntbnbt.exe 3676 dvddd.exe 4420 xflrrxx.exe 1480 lxfxfxf.exe 408 tnbbbh.exe 2148 rrrrxfr.exe 2452 tntnhh.exe 3208 vjppj.exe 464 vdjpj.exe 4956 5ntbhn.exe 964 vpjvv.exe 3720 9rxxrrr.exe 4356 rfxxlrr.exe 4076 hbbnnb.exe 4732 vjpjv.exe 3828 rxrlllx.exe 4136 bbhhtt.exe 2016 vpvpv.exe 2812 3llfxlr.exe 3324 5bnbhn.exe 760 ppvvj.exe 4944 1rlfxxr.exe 208 nhhthn.exe 3592 5bhhtt.exe 3264 jpvpv.exe 1748 hhhnht.exe 4400 bbhtbh.exe 4040 fxffxfr.exe 3996 flrrxxf.exe 4556 dvpjj.exe 2596 1lrxlrr.exe 5080 lfxrxxf.exe 2940 btbbbb.exe 732 pvjpv.exe 812 lflxlxx.exe 2432 hbnntt.exe 672 vvjpv.exe 2416 jvpjp.exe 2748 xlxxrrr.exe 3904 rrxxrff.exe 1660 thtttt.exe 2768 7pvvv.exe 2604 fxxfffx.exe 544 hnnhnb.exe 4184 jjvvp.exe 636 vjpjv.exe 4588 1flllrf.exe 1644 1lffxxx.exe 2592 vpvpp.exe 5008 llrxflf.exe 2680 xrrxxfr.exe 2316 1tnttb.exe 3304 ddjdp.exe 984 dvdpd.exe 1956 7bbtbb.exe 4544 bnhhbn.exe 992 pjdpv.exe 2920 9jvjp.exe 4948 lrrxflx.exe 2452 3bhhhn.exe -
resource yara_rule behavioral2/memory/2604-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfffxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llfxrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrrrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxxfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1xrflll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2604 wrote to memory of 2468 2604 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 82 PID 2604 wrote to memory of 2468 2604 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 82 PID 2604 wrote to memory of 2468 2604 e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe 82 PID 2468 wrote to memory of 916 2468 flxxxrr.exe 83 PID 2468 wrote to memory of 916 2468 flxxxrr.exe 83 PID 2468 wrote to memory of 916 2468 flxxxrr.exe 83 PID 916 wrote to memory of 5060 916 bnntth.exe 84 PID 916 wrote to memory of 5060 916 bnntth.exe 84 PID 916 wrote to memory of 5060 916 bnntth.exe 84 PID 5060 wrote to memory of 2340 5060 nbbbht.exe 85 PID 5060 wrote to memory of 2340 5060 nbbbht.exe 85 PID 5060 wrote to memory of 2340 5060 nbbbht.exe 85 PID 2340 wrote to memory of 3872 2340 flrxrxl.exe 86 PID 2340 wrote to memory of 3872 2340 flrxrxl.exe 86 PID 2340 wrote to memory of 3872 2340 flrxrxl.exe 86 PID 3872 wrote to memory of 3676 3872 ntbnbt.exe 87 PID 3872 wrote to memory of 3676 3872 ntbnbt.exe 87 PID 3872 wrote to memory of 3676 3872 ntbnbt.exe 87 PID 3676 wrote to memory of 4420 3676 dvddd.exe 88 PID 3676 wrote to memory of 4420 3676 dvddd.exe 88 PID 3676 wrote to memory of 4420 3676 dvddd.exe 88 PID 4420 wrote to memory of 1480 4420 xflrrxx.exe 89 PID 4420 wrote to memory of 1480 4420 xflrrxx.exe 89 PID 4420 wrote to memory of 1480 4420 xflrrxx.exe 89 PID 1480 wrote to memory of 408 1480 lxfxfxf.exe 90 PID 1480 wrote to memory of 408 1480 lxfxfxf.exe 90 PID 1480 wrote to memory of 408 1480 lxfxfxf.exe 90 PID 408 wrote to memory of 2148 408 tnbbbh.exe 91 PID 408 wrote to memory of 2148 408 tnbbbh.exe 91 PID 408 wrote to memory of 2148 408 tnbbbh.exe 91 PID 2148 wrote to