Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 02:52
Static task
static1
Behavioral task
behavioral1
Sample
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
Resource
win7-20240903-en
General
-
Target
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe
-
Size
93KB
-
MD5
789612a58fd4b8deaca1dcd85daa895d
-
SHA1
2c227d9ad452da6a3e763e2ab15908f9bf545031
-
SHA256
874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85
-
SHA512
888e6de09c4f9ea6e52829ddc20ef6a2530386820e4613cbe377217a004e6ca3ba3818a5b1aaac1ccbbb5f994eb32720e85d1c35cf3a9cb8da92bbede1951a79
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp99zx/A0UtgK:ymb3NkkiQ3mdBjFo73tvn+Yp99zDut
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 27 IoCs
resource yara_rule behavioral2/memory/5032-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3648-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4672 fllfxxx.exe 3648 bnbhtn.exe 924 jvjjd.exe 2996 dvvvd.exe 4756 7httnt.exe 3172 dpvpj.exe 1020 frlffll.exe 4504 nnnnhn.exe 436 jvjvj.exe 3512 lxxxrrr.exe 3232 pjvjp.exe 4876 pjjdj.exe 3680 rflflfx.exe 4080 nhhhhn.exe 5112 1pvjd.exe 3032 rrlfxfx.exe 4820 fxffrrf.exe 2380 bbtnbb.exe 2144 ppjdj.exe 1388 llxflxl.exe 4664 thbthb.exe 4948 bbbbnn.exe 4740 ddvjv.exe 3944 ffxfllx.exe 3756 9ntnhh.exe 1952 hbbhnb.exe 3240 1jjdd.exe 1968 tbhhhh.exe 1948 nhtntn.exe 3384 vdddd.exe 4660 3rllffx.exe 552 hbnnhh.exe 4696 7bhhtb.exe 2568 ppjdv.exe 3252 rlxxffr.exe 3692 hnttbn.exe 1660 hhbbhh.exe 724 pdddd.exe 4396 rfrrlrr.exe 2304 xlrrllf.exe 4944 9thhbb.exe 384 pppdv.exe 2736 lrrrrxx.exe 3648 rxllffx.exe 3612 hnnnhh.exe 4404 9pppp.exe 4004 xrrlxxx.exe 216 xrrllll.exe 1592 9tthhh.exe 1992 bntnnh.exe 1232 pvvvv.exe 1020 ddjpp.exe 3916 9rxxrrr.exe 180 frflfll.exe 4936 tbbhhh.exe 1472 1jvvj.exe 3512 pdjjd.exe 5052 frfffll.exe 3228 rxfxrfr.exe 1840 tttbtb.exe 3548 jjvvv.exe 3532 fxffrrr.exe 1208 tbbtnn.exe 3332 bbbtnn.exe -
resource yara_rule behavioral2/memory/5032-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3648-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrlxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9htnbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdvvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1btntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnhnbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9jppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9pdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frlffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxflfrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4672 5032 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 82 PID 5032 wrote to memory of 4672 5032 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 82 PID 5032 wrote to memory of 4672 5032 874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe 82 PID 4672 wrote to memory of 3648 4672 fllfxxx.exe 83 PID 4672 wrote to memory of 3648 4672 fllfxxx.exe 83 PID 4672 wrote to memory of 3648 4672 fllfxxx.exe 83 PID 3648 wrote to memory of 924 3648 bnbhtn.exe 84 PID 3648 wrote to memory of 924 3648 bnbhtn.exe 84 PID 3648 wrote to memory of 924 3648 bnbhtn.exe 84 PID 924 wrote to memory of 2996 924 jvjjd.exe 85 PID 924 wrote to memory of 2996 924 jvjjd.exe 85 PID 924 wrote to memory of 2996 924 jvjjd.exe 85 PID 2996 wrote to memory of 4756 2996 dvvvd.exe 86 PID 2996 wrote to memory of 4756 2996 dvvvd.exe 