Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe
Resource
win7-20240903-en
7 signatures
120 seconds
General
-
Target
0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe
-
Size
61KB
-
MD5
82fb189d757d46b906dee1dd955dee97
-
SHA1
581519de4e1328684fe445a51d857cf60052910e
-
SHA256
0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9
-
SHA512
572ddb2a2ad4294d4a21665164a819012b22983de6a7db02474bff4619a65be24c3768e4a3759e849a2ae3c1a645754420112aa811f403748dea96c5d4f83efb
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+byu:ymb3NkkiQ3mdBjF+3TpL
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/3924-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3924-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2240-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4328 5jjjj.exe 4368 vdpjv.exe 216 xrrllll.exe 2040 hhtttb.exe 428 bthhhn.exe 1208 vvddj.exe 2240 fxfxxff.exe 1860 xxfllrr.exe 1016 djdpv.exe 2844 9bbbbh.exe 4788 nbnhhb.exe 3016 vdjpj.exe 4360 5lffflr.exe 3388 5bnnnt.exe 2632 pjjvp.exe 3604 pdppj.exe 4984 ffllfll.exe 3776 ttnbbb.exe 2524 pdddj.exe 2528 djvjp.exe 4476 rlrrrrl.exe 4192 tbtnhb.exe 2016 vjvjv.exe 3060 rrrxflr.exe 3944 tbtnbb.exe 4416 7bnhht.exe 4728 dvdvd.exe 5044 jjddp.exe 4392 5lllrxr.exe 2480 5hnnnn.exe 3200 vjpjd.exe 4520 1lrxlrl.exe 2444 vvvdv.exe 2020 vvdvv.exe 1420 rfllffx.exe 1436 hnnhbt.exe 4472 bhbbth.exe 4168 ppvpj.exe 4716 lxfffll.exe 5008 tttntt.exe 4292 jjvjd.exe 4180 jjjpj.exe 1080 tthbhh.exe 4028 ttnbnb.exe 4288 pjppv.exe 4880 3bhhhh.exe 696 bbtthh.exe 5012 jjdvv.exe 3624 xffllrx.exe 184 jdvpp.exe 2188 3vjjv.exe 4832 5rrrrxx.exe 4672 5vvdd.exe 1096 xflfffx.exe 4228 nnhnnt.exe 4912 djjdv.exe 3308 ffxxlrf.exe 1640 xflrfff.exe 4892 7tbbht.exe 4264 vdppp.exe 1612 7jjjj.exe 2808 rxllfll.exe 4788 nnbnbb.exe 2328 bbnbnt.exe -
resource yara_rule behavioral2/memory/3924-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3924-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2240-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnhbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xffrlxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbttnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7pppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llxxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bnhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrxxlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3924 wrote to memory of 4328 3924 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 83 PID 3924 wrote to memory of 4328 3924 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 83 PID 3924 wrote to memory of 4328 3924 0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe 83 PID 4328 wrote to memory of 4368 4328 5jjjj.exe 84 PID 4328 wrote to memory of 4368 4328 5jjjj.exe 84 PID 4328 wrote to memory of 4368 4328 5jjjj.exe 84 PID 4368 wrote to memory of 216 4368 vdpjv.exe 85 PID 4368 wrote to memory of 216 4368 vdpjv.exe 85 PID 4368 wrote to memory of 216 4368 vdpjv.exe 85 PID 216 wrote to memory of 2040 216 xrrllll.exe 86 PID 216 wrote to memory of 2040 216 xrrllll.exe 86 PID 216 wrote to memory of 2040 216 xrrllll.exe 86 PID 2040 wrote to memory of 428 2040 hhtttb.exe 87 PID 2040 wrote to memory of 428 2040 hhtttb.exe 87 PID 2040 wrote to memory of 428 2040 hhtttb.exe 87 PID 428 wrote