memory of 2452 2148 rrrrxfr.exe 92 PID 2148 wrote to memory of 2452 2148 rrrrxfr.exe 92 PID 2148 wrote to memory of 2452 2148 rrrrxfr.exe 92 PID 2452 wrote to memory of 3208 2452 tntnhh.exe 93 PID 2452 wrote to memory of 3208 2452 tntnhh.exe 93 PID 2452 wrote to memory of 3208 2452 tntnhh.exe 93 PID 3208 wrote to memory of 464 3208 vjppj.exe 94 PID 3208 wrote to memory of 464 3208 vjppj.exe 94 PID 3208 wrote to memory of 464 3208 vjppj.exe 94 PID 464 wrote to memory of 4956 464 vdjpj.exe 95 PID 464 wrote to memory of 4956 464 vdjpj.exe 95 PID 464 wrote to memory of 4956 464 vdjpj.exe 95 PID 4956 wrote to memory of 964 4956 5ntbhn.exe 96 PID 4956 wrote to memory of 964 4956 5ntbhn.exe 96 PID 4956 wrote to memory of 964 4956 5ntbhn.exe 96 PID 964 wrote to memory of 3720 964 vpjvv.exe 97 PID 964 wrote to memory of 3720 964 vpjvv.exe 97 PID 964 wrote to memory of 3720 964 vpjvv.exe 97 PID 3720 wrote to memory of 4356 3720 9rxxrrr.exe 98 PID 3720 wrote to memory of 4356 3720 9rxxrrr.exe 98 PID 3720 wrote to memory of 4356 3720 9rxxrrr.exe 98 PID 4356 wrote to memory of 4076 4356 rfxxlrr.exe 99 PID 4356 wrote to memory of 4076 4356 rfxxlrr.exe 99 PID 4356 wrote to memory of 4076 4356 rfxxlrr.exe 99 PID 4076 wrote to memory of 4732 4076 hbbnnb.exe 100 PID 4076 wrote to memory of 4732 4076 hbbnnb.exe 100 PID 4076 wrote to memory of 4732 4076 hbbnnb.exe 100 PID 4732 wrote to memory of 3828 4732 vjpjv.exe 101 PID 4732 wrote to memory of 3828 4732 vjpjv.exe 101 PID 4732 wrote to memory of 3828 4732 vjpjv.exe 101 PID 3828 wrote to memory of 4136 3828 rxrlllx.exe 102 PID 3828 wrote to memory of 4136 3828 rxrlllx.exe 102 PID 3828 wrote to memory of 4136 3828 rxrlllx.exe 102 PID 4136 wrote to memory of 2016 4136 bbhhtt.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"C:\Users\Admin\AppData\Local\Temp\e30b03c0caf290608292b13d88bf3aab69418785706912a376327ac14ff0b3eb.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\flxxxrr.exec:\flxxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\bnntth.exec:\bnntth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\nbbbht.exec:\nbbbht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\flrxrxl.exec:\flrxrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\ntbnbt.exec:\ntbnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
\??\c:\dvddd.exec:\dvddd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\xflrrxx.exec:\xflrrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\lxfxfxf.exec:\lxfxfxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\tnbbbh.exec:\tnbbbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\rrrrxfr.exec:\rrrrxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tntnhh.exec:\tntnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\vjppj.exec:\vjppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\vdjpj.exec:\vdjpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\5ntbhn.exec:\5ntbhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\vpjvv.exec:\vpjvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\9rxxrrr.exec:\9rxxrrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\rfxxlrr.exec:\rfxxlrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\hbbnnb.exec:\hbbnnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\vjpjv.exec:\vjpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\rxrlllx.exec:\rxrlllx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\bbhhtt.exec:\bbhhtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\vpvpv.exec:\vpvpv.exe23⤵
- Executes dropped EXE
PID:2016 -
\??\c:\3llfxlr.exec:\3llfxlr.exe24⤵
- Executes dropped EXE
PID:2812 -
\??\c:\5bnbhn.exec:\5bnbhn.exe25⤵
- Executes dropped EXE
PID:3324 -
\??\c:\ppvvj.exec:\ppvvj.exe26⤵
- Executes dropped EXE
PID:760 -
\??\c:\1rlfxxr.exec:\1rlfxxr.exe27⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nhhthn.exec:\nhhthn.exe28⤵
- Executes dropped EXE
PID:208 -
\??\c:\5bhhtt.exec:\5bhhtt.exe29⤵
- Executes dropped EXE
PID:3592 -
\??\c:\jpvpv.exec:\jpvpv.exe30⤵
- Executes dropped EXE
PID:3264 -
\??\c:\hhhnht.exec:\hhhnht.exe31⤵
- Executes dropped EXE
PID:1748 -
\??\c:\bbhtbh.exec:\bbhtbh.exe32⤵
- Executes dropped EXE
PID:4400 -
\??\c:\fxffxfr.exec:\fxffxfr.exe33⤵
- Executes dropped EXE
PID:4040 -
\??\c:\flrrxxf.exec:\flrrxxf.exe34⤵
- Executes dropped EXE
PID:3996 -
\??\c:\dvpjj.exec:\dvpjj.exe35⤵
- Executes dropped EXE
PID:4556 -
\??\c:\1lrxlrr.exec:\1lrxlrr.exe36⤵
- Executes dropped EXE
PID:2596 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe37⤵
- Executes dropped EXE
PID:5080 -
\??\c:\btbbbb.exec:\btbbbb.exe38⤵
- Executes dropped EXE
PID:2940 -
\??\c:\pvjpv.exec:\pvjpv.exe39⤵
- Executes dropped EXE
PID:732 -
\??\c:\lflxlxx.exec:\lflxlxx.exe40⤵
- Executes dropped EXE
PID:812 -
\??\c:\hbnntt.exec:\hbnntt.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2432 -
\??\c:\vvjpv.exec:\vvjpv.exe42⤵
- Executes dropped EXE
PID:672 -
\??\c:\jvpjp.exec:\jvpjp.exe43⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe44⤵
- Executes dropped EXE
PID:2748 -
\??\c:\rrxxrff.exec:\rrxxrff.exe45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3904 -
\??\c:\thtttt.exec:\thtttt.exe46⤵
- Executes dropped EXE
PID:1660 -
\??\c:\7pvvv.exec:\7pvvv.exe47⤵
- Executes dropped EXE
PID:2768 -
\??\c:\fxxfffx.exec:\fxxfffx.exe48⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hnnhnb.exec:\hnnhnb.exe49⤵
- Executes dropped EXE
PID:544 -
\??\c:\jjvvp.exec:\jjvvp.exe50⤵
- Executes dropped EXE
PID:4184 -
\??\c:\vjpjv.exec:\vjpjv.exe51⤵
- Executes dropped EXE
PID:636 -
\??\c:\1flllrf.exec:\1flllrf.exe52⤵
- Executes dropped EXE
PID:4588 -
\??\c:\1lffxxx.exec:\1lffxxx.exe53⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vpvpp.exec:\vpvpp.exe54⤵
- Executes dropped EXE
PID:2592 -
\??\c:\llrxflf.exec:\llrxflf.exe55⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xrrxxfr.exec:\xrrxxfr.exe56⤵
- Executes dropped EXE
PID:2680 -
\??\c:\1tnttb.exec:\1tnttb.exe57⤵
- Executes dropped EXE
PID:2316 -
\??\c:\ddjdp.exec:\ddjdp.exe58⤵
- Executes dropped EXE
PID:3304 -
\??\c:\dvdpd.exec:\dvdpd.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:984 -