86 PID 2996 wrote to memory of 4756 2996 dvvvd.exe 86 PID 4756 wrote to memory of 3172 4756 7httnt.exe 87 PID 4756 wrote to memory of 3172 4756 7httnt.exe 87 PID 4756 wrote to memory of 3172 4756 7httnt.exe 87 PID 3172 wrote to memory of 1020 3172 dpvpj.exe 88 PID 3172 wrote to memory of 1020 3172 dpvpj.exe 88 PID 3172 wrote to memory of 1020 3172 dpvpj.exe 88 PID 1020 wrote to memory of 4504 1020 frlffll.exe 89 PID 1020 wrote to memory of 4504 1020 frlffll.exe 89 PID 1020 wrote to memory of 4504 1020 frlffll.exe 89 PID 4504 wrote to memory of 436 4504 nnnnhn.exe 90 PID 4504 wrote to memory of 436 4504 nnnnhn.exe 90 PID 4504 wrote to memory of 436 4504 nnnnhn.exe 90 PID 436 wrote to memory of 3512 436 jvjvj.exe 91 PID 436 wrote to memory of 3512 436 jvjvj.exe 91 PID 436 wrote to memory of 3512 436 jvjvj.exe 91 PID 3512 wrote to memory of 3232 3512 lxxxrrr.exe 92 PID 3512 wrote to memory of 3232 3512 lxxxrrr.exe 92 PID 3512 wrote to memory of 3232 3512 lxxxrrr.exe 92 PID 3232 wrote to memory of 4876 3232 pjvjp.exe 93 PID 3232 wrote to memory of 4876 3232 pjvjp.exe 93 PID 3232 wrote to memory of 4876 3232 pjvjp.exe 93 PID 4876 wrote to memory of 3680 4876 pjjdj.exe 94 PID 4876 wrote to memory of 3680 4876 pjjdj.exe 94 PID 4876 wrote to memory of 3680 4876 pjjdj.exe 94 PID 3680 wrote to memory of 4080 3680 rflflfx.exe 95 PID 3680 wrote to memory of 4080 3680 rflflfx.exe 95 PID 3680 wrote to memory of 4080 3680 rflflfx.exe 95 PID 4080 wrote to memory of 5112 4080 nhhhhn.exe 96 PID 4080 wrote to memory of 5112 4080 nhhhhn.exe 96 PID 4080 wrote to memory of 5112 4080 nhhhhn.exe 96 PID 5112 wrote to memory of 3032 5112 1pvjd.exe 97 PID 5112 wrote to memory of 3032 5112 1pvjd.exe 97 PID 5112 wrote to memory of 3032 5112 1pvjd.exe 97 PID 3032 wrote to memory of 4820 3032 rrlfxfx.exe 98 PID 3032 wrote to memory of 4820 3032 rrlfxfx.exe 98 PID 3032 wrote to memory of 4820 3032 rrlfxfx.exe 98 PID 4820 wrote to memory of 2380 4820 fxffrrf.exe 99 PID 4820 wrote to memory of 2380 4820 fxffrrf.exe 99 PID 4820 wrote to memory of 2380 4820 fxffrrf.exe 99 PID 2380 wrote to memory of 2144 2380 bbtnbb.exe 100 PID 2380 wrote to memory of 2144 2380 bbtnbb.exe 100 PID 2380 wrote to memory of 2144 2380 bbtnbb.exe 100 PID 2144 wrote to memory of 1388 2144 ppjdj.exe 101 PID 2144 wrote to memory of 1388 2144 ppjdj.exe 101 PID 2144 wrote to memory of 1388 2144 ppjdj.exe 101 PID 1388 wrote to memory of 4664 1388 llxflxl.exe 102 PID 1388 wrote to memory of 4664 1388 llxflxl.exe 102 PID 1388 wrote to memory of 4664 1388 llxflxl.exe 102 PID 4664 wrote to memory of 4948 4664 thbthb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"C:\Users\Admin\AppData\Local\Temp\874dff840b18a7be75b75f9cb07abe86bafb1661173102186ac7842bec414e85.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\fllfxxx.exec:\fllfxxx.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\bnbhtn.exec:\bnbhtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\jvjjd.exec:\jvjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\dvvvd.exec:\dvvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\7httnt.exec:\7httnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\dpvpj.exec:\dpvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\frlffll.exec:\frlffll.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\nnnnhn.exec:\nnnnhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\jvjvj.exec:\jvjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\lxxxrrr.exec:\lxxxrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\pjvjp.exec:\pjvjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\pjjdj.exec:\pjjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\rflflfx.exec:\rflflfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
