Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 09:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b540de8b959a83b7eb41a847df63eff0N.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
120 seconds
General
-
Target
b540de8b959a83b7eb41a847df63eff0N.exe
-
Size
151KB
-
MD5
b540de8b959a83b7eb41a847df63eff0
-
SHA1
4c86ea27c659b074c0e3828fce0e333214750c0d
-
SHA256
6e710baa1c8179377512abf70491b75765d871e39669bcfc09faa123ac789fe5
-
SHA512
9c8e1e26af5843c74bd5d7487d8a7e4a4a74dec8cc7af887a92f967a1be0c2f9a92055ab88233cfe758f79de43057990477c768ed194eceb6a0f0489054b357b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo7LAIRUohDmRG08fKkZEU5hkVaqaK6qa50iKVb:n3C9BRo/AIuuOmfDZEU5OVFii
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1768-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1004-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9fxfrfl.exetbbthb.exepdjdv.exelrxlfxl.exenhbttn.exevjjvj.exelxxrrll.exeffxfrxl.exevpdjp.exellfrlfr.exenhhnth.exe5pjdp.exe7lxxxrl.exe3bbtbb.exejdvpj.exerlffrrl.exe5llflfx.exehhbnhb.exe3pjvv.exerllfrlr.exebthhtn.exevvdpd.exexrrfxrr.exelfxxrfr.exehnbtth.exejdjjp.exerlrrrxf.exettbbbh.exejdvjd.exerrxrllr.exe3thtnh.exevjpvp.exejvjvv.exelxfrlfr.exelllfxxf.exettnhhh.exejdddd.exefrxrrll.exefxfxlfr.exehbbnnn.exe9ppjp.exe5ddpd.exe9rlfrlf.exethnbtn.exedjdpv.exe9lfrfxr.exethtthb.exehbhthb.exe7vvpd.exe3dpvj.exe1rrlxff.exenbhbhh.exebbhbnh.exeppddp.exefflfllf.exelxlxlxr.exehbbtnh.exetttnnh.exe5ppvp.exexrfrfxx.exebnttnt.exetbbbtn.exejjvpv.exerllxllr.exepid process 2820 9fxfrfl.exe 1512 tbbthb.exe 4956 pdjdv.exe 512 lrxlfxl.exe 944 nhbttn.exe 2692 vjjvj.exe 3836 lxxrrll.exe 836 ffxfrxl.exe 5056 vpdjp.exe 2624 llfrlfr.exe 4688 nhhnth.exe 4456 5pjdp.exe 3316 7lxxxrl.exe 1944 3bbtbb.exe 2128 jdvpj.exe 1608 rlffrrl.exe 1196 5llflfx.exe 3128 hhbnhb.exe 3380 3pjvv.exe 3604 rllfrlr.exe 4892 bthhtn.exe 2688 vvdpd.exe 388 xrrfxrr.exe 3708 lfxxrfr.exe 1900 hnbtth.exe 1772 jdjjp.exe 5036 rlrrrxf.exe 2864 ttbbbh.exe 4868 jdvjd.exe 1004 rrxrllr.exe 2460 3thtnh.exe 552 vjpvp.exe 680 jvjvv.exe 1044 lxfrlfr.exe 4280 lllfxxf.exe 1348 ttnhhh.exe 5072 jdddd.exe 1616 frxrrll.exe 3540 fxfxlfr.exe 184 hbbnnn.exe 3148 9ppjp.exe 3156 5ddpd.exe 1508 9rlfrlf.exe 520 thnbtn.exe 4244 djdpv.exe 220 9lfrfxr.exe 2416 thtthb.exe 2960 hbhthb.exe 648 7vvpd.exe 2976 3dpvj.exe 4100 1rrlxff.exe 884 nbhbhh.exe 1036 bbhbnh.exe 4968 ppddp.exe 2560 fflfllf.exe 2452 lxlxlxr.exe 4620 hbbtnh.exe 3748 tttnnh.exe 4084 5ppvp.exe 3088 xrfrfxx.exe 3928 bnttnt.exe 2780 tbbbtn.exe 1220 jjvpv.exe 3952 rllxllr.exe -
Processes:
resource yara_rule behavioral2/memory/1768-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1004-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
rrlrffl.exerffxlxr.exenbbtnn.exethnnnn.exevjpjv.exefxxxfxf.exefrxlxxx.exenhnnhh.exenbttnt.exejjvpv.exedvvvj.exepjjdv.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrlrffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffxlxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbttnt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjvpv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b540de8b959a83b7eb41a847df63eff0N.exe9fxfrfl.exetbbthb.exepdjdv.exelrxlfxl.exenhbttn.exevjjvj.exelxxrrll.exeffxfrxl.exevpdjp.exellfrlfr.exenhhnth.exe5pjdp.exe7lxxxrl.exe3bbtbb.exejdvpj.exerlffrrl.exe5llflfx.exehhbnhb.exe3pjvv.exerllfrlr.exebthhtn.exedescription pid process target process PID 1768 wrote to memory of 2820 1768 b540de8b959a83b7eb41a847df63eff0N.exe 9fxfrfl.exe PID 1768 wrote to memory of 2820 1768 b540de8b959a83b7eb41a847df63eff0N.exe 9fxfrfl.exe PID 1768 wrote to memory of 2820 1768 b540de8b959a83b7eb41a847df63eff0N.exe 9fxfrfl.exe PID 2820 wrote to memory of 1512 2820 9fxfrfl.exe tbbthb.exe PID 2820 wrote to memory of 1512 2820 9fxfrfl.exe tbbthb.exe PID 2820 wrote to memory of 1512 2820 9fxfrfl.exe tbbthb.exe PID 1512 wrote to memory of 4956 1512 tbbthb.exe pdjdv.exe PID 1512 wrote to memory of 4956 1512 tbbthb.exe pdjdv.exe PID 1512 wrote to memory of 4956 1512 tbbthb.exe pdjdv.exe PID 4956 wrote to memory of 512 4956 pdjdv.exe lrxlfxl.exe PID 4956 wrote to memory of 512 4956 pdjdv.exe lrxlfxl.exe PID 4956 wrote to memory of 512 4956 pdjdv.exe lrxlfxl.exe PID 512 wrote to memory of 944 512 lrxlfxl.exe nhbttn.exe PID 512 wrote to memory of 944 512 lrxlfxl.exe nhbttn.exe PID 512 wrote to memory of 944 512 lrxlfxl.exe nhbttn.exe PID 944 wrote to memory of 2692 944 nhbttn.exe vjjvj.exe PID 944 wrote to memory of 2692 944 nhbttn.exe vjjvj.exe PID 944 wrote to memory of 2692 944 nhbttn.exe vjjvj.exe PID 2692 wrote to memory of 3836 2692 vjjvj.exe lxxrrll.exe PID 2692 wrote to memory of 3836 2692 vjjvj.exe lxxrrll.exe PID 2692 wrote to memory of 3836 2692 vjjvj.exe lxxrrll.exe PID 3836 wrote to memory of 836 3836 lxxrrll.exe ffxfrxl.exe PID 3836 wrote to memory of 836 3836 lxxrrll.exe ffxfrxl.exe PID 3836 wrote to memory of 836 3836 lxxrrll.exe ffxfrxl.exe PID 836 wrote to memory of 5056 836 ffxfrxl.exe vpdjp.exe PID 836 wrote to memory of 5056 836 ffxfrxl.exe vpdjp.exe PID 836 wrote to memory of 5056 836 ffxfrxl.exe vpdjp.exe PID 5056 wrote to memory of 2624 5056 vpdjp.exe llfrlfr.exe PID 5056 wrote to memory of 2624 