Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 04:19
Static task
static1
Behavioral task
behavioral1
Sample
9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe
Resource
win7-20240903-en
General
-
Target
9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe
-
Size
83KB
-
MD5
ef052d63abab06b004cb4c8465d73af3
-
SHA1
f5e4a43136481d24d353dfb1cdd29ef2fad31733
-
SHA256
9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b
-
SHA512
d9b28b0c01b5cad2173068dd61fbbbd5cb37e951a59d989862d83158f82ab4f7c4ecbc5b5dbb3ddef4a08f7b0d21875569a7e7f72a00153d30806204d812a416
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QM:ymb3NkkiQ3mdBjFIIp9L9QrrA83
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/4792-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4196-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3560-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4140-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/776-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1488 jjjpp.exe 4196 ffrxrxx.exe 4836 tbhhnt.exe 1960 bhbnnn.exe 5100 dpdjv.exe 3204 dvddv.exe 2380 rflllrx.exe 220 xfrrrrr.exe 5052 hhtnhb.exe 4720 1thhhh.exe 4116 jjjjd.exe 1780 tbhnhn.exe 4236 hhhnnb.exe 232 dvvvj.exe 3560 lllrrxf.exe 4780 bhhhhh.exe 4404 ppdjv.exe 4140 frxllxr.exe 1920 ntbbtb.exe 3368 9jjjd.exe 4816 rxffxff.exe 1864 lffffll.exe 1716 bbhhth.exe 4992 pdpdp.exe 776 flxlfll.exe 4952 llxxxrx.exe 3960 nttbbb.exe 4732 jjvvj.exe 3816 rfxrxrr.exe 4468 ntbbtt.exe 3544 bnnbbh.exe 1116 dvjdd.exe 2588 1lflxff.exe 4564 7xfrrrx.exe 1740 ntbbtn.exe 2640 vdpdv.exe 2600 ppvjj.exe 5004 rxfffxx.exe 2408 7nntnt.exe 2516 thnttb.exe 4072 jvjdp.exe 4424 lrlffff.exe 4584 lxfrrxf.exe 4032 bnttbh.exe 1256 hnnttb.exe 2128 ppdjd.exe 4984 rxffflr.exe 1300 3nnhht.exe 4552 vvjjj.exe 452 frrlllf.exe 4300 fxfffrr.exe 4980 ttthbb.exe 3764 dvpjd.exe 4008 jjddd.exe 4268 frxfrrl.exe 1924 thnnhn.exe 5116 jvjdd.exe 1604 vjjjj.exe 1588 lrffrrf.exe 2216 htbtbb.exe 3552 btnhbn.exe 2732 vdppp.exe 3036 5frrflf.exe 3344 llrrrfl.exe -
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4196-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3560-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4140-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/776-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5hhbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nntnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllllrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frxrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnnnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ttttb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhbbtb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4792 wrote to memory of 1488 4792 9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe 83 PID 4792 wrote to memory of 1488 4792 9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe 83 PID 4792 wrote to memory of 1488 4792 9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe 83 PID 1488 wrote to memory of 4196 1488 jjjpp.exe 84 PID 1488 wrote to memory of 4196 1488 jjjpp.exe 84 PID 1488 wrote to memory of 4196 1488 jjjpp.exe 84 PID 4196 wrote to memory of 4836 4196 ffrxrxx.exe 85 PID 4196 wrote to memory of 4836 4196 ffrxrxx.exe 85 PID 4196 wrote to memory of 4836 4196 ffrxrxx.exe 85 PID 4836 wrote to memory of 1960 4836 tbhhnt.exe 86 PID 4836 wrote to memory of 1960 4836 