\??\c:\7bbtbb.exec:\7bbtbb.exe60⤵
- Executes dropped EXE
PID:1956 -
\??\c:\bnhhbn.exec:\bnhhbn.exe61⤵
- Executes dropped EXE
PID:4544 -
\??\c:\pjdpv.exec:\pjdpv.exe62⤵
- Executes dropped EXE
PID:992 -
\??\c:\9jvjp.exec:\9jvjp.exe63⤵
- Executes dropped EXE
PID:2920 -
\??\c:\lrrxflx.exec:\lrrxflx.exe64⤵
- Executes dropped EXE
PID:4948 -
\??\c:\3bhhhn.exec:\3bhhhn.exe65⤵
- Executes dropped EXE
PID:2452 -
\??\c:\btbbbn.exec:\btbbbn.exe66⤵PID:3424
-
\??\c:\9pvvj.exec:\9pvvj.exe67⤵PID:2928
-
\??\c:\rffxxxx.exec:\rffxxxx.exe68⤵PID:4760
-
\??\c:\fxfxlfl.exec:\fxfxlfl.exe69⤵PID:4984
-
\??\c:\nhnnnh.exec:\nhnnnh.exe70⤵PID:2820
-
\??\c:\9jjpd.exec:\9jjpd.exe71⤵PID:964
-
\??\c:\xrfrrxx.exec:\xrfrrxx.exe72⤵PID:4312
-
\??\c:\9lrrxxr.exec:\9lrrxxr.exe73⤵PID:3704
-
\??\c:\3bttnn.exec:\3bttnn.exe74⤵PID:4356
-
\??\c:\3jvdj.exec:\3jvdj.exe75⤵PID:4952
-
\??\c:\dpjvj.exec:\dpjvj.exe76⤵PID:2660
-
\??\c:\xxlxxxl.exec:\xxlxxxl.exe77⤵PID:2320
-
\??\c:\bnnbhn.exec:\bnnbhn.exe78⤵PID:2796
-
\??\c:\ttbbhb.exec:\ttbbhb.exe79⤵PID:608
-
\??\c:\pppjj.exec:\pppjj.exe80⤵PID:2564
-
\??\c:\lxfrffr.exec:\lxfrffr.exe81⤵PID:5116
-
\??\c:\nnhbnt.exec:\nnhbnt.exe82⤵PID:3476
-
\??\c:\hhnhnb.exec:\hhnhnb.exe83⤵PID:3324
-
\??\c:\9jddv.exec:\9jddv.exe84⤵PID:760
-
\??\c:\5xxlffx.exec:\5xxlffx.exe85⤵PID:4944
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe86⤵PID:3228
-
\??\c:\7jjjd.exec:\7jjjd.exe87⤵PID:1084
-
\??\c:\dpvvp.exec:\dpvvp.exe88⤵PID:756
-
\??\c:\lffflrf.exec:\lffflrf.exe89⤵PID:3644
-
\??\c:\bthhbh.exec:\bthhbh.exe90⤵PID:2060
-
\??\c:\llrrxxx.exec:\llrrxxx.exe91⤵PID:1576
-
\??\c:\9xxrlxr.exec:\9xxrlxr.exe92⤵PID:1492
-
\??\c:\ttttbb.exec:\ttttbb.exe93⤵PID:3560
-
\??\c:\9pddd.exec:\9pddd.exe94⤵PID:3084
-
\??\c:\9fxrrxf.exec:\9fxrrxf.exe95⤵PID:2440
-
\??\c:\1tbnnt.exec:\1tbnnt.exe96⤵PID:5092
-
\??\c:\tbbtnn.exec:\tbbtnn.exe97⤵PID:4808
-
\??\c:\jjvvv.exec:\jjvvv.exe98⤵PID:444
-
\??\c:\rrxllfl.exec:\rrxllfl.exe99⤵PID:724
-
\??\c:\tnttbh.exec:\tnttbh.exe100⤵PID:264
-
\??\c:\bnttht.exec:\bnttht.exe101⤵PID:1028
-
\??\c:\1jdjj.exec:\1jdjj.exe102⤵PID:3556
-
\??\c:\xxlfllr.exec:\xxlfllr.exe103⤵PID:3176
-
\??\c:\fxflflr.exec:\fxflflr.exe104⤵PID:4284
-
\??\c:\bthnnt.exec:\bthnnt.exe105⤵PID:3512
-
\??\c:\djvvv.exec:\djvvv.exe106⤵PID:1672
-
\??\c:\5pjjd.exec:\5pjjd.exe107⤵PID:4456
-
\??\c:\1frrxff.exec:\1frrxff.exe108⤵PID:1952
-
\??\c:\bnnnth.exec:\bnnnth.exe109⤵PID:1880
-
\??\c:\nnhhhn.exec:\nnhhhn.exe110⤵PID:3944
-
\??\c:\9pddd.exec:\9pddd.exe111⤵PID:2340
-
\??\c:\rxflflr.exec:\rxflflr.exe112⤵PID:620
-
\??\c:\nhnhhh.exec:\nhnhhh.exe113⤵PID:3600
-
\??\c:\hhhnhn.exec:\hhhnhn.exe114⤵PID:1060
-
\??\c:\jppvp.exec:\jppvp.exe115⤵PID:1656
-
\??\c:\xrrlrlr.exec:\xrrlrlr.exe116⤵PID:4420
-
\??\c:\rlrlrfl.exec:\rlrlrfl.exe117⤵PID:1564
-
\??\c:\nhnhnn.exec:\nhnhnn.exe118⤵PID:3648
-
\??\c:\dvvvp.exec:\dvvvp.exe119⤵PID:1600
-
\??\c:\5xfffll.exec:\5xfffll.exe120⤵PID:4544
-
\??\c:\rfrfflr.exec:\rfrfflr.exe121⤵PID:2148
-
\??\c:\btbnnb.exec:\btbnnb.exe122⤵PID:2920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-