5056 vpdjp.exe llfrlfr.exe PID 5056 wrote to memory of 2624 5056 vpdjp.exe llfrlfr.exe PID 2624 wrote to memory of 4688 2624 llfrlfr.exe nhhnth.exe PID 2624 wrote to memory of 4688 2624 llfrlfr.exe nhhnth.exe PID 2624 wrote to memory of 4688 2624 llfrlfr.exe nhhnth.exe PID 4688 wrote to memory of 4456 4688 nhhnth.exe 5pjdp.exe PID 4688 wrote to memory of 4456 4688 nhhnth.exe 5pjdp.exe PID 4688 wrote to memory of 4456 4688 nhhnth.exe 5pjdp.exe PID 4456 wrote to memory of 3316 4456 5pjdp.exe 7lxxxrl.exe PID 4456 wrote to memory of 3316 4456 5pjdp.exe 7lxxxrl.exe PID 4456 wrote to memory of 3316 4456 5pjdp.exe 7lxxxrl.exe PID 3316 wrote to memory of 1944 3316 7lxxxrl.exe 3bbtbb.exe PID 3316 wrote to memory of 1944 3316 7lxxxrl.exe 3bbtbb.exe PID 3316 wrote to memory of 1944 3316 7lxxxrl.exe 3bbtbb.exe PID 1944 wrote to memory of 2128 1944 3bbtbb.exe jdvpj.exe PID 1944 wrote to memory of 2128 1944 3bbtbb.exe jdvpj.exe PID 1944 wrote to memory of 2128 1944 3bbtbb.exe jdvpj.exe PID 2128 wrote to memory of 1608 2128 jdvpj.exe rlffrrl.exe PID 2128 wrote to memory of 1608 2128 jdvpj.exe rlffrrl.exe PID 2128 wrote to memory of 1608 2128 jdvpj.exe rlffrrl.exe PID 1608 wrote to memory of 1196 1608 rlffrrl.exe 5llflfx.exe PID 1608 wrote to memory of 1196 1608 rlffrrl.exe 5llflfx.exe PID 1608 wrote to memory of 1196 1608 rlffrrl.exe 5llflfx.exe PID 1196 wrote to memory of 3128 1196 5llflfx.exe hhbnhb.exe PID 1196 wrote to memory of 3128 1196 5llflfx.exe hhbnhb.exe PID 1196 wrote to memory of 3128 1196 5llflfx.exe hhbnhb.exe PID 3128 wrote to memory of 3380 3128 hhbnhb.exe 3pjvv.exe PID 3128 wrote to memory of 3380 3128 hhbnhb.exe 3pjvv.exe PID 3128 wrote to memory of 3380 3128 hhbnhb.exe 3pjvv.exe PID 3380 wrote to memory of 3604 3380 3pjvv.exe rllfrlr.exe PID 3380 wrote to memory of 3604 3380 3pjvv.exe rllfrlr.exe PID 3380 wrote to memory of 3604 3380 3pjvv.exe rllfrlr.exe PID 3604 wrote to memory of 4892 3604 rllfrlr.exe bthhtn.exe PID 3604 wrote to memory of 4892 3604 rllfrlr.exe bthhtn.exe PID 3604 wrote to memory of 4892 3604 rllfrlr.exe bthhtn.exe PID 4892 wrote to memory of 2688 4892 bthhtn.exe vvdpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b540de8b959a83b7eb41a847df63eff0N.exe"C:\Users\Admin\AppData\Local\Temp\b540de8b959a83b7eb41a847df63eff0N.exe"1⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\9fxfrfl.exec:\9fxfrfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\tbbthb.exec:\tbbthb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\pdjdv.exec:\pdjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lrxlfxl.exec:\lrxlfxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhbttn.exec:\nhbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vjjvj.exec:\vjjvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\lxxrrll.exec:\lxxrrll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vpdjp.exec:\vpdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\llfrlfr.exec:\llfrlfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\nhhnth.exec:\nhhnth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5pjdp.exec:\5pjdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\7lxxxrl.exec:\7lxxxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3bbtbb.exec:\3bbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\jdvpj.exec:\jdvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rlffrrl.exec:\rlffrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\5llflfx.exec:\5llflfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\hhbnhb.exec:\hhbnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\3pjvv.exec:\3pjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\rllfrlr.exec:\rllfrlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\bthhtn.exec:\bthhtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
\??\c:\vvdpd.exec:\vvdpd.exe23⤵
- Executes dropped EXE
-
\??\c:\xrrfxrr.exec:\xrrfxrr.exe24⤵
- Executes dropped EXE
-
\??\c:\lfxxrfr.exec:\lfxxrfr.exe25⤵
- Executes dropped EXE
-
\??\c:\hnbtth.exec:\hnbtth.exe26⤵
- Executes dropped EXE
-
\??\c:\jdjjp.exec:\jdjjp.exe27⤵
- Executes dropped EXE
-
\??\c:\rlrrrxf.exec:\rlrrrxf.exe28⤵
- Executes dropped EXE
-
\??\c:\ttbbbh.exec:\ttbbbh.exe29⤵
- Executes dropped EXE
-
\??\c:\jdvjd.exec:\jdvjd.exe30⤵
- Executes dropped EXE
-
\??\c:\rrxrllr.exec:\rrxrllr.exe31⤵
- Executes dropped EXE
-
\??\c:\3thtnh.exec:\3thtnh.exe32⤵
- Executes dropped EXE
-
\??\c:\vjpvp.exec:\vjpvp.exe33⤵
- Executes dropped EXE
-
\??\c:\jvjvv.exec:\jvjvv.exe34⤵
- Executes dropped EXE
-
\??\c:\lxfrlfr.exec:\lxfrlfr.exe35⤵
- Executes dropped EXE
-
\??\c:\lllfxxf.exec:\lllfxxf.exe36⤵
- Executes dropped EXE
-
\??\c:\ttnhhh.exec:\ttnhhh.exe37⤵
- Executes dropped EXE
-
\??\c:\jdddd.exec:\jdddd.exe38⤵
- Executes dropped EXE
-
\??\c:\frxrrll.exec:\frxrrll.exe39⤵
- Executes dropped EXE
-
\??\c:\fxfxlfr.exec:\fxfxlfr.exe40⤵
- Executes dropped EXE
-
\??\c:\hbbnnn.exec:\hbbnnn.exe41⤵
- Executes dropped EXE
-
\??\c:\9ppjp.exec:\9ppjp.exe42⤵
- Executes dropped EXE
-
\??\c:\5ddpd.exec:\5ddpd.exe43⤵
- Executes dropped EXE
-
\??\c:\9rlfrlf.exec:\9rlfrlf.exe44⤵
- Executes dropped EXE
-
\??\c:\thnbtn.exec:\thnbtn.exe45⤵
- Executes dropped EXE
-
\??\c:\djdpv.exec:\djdpv.exe46⤵