tbhhnt.exe 86 PID 4836 wrote to memory of 1960 4836 tbhhnt.exe 86 PID 1960 wrote to memory of 5100 1960 bhbnnn.exe 87 PID 1960 wrote to memory of 5100 1960 bhbnnn.exe 87 PID 1960 wrote to memory of 5100 1960 bhbnnn.exe 87 PID 5100 wrote to memory of 3204 5100 dpdjv.exe 88 PID 5100 wrote to memory of 3204 5100 dpdjv.exe 88 PID 5100 wrote to memory of 3204 5100 dpdjv.exe 88 PID 3204 wrote to memory of 2380 3204 dvddv.exe 89 PID 3204 wrote to memory of 2380 3204 dvddv.exe 89 PID 3204 wrote to memory of 2380 3204 dvddv.exe 89 PID 2380 wrote to memory of 220 2380 rflllrx.exe 90 PID 2380 wrote to memory of 220 2380 rflllrx.exe 90 PID 2380 wrote to memory of 220 2380 rflllrx.exe 90 PID 220 wrote to memory of 5052 220 xfrrrrr.exe 91 PID 220 wrote to memory of 5052 220 xfrrrrr.exe 91 PID 220 wrote to memory of 5052 220 xfrrrrr.exe 91 PID 5052 wrote to memory of 4720 5052 hhtnhb.exe 92 PID 5052 wrote to memory of 4720 5052 hhtnhb.exe 92 PID 5052 wrote to memory of 4720 5052 hhtnhb.exe 92 PID 4720 wrote to memory of 4116 4720 1thhhh.exe 93 PID 4720 wrote to memory of 4116 4720 1thhhh.exe 93 PID 4720 wrote to memory of 4116 4720 1thhhh.exe 93 PID 4116 wrote to memory of 1780 4116 jjjjd.exe 94 PID 4116 wrote to memory of 1780 4116 jjjjd.exe 94 PID 4116 wrote to memory of 1780 4116 jjjjd.exe 94 PID 1780 wrote to memory of 4236 1780 tbhnhn.exe 95 PID 1780 wrote to memory of 4236 1780 tbhnhn.exe 95 PID 1780 wrote to memory of 4236 1780 tbhnhn.exe 95 PID 4236 wrote to memory of 232 4236 hhhnnb.exe 96 PID 4236 wrote to memory of 232 4236 hhhnnb.exe 96 PID 4236 wrote to memory of 232 4236 hhhnnb.exe 96 PID 232 wrote to memory of 3560 232 dvvvj.exe 97 PID 232 wrote to memory of 3560 232 dvvvj.exe 97 PID 232 wrote to memory of 3560 232 dvvvj.exe 97 PID 3560 wrote to memory of 4780 3560 lllrrxf.exe 98 PID 3560 wrote to memory of 4780 3560 lllrrxf.exe 98 PID 3560 wrote to memory of 4780 3560 lllrrxf.exe 98 PID 4780 wrote to memory of 4404 4780 bhhhhh.exe 99 PID 4780 wrote to memory of 4404 4780 bhhhhh.exe 99 PID 4780 wrote to memory of 4404 4780 bhhhhh.exe 99 PID 4404 wrote to memory of 4140 4404 ppdjv.exe 100 PID 4404 wrote to memory of 4140 4404 ppdjv.exe 100 PID 4404 wrote to memory of 4140 4404 ppdjv.exe 100 PID 4140 wrote to memory of 1920 4140 frxllxr.exe 101 PID 4140 wrote to memory of 1920 4140 frxllxr.exe 101 PID 4140 wrote to memory of 1920 4140 frxllxr.exe 101 PID 1920 wrote to memory of 3368 1920 ntbbtb.exe 102 PID 1920 wrote to memory of 3368 1920 ntbbtb.exe 102 PID 1920 wrote to memory of 3368 1920 ntbbtb.exe 102 PID 3368 wrote to memory of 4816 3368 9jjjd.exe 103 PID 3368 wrote to memory of 4816 3368 9jjjd.exe 103 PID 3368 wrote to memory of 4816 3368 9jjjd.exe 103 PID 4816 wrote to memory of 1864 4816 rxffxff.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe"C:\Users\Admin\AppData\Local\Temp\9a35dba9bad31d8204aa4219a64fcee853e87d4e405443aca9eab5c324bf351b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\jjjpp.exec:\jjjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\ffrxrxx.exec:\ffrxrxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\tbhhnt.exec:\tbhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\bhbnnn.exec:\bhbnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
