Analysis
-
max time kernel
120s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 03:34
Static task
static1
Behavioral task
behavioral1
Sample
50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe
Resource
win7-20240903-en
General
-
Target
50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe
-
Size
82KB
-
MD5
817ddd3b7c647fc56fed3c7b9b9ea0a0
-
SHA1
f408aa91aa6683ccc2d7aa08915da94f29fd7b2f
-
SHA256
50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2
-
SHA512
af4ff8916ba245d66e09fa07b9e2ca2956a648078b949176ab7e9bd60d66ead7188992508a8d1faa9927969544fcf950c7fbdcaf9281b589910eca31f979ebd6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINFE4yeqj:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu4rb
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/4864-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2224 hhbthb.exe 1836 vjjdv.exe 3260 jvpdp.exe 3508 xlffxlx.exe 1260 vddvj.exe 2696 vppjd.exe 4268 9thbtn.exe 220 dppjv.exe 4092 xlfxllf.exe 1472 9tntnn.exe 1372 9jjdd.exe 1220 lxfxrlf.exe 1656 5btnhh.exe 2172 vpdjv.exe 2604 rfxlxrl.exe 2420 9llxrrl.exe 4232 nhthbn.exe 5052 vpjdd.exe 3636 bbhbbt.exe 3916 jdjvp.exe 1392 xlxlxfr.exe 2228 xlrfxlf.exe 3836 nbbthb.exe 2132 dvjvv.exe 2040 ppjvj.exe 1252 xlfxlff.exe 4924 xfrlffx.exe 3560 7dpjj.exe 3592 9dpjv.exe 3348 xxxlfxx.exe 4068 btnhtn.exe 4944 xrxxrlf.exe 3296 nnbthh.exe 3772 vppjv.exe 2432 djvpp.exe 4368 rxrrffr.exe 400 nhthbt.exe 4876 9ththb.exe 936 xfrlffx.exe 4540 rllrrlf.exe 1476 jpdvp.exe 1596 lrfllfr.exe 4360 dppjj.exe 4664 7hhbbn.exe 1916 dvdvp.exe 2300 lxxlxrx.exe 2756 rxxrffx.exe 3128 nbhbtt.exe 5068 dpdvj.exe 3520 pdjdp.exe 3404 lfxlfxr.exe 2268 hntttt.exe 4400 pvvpd.exe 3368 ddjdp.exe 4092 9xrlfxr.exe 2980 vdpjd.exe 2012 rxffxxx.exe 2084 fxxrlxr.exe 4180 bbttnn.exe 2960 vjpdv.exe 1984 xrlfxlf.exe 3728 lfrlrrr.exe 1940 nhhhbb.exe 4100 jdvpv.exe -
resource yara_rule behavioral2/memory/4864-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-215-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlrllfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvpdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9llxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7hhhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bttnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrffrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbhbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjvj.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 2224 4864 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 82 PID 4864 wrote to memory of 2224 4864 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 82 PID 4864 wrote to memory of 2224 4864 50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe 82 PID 2224 wrote to memory of 1836 2224 hhbthb.exe 83 PID 2224 wrote to memory of 1836 2224 hhbthb.exe 83 PID 2224 wrote to memory of 1836 2224 hhbthb.exe 83 PID 1836 wrote to memory of 3260 1836 vjjdv.exe 84 PID 1836 wrote to memory of 3260 1836 vjjdv.exe 84 PID 1836 wrote to memory of 3260 1836 vjjdv.exe 84 PID 3260 wrote to memory of 3508 3260 jvpdp.exe 85 PID 3260 wrote to memory of 3508 3260 jvpdp.exe 85 PID 3260 wrote to memory of 3508 3260 jvpdp.exe 85 PID 3508 wrote to memory of 1260 3508 xlffxlx.exe 86 PID 3508 wrote to