to memory of 1208 428 bthhhn.exe 88 PID 428 wrote to memory of 1208 428 bthhhn.exe 88 PID 428 wrote to memory of 1208 428 bthhhn.exe 88 PID 1208 wrote to memory of 2240 1208 vvddj.exe 89 PID 1208 wrote to memory of 2240 1208 vvddj.exe 89 PID 1208 wrote to memory of 2240 1208 vvddj.exe 89 PID 2240 wrote to memory of 1860 2240 fxfxxff.exe 90 PID 2240 wrote to memory of 1860 2240 fxfxxff.exe 90 PID 2240 wrote to memory of 1860 2240 fxfxxff.exe 90 PID 1860 wrote to memory of 1016 1860 xxfllrr.exe 91 PID 1860 wrote to memory of 1016 1860 xxfllrr.exe 91 PID 1860 wrote to memory of 1016 1860 xxfllrr.exe 91 PID 1016 wrote to memory of 2844 1016 djdpv.exe 92 PID 1016 wrote to memory of 2844 1016 djdpv.exe 92 PID 1016 wrote to memory of 2844 1016 djdpv.exe 92 PID 2844 wrote to memory of 4788 2844 9bbbbh.exe 93 PID 2844 wrote to memory of 4788 2844 9bbbbh.exe 93 PID 2844 wrote to memory of 4788 2844 9bbbbh.exe 93 PID 4788 wrote to memory of 3016 4788 nbnhhb.exe 94 PID 4788 wrote to memory of 3016 4788 nbnhhb.exe 94 PID 4788 wrote to memory of 3016 4788 nbnhhb.exe 94 PID 3016 wrote to memory of 4360 3016 vdjpj.exe 95 PID 3016 wrote to memory of 4360 3016 vdjpj.exe 95 PID 3016 wrote to memory of 4360 3016 vdjpj.exe 95 PID 4360 wrote to memory of 3388 4360 5lffflr.exe 96 PID 4360 wrote to memory of 3388 4360 5lffflr.exe 96 PID 4360 wrote to memory of 3388 4360 5lffflr.exe 96 PID 3388 wrote to memory of 2632 3388 5bnnnt.exe 97 PID 3388 wrote to memory of 2632 3388 5bnnnt.exe 97 PID 3388 wrote to memory of 2632 3388 5bnnnt.exe 97 PID 2632 wrote to memory of 3604 2632 pjjvp.exe 98 PID 2632 wrote to memory of 3604 2632 pjjvp.exe 98 PID 2632 wrote to memory of 3604 2632 pjjvp.exe 98 PID 3604 wrote to memory of 4984 3604 pdppj.exe 99 PID 3604 wrote to memory of 4984 3604 pdppj.exe 99 PID 3604 wrote to memory of 4984 3604 pdppj.exe 99 PID 4984 wrote to memory of 3776 4984 ffllfll.exe 100 PID 4984 wrote to memory of 3776 4984 ffllfll.exe 100 PID 4984 wrote to memory of 3776 4984 ffllfll.exe 100 PID 3776 wrote to memory of 2524 3776 ttnbbb.exe 101 PID 3776 wrote to memory of 2524 3776 ttnbbb.exe 101 PID 3776 wrote to memory of 2524 3776 ttnbbb.exe 101 PID 2524 wrote to memory of 2528 2524 pdddj.exe 102 PID 2524 wrote to memory of 2528 2524 pdddj.exe 102 PID 2524 wrote to memory of 2528 2524 pdddj.exe 102 PID 2528 wrote to memory of 4476 2528 djvjp.exe 103 PID 2528 wrote to memory of 4476 2528 djvjp.exe 103 PID 2528 wrote to memory of 4476 2528 djvjp.exe 103 PID 4476 wrote to memory of 4192 4476 rlrrrrl.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe"C:\Users\Admin\AppData\Local\Temp\0f73853d0bb87b83dee77d0125870d2555550b8578965dcfaa558f8a256b5dc9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\5jjjj.exec:\5jjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\vdpjv.exec:\vdpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\xrrllll.exec:\xrrllll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\hhtttb.exec:\hhtttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\bthhhn.exec:\bthhhn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\vvddj.exec:\vvddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\fxfxxff.exec:\fxfxxff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\xxfllrr.exec:\xxfllrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\djdpv.exec:\djdpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\9bbbbh.exec:\9bbbbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\nbnhhb.exec:\nbnhhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\vdjpj.exec:\vdjpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\5lffflr.exec:\5lffflr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360 -
\??\c:\5bnnnt.exec:\5bnnnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\pjjvp.exec:\pjjvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pdppj.exec:\pdppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ffllfll.exec:\ffllfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\ttnbbb.exec:\ttnbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\pdddj.exec:\pdddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\djvjp.exec:\djvjp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\rlrrrrl.exec:\rlrrrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\tbtnhb.exec:\tbtnhb.exe23⤵
- Executes dropped EXE
PID:4192 -
\??\c:\vjvjv.exec:\vjvjv.exe24⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rrrxflr.exec:\rrrxflr.exe25⤵
- Executes dropped EXE
PID:3060 -
\??\c:\tbtnbb.exec:\tbtnbb.exe26⤵
- Executes dropped EXE
PID:3944 -
\??\c:\7bnhht.exec:\7bnhht.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4416 -
\??\c:\dvdvd.exec:\dvdvd.exe28⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jjddp.exec:\jjddp.exe29⤵
- Executes dropped EXE
PID:5044 -
\??\c:\5lllrxr.exec:\5lllrxr.exe30⤵
- Executes dropped EXE
PID:4392 -
\??\c:\5hnnnn.exec:\5hnnnn.exe31⤵
- Executes dropped EXE
PID:2480 -
\??\c:\vjpjd.exec:\vjpjd.exe32⤵
- Executes dropped EXE
PID:3200 -
\??\c:\1lrxlrl.exec:\1lrxlrl.exe33⤵
- Executes dropped EXE
PID:4520 -
\??\c:\vvvdv.exec:\vvvdv.exe34⤵
- Executes dropped EXE
PID:2444 -
\??\c:\vvdvv.exec:\vvdvv.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rfllffx.exec:\rfllffx.exe36⤵
- Executes dropped EXE
PID:1420 -
\??\c:\hnnhbt.exec:\hnnhbt.exe37⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bhbbth.exec:\bhbbth.exe38⤵
- Executes dropped EXE
PID:4472 -
\??\c:\ppvpj.exec:\ppvpj.exe39⤵
- Executes dropped EXE
PID:4168 -
\??\c:\lxfffll.exec:\lxfffll.exe40⤵
- Executes dropped EXE
PID:4716 -
\??\c:\tttntt.exec:\tttntt.exe41⤵
- Executes dropped EXE
PID:5008 -
\??\c:\jjvjd.exec:\jjvjd.exe42⤵
- Executes dropped EXE
PID:4292 -
\??\c:\jjjpj.exec:\jjjpj.exe43⤵
- Executes dropped EXE
PID:4180 -
\??\c:\tthbhh.exec:\tthbhh.exe44⤵
- Executes dropped EXE
PID:1080 -
\??\c:\ttnbnb.exec:\ttnbnb.exe45⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pjppv.exec:\pjppv.exe46⤵
- Executes dropped EXE
PID:4288 -
\??\c:\3bhhhh.exec:\3bhhhh.exe47⤵
- Executes dropped EXE
PID:4880 -
\??\c:\bbtthh.exec:\bbtthh.exe48⤵
- Executes dropped EXE
PID:696 -
\??\c:\jjdvv.exec:\jjdvv.exe49⤵
- Executes dropped EXE
PID:5012 -
\??\c:\xffllrx.exec:\xffllrx.exe50⤵
- Executes dropped EXE
PID:3624 -
\??\c:\jdvpp.exec:\jdvpp.exe51⤵
- Executes dropped EXE
PID:184 -
\??\c:\3vjjv.exec:\3vjjv.exe52⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5rrrrxx.exec:\5rrrrxx.exe53⤵
- Executes dropped EXE
PID:4832 -
\??\c:\5vvdd.exec:\5vvdd.exe54⤵
- Executes dropped EXE
PID:4672 -
\??\c:\xflfffx.exec:\xflfffx.exe55⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nnhnnt.exec:\nnhnnt.exe56⤵
- Executes dropped EXE
PID:4228 -
\??\c:\djjdv.exec:\djjdv.exe57⤵
- Executes dropped EXE
PID:4912 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe58⤵
- Executes dropped EXE
PID:3308 -
\??\c:\xflrfff.exec:\xflrfff.exe59⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7tbbht.exec:\7tbbht.exe60⤵
- Executes dropped EXE
PID:4892 -
\??\c:\vdppp.exec:\vdppp.exe61⤵
- Executes dropped EXE
PID:4264 -
\??\c:\7jjjj.exec:\7jjjj.exe62⤵
- Executes dropped EXE
PID:1612 -
\??\c:\rxllfll.exec:\rxllfll.exe63⤵
- Executes dropped EXE
PID:2808 -
\??\c:\nnbnbb.exec:\nnbnbb.exe64⤵
- Executes dropped EXE
PID:4788 -
\??\c:\bbnbnt.exec:\bbnbnt.exe65⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dvjpp.exec:\dvjpp.exe66⤵PID:4484
-
\??\c:\rrxfxff.exec:\rrxfxff.exe67⤵PID:632
-
\??\c:\rlrrfll.exec:\rlrrfll.exe68⤵PID:1528
-
\??\c:\hbnnnt.exec:\hbnnnt.exe69⤵PID:2072
-
\??\c:\dpddd.exec:\dpddd.exe70⤵PID:2124
-
\??\c:\ddvpj.exec:\ddvpj.exe71⤵PID:908
-
\??\c:\llxxllx.exec:\llxxllx.exe72⤵
- System Location Discovery: System Language Discovery
PID:1828 -
\??\c:\htnnnt.exec:\htnnnt.exe73⤵PID:4612
-
\??\c:\7pddd.exec:\7pddd.exe74⤵PID:4980
-
\??\c:\pdppj.exec:\pdppj.exe75⤵PID:3788
-
\??\c:\1fllfxx.exec:\1fllfxx.exe76⤵PID:2528
-
\??\c:\9flflrf.exec:\9flflrf.exe77⤵PID:1172
-
\??\c:\vjvvv.exec:\vjvvv.exe78⤵PID:5052
-
\??\c:\flllrlr.exec:\flllrlr.exe79⤵PID:3688
-
\??\c:\1bbbbh.exec:\1bbbbh.exe80⤵PID:3092
-
\??\c:\7vddv.exec:\7vddv.exe81⤵PID:3952
-
\??\c:\pvdvp.exec:\pvdvp.exe82⤵PID:4336
-
\??\c:\flrllll.exec:\flrllll.exe83⤵PID:388
-
\??\c:\nhnttb.exec:\nhnttb.exe84⤵PID:4416
-
\??\c:\tnbhbb.exec:\tnbhbb.exe85⤵PID:4448
-
\??\c:\dvjjj.exec:\dvjjj.exe86⤵PID:4936
-
\??\c:\lllxrxx.exec:\lllxrxx.exe87⤵PID:880
-
\??\c:\rrxfflr.exec:\rrxfflr.exe88⤵PID:1064
-
\??\c:\5hnnbt.exec:\5hnnbt.exe89⤵PID:4920
-
\??\c:\ppvvp.exec:\ppvvp.exe90⤵PID:412
-
\??\c:\vpjjv.exec:\vpjjv.exe91⤵PID:4520
-
\??\c:\3llllrr.exec:\3llllrr.exe92⤵PID:1832
-
\??\c:\3thhhn.exec:\3thhhn.exe93⤵PID:4872
-
\??\c:\htbbtt.exec:\htbbtt.exe94⤵PID:5104
-
\??\c:\jpppj.exec:\jpppj.exe95⤵PID:1436
-
\??\c:\fxxfxff.exec:\fxxfxff.exe96⤵PID:4472
-
\??\c:\hhntbh.exec:\hhntbh.exe97⤵PID:4744
-
\??\c:\vpvvp.exec:\vpvvp.exe98⤵PID:1572
-
\??\c:\dvvvv.exec:\dvvvv.exe99⤵
- System Location Discovery: System Language Discovery
PID:2460 -
\??\c:\xxlllll.exec:\xxlllll.exe100⤵PID:1132
-
\??\c:\3thhhh.exec:\3thhhh.exe101⤵PID:3000
-
\??\c:\jpdvp.exec:\jpdvp.exe102⤵PID:4312
-
\??\c:\jvdjj.exec:\jvdjj.exe103⤵PID:3956
-
\??\c:\fflllff.exec:\fflllff.exe104⤵PID:4456
-
\??\c:\rllrrrr.exec:\rllrrrr.exe105⤵PID:3256
-
\??\c:\tbbnbh.exec:\tbbnbh.exe106⤵PID:3624
-
\??\c:\pjvvd.exec:\pjvvd.exe107⤵PID:184
-
\??\c:\ppddp.exec:\ppddp.exe108⤵PID:2140
-
\??\c:\xrrxxxf.exec:\xrrxxxf.exe109⤵PID:4688
-
\??\c:\htbhhh.exec:\htbhhh.exe110⤵PID:1968
-
\??\c:\dvdpp.exec:\dvdpp.exe111⤵PID:1160
-
\??\c:\pppvp.exec:\pppvp.exe112⤵PID:2240
-
\??\c:\rxxxfff.exec:\rxxxfff.exe113⤵PID:1220
-
\??\c:\5tnnnt.exec:\5tnnnt.exe114⤵PID:1496
-
\??\c:\btthtn.exec:\btthtn.exe115⤵PID:2416
-
\??\c:\9jddv.exec:\9jddv.exe116⤵PID:4664
-
\??\c:\ppdvv.exec:\ppdvv.exe117⤵PID:4908
-
\??\c:\fxxxfff.exec:\fxxxfff.exe118⤵PID:3876
-
\??\c:\nbnnnh.exec:\nbnnnh.exe119⤵PID:2808
-
\??\c:\tthhbh.exec:\tthhbh.exe120⤵PID:4788
-
\??\c:\pvjjd.exec:\pvjjd.exe121⤵PID:2228
-
\??\c:\lxffflr.exec:\lxffflr.exe122⤵PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-