Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 01:21
Static task
static1
Behavioral task
behavioral1
Sample
988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe
Resource
win7-20240903-en
General
-
Target
988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe
-
Size
229KB
-
MD5
c5e7534975529f51823f5fd4190ede40
-
SHA1
ec7522020a699a8273ac8a81bcfe21bf1341ef1c
-
SHA256
988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ec
-
SHA512
99a9daf063e56f950e6aa884f3679d1df16e29fcb8b978dac2eecc5f6203cdb62a4bc9da27be6dcc63d4110b8ae5767964fd1e698d2be0a5fb9aa47bd9cd8b74
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeGdQ:n3C9BRo7MlrWKo+lxKU
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4028-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxfxrxx.exe7vjjd.exehtbbth.exetthhnn.exevjppj.exefxlfrrx.exedppdj.exebhtntb.exenhbhhh.exevdjjp.exeffrfrxl.exe5tnntt.exenbhbbh.exevdvpj.exellrllfl.exerlrfflf.exenbhnbn.exentbttt.exevddvv.exelffxrlx.exexrrrllf.exennhbtb.exedvdvv.exevjjdj.exe9xxrlfr.exenbbbbt.exepdpdv.exerxrrlxr.exelxfrrlr.exenhhhnt.exeppdpj.exefrrrffx.exexlfxrlf.exehhnnht.exe1vvpj.exellrfrlf.exelrffllf.exenhnnbn.exedjjpj.exexfffffl.exetbhhtt.exetnhnnh.exepvdpv.exefxrrxff.exehbbhnb.exedvjdv.exedvdvv.exefflrfxx.exenbbhtb.exedvjdj.exepddvj.exefxrxffx.exehthbbb.exepdjdd.exexrlfxxl.exe9hhhnh.exehnthnt.exedjjjj.exellfxrrx.exevpppp.exerrfxllr.exe5tbhbh.exedjdvd.exerlrrxxl.exepid Process 464 xxfxrxx.exe 4040 7vjjd.exe 4280 htbbth.exe 3328 tthhnn.exe 384 vjppj.exe 1924 fxlfrrx.exe 396 dppdj.exe 3316 bhtntb.exe 4072 nhbhhh.exe 3172 vdjjp.exe 316 ffrfrxl.exe 4076 5tnntt.exe 5044 nbhbbh.exe 1948 vdvpj.exe 1208 llrllfl.exe 2132 rlrfflf.exe 4120 nbhnbn.exe 4800 ntbttt.exe 3036 vddvv.exe 1344 lffxrlx.exe 4004 xrrrllf.exe 3276 nnhbtb.exe 2708 dvdvv.exe 2180 vjjdj.exe 4732 9xxrlfr.exe 1052 nbbbbt.exe 4504 pdpdv.exe 1776 rxrrlxr.exe 4720 lxfrrlr.exe 2176 nhhhnt.exe 1920 ppdpj.exe 2972 frrrffx.exe 748 xlfxrlf.exe 2368 hhnnht.exe 3356 1vvpj.exe 2116 llrfrlf.exe 4528 lrffllf.exe 2900 nhnnbn.exe 4756 djjpj.exe 3440 xfffffl.exe 1864 tbhhtt.exe 3020 tnhnnh.exe 764 pvdpv.exe 4344 fxrrxff.exe 532 hbbhnb.exe 4360 dvjdv.exe 2752 dvdvv.exe 4348 fflrfxx.exe 2640 nbbhtb.exe 3876 dvjdj.exe 1380 pddvj.exe 264 fxrxffx.exe 4028 hthbbb.exe 4600 pdjdd.exe 3636 xrlfxxl.exe 4244 9hhhnh.exe 1204 hnthnt.exe 4908 djjjj.exe 2504 llfxrrx.exe 3120 vpppp.exe 3180 rrfxllr.exe 1748 5tbhbh.exe 4844 djdvd.exe 1200 rlrrxxl.exe -
Processes:
resource yara_rule behavioral2/memory/4028-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4800-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-69-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
