Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
20-12-2024 07:03
Static task
static1
Behavioral task
behavioral1
Sample
e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe
Resource
win7-20240708-en
General
-
Target
e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe
-
Size
91KB
-
MD5
7770a099fcc9d33227caac3b9f782e30
-
SHA1
a999195d674946804f301b89d9f7a38649f4b2d9
-
SHA256
e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6
-
SHA512
2c62c8600a6fda5274d381167a2c32d9bd68f47d25ddedad9e868c64f1f17043ccc6bc61cfc871fd36759635e049a8f10c6614e9df6ccc0270a27bb8c850d8b6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkBq:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS14
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 26 IoCs
resource yara_rule behavioral2/memory/560-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/560-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/264-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4960 3jpjd.exe 2464 lflflrl.exe 212 thbbtt.exe 264 hbbtnb.exe 4652 ffxflll.exe 3124 tnbhbb.exe 2952 pvpjj.exe 404 5xrrlll.exe 1492 nnbtnh.exe 3520 jvdjj.exe 4328 lffxrfx.exe 4496 9hhbbt.exe 3272 dpvpj.exe 3392 bnnhbb.exe 2712 btnhbt.exe 4992 jdvvd.exe 5052 tnnbhn.exe 4068 pdpjd.exe 1156 fxfffll.exe 3844 nbhnnt.exe 2388 vdvvj.exe 4736 rrxlxxr.exe 388 tnnhnt.exe 4504 lxfrfrr.exe 648 9bthbb.exe 3360 pvpdd.exe 4452 5rlxrlf.exe 1644 tnbbnh.exe 5020 dpppp.exe 4424 pvvvp.exe 924 frxxrrl.exe 3572 ttttbh.exe 1864 jjpdv.exe 3432 lfffrxr.exe 4460 bbbnnn.exe 4884 nbtbtt.exe 952 9ppvv.exe 1280 xxfxllf.exe 2892 hhntnt.exe 3484 vvppj.exe 700 jdjpd.exe 1360 5flllff.exe 3012 ntbhhn.exe 3632 pdjjd.exe 1368 rllllll.exe 4408 hhbbbb.exe 3068 7nttbb.exe 4964 3vdvj.exe 1252 1xxrlrl.exe 2984 3nbbtt.exe 3544 bbnhhn.exe 4760 dvppp.exe 4676 vjvpj.exe 740 fxrfrxf.exe 1308 ffrfrfr.exe 1032 ppjvd.exe 376 llllfll.exe 2868 ffxffrf.exe 4072 nhhhtt.exe 3088 1dvvd.exe 896 jdjdv.exe 4396 rrffxxf.exe 2872 nnnnbh.exe 4280 pdppj.exe -
resource yara_rule behavioral2/memory/560-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/560-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/264-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thtthn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffrrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflfff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bntbth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5frrxff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rfrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hthhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdpdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1rxrflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 560 wrote to memory of 4960 560 e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe 84 PID 560 wrote to memory of 4960 560 e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe 84 PID 560 wrote to memory of 4960 560 e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe 84 PID 4960 wrote to memory of 2464 4960 3jpjd.exe 85 PID 4960 wrote to memory of 2464 4960 3jpjd.exe 85 PID 4960 wrote to memory of 2464 4960 3jpjd.exe 85 PID 2464 wrote to memory of 212 2464 lflflrl.exe 86 PID 2464 wrote to memory of 212 2464 lflflrl.exe 86 PID 2464 wrote to memory of 212 2464 lflflrl.exe 86 PID 212 wrote to memory of 264 212 thbbtt.exe 87 PID 212 