\??\c:\nhhhhn.exec:\nhhhhn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\1pvjd.exec:\1pvjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\rrlfxfx.exec:\rrlfxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\fxffrrf.exec:\fxffrrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\bbtnbb.exec:\bbtnbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\ppjdj.exec:\ppjdj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\llxflxl.exec:\llxflxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\thbthb.exec:\thbthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\bbbbnn.exec:\bbbbnn.exe23⤵
- Executes dropped EXE
PID:4948 -
\??\c:\ddvjv.exec:\ddvjv.exe24⤵
- Executes dropped EXE
PID:4740 -
\??\c:\ffxfllx.exec:\ffxfllx.exe25⤵
- Executes dropped EXE
PID:3944 -
\??\c:\9ntnhh.exec:\9ntnhh.exe26⤵
- Executes dropped EXE
PID:3756 -
\??\c:\hbbhnb.exec:\hbbhnb.exe27⤵
- Executes dropped EXE
PID:1952 -
\??\c:\1jjdd.exec:\1jjdd.exe28⤵
- Executes dropped EXE
PID:3240 -
\??\c:\tbhhhh.exec:\tbhhhh.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nhtntn.exec:\nhtntn.exe30⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vdddd.exec:\vdddd.exe31⤵
- Executes dropped EXE
PID:3384 -
\??\c:\3rllffx.exec:\3rllffx.exe32⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hbnnhh.exec:\hbnnhh.exe33⤵
- Executes dropped EXE
PID:552 -
\??\c:\7bhhtb.exec:\7bhhtb.exe34⤵
- Executes dropped EXE
PID:4696 -
\??\c:\ppjdv.exec:\ppjdv.exe35⤵
- Executes dropped EXE
PID:2568 -
\??\c:\rlxxffr.exec:\rlxxffr.exe36⤵
- Executes dropped EXE
PID:3252 -
\??\c:\hnttbn.exec:\hnttbn.exe37⤵
- Executes dropped EXE
PID:3692 -
\??\c:\hhbbhh.exec:\hhbbhh.exe38⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdddd.exec:\pdddd.exe39⤵
- Executes dropped EXE
PID:724 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe40⤵
- Executes dropped EXE
PID:4396 -
\??\c:\xlrrllf.exec:\xlrrllf.exe41⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9thhbb.exec:\9thhbb.exe42⤵
- Executes dropped EXE
PID:4944 -
\??\c:\pppdv.exec:\pppdv.exe43⤵
- Executes dropped EXE
PID:384 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe44⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rxllffx.exec:\rxllffx.exe45⤵
- Executes dropped EXE
PID:3648 -
\??\c:\hnnnhh.exec:\hnnnhh.exe46⤵
- Executes dropped EXE
PID:3612 -
\??\c:\9pppp.exec:\9pppp.exe47⤵
- Executes dropped EXE
PID:4404 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe48⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xrrllll.exec:\xrrllll.exe49⤵
- Executes dropped EXE
PID:216 -
\??\c:\9tthhh.exec:\9tthhh.exe50⤵
- Executes dropped EXE
PID:1592 -
\??\c:\bntnnh.exec:\bntnnh.exe51⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pvvvv.exec:\pvvvv.exe52⤵
- Executes dropped EXE
PID:1232 -
\??\c:\ddjpp.exec:\ddjpp.exe53⤵
- Executes dropped EXE
PID:1020 -
\??\c:\9rxxrrr.exec:\9rxxrrr.exe54⤵
- Executes dropped EXE
PID:3916 -
\??\c:\frflfll.exec:\frflfll.exe55⤵
- Executes dropped EXE
PID:180 -
\??\c:\tbbhhh.exec:\tbbhhh.exe56⤵
- Executes dropped EXE
PID:4936 -