- Executes dropped EXE
-
\??\c:\9lfrfxr.exec:\9lfrfxr.exe47⤵
- Executes dropped EXE
-
\??\c:\thtthb.exec:\thtthb.exe48⤵
- Executes dropped EXE
-
\??\c:\hbhthb.exec:\hbhthb.exe49⤵
- Executes dropped EXE
-
\??\c:\7vvpd.exec:\7vvpd.exe50⤵
- Executes dropped EXE
-
\??\c:\3dpvj.exec:\3dpvj.exe51⤵
- Executes dropped EXE
-
\??\c:\1rrlxff.exec:\1rrlxff.exe52⤵
- Executes dropped EXE
-
\??\c:\nbhbhh.exec:\nbhbhh.exe53⤵
- Executes dropped EXE
-
\??\c:\bbhbnh.exec:\bbhbnh.exe54⤵
- Executes dropped EXE
-
\??\c:\ppddp.exec:\ppddp.exe55⤵
- Executes dropped EXE
-
\??\c:\fflfllf.exec:\fflfllf.exe56⤵
- Executes dropped EXE
-
\??\c:\lxlxlxr.exec:\lxlxlxr.exe57⤵
- Executes dropped EXE
-
\??\c:\hbbtnh.exec:\hbbtnh.exe58⤵
- Executes dropped EXE
-
\??\c:\tttnnh.exec:\tttnnh.exe59⤵
- Executes dropped EXE
-
\??\c:\5ppvp.exec:\5ppvp.exe60⤵
- Executes dropped EXE
-
\??\c:\xrfrfxx.exec:\xrfrfxx.exe61⤵
- Executes dropped EXE
-
\??\c:\bnttnt.exec:\bnttnt.exe62⤵
- Executes dropped EXE
-
\??\c:\tbbbtn.exec:\tbbbtn.exe63⤵
- Executes dropped EXE
-
\??\c:\jjvpv.exec:\jjvpv.exe64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\rllxllr.exec:\rllxllr.exe65⤵
- Executes dropped EXE
-
\??\c:\3xxrlxf.exec:\3xxrlxf.exe66⤵
-
\??\c:\hhttnh.exec:\hhttnh.exe67⤵
-
\??\c:\7bhbbt.exec:\7bhbbt.exe68⤵
-
\??\c:\dppjv.exec:\dppjv.exe69⤵
-
\??\c:\flrrrff.exec:\flrrrff.exe70⤵
-
\??\c:\xfrrxrx.exec:\xfrrxrx.exe71⤵
-
\??\c:\hbnbhb.exec:\hbnbhb.exe72⤵
-
\??\c:\jjddd.exec:\jjddd.exe73⤵
-
\??\c:\llflxrr.exec:\llflxrr.exe74⤵
-
\??\c:\xxfrxlf.exec:\xxfrxlf.exe75⤵
-
\??\c:\nhnbtn.exec:\nhnbtn.exe76⤵
-
\??\c:\pdvdj.exec:\pdvdj.exe77⤵
-
\??\c:\dvvpv.exec:\dvvpv.exe78⤵
-
\??\c:\fxrllrx.exec:\fxrllrx.exe79⤵
-
\??\c:\1bhbnb.exec:\1bhbnb.exe80⤵
-
\??\c:\7bthtt.exec:\7bthtt.exe81⤵
-
\??\c:\jpddp.exec:\jpddp.exe82⤵
-
\??\c:\5lrlfxr.exec:\5lrlfxr.exe83⤵
-
\??\c:\xrrlllr.exec:\xrrlllr.exe84⤵
-
\??\c:\7bhbnb.exec:\7bhbnb.exe85⤵
-
\??\c:\dvvvd.exec:\dvvvd.exe86⤵
-
\??\c:\jjdjv.exec:\jjdjv.exe87⤵
-
\??\c:\rffxlrr.exec:\rffxlrr.exe88⤵
-
\??\c:\rxxlffr.exec:\rxxlffr.exe89⤵
-
\??\c:\bbtnhh.exec:\bbtnhh.exe90⤵
-
\??\c:\dppjv.exec:\dppjv.exe91⤵
-
\??\c:\3pdvv.exec:\3pdvv.exe92⤵
-
\??\c:\rxxxflr.exec:\rxxxflr.exe93⤵
-
\??\c:\thttnh.exec:\thttnh.exe94⤵
-
\??\c:\thbthb.exec:\thbthb.exe95⤵
-
\??\c:\7dddp.exec:\7dddp.exe96⤵
-
\??\c:\fllffff.exec:\fllffff.exe97⤵
-
\??\c:\5frxlxx.exec:\5frxlxx.exe98⤵
-
\??\c:\thhbtt.exec:\thhbtt.exe99⤵
-
\??\c:\jpppv.exec:\jpppv.exe100⤵
-
\??\c:\vpjdd.exec:\vpjdd.exe101⤵
-
\??\c:\rlfxxlf.exec:\rlfxxlf.exe102⤵
-
\??\c:\rxrrlll.exec:\rxrrlll.exe103⤵
-
\??\c:\btbhnt.exec:\btbhnt.exe104⤵
-