jdddd.exebbnhhn.exennhbnn.exehhbbnb.exentbbbt.exejjvvv.exevjpjd.exennnbth.exexfrxxxf.exehhnttt.exe1ttbnb.exexxrxlfl.exexfffffl.exedjppd.exexxxrllf.exefxfllll.exeppddv.exejjppj.exe3dppp.exe7tbbbb.exejpvpj.exe5rllffx.exexxrxlfl.exejpppp.exevdvvj.exeflrrrff.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhbnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbbbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfrxxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ttbnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfffffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxfllll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3dppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rllffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrxlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrff.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exexxfxrxx.exe7vjjd.exehtbbth.exetthhnn.exevjppj.exefxlfrrx.exedppdj.exebhtntb.exenhbhhh.exevdjjp.exeffrfrxl.exe5tnntt.exenbhbbh.exevdvpj.exellrllfl.exerlrfflf.exenbhnbn.exentbttt.exevddvv.exelffxrlx.exexrrrllf.exedescription pid Process procid_target PID 4028 wrote to memory of 464 4028 988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe 82 PID 4028 wrote to memory of 464 4028 988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe 82 PID 4028 wrote to memory of 464 4028 988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe 82 PID 464 wrote to memory of 4040 464 xxfxrxx.exe 83 PID 464 wrote to memory of 4040 464 xxfxrxx.exe 83 PID 464 wrote to memory of 4040 464 xxfxrxx.exe 83 PID 4040 wrote to memory of 4280 4040 7vjjd.exe 84 PID 4040 wrote to memory of 4280 4040 7vjjd.exe 84 PID 4040 wrote to memory of 4280 4040 7vjjd.exe 84 PID 4280 wrote to memory of 3328 4280 htbbth.exe 85 PID 4280 wrote to memory of 3328 4280 htbbth.exe 85 PID 4280 wrote to memory of 3328 4280 htbbth.exe 85 PID 3328 wrote to memory of 384 3328 tthhnn.exe 86 PID 3328 wrote to memory of 384 3328 tthhnn.exe 86 PID 3328 wrote to memory of 384 3328 tthhnn.exe 86 PID 384 wrote to memory of 1924 384 vjppj.exe 87 PID 384 wrote to memory of 1924 384 vjppj.exe 87 PID 384 wrote to memory of 1924 384 vjppj.exe 87 PID 1924 wrote to memory of 396 1924 fxlfrrx.exe 88 PID 1924 wrote to memory of 396 1924 fxlfrrx.exe 88 PID 1924 wrote to memory of 396 1924 fxlfrrx.exe 88 PID 396 wrote to memory of 3316 396 dppdj.exe 89 PID 396 wrote to memory of 3316 396 dppdj.exe 89 PID 396 wrote to memory of 3316 396 dppdj.exe 89 PID 3316 wrote to memory of 4072 3316 bhtntb.exe 90 PID 3316 wrote to memory of 4072 3316 bhtntb.exe 90 PID 3316 wrote to memory of 4072 3316 bhtntb.exe 90 PID 4072 wrote to memory of 3172 4072 nhbhhh.exe 91 PID 4072 wrote to memory of 3172 4072 nhbhhh.exe 91 PID 4072 wrote to memory of 3172 4072 nhbhhh.exe 91 PID 3172 wrote to memory of 316 3172 vdjjp.exe 92 PID 3172 wrote to memory of 316 3172 vdjjp.exe 92 PID 3172 wrote to memory of 316 3172 vdjjp.exe 92 PID 316 wrote to memory of 4076 316 ffrfrxl.exe 93 PID 316 wrote to memory of 4076 316 ffrfrxl.exe 93 PID 316 wrote to memory of 4076 316 ffrfrxl.exe 93 PID 4076 wrote to memory of 5044 4076 5tnntt.exe 94 PID 4076 wrote to memory of 5044 4076 5tnntt.exe 94 PID 