wrote to memory of 264 212 thbbtt.exe 87 PID 212 wrote to memory of 264 212 thbbtt.exe 87 PID 264 wrote to memory of 4652 264 hbbtnb.exe 88 PID 264 wrote to memory of 4652 264 hbbtnb.exe 88 PID 264 wrote to memory of 4652 264 hbbtnb.exe 88 PID 4652 wrote to memory of 3124 4652 ffxflll.exe 89 PID 4652 wrote to memory of 3124 4652 ffxflll.exe 89 PID 4652 wrote to memory of 3124 4652 ffxflll.exe 89 PID 3124 wrote to memory of 2952 3124 tnbhbb.exe 90 PID 3124 wrote to memory of 2952 3124 tnbhbb.exe 90 PID 3124 wrote to memory of 2952 3124 tnbhbb.exe 90 PID 2952 wrote to memory of 404 2952 pvpjj.exe 91 PID 2952 wrote to memory of 404 2952 pvpjj.exe 91 PID 2952 wrote to memory of 404 2952 pvpjj.exe 91 PID 404 wrote to memory of 1492 404 5xrrlll.exe 92 PID 404 wrote to memory of 1492 404 5xrrlll.exe 92 PID 404 wrote to memory of 1492 404 5xrrlll.exe 92 PID 1492 wrote to memory of 3520 1492 nnbtnh.exe 93 PID 1492 wrote to memory of 3520 1492 nnbtnh.exe 93 PID 1492 wrote to memory of 3520 1492 nnbtnh.exe 93 PID 3520 wrote to memory of 4328 3520 jvdjj.exe 94 PID 3520 wrote to memory of 4328 3520 jvdjj.exe 94 PID 3520 wrote to memory of 4328 3520 jvdjj.exe 94 PID 4328 wrote to memory of 4496 4328 lffxrfx.exe 95 PID 4328 wrote to memory of 4496 4328 lffxrfx.exe 95 PID 4328 wrote to memory of 4496 4328 lffxrfx.exe 95 PID 4496 wrote to memory of 3272 4496 9hhbbt.exe 96 PID 4496 wrote to memory of 3272 4496 9hhbbt.exe 96 PID 4496 wrote to memory of 3272 4496 9hhbbt.exe 96 PID 3272 wrote to memory of 3392 3272 dpvpj.exe 97 PID 3272 wrote to memory of 3392 3272 dpvpj.exe 97 PID 3272 wrote to memory of 3392 3272 dpvpj.exe 97 PID 3392 wrote to memory of 2712 3392 bnnhbb.exe 98 PID 3392 wrote to memory of 2712 3392 bnnhbb.exe 98 PID 3392 wrote to memory of 2712 3392 bnnhbb.exe 98 PID 2712 wrote to memory of 4992 2712 btnhbt.exe 99 PID 2712 wrote to memory of 4992 2712 btnhbt.exe 99 PID 2712 wrote to memory of 4992 2712 btnhbt.exe 99 PID 4992 wrote to memory of 5052 4992 jdvvd.exe 100 PID 4992 wrote to memory of 5052 4992 jdvvd.exe 100 PID 4992 wrote to memory of 5052 4992 jdvvd.exe 100 PID 5052 wrote to memory of 4068 5052 tnnbhn.exe 101 PID 5052 wrote to memory of 4068 5052 tnnbhn.exe 101 PID 5052 wrote to memory of 4068 5052 tnnbhn.exe 101 PID 4068 wrote to memory of 1156 4068 pdpjd.exe 102 PID 4068 wrote to memory of 1156 4068 pdpjd.exe 102 PID 4068 wrote to memory of 1156 4068 pdpjd.exe 102 PID 1156 wrote to memory of 3844 1156 fxfffll.exe 103 PID 1156 wrote to memory of 3844 1156 fxfffll.exe 103 PID 1156 wrote to memory of 3844 1156 fxfffll.exe 103 PID 3844 wrote to memory of 2388 3844 nbhnnt.exe 104 PID 3844 wrote to memory of 2388 3844 nbhnnt.exe 104 PID 3844 wrote to memory of 2388 3844 nbhnnt.exe 104 PID 2388 wrote to memory of 4736 2388 vdvvj.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe"C:\Users\Admin\AppData\Local\Temp\e8e5d4ccef085d9a4472b8d3104e49d8a64ea9f760a1e0fafa5f1ec344b78bc6N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\3jpjd.exec:\3jpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lflflrl.exec:\lflflrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\thbbtt.exec:\thbbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\hbbtnb.exec:\hbbtnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