memory of 1260 3508 xlffxlx.exe 86 PID 3508 wrote to memory of 1260 3508 xlffxlx.exe 86 PID 1260 wrote to memory of 2696 1260 vddvj.exe 87 PID 1260 wrote to memory of 2696 1260 vddvj.exe 87 PID 1260 wrote to memory of 2696 1260 vddvj.exe 87 PID 2696 wrote to memory of 4268 2696 vppjd.exe 88 PID 2696 wrote to memory of 4268 2696 vppjd.exe 88 PID 2696 wrote to memory of 4268 2696 vppjd.exe 88 PID 4268 wrote to memory of 220 4268 9thbtn.exe 89 PID 4268 wrote to memory of 220 4268 9thbtn.exe 89 PID 4268 wrote to memory of 220 4268 9thbtn.exe 89 PID 220 wrote to memory of 4092 220 dppjv.exe 90 PID 220 wrote to memory of 4092 220 dppjv.exe 90 PID 220 wrote to memory of 4092 220 dppjv.exe 90 PID 4092 wrote to memory of 1472 4092 xlfxllf.exe 91 PID 4092 wrote to memory of 1472 4092 xlfxllf.exe 91 PID 4092 wrote to memory of 1472 4092 xlfxllf.exe 91 PID 1472 wrote to memory of 1372 1472 9tntnn.exe 92 PID 1472 wrote to memory of 1372 1472 9tntnn.exe 92 PID 1472 wrote to memory of 1372 1472 9tntnn.exe 92 PID 1372 wrote to memory of 1220 1372 9jjdd.exe 93 PID 1372 wrote to memory of 1220 1372 9jjdd.exe 93 PID 1372 wrote to memory of 1220 1372 9jjdd.exe 93 PID 1220 wrote to memory of 1656 1220 lxfxrlf.exe 94 PID 1220 wrote to memory of 1656 1220 lxfxrlf.exe 94 PID 1220 wrote to memory of 1656 1220 lxfxrlf.exe 94 PID 1656 wrote to memory of 2172 1656 5btnhh.exe 95 PID 1656 wrote to memory of 2172 1656 5btnhh.exe 95 PID 1656 wrote to memory of 2172 1656 5btnhh.exe 95 PID 2172 wrote to memory of 2604 2172 vpdjv.exe 96 PID 2172 wrote to memory of 2604 2172 vpdjv.exe 96 PID 2172 wrote to memory of 2604 2172 vpdjv.exe 96 PID 2604 wrote to memory of 2420 2604 rfxlxrl.exe 97 PID 2604 wrote to memory of 2420 2604 rfxlxrl.exe 97 PID 2604 wrote to memory of 2420 2604 rfxlxrl.exe 97 PID 2420 wrote to memory of 4232 2420 9llxrrl.exe 98 PID 2420 wrote to memory of 4232 2420 9llxrrl.exe 98 PID 2420 wrote to memory of 4232 2420 9llxrrl.exe 98 PID 4232 wrote to memory of 5052 4232 nhthbn.exe 99 PID 4232 wrote to memory of 5052 4232 nhthbn.exe 99 PID 4232 wrote to memory of 5052 4232 nhthbn.exe 99 PID 5052 wrote to memory of 3636 5052 vpjdd.exe 100 PID 5052 wrote to memory of 3636 5052 vpjdd.exe 100 PID 5052 wrote to memory of 3636 5052 vpjdd.exe 100 PID 3636 wrote to memory of 3916 3636 bbhbbt.exe 101 PID 3636 wrote to memory of 3916 3636 bbhbbt.exe 101 PID 3636 wrote to memory of 3916 3636 bbhbbt.exe 101 PID 3916 wrote to memory of 1392 3916 jdjvp.exe 102 PID 3916 wrote to memory of 1392 3916 jdjvp.exe 102 PID 3916 wrote to memory of 1392 3916 jdjvp.exe 102 PID 1392 wrote to memory of 2228 1392 xlxlxfr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe"C:\Users\Admin\AppData\Local\Temp\50a750c3a418dec6220a52ddf37df6badda634490ee22c9f6c4962a6616bbed2N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\hhbthb.exec:\hhbthb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\vjjdv.exec:\vjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\jvpdp.exec:\jvpdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\xlffxlx.exec:\xlffxlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\vddvj.exec:\vddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\vppjd.exec:\vppjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9thbtn.exec:\9thbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\dppjv.exec:\dppjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\xlfxllf.exec:\xlfxllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\9tntnn.exec:\9tntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\9jjdd.exec:\9jjdd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\5btnhh.exec:\5btnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\vpdjv.exec:\vpdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9llxrrl.exec:\9llxrrl.exe17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\nhthbn.exec:\nhthbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\vpjdd.exec:\vpjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\bbhbbt.exec:\bbhbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\jdjvp.exec:\jdjvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\xlxlxfr.exec:\xlxlxfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\xlrfxlf.exec:\xlrfxlf.exe23⤵
- Executes dropped EXE
PID:2228 -
\??\c:\nbbthb.exec:\nbbthb.exe24⤵
- Executes dropped EXE
PID:3836 -
\??\c:\dvjvv.exec:\dvjvv.exe25⤵
- Executes dropped EXE
PID:2132 -
\??\c:\ppjvj.exec:\ppjvj.exe26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2040 -
\??\c:\xlfxlff.exec:\xlfxlff.exe27⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xfrlffx.exec:\xfrlffx.exe28⤵
- Executes dropped EXE
PID:4924 -
\??\c:\7dpjj.exec:\7dpjj.exe29⤵
- Executes dropped EXE
PID:3560 -
\??\c:\9dpjv.exec:\9dpjv.exe30⤵
- Executes dropped EXE
PID:3592 -
\??\c:\xxxlfxx.exec:\xxxlfxx.exe31⤵
- Executes dropped EXE
PID:3348 -
\??\c:\btnhtn.exec:\btnhtn.exe32⤵
- Executes dropped EXE
PID:4068 -
\??\c:\xrxxrlf.exec:\xrxxrlf.exe33⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nnbthh.exec:\nnbthh.exe34⤵
- Executes dropped EXE
PID:3296 -
\??\c:\vppjv.exec:\vppjv.exe35⤵
- Executes dropped EXE
PID:3772 -
\??\c:\djvpp.exec:\djvpp.exe36⤵
- Executes dropped EXE
PID:2432 -
\??\c:\rxrrffr.exec:\rxrrffr.exe37⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nhthbt.exec:\nhthbt.exe38⤵
- Executes dropped EXE
PID:400 -
\??\c:\9ththb.exec:\9ththb.exe39⤵
- Executes dropped EXE
PID:4876 -
\??\c:\xfrlffx.exec:\xfrlffx.exe40⤵
- Executes dropped EXE
PID:936 -
\??\c:\rllrrlf.exec:\rllrrlf.exe41⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jpdvp.exec:\jpdvp.exe42⤵
- Executes dropped EXE
PID:1476 -
\??\c:\lrfllfr.exec:\lrfllfr.exe43⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dppjj.exec:\dppjj.exe44⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7hhbbn.exec:\7hhbbn.exe45⤵
- Executes dropped EXE
PID:4664 -
\??\c:\dvdvp.exec:\dvdvp.exe46⤵
- Executes dropped EXE
PID:1916 -
\??\c:\lxxlxrx.exec:\lxxlxrx.exe47⤵
- Executes dropped EXE
PID:2300 -
\??\c:\rxxrffx.exec:\rxxrffx.exe48⤵
- Executes dropped EXE
PID:2756 -
\??\c:\nbhbtt.exec:\nbhbtt.exe49⤵
- Executes dropped EXE
PID:3128 -
\??\c:\dpdvj.exec:\dpdvj.exe50⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pdjdp.exec:\pdjdp.exe51⤵
- Executes dropped EXE
PID:3520 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe52⤵
- Executes dropped EXE
PID:3404 -
\??\c:\hntttt.exec:\hntttt.exe53⤵
- Executes dropped EXE
PID:2268 -
\??\c:\pvvpd.exec:\pvvpd.exe54⤵
- Executes dropped EXE
PID:4400 -
\??\c:\ddjdp.exec:\ddjdp.exe55⤵
- Executes dropped EXE
PID:3368 -