\??\c:\dpdjv.exec:\dpdjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\dvddv.exec:\dvddv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\rflllrx.exec:\rflllrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\hhtnhb.exec:\hhtnhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\1thhhh.exec:\1thhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\jjjjd.exec:\jjjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\tbhnhn.exec:\tbhnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\hhhnnb.exec:\hhhnnb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\dvvvj.exec:\dvvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\lllrrxf.exec:\lllrrxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\bhhhhh.exec:\bhhhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\ppdjv.exec:\ppdjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\frxllxr.exec:\frxllxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\ntbbtb.exec:\ntbbtb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\9jjjd.exec:\9jjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\rxffxff.exec:\rxffxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\lffffll.exec:\lffffll.exe23⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bbhhth.exec:\bbhhth.exe24⤵
- Executes dropped EXE
PID:1716 -
\??\c:\pdpdp.exec:\pdpdp.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\flxlfll.exec:\flxlfll.exe26⤵
- Executes dropped EXE
PID:776 -
\??\c:\llxxxrx.exec:\llxxxrx.exe27⤵
- Executes dropped EXE
PID:4952 -
\??\c:\nttbbb.exec:\nttbbb.exe28⤵
- Executes dropped EXE
PID:3960 -
\??\c:\jjvvj.exec:\jjvvj.exe29⤵
- Executes dropped EXE
PID:4732 -
\??\c:\rfxrxrr.exec:\rfxrxrr.exe30⤵
- Executes dropped EXE
PID:3816 -
\??\c:\ntbbtt.exec:\ntbbtt.exe31⤵
- Executes dropped EXE
PID:4468 -
\??\c:\bnnbbh.exec:\bnnbbh.exe32⤵
- Executes dropped EXE
PID:3544 -
\??\c:\dvjdd.exec:\dvjdd.exe33⤵
- Executes dropped EXE
PID:1116 -
\??\c:\1lflxff.exec:\1lflxff.exe34⤵
- Executes dropped EXE
PID:2588 -
\??\c:\7xfrrrx.exec:\7xfrrrx.exe35⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ntbbtn.exec:\ntbbtn.exe36⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vdpdv.exec:\vdpdv.exe37⤵
- Executes dropped EXE
PID:2640 -
\??\c:\ppvjj.exec:\ppvjj.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2600 -
\??\c:\rxfffxx.exec:\rxfffxx.exe39⤵
- Executes dropped EXE
PID:5004 -
\??\c:\7nntnt.exec:\7nntnt.exe40⤵
- Executes dropped EXE
PID:2408 -
\??\c:\thnttb.exec:\thnttb.exe41⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jvjdp.exec:\jvjdp.exe42⤵
- Executes dropped EXE
PID:4072 -
\??\c:\lrlffff.exec:\lrlffff.exe43⤵
- Executes dropped EXE
PID:4424 -
\??\c:\lxfrrxf.exec:\lxfrrxf.exe44⤵
- Executes dropped EXE
PID:4584 -
\??\c:\bnttbh.exec:\bnttbh.exe45⤵
- Executes dropped EXE
PID:4032 -
\??\c:\hnnttb.exec:\hnnttb.exe46⤵
- Executes dropped EXE
PID:1256 -
\??\c:\ppdjd.exec:\ppdjd.exe47⤵
- Executes dropped EXE
PID:2128 -
\??\c:\jpddd.exec:\jpddd.exe48⤵PID:1468
-
\??\c:\rxffflr.exec:\rxffflr.exe49⤵
- Executes dropped EXE
PID:4984 -
\??\c:\3nnhht.exec:\3nnhht.exe50⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vvjjj.exec:\vvjjj.exe51⤵
- Executes dropped EXE
PID:4552 -
\??\c:\frrlllf.exec:\frrlllf.exe52⤵
- Executes dropped EXE
PID:452 -
\??\c:\fxfffrr.exec:\fxfffrr.exe53⤵
- Executes dropped EXE
PID:4300 -
\??\c:\ttthbb.exec:\ttthbb.exe54⤵
- Executes dropped EXE
PID:4980 -
\??\c:\dvpjd.exec:\dvpjd.exe55⤵
- Executes dropped EXE
PID:3764 -
\??\c:\jjddd.exec:\jjddd.exe56⤵
- Executes dropped EXE
PID:4008 -
\??\c:\frxfrrl.exec:\frxfrrl.exe57⤵