\??\c:\ffxflll.exec:\ffxflll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\tnbhbb.exec:\tnbhbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\pvpjj.exec:\pvpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\5xrrlll.exec:\5xrrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\nnbtnh.exec:\nnbtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\jvdjj.exec:\jvdjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\lffxrfx.exec:\lffxrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\9hhbbt.exec:\9hhbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\dpvpj.exec:\dpvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\bnnhbb.exec:\bnnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\btnhbt.exec:\btnhbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\jdvvd.exec:\jdvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\tnnbhn.exec:\tnnbhn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\pdpjd.exec:\pdpjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\fxfffll.exec:\fxfffll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\nbhnnt.exec:\nbhnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\vdvvj.exec:\vdvvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rrxlxxr.exec:\rrxlxxr.exe23⤵
- Executes dropped EXE
PID:4736 -
\??\c:\tnnhnt.exec:\tnnhnt.exe24⤵
- Executes dropped EXE
PID:388 -
\??\c:\lxfrfrr.exec:\lxfrfrr.exe25⤵
- Executes dropped EXE
PID:4504 -
\??\c:\9bthbb.exec:\9bthbb.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\pvpdd.exec:\pvpdd.exe27⤵
- Executes dropped EXE
PID:3360 -
\??\c:\5rlxrlf.exec:\5rlxrlf.exe28⤵
- Executes dropped EXE
PID:4452 -
\??\c:\tnbbnh.exec:\tnbbnh.exe29⤵
- Executes dropped EXE
PID:1644 -
\??\c:\dpppp.exec:\dpppp.exe30⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pvvvp.exec:\pvvvp.exe31⤵
- Executes dropped EXE
PID:4424 -
\??\c:\frxxrrl.exec:\frxxrrl.exe32⤵
- Executes dropped EXE
PID:924 -
\??\c:\ttttbh.exec:\ttttbh.exe33⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jjpdv.exec:\jjpdv.exe34⤵
- Executes dropped EXE
PID:1864 -
\??\c:\lfffrxr.exec:\lfffrxr.exe35⤵
- Executes dropped EXE
PID:3432 -
\??\c:\bbbnnn.exec:\bbbnnn.exe36⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nbtbtt.exec:\nbtbtt.exe37⤵
- Executes dropped EXE
PID:4884 -
\??\c:\9ppvv.exec:\9ppvv.exe38⤵
- Executes dropped EXE
PID:952 -
\??\c:\xxfxllf.exec:\xxfxllf.exe39⤵
- Executes dropped EXE
PID:1280 -
\??\c:\hhntnt.exec:\hhntnt.exe40⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvppj.exec:\vvppj.exe41⤵
- Executes dropped EXE
PID:3484 -
\??\c:\jdjpd.exec:\jdjpd.exe42⤵
- Executes dropped EXE
PID:700 -
\??\c:\5flllff.exec:\5flllff.exe43⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ntbhhn.exec:\ntbhhn.exe44⤵
- Executes dropped EXE
PID:3012 -
\??\c:\pdjjd.exec:\pdjjd.exe45⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rllllll.exec:\rllllll.exe46⤵
- Executes dropped EXE
PID:1368 -
\??\c:\hhbbbb.exec:\hhbbbb.exe47⤵
- Executes dropped EXE
PID:4408 -
\??\c:\7nttbb.exec:\7nttbb.exe48⤵
- Executes dropped EXE
PID:3068 -
\??\c:\3vdvj.exec:\3vdvj.exe49⤵
- Executes dropped EXE
PID:4964 -
\??\c:\1xxrlrl.exec:\1xxrlrl.exe50⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3nbbtt.exec:\3nbbtt.exe51⤵
- Executes dropped EXE
PID:2984 -
\??\c:\bbnhhn.exec:\bbnhhn.exe52⤵
- Executes dropped EXE
PID:3544 -
\??\c:\dvppp.exec:\dvppp.exe53⤵
- Executes dropped EXE
PID:4760 -
\??\c:\vjvpj.exec:\vjvpj.exe54⤵
- Executes dropped EXE