\??\c:\pvvpv.exec:\pvvpv.exe105⤵
-
\??\c:\1jpdj.exec:\1jpdj.exe106⤵
-
\??\c:\xrxrrrf.exec:\xrxrrrf.exe107⤵
-
\??\c:\xrfrrfx.exec:\xrfrrfx.exe108⤵
-
\??\c:\5tbnhb.exec:\5tbnhb.exe109⤵
-
\??\c:\1bbbnh.exec:\1bbbnh.exe110⤵
-
\??\c:\1dddv.exec:\1dddv.exe111⤵
-
\??\c:\pddvp.exec:\pddvp.exe112⤵
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe113⤵
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe114⤵
-
\??\c:\rfffffx.exec:\rfffffx.exe115⤵
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe116⤵
-
\??\c:\hbbtnn.exec:\hbbtnn.exe117⤵
-
\??\c:\nhtbnb.exec:\nhtbnb.exe118⤵
-
\??\c:\vvddd.exec:\vvddd.exe119⤵
-
\??\c:\rlxlflx.exec:\rlxlflx.exe120⤵
-
\??\c:\flrrrrl.exec:\flrrrrl.exe121⤵
-
\??\c:\lfrlxlf.exec:\lfrlxlf.exe122⤵
-
\??\c:\btbbbt.exec:\btbbbt.exe123⤵
-
\??\c:\7pdpv.exec:\7pdpv.exe124⤵
-
\??\c:\frlfrlr.exec:\frlfrlr.exe125⤵
-
\??\c:\tnnhhh.exec:\tnnhhh.exe126⤵
-
\??\c:\bnhbnt.exec:\bnhbnt.exe127⤵
-
\??\c:\7jjdp.exec:\7jjdp.exe128⤵
-
\??\c:\jdpjd.exec:\jdpjd.exe129⤵
-
\??\c:\lfrrffx.exec:\lfrrffx.exe130⤵
-
\??\c:\xfxrlfx.exec:\xfxrlfx.exe131⤵
-
\??\c:\tnhthb.exec:\tnhthb.exe132⤵
-
\??\c:\bttntb.exec:\bttntb.exe133⤵
-
\??\c:\pvpjd.exec:\pvpjd.exe134⤵
-
\??\c:\pjpjv.exec:\pjpjv.exe135⤵
-
\??\c:\9rrlxrl.exec:\9rrlxrl.exe136⤵
-
\??\c:\xfflfrf.exec:\xfflfrf.exe137⤵
-
\??\c:\bhthbn.exec:\bhthbn.exe138⤵
-
\??\c:\ttbtnn.exec:\ttbtnn.exe139⤵
-
\??\c:\vpvvj.exec:\vpvvj.exe140⤵
-
\??\c:\5rrfrlx.exec:\5rrfrlx.exe141⤵
-
\??\c:\5rrfxrl.exec:\5rrfxrl.exe142⤵
-
\??\c:\thhtht.exec:\thhtht.exe143⤵
-
\??\c:\5vjpd.exec:\5vjpd.exe144⤵
-
\??\c:\djjdd.exec:\djjdd.exe145⤵
-
\??\c:\1xxrllf.exec:\1xxrllf.exe146⤵
-
\??\c:\flflrrf.exec:\flflrrf.exe147⤵
-
\??\c:\thbntn.exec:\thbntn.exe148⤵
-
\??\c:\vpjvj.exec:\vpjvj.exe149⤵
-
\??\c:\ppjvp.exec:\ppjvp.exe150⤵
-
\??\c:\flrlxxr.exec:\flrlxxr.exe151⤵
-
\??\c:\3bbtnn.exec:\3bbtnn.exe152⤵
-
\??\c:\nhnbhb.exec:\nhnbhb.exe153⤵
-
\??\c:\1jpdd.exec:\1jpdd.exe154⤵
-
\??\c:\xrrfrlr.exec:\xrrfrlr.exe155⤵
-
\??\c:\7rllffr.exec:\7rllffr.exe156⤵
-
\??\c:\5hnhtt.exec:\5hnhtt.exe157⤵
-
\??\c:\pddjv.exec:\pddjv.exe158⤵
-
\??\c:\dvpvv.exec:\dvpvv.exe159⤵
-
\??\c:\7rllxxr.exec:\7rllxxr.exe160⤵
-
\??\c:\ntnhtn.exec:\ntnhtn.exe161⤵
-
\??\c:\bbnhtn.exec:\bbnhtn.exe162⤵
-
\??\c:\1jpjp.exec:\1jpjp.exe163⤵
-
\??\c:\ppdpj.exec:\ppdpj.exe164⤵
-
\??\c:\llrxflr.exec:\llrxflr.exe165⤵
-
\??\c:\bbtbbt.exec:\bbtbbt.exe166⤵
-
\??\c:\btthbb.exec:\btthbb.exe167⤵
-
\??\c:\jjvpp.exec:\jjvpp.exe168⤵
-
\??\c:\lrflxrl.exec:\lrflxrl.exe169⤵
-
\??\c:\rrllffx.exec:\rrllffx.exe170⤵
-
\??\c:\ntbbtn.exec:\ntbbtn.exe171⤵
-
\??\c:\bhnhbb.exec:\bhnhbb.exe172⤵
-