\??\c:\1jvvj.exec:\1jvvj.exe57⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pdjjd.exec:\pdjjd.exe58⤵
- Executes dropped EXE
PID:3512 -
\??\c:\frfffll.exec:\frfffll.exe59⤵
- Executes dropped EXE
PID:5052 -
\??\c:\rxfxrfr.exec:\rxfxrfr.exe60⤵
- Executes dropped EXE
PID:3228 -
\??\c:\tttbtb.exec:\tttbtb.exe61⤵
- Executes dropped EXE
PID:1840 -
\??\c:\jjvvv.exec:\jjvvv.exe62⤵
- Executes dropped EXE
PID:3548 -
\??\c:\fxffrrr.exec:\fxffrrr.exe63⤵
- Executes dropped EXE
PID:3532 -
\??\c:\tbbtnn.exec:\tbbtnn.exe64⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bbbtnn.exec:\bbbtnn.exe65⤵
- Executes dropped EXE
PID:3332 -
\??\c:\jjjjd.exec:\jjjjd.exe66⤵PID:3016
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe67⤵PID:3852
-
\??\c:\xlffxrx.exec:\xlffxrx.exe68⤵PID:760
-
\??\c:\thnhbb.exec:\thnhbb.exe69⤵PID:4416
-
\??\c:\dvppp.exec:\dvppp.exe70⤵PID:1072
-
\??\c:\llllfll.exec:\llllfll.exe71⤵PID:4636
-
\??\c:\rlrlllf.exec:\rlrlllf.exe72⤵PID:1240
-
\??\c:\hnbhnh.exec:\hnbhnh.exe73⤵PID:4784
-
\??\c:\hbhntb.exec:\hbhntb.exe74⤵PID:4152
-
\??\c:\dvjjj.exec:\dvjjj.exe75⤵PID:1052
-
\??\c:\xffrlrl.exec:\xffrlrl.exe76⤵PID:3944
-
\??\c:\llrxfff.exec:\llrxfff.exe77⤵PID:1464
-
\??\c:\thbtbb.exec:\thbtbb.exe78⤵PID:1324
-
\??\c:\htnbtt.exec:\htnbtt.exe79⤵PID:3492
-
\??\c:\ddddp.exec:\ddddp.exe80⤵PID:2504
-
\??\c:\lfxrrff.exec:\lfxrrff.exe81⤵PID:3744
-
\??\c:\5ffxfff.exec:\5ffxfff.exe82⤵PID:2472
-
\??\c:\9htnbn.exec:\9htnbn.exe83⤵
- System Location Discovery: System Language Discovery
PID:2512 -
\??\c:\btbbtt.exec:\btbbtt.exe84⤵PID:4376
-
\??\c:\ppvjj.exec:\ppvjj.exe85⤵PID:5084
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe86⤵PID:1320
-
\??\c:\hnttbb.exec:\hnttbb.exe87⤵PID:4024
-
\??\c:\bbhhtn.exec:\bbhhtn.exe88⤵PID:3412
-
\??\c:\jdvpv.exec:\jdvpv.exe89⤵PID:4972
-
\??\c:\jjjdj.exec:\jjjdj.exe90⤵PID:3256
-
\??\c:\xrfxlfr.exec:\xrfxlfr.exe91⤵PID:3224
-
\??\c:\nbtthh.exec:\nbtthh.exe92⤵PID:552
-
\??\c:\nhbttt.exec:\nhbttt.exe93⤵PID:1712
-
\??\c:\vvppp.exec:\vvppp.exe94⤵PID:4192
-
\??\c:\1rxlxxr.exec:\1rxlxxr.exe95⤵PID:3444
-
\??\c:\hntnhh.exec:\hntnhh.exe96⤵PID:1716
-
\??\c:\tnhnbh.exec:\tnhnbh.exe97⤵
- System Location Discovery: System Language Discovery
PID:4700 -
\??\c:\dddpj.exec:\dddpj.exe98⤵PID:5024
-
\??\c:\llffllr.exec:\llffllr.exe99⤵PID:2388
-
\??\c:\bntbnn.exec:\bntbnn.exe100⤵PID:5032
-
\??\c:\bhbthh.exec:\bhbthh.exe101⤵PID:4180
-
\??\c:\dvjdj.exec:\dvjdj.exe102⤵PID:728
-
\??\c:\frffflr.exec:\frffflr.exe103⤵PID:3184
-
\??\c:\bttnnn.exec:\bttnnn.exe104⤵PID:924
-
\??\c:\ppvvv.exec:\ppvvv.exe105⤵PID:1160
-
\??\c:\dppjd.exec:\dppjd.exe106⤵PID:1596
-
\??\c:\fxfxxff.exec:\fxfxxff.exe107⤵PID:844
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe108⤵PID:1176
-
\??\c:\hhbnth.exec:\hhbnth.exe109⤵PID:1012
-
\??\c:\pvjdp.exec:\pvjdp.exe110⤵PID:1668
-
\??\c:\3ppdj.exec:\3ppdj.exe111⤵PID:1140
-
\??\c:\lfxlfxr.exec:\lfxlfxr.exe112⤵PID:372
-
\??\c:\btnhhb.exec:\btnhhb.exe113⤵PID:232
-
\??\c:\ntnhtt.exec:\ntnhtt.exe114⤵PID:436
-
\??\c:\pppvd.exec:\pppvd.exe115⤵PID:4236
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe116⤵PID:2728
-
\??\c:\lrlfffx.exec:\lrlfffx.exe117⤵PID:1488
-
\??\c:\htnhtt.exec:\htnhtt.exe118⤵PID:5052
-
\??\c:\jpdjd.exec:\jpdjd.exe119⤵PID:1604
-
\??\c:\dvvjd.exec:\dvvjd.exe120⤵PID:4432
-
\??\c:\lrrlffr.exec:\lrrlffr.exe121⤵PID:3680
-
\??\c:\tnnnnh.exec:\tnnnnh.exe122⤵PID:4960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-