- Executes dropped EXE
PID:4268 -
\??\c:\thnnhn.exec:\thnnhn.exe58⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jvjdd.exec:\jvjdd.exe59⤵
- Executes dropped EXE
PID:5116 -
\??\c:\vjjjj.exec:\vjjjj.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lrffrrf.exec:\lrffrrf.exe61⤵
- Executes dropped EXE
PID:1588 -
\??\c:\htbtbb.exec:\htbtbb.exe62⤵
- Executes dropped EXE
PID:2216 -
\??\c:\btnhbn.exec:\btnhbn.exe63⤵
- Executes dropped EXE
PID:3552 -
\??\c:\vdppp.exec:\vdppp.exe64⤵
- Executes dropped EXE
PID:2732 -
\??\c:\5frrflf.exec:\5frrflf.exe65⤵
- Executes dropped EXE
PID:3036 -
\??\c:\llrrrfl.exec:\llrrrfl.exe66⤵
- Executes dropped EXE
PID:3344 -
\??\c:\ttbhhh.exec:\ttbhhh.exe67⤵PID:3784
-
\??\c:\hnbhhn.exec:\hnbhhn.exe68⤵PID:2556
-
\??\c:\1htttt.exec:\1htttt.exe69⤵PID:3604
-
\??\c:\vpjjj.exec:\vpjjj.exe70⤵PID:1632
-
\??\c:\rrfllll.exec:\rrfllll.exe71⤵PID:1404
-
\??\c:\ffllrxf.exec:\ffllrxf.exe72⤵PID:4780
-
\??\c:\jpddj.exec:\jpddj.exe73⤵
- System Location Discovery: System Language Discovery
PID:2964 -
\??\c:\dvvvv.exec:\dvvvv.exe74⤵PID:3160
-
\??\c:\lflrrrx.exec:\lflrrrx.exe75⤵PID:4456
-
\??\c:\1hhhnt.exec:\1hhhnt.exe76⤵PID:3376
-
\??\c:\nhtthh.exec:\nhtthh.exe77⤵PID:628
-
\??\c:\ppjvv.exec:\ppjvv.exe78⤵PID:1820
-
\??\c:\frrlxxr.exec:\frrlxxr.exe79⤵PID:1320
-
\??\c:\rffxrrl.exec:\rffxrrl.exe80⤵PID:2972
-
\??\c:\bhnnnn.exec:\bhnnnn.exe81⤵PID:3512
-
\??\c:\hnbbnn.exec:\hnbbnn.exe82⤵PID:812
-
\??\c:\vjppp.exec:\vjppp.exe83⤵PID:4820
-
\??\c:\rxllrrx.exec:\rxllrrx.exe84⤵PID:1768
-
\??\c:\1btbth.exec:\1btbth.exe85⤵PID:4640
-
\??\c:\dvdjj.exec:\dvdjj.exe86⤵PID:816
-
\??\c:\5xxxrxr.exec:\5xxxrxr.exe87⤵PID:3068
-
\??\c:\rxllxfl.exec:\rxllxfl.exe88⤵PID:404
-
\??\c:\tthhnt.exec:\tthhnt.exe89⤵PID:64
-
\??\c:\bnnnnt.exec:\bnnnnt.exe90⤵PID:4192
-
\??\c:\9vjjp.exec:\9vjjp.exe91⤵PID:1508
-
\??\c:\ddjpp.exec:\ddjpp.exe92⤵PID:2588
-
\??\c:\xflllrx.exec:\xflllrx.exe93⤵PID:4484
-
\??\c:\xllxxll.exec:\xllxxll.exe94⤵PID:2436
-
\??\c:\ttbbbb.exec:\ttbbbb.exe95⤵PID:3320
-
\??\c:\fflfxll.exec:\fflfxll.exe96⤵PID:2764
-
\??\c:\5lfflrl.exec:\5lfflrl.exe97⤵PID:364
-
\??\c:\nnhhht.exec:\nnhhht.exe98⤵
- System Location Discovery: System Language Discovery
PID:1952 -
\??\c:\thhhhh.exec:\thhhhh.exe99⤵
- System Location Discovery: System Language Discovery
PID:3804 -
\??\c:\jvddd.exec:\jvddd.exe100⤵PID:3224
-
\??\c:\xlrflll.exec:\xlrflll.exe101⤵PID:3152
-
\??\c:\vvppd.exec:\vvppd.exe102⤵PID:2232
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe103⤵PID:1576
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe104⤵PID:2880
-
\??\c:\tttttt.exec:\tttttt.exe105⤵PID:4792
-
\??\c:\nhnntb.exec:\nhnntb.exe106⤵PID:1640
-
\??\c:\9hbhth.exec:\9hbhth.exe107⤵PID:2188
-
\??\c:\hbntnt.exec:\hbntnt.exe108⤵PID:1968
-
\??\c:\9vddd.exec:\9vddd.exe109⤵PID:3900
-
\??\c:\djppj.exec:\djppj.exe110⤵PID:4836
-
\??\c:\xxlflrr.exec:\xxlflrr.exe111⤵PID:1268
-
\??\c:\pvvvv.exec:\pvvvv.exe112⤵PID:5100
-
\??\c:\lfllrxf.exec:\lfllrxf.exe113⤵PID:3692
-
\??\c:\ntnbth.exec:\ntnbth.exe114⤵PID:1764
-
\??\c:\dpjdd.exec:\dpjdd.exe115⤵PID:3752
-
\??\c:\ddjvd.exec:\ddjvd.exe116⤵PID:2828
-
\??\c:\rxrfxxf.exec:\rxrfxxf.exe117⤵PID:1232
-
\??\c:\tnbbbh.exec:\tnbbbh.exe118⤵PID:2248
-
\??\c:\3nbbht.exec:\3nbbht.exe119⤵PID:3992
-
\??\c:\pjjpp.exec:\pjjpp.exe120⤵PID:3864
-
\??\c:\pppvp.exec:\pppvp.exe121⤵PID:312
-
\??\c:\3xlrrff.exec:\3xlrrff.exe122⤵PID:1128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-