\??\c:\btbnbb.exec:\btbnbb.exe173⤵
-
\??\c:\jjddv.exec:\jjddv.exe174⤵
-
\??\c:\vddvd.exec:\vddvd.exe175⤵
-
\??\c:\ffxfxrx.exec:\ffxfxrx.exe176⤵
-
\??\c:\rfllllf.exec:\rfllllf.exe177⤵
-
\??\c:\hbnbhh.exec:\hbnbhh.exe178⤵
-
\??\c:\dvjdv.exec:\dvjdv.exe179⤵
-
\??\c:\3ppvv.exec:\3ppvv.exe180⤵
-
\??\c:\rxrllfr.exec:\rxrllfr.exe181⤵
-
\??\c:\rrrlfll.exec:\rrrlfll.exe182⤵
-
\??\c:\3ttnnh.exec:\3ttnnh.exe183⤵
-
\??\c:\jjjdv.exec:\jjjdv.exe184⤵
-
\??\c:\djpjj.exec:\djpjj.exe185⤵
-
\??\c:\dppdd.exec:\dppdd.exe186⤵
-
\??\c:\xfxrfxx.exec:\xfxrfxx.exe187⤵
-
\??\c:\rlrrlxx.exec:\rlrrlxx.exe188⤵
-
\??\c:\btbhbb.exec:\btbhbb.exe189⤵
-
\??\c:\pppjp.exec:\pppjp.exe190⤵
-
\??\c:\7llfrrl.exec:\7llfrrl.exe191⤵
-
\??\c:\lrllxxl.exec:\lrllxxl.exe192⤵
-
\??\c:\hhnhhb.exec:\hhnhhb.exe193⤵
-
\??\c:\nbhtnn.exec:\nbhtnn.exe194⤵
-
\??\c:\jddvj.exec:\jddvj.exe195⤵
-
\??\c:\1lrlxrf.exec:\1lrlxrf.exe196⤵
-
\??\c:\lxfxfrf.exec:\lxfxfrf.exe197⤵
-
\??\c:\tbhnnh.exec:\tbhnnh.exe198⤵
-
\??\c:\pppvp.exec:\pppvp.exe199⤵
-
\??\c:\pjpjj.exec:\pjpjj.exe200⤵
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe201⤵
-
\??\c:\1lfxfxf.exec:\1lfxfxf.exe202⤵
-
\??\c:\nthtnh.exec:\nthtnh.exe203⤵
-
\??\c:\ppvjv.exec:\ppvjv.exe204⤵
-
\??\c:\1rffxxl.exec:\1rffxxl.exe205⤵
-
\??\c:\lflllll.exec:\lflllll.exe206⤵
-
\??\c:\thhtnb.exec:\thhtnb.exe207⤵
-
\??\c:\httntt.exec:\httntt.exe208⤵
-
\??\c:\djdvp.exec:\djdvp.exe209⤵
-
\??\c:\dppdd.exec:\dppdd.exe210⤵
-
\??\c:\1llfrrx.exec:\1llfrrx.exe211⤵
-
\??\c:\rrrxlxf.exec:\rrrxlxf.exe212⤵
-
\??\c:\ntnbnh.exec:\ntnbnh.exe213⤵
-
\??\c:\pjdvj.exec:\pjdvj.exe214⤵
-
\??\c:\dpjdv.exec:\dpjdv.exe215⤵
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe216⤵
-
\??\c:\xlfxrfx.exec:\xlfxrfx.exe217⤵
-
\??\c:\bhhbbn.exec:\bhhbbn.exe218⤵
-
\??\c:\tbtnhb.exec:\tbtnhb.exe219⤵
-
\??\c:\vjjvp.exec:\vjjvp.exe220⤵
-
\??\c:\3pjvp.exec:\3pjvp.exe221⤵
-
\??\c:\frrfrlx.exec:\frrfrlx.exe222⤵
-
\??\c:\9xxrrrr.exec:\9xxrrrr.exe223⤵
-
\??\c:\nnbhbh.exec:\nnbhbh.exe224⤵
-
\??\c:\nttnbh.exec:\nttnbh.exe225⤵
-
\??\c:\vdjvp.exec:\vdjvp.exe226⤵
-
\??\c:\rlrllfx.exec:\rlrllfx.exe227⤵
-
\??\c:\hnnbtn.exec:\hnnbtn.exe228⤵
-
\??\c:\1nbttn.exec:\1nbttn.exe229⤵
-
\??\c:\pdppp.exec:\pdppp.exe230⤵
-
\??\c:\ppjvj.exec:\ppjvj.exe231⤵
-
\??\c:\lffrrxx.exec:\lffrrxx.exe232⤵
-
\??\c:\7htnnb.exec:\7htnnb.exe233⤵
-
\??\c:\thhtnb.exec:\thhtnb.exe234⤵
-
\??\c:\tttbnb.exec:\tttbnb.exe235⤵
-
\??\c:\flrlxrr.exec:\flrlxrr.exe236⤵
-
\??\c:\xfxrlfr.exec:\xfxrlfr.exe237⤵
-
\??\c:\hnttnb.exec:\hnttnb.exe238⤵
-
\??\c:\hnbtbt.exec:\hnbtbt.exe239⤵
-
\??\c:\9dvjd.exec:\9dvjd.exe240⤵
-
\??\c:\fllflfx.exec:\fllflfx.exe241⤵