4076 wrote to memory of 5044 4076 5tnntt.exe 94 PID 5044 wrote to memory of 1948 5044 nbhbbh.exe 95 PID 5044 wrote to memory of 1948 5044 nbhbbh.exe 95 PID 5044 wrote to memory of 1948 5044 nbhbbh.exe 95 PID 1948 wrote to memory of 1208 1948 vdvpj.exe 96 PID 1948 wrote to memory of 1208 1948 vdvpj.exe 96 PID 1948 wrote to memory of 1208 1948 vdvpj.exe 96 PID 1208 wrote to memory of 2132 1208 llrllfl.exe 97 PID 1208 wrote to memory of 2132 1208 llrllfl.exe 97 PID 1208 wrote to memory of 2132 1208 llrllfl.exe 97 PID 2132 wrote to memory of 4120 2132 rlrfflf.exe 98 PID 2132 wrote to memory of 4120 2132 rlrfflf.exe 98 PID 2132 wrote to memory of 4120 2132 rlrfflf.exe 98 PID 4120 wrote to memory of 4800 4120 nbhnbn.exe 99 PID 4120 wrote to memory of 4800 4120 nbhnbn.exe 99 PID 4120 wrote to memory of 4800 4120 nbhnbn.exe 99 PID 4800 wrote to memory of 3036 4800 ntbttt.exe 100 PID 4800 wrote to memory of 3036 4800 ntbttt.exe 100 PID 4800 wrote to memory of 3036 4800 ntbttt.exe 100 PID 3036 wrote to memory of 1344 3036 vddvv.exe 101 PID 3036 wrote to memory of 1344 3036 vddvv.exe 101 PID 3036 wrote to memory of 1344 3036 vddvv.exe 101 PID 1344 wrote to memory of 4004 1344 lffxrlx.exe 102 PID 1344 wrote to memory of 4004 1344 lffxrlx.exe 102 PID 1344 wrote to memory of 4004 1344 lffxrlx.exe 102 PID 4004 wrote to memory of 3276 4004 xrrrllf.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe"C:\Users\Admin\AppData\Local\Temp\988b7520d682dbac0ceef153b106c1efaf2411751ec61cbde3587c6b39f016ecN.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\xxfxrxx.exec:\xxfxrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\7vjjd.exec:\7vjjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\htbbth.exec:\htbbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\tthhnn.exec:\tthhnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\vjppj.exec:\vjppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\fxlfrrx.exec:\fxlfrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\dppdj.exec:\dppdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\bhtntb.exec:\bhtntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\nhbhhh.exec:\nhbhhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\vdjjp.exec:\vdjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\ffrfrxl.exec:\ffrfrxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\5tnntt.exec:\5tnntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\nbhbbh.exec:\nbhbbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\vdvpj.exec:\vdvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\llrllfl.exec:\llrllfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\rlrfflf.exec:\rlrfflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\nbhnbn.exec:\nbhnbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\ntbttt.exec:\ntbttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\vddvv.exec:\vddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\lffxrlx.exec:\lffxrlx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\xrrrllf.exec:\xrrrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