PID:4676 -
\??\c:\fxrfrxf.exec:\fxrfrxf.exe55⤵
- Executes dropped EXE
PID:740 -
\??\c:\ffrfrfr.exec:\ffrfrfr.exe56⤵
- Executes dropped EXE
PID:1308 -
\??\c:\ppjvd.exec:\ppjvd.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\llllfll.exec:\llllfll.exe58⤵
- Executes dropped EXE
PID:376 -
\??\c:\ffxffrf.exec:\ffxffrf.exe59⤵
- Executes dropped EXE
PID:2868 -
\??\c:\nhhhtt.exec:\nhhhtt.exe60⤵
- Executes dropped EXE
PID:4072 -
\??\c:\1dvvd.exec:\1dvvd.exe61⤵
- Executes dropped EXE
PID:3088 -
\??\c:\jdjdv.exec:\jdjdv.exe62⤵
- Executes dropped EXE
PID:896 -
\??\c:\rrffxxf.exec:\rrffxxf.exe63⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4396 -
\??\c:\nnnnbh.exec:\nnnnbh.exe64⤵
- Executes dropped EXE
PID:2872 -
\??\c:\pdppj.exec:\pdppj.exe65⤵
- Executes dropped EXE
PID:4280 -
\??\c:\rlllxff.exec:\rlllxff.exe66⤵PID:1920
-
\??\c:\3thnnt.exec:\3thnnt.exe67⤵PID:432
-
\??\c:\pvvpv.exec:\pvvpv.exe68⤵PID:4472
-
\??\c:\xrxxxrf.exec:\xrxxxrf.exe69⤵PID:3100
-
\??\c:\ntthhb.exec:\ntthhb.exe70⤵PID:460
-
\??\c:\nnnhhn.exec:\nnnhhn.exe71⤵PID:2704
-
\??\c:\ppjvv.exec:\ppjvv.exe72⤵PID:1608
-
\??\c:\rflfxxr.exec:\rflfxxr.exe73⤵PID:4824
-
\??\c:\3nbtbh.exec:\3nbtbh.exe74⤵PID:4568
-
\??\c:\nbnhhh.exec:\nbnhhh.exe75⤵PID:2356
-
\??\c:\3lxxrrl.exec:\3lxxrrl.exe76⤵PID:3820
-
\??\c:\rrlxfxf.exec:\rrlxfxf.exe77⤵PID:1180
-
\??\c:\tnhbth.exec:\tnhbth.exe78⤵PID:5092
-
\??\c:\jvjjp.exec:\jvjjp.exe79⤵PID:4808
-
\??\c:\7frfllf.exec:\7frfllf.exe80⤵PID:488
-
\??\c:\3bhhbh.exec:\3bhhbh.exe81⤵PID:2196
-
\??\c:\dvvjv.exec:\dvvjv.exe82⤵PID:3384
-
\??\c:\7xfffll.exec:\7xfffll.exe83⤵PID:4180
-
\??\c:\hhhnbh.exec:\hhhnbh.exe84⤵PID:4708
-
\??\c:\pvvdv.exec:\pvvdv.exe85⤵PID:2800
-
\??\c:\ddddd.exec:\ddddd.exe86⤵PID:3852
-
\??\c:\7pdvp.exec:\7pdvp.exe87⤵PID:2912
-
\??\c:\lrxrlll.exec:\lrxrlll.exe88⤵PID:4664
-
\??\c:\vvvvp.exec:\vvvvp.exe89⤵PID:3888
-
\??\c:\djvjv.exec:\djvjv.exe90⤵PID:4728
-
\??\c:\fxxrlll.exec:\fxxrlll.exe91⤵PID:3572
-
\??\c:\btbtbt.exec:\btbtbt.exe92⤵PID:1864
-
\??\c:\ddpdj.exec:\ddpdj.exe93⤵PID:2136
-
\??\c:\7xxxxrr.exec:\7xxxxrr.exe94⤵PID:2072
-
\??\c:\nnnnhh.exec:\nnnnhh.exe95⤵PID:4884
-
\??\c:\pjvpp.exec:\pjvpp.exe96⤵PID:2360
-
\??\c:\jdpvp.exec:\jdpvp.exe97⤵PID:4048
-
\??\c:\9lrfrlr.exec:\9lrfrlr.exe98⤵PID:2892
-
\??\c:\1tnthh.exec:\1tnthh.exe99⤵PID:2076
-
\??\c:\pvvdp.exec:\pvvdp.exe100⤵PID:3488
-
\??\c:\xrfrffr.exec:\xrfrffr.exe101⤵PID:1628
-
\??\c:\ntnbnb.exec:\ntnbnb.exe102⤵PID:4388
-
\??\c:\hnnnth.exec:\hnnnth.exe103⤵PID:2300
-
\??\c:\jjpjd.exec:\jjpjd.exe104⤵PID:3008
-
\??\c:\xrlflfl.exec:\xrlflfl.exe105⤵PID:560
-
\??\c:\bbhhhh.exec:\bbhhhh.exe106⤵PID:1852
-
\??\c:\vvvpp.exec:\vvvpp.exe107⤵PID:3028
-
\??\c:\jvvpj.exec:\jvvpj.exe108⤵PID:1252
-
\??\c:\3rxrllf.exec:\3rxrllf.exe109⤵PID:1788
-
\??\c:\ntbhhh.exec:\ntbhhh.exe110⤵PID:2236
-
\??\c:\nthbbt.exec:\nthbbt.exe111⤵PID:4760
-
\??\c:\jddvp.exec:\jddvp.exe112⤵PID:4676
-
\??\c:\llxlxrx.exec:\llxlxrx.exe113⤵PID:2784
-
\??\c:\7bbbbb.exec:\7bbbbb.exe114⤵PID:3124
-
\??\c:\dvvvj.exec:\dvvvj.exe115⤵PID:1032
-
\??\c:\nbnntn.exec:\nbnntn.exe116⤵PID:1124
-
\??\c:\ddjdv.exec:\ddjdv.exe117⤵PID:2868
-
\??\c:\jvvvv.exec:\jvvvv.exe118⤵PID:4224
-
\??\c:\flffxxx.exec:\flffxxx.exe119⤵PID:3472
-
\??\c:\9hbnbh.exec:\9hbnbh.exe120⤵PID:896
-
\??\c:\jdpdj.exec:\jdpdj.exe121⤵PID:1120
-
\??\c:\jpvpv.exec:\jpvpv.exe122⤵PID:4812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-