\??\c:\9xrlfxr.exec:\9xrlfxr.exe56⤵
- Executes dropped EXE
PID:4092 -
\??\c:\vdpjd.exec:\vdpjd.exe57⤵
- Executes dropped EXE
PID:2980 -
\??\c:\rxffxxx.exec:\rxffxxx.exe58⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fxxrlxr.exec:\fxxrlxr.exe59⤵
- Executes dropped EXE
PID:2084 -
\??\c:\bbttnn.exec:\bbttnn.exe60⤵
- Executes dropped EXE
PID:4180 -
\??\c:\vjpdv.exec:\vjpdv.exe61⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe62⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe63⤵
- Executes dropped EXE
PID:3728 -
\??\c:\nhhhbb.exec:\nhhhbb.exe64⤵
- Executes dropped EXE
PID:1940 -
\??\c:\jdvpv.exec:\jdvpv.exe65⤵
- Executes dropped EXE
PID:4100 -
\??\c:\xrrlrrf.exec:\xrrlrrf.exe66⤵PID:4800
-
\??\c:\7fxrlff.exec:\7fxrlff.exe67⤵PID:1152
-
\??\c:\7nnnnn.exec:\7nnnnn.exe68⤵PID:4728
-
\??\c:\hnttnh.exec:\hnttnh.exe69⤵PID:4868
-
\??\c:\3ppdp.exec:\3ppdp.exe70⤵PID:3636
-
\??\c:\djjvp.exec:\djjvp.exe71⤵PID:1240
-
\??\c:\lfrlxrr.exec:\lfrlxrr.exe72⤵PID:368
-
\??\c:\9nhttt.exec:\9nhttt.exe73⤵PID:5012
-
\??\c:\jddvp.exec:\jddvp.exe74⤵PID:1460
-
\??\c:\pjpjd.exec:\pjpjd.exe75⤵PID:3836
-
\??\c:\7lffrrx.exec:\7lffrrx.exe76⤵PID:1032
-
\??\c:\tnnhbb.exec:\tnnhbb.exe77⤵PID:3344
-
\??\c:\ttbnnh.exec:\ttbnnh.exe78⤵PID:756
-
\??\c:\dvvvv.exec:\dvvvv.exe79⤵PID:3676
-
\??\c:\pjjjv.exec:\pjjjv.exe80⤵PID:3440
-
\??\c:\3fxlxrl.exec:\3fxlxrl.exe81⤵PID:3448
-
\??\c:\9bnbtn.exec:\9bnbtn.exe82⤵PID:3588
-
\??\c:\bnbttt.exec:\bnbttt.exe83⤵PID:3536
-
\??\c:\vpjdp.exec:\vpjdp.exe84⤵PID:3348
-
\??\c:\vdpjv.exec:\vdpjv.exe85⤵PID:652
-
\??\c:\llflfrx.exec:\llflfrx.exe86⤵PID:528
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe87⤵PID:2176
-
\??\c:\5hbhbb.exec:\5hbhbb.exe88⤵PID:428
-
\??\c:\pppjv.exec:\pppjv.exe89⤵PID:2840
-
\??\c:\xrrlfxx.exec:\xrrlfxx.exe90⤵PID:2292
-
\??\c:\fxrrlll.exec:\fxrrlll.exe91⤵PID:4680
-
\??\c:\nhthhn.exec:\nhthhn.exe92⤵PID:3800
-
\??\c:\3jpjj.exec:\3jpjj.exe93⤵PID:4488
-
\??\c:\pjjvp.exec:\pjjvp.exe94⤵PID:4564
-
\??\c:\frrlxxl.exec:\frrlxxl.exe95⤵PID:5080
-
\??\c:\bntttn.exec:\bntttn.exe96⤵PID:1416
-
\??\c:\dvpjp.exec:\dvpjp.exe97⤵PID:3444
-
\??\c:\vpdvd.exec:\vpdvd.exe98⤵PID:4156
-
\??\c:\rrfxllf.exec:\rrfxllf.exe99⤵PID:3376
-
\??\c:\vjpjd.exec:\vjpjd.exe100⤵PID:3260
-
\??\c:\pddvp.exec:\pddvp.exe101⤵PID:4052
-
\??\c:\rxxrllf.exec:\rxxrllf.exe102⤵PID:1992
-
\??\c:\hbttnn.exec:\hbttnn.exe103⤵PID:1260
-
\??\c:\5jdvj.exec:\5jdvj.exe104⤵PID:3872
-
\??\c:\3rxrlff.exec:\3rxrlff.exe105⤵PID:2396
-
\??\c:\lrllxrl.exec:\lrllxrl.exe106⤵PID:224
-
\??\c:\9lllffx.exec:\9lllffx.exe107⤵PID:3176
-
\??\c:\tnbtbt.exec:\tnbtbt.exe108⤵PID:4400
-
\??\c:\pdjvp.exec:\pdjvp.exe109⤵PID:3016
-
\??\c:\vjjdv.exec:\vjjdv.exe110⤵PID:4172
-
\??\c:\7lfrfxf.exec:\7lfrfxf.exe111⤵PID:2032
-
\??\c:\9bhhbt.exec:\9bhhbt.exe112⤵PID:1300
-
\??\c:\nhnhnh.exec:\nhnhnh.exe113⤵PID:1644
-
\??\c:\dvppj.exec:\dvppj.exe114⤵PID:4176
-
\??\c:\fxffxrx.exec:\fxffxrx.exe115⤵PID:3116
-
\??\c:\frrlffx.exec:\frrlffx.exe116⤵PID:4204
-
\??\c:\nthhbb.exec:\nthhbb.exe117⤵PID:1148
-
\??\c:\7dvjv.exec:\7dvjv.exe118⤵PID:5092
-
\??\c:\jpvpj.exec:\jpvpj.exe119⤵PID:4100
-
\??\c:\1rxrxxf.exec:\1rxrxxf.exe120⤵PID:4312
-
\??\c:\nhhbhb.exec:\nhhbhb.exe121⤵PID:1152
-
\??\c:\nhtnnh.exec:\nhtnnh.exe122⤵PID:4728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-