\??\c:\nnhbtb.exec:\nnhbtb.exe23⤵
- Executes dropped EXE
PID:3276 -
\??\c:\dvdvv.exec:\dvdvv.exe24⤵
- Executes dropped EXE
PID:2708 -
\??\c:\vjjdj.exec:\vjjdj.exe25⤵
- Executes dropped EXE
PID:2180 -
\??\c:\9xxrlfr.exec:\9xxrlfr.exe26⤵
- Executes dropped EXE
PID:4732 -
\??\c:\nbbbbt.exec:\nbbbbt.exe27⤵
- Executes dropped EXE
PID:1052 -
\??\c:\pdpdv.exec:\pdpdv.exe28⤵
- Executes dropped EXE
PID:4504 -
\??\c:\rxrrlxr.exec:\rxrrlxr.exe29⤵
- Executes dropped EXE
PID:1776 -
\??\c:\lxfrrlr.exec:\lxfrrlr.exe30⤵
- Executes dropped EXE
PID:4720 -
\??\c:\nhhhnt.exec:\nhhhnt.exe31⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ppdpj.exec:\ppdpj.exe32⤵
- Executes dropped EXE
PID:1920 -
\??\c:\frrrffx.exec:\frrrffx.exe33⤵
- Executes dropped EXE
PID:2972 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe34⤵
- Executes dropped EXE
PID:748 -
\??\c:\hhnnht.exec:\hhnnht.exe35⤵
- Executes dropped EXE
PID:2368 -
\??\c:\1vvpj.exec:\1vvpj.exe36⤵
- Executes dropped EXE
PID:3356 -
\??\c:\llrfrlf.exec:\llrfrlf.exe37⤵
- Executes dropped EXE
PID:2116 -
\??\c:\lrffllf.exec:\lrffllf.exe38⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nhnnbn.exec:\nhnnbn.exe39⤵
- Executes dropped EXE
PID:2900 -
\??\c:\djjpj.exec:\djjpj.exe40⤵
- Executes dropped EXE
PID:4756 -
\??\c:\xfffffl.exec:\xfffffl.exe41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3440 -
\??\c:\tbhhtt.exec:\tbhhtt.exe42⤵
- Executes dropped EXE
PID:1864 -
\??\c:\tnhnnh.exec:\tnhnnh.exe43⤵
- Executes dropped EXE
PID:3020 -
\??\c:\pvdpv.exec:\pvdpv.exe44⤵
- Executes dropped EXE
PID:764 -
\??\c:\fxrrxff.exec:\fxrrxff.exe45⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hbbhnb.exec:\hbbhnb.exe46⤵
- Executes dropped EXE
PID:532 -
\??\c:\dvjdv.exec:\dvjdv.exe47⤵
- Executes dropped EXE
PID:4360 -
\??\c:\dvdvv.exec:\dvdvv.exe48⤵
- Executes dropped EXE
PID:2752 -
\??\c:\fflrfxx.exec:\fflrfxx.exe49⤵
- Executes dropped EXE
PID:4348 -
\??\c:\nbbhtb.exec:\nbbhtb.exe50⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvjdj.exec:\dvjdj.exe51⤵
- Executes dropped EXE
PID:3876 -
\??\c:\pddvj.exec:\pddvj.exe52⤵
- Executes dropped EXE
PID:1380 -
\??\c:\fxrxffx.exec:\fxrxffx.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\hthbbb.exec:\hthbbb.exe54⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pdjdd.exec:\pdjdd.exe55⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xrlfxxl.exec:\xrlfxxl.exe56⤵
- Executes dropped EXE
PID:3636 -
\??\c:\9hhhnh.exec:\9hhhnh.exe57⤵
- Executes dropped EXE
PID:4244 -
\??\c:\hnthnt.exec:\hnthnt.exe58⤵
- Executes dropped EXE
PID:1204 -
\??\c:\djjjj.exec:\djjjj.exe59⤵
- Executes dropped EXE
PID:4908 -
\??\c:\llfxrrx.exec:\llfxrrx.exe60⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vpppp.exec:\vpppp.exe61⤵
- Executes dropped EXE
PID:3120 -
\??\c:\rrfxllr.exec:\rrfxllr.exe62⤵
