Analysis
-
max time kernel
120s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 02:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ee457e67753939bda8ea9961442dcba0N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
ee457e67753939bda8ea9961442dcba0N.exe
-
Size
71KB
-
MD5
ee457e67753939bda8ea9961442dcba0
-
SHA1
aadb73219f109072a983d498d18c7c62e32737e6
-
SHA256
90874d940fd0f7a9c7f37c5966200ffb3f7a88ebec50ad651d6bafb327d16425
-
SHA512
ba5d4b7713ef0f868bdebcb7a3d2089d19edd87decfdfb2bb2802b44126986804af75157a609a85c6a13043eac4e54fcb340b5906c8dadee3f7956bd464809b7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUPqrDZ5RxfVK5Da:ymb3NkkiQ3mdBjF0yUmrfVc+
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2780-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1504-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2588-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2428-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1960-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1544 pdvvj.exe 216 xrrfxrl.exe 4680 tnttth.exe 3368 vpdjj.exe 3060 dpvpj.exe 4880 9frlllf.exe 2668 nnnhnn.exe 2024 7vddv.exe 4888 1pjdd.exe 972 xrrlffx.exe 2888 hhttnn.exe 3760 5nbbtt.exe 3824 vpppj.exe 1604 pjpdv.exe 1504 rlxrffx.exe 2844 bnbbnh.exe 2588 pjpjj.exe 3952 lrlffxx.exe 2912 nhttnh.exe 408 pdvjd.exe 4808 lffrffx.exe 4204 fxfxrfx.exe 1872 hhnntn.exe 4040 dvvpv.exe 3216 ppjpj.exe 3980 rfxrrrr.exe 2468 xxxxxxr.exe 4472 ttbhnn.exe 2364 frxrrxf.exe 2428 rxffrrr.exe 1960 thtnnn.exe 1532 vddvj.exe 4500 dpdvp.exe 4288 rxfrllf.exe 4168 rxxrlll.exe 2988 btbttb.exe 1508 7bhhhh.exe 3348 jjdvv.exe 216 vppdd.exe 4268 rlrlfxl.exe 3972 xxfxxxx.exe 5116 dddpj.exe 2212 ddjjj.exe 1984 xffrfxl.exe 2668 lrxrlfl.exe 4524 7hbnhh.exe 1492 btbbth.exe 3088 vdjvv.exe 4360 fflxrlr.exe 4736 rfxlxfx.exe 4876 btbnbn.exe 2220 hbtntn.exe 3720 1pjdp.exe 1688 flllxlf.exe 2508 frlrfrl.exe 3276 nbbnbt.exe 4864 ntbbnh.exe 3168 vdjpp.exe 1708 jdddd.exe 3436 lffrxrx.exe 3932 ffflrfr.exe 1592 tbbnht.exe 4792 thnbnh.exe 4948 pdvpv.exe -
resource yara_rule behavioral2/memory/2780-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1504-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2588-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2428-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1960-211-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffxrlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vpppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlxlxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tntnbt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djdvd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frxrxxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 1544 2780 ee457e67753939bda8ea9961442dcba0N.exe 88 PID 2780 wrote to memory of 1544 2780 ee457e67753939bda8ea9961442dcba0N.exe 88 PID 2780 wrote to memory of 1544 2780 ee457e67753939bda8ea9961442dcba0N.exe 88 PID 1544 wrote to memory of 216 1544 pdvvj.exe 89 PID 1544 wrote to memory of 216 1544 pdvvj.exe 89 PID 1544 wrote to memory of 216 1544 pdvvj.exe 89 PID 216 wrote to memory of 4680 216 xrrfxrl.exe 90 PID 216 wrote to memory of 4680 216 xrrfxrl.exe 90 PID 216 wrote to memory of 4680 216 xrrfxrl.exe 90 PID 4680 wrote to memory of 3368 4680 tnttth.exe 91 PID 4680 wrote to memory of 3368 4680 tnttth.exe 91 PID 4680 wrote to memory of 3368 4680 tnttth.exe 91 PID 3368 wrote to memory