- Executes dropped EXE
PID:3180 -
\??\c:\5tbhbh.exec:\5tbhbh.exe63⤵
- Executes dropped EXE
PID:1748 -
\??\c:\djdvd.exec:\djdvd.exe64⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe65⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rrxlffl.exec:\rrxlffl.exe66⤵PID:2768
-
\??\c:\thntbn.exec:\thntbn.exe67⤵PID:4232
-
\??\c:\lfrlxrf.exec:\lfrlxrf.exe68⤵PID:3132
-
\??\c:\dpddd.exec:\dpddd.exe69⤵PID:2012
-
\??\c:\pppvv.exec:\pppvv.exe70⤵PID:3464
-
\??\c:\rlllxfx.exec:\rlllxfx.exe71⤵PID:3484
-
\??\c:\bhnhbb.exec:\bhnhbb.exe72⤵PID:2132
-
\??\c:\7ffxrff.exec:\7ffxrff.exe73⤵PID:732
-
\??\c:\tbhbbb.exec:\tbhbbb.exe74⤵PID:2760
-
\??\c:\lrxxrrr.exec:\lrxxrrr.exe75⤵PID:536
-
\??\c:\1ttnhn.exec:\1ttnhn.exe76⤵PID:2884
-
\??\c:\7djdv.exec:\7djdv.exe77⤵PID:3404
-
\??\c:\flrrrrr.exec:\flrrrrr.exe78⤵PID:2708
-
\??\c:\djdvp.exec:\djdvp.exe79⤵PID:1236
-
\??\c:\nhnttt.exec:\nhnttt.exe80⤵PID:4784
-
\??\c:\xlllfrr.exec:\xlllfrr.exe81⤵PID:3640
-
\??\c:\hnbttn.exec:\hnbttn.exe82⤵PID:3332
-
\??\c:\vjjvj.exec:\vjjvj.exe83⤵PID:64
-
\??\c:\lrfrrrl.exec:\lrfrrrl.exe84⤵PID:2832
-
\??\c:\tntttn.exec:\tntttn.exe85⤵PID:4412
-
\??\c:\pvjjd.exec:\pvjjd.exe86⤵PID:2316
-
\??\c:\dvvdv.exec:\dvvdv.exe87⤵PID:4704
-
\??\c:\5rllffx.exec:\5rllffx.exe88⤵
- System Location Discovery: System Language Discovery
PID:1744 -
\??\c:\thnhht.exec:\thnhht.exe89⤵PID:1532
-
\??\c:\pvdpp.exec:\pvdpp.exe90⤵PID:776
-
\??\c:\pdpvp.exec:\pdpvp.exe91⤵PID:884
-
\??\c:\rlrrxxr.exec:\rlrrxxr.exe92⤵PID:2408
-
\??\c:\htnhnb.exec:\htnhnb.exe93⤵PID:1724
-
\??\c:\jddvp.exec:\jddvp.exe94⤵PID:4224
-
\??\c:\llllllf.exec:\llllllf.exe95⤵PID:4024
-
\??\c:\5nbtnn.exec:\5nbtnn.exe96⤵PID:4968
-
\??\c:\5btnhh.exec:\5btnhh.exe97⤵PID:60
-
\??\c:\fxxlflr.exec:\fxxlflr.exe98⤵PID:1388
-
\??\c:\btnnhn.exec:\btnnhn.exe99⤵PID:2212
-
\??\c:\vvjjp.exec:\vvjjp.exe100⤵PID:2712
-
\??\c:\rxlffxf.exec:\rxlffxf.exe101⤵PID:3996
-
\??\c:\bhthhn.exec:\bhthhn.exe102⤵PID:3524
-
\??\c:\nhntnh.exec:\nhntnh.exe103⤵PID:2200
-
\??\c:\nhbttn.exec:\nhbttn.exe104⤵PID:4428
-
\??\c:\ttbthn.exec:\ttbthn.exe105⤵PID:1380
-
\??\c:\ddjdd.exec:\ddjdd.exe106⤵PID:4328
-
\??\c:\nbnnnh.exec:\nbnnnh.exe107⤵PID:3596
-
\??\c:\bbnhhn.exec:\bbnhhn.exe108⤵
- System Location Discovery: System Language Discovery
PID:4432 -
\??\c:\ppddv.exec:\ppddv.exe109⤵PID:224
-
\??\c:\9bntnn.exec:\9bntnn.exe110⤵PID:464
-
\??\c:\djdvv.exec:\djdvv.exe111⤵PID:3396
-
\??\c:\lfllffx.exec:\lfllffx.exe112⤵PID:5032
-
\??\c:\btbbht.exec:\btbbht.exe113⤵PID:4948
-
\??\c:\tbbbtb.exec:\tbbbtb.exe114⤵PID:4992
-
\??\c:\ddpjd.exec:\ddpjd.exe115⤵PID:4056
-
\??\c:\pvpjp.exec:\pvpjp.exe116⤵PID:4560
-
\??\c:\xxxfrrl.exec:\xxxfrrl.exe117⤵PID:3240
-
\??\c:\bbnthh.exec:\bbnthh.exe118⤵PID:2488
-
\??\c:\djpjj.exec:\djpjj.exe119⤵PID:2184
-
\??\c:\ffxfrfr.exec:\ffxfrfr.exe120⤵PID:4760
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe121⤵PID:1904
-
\??\c:\bbbttt.exec:\bbbttt.exe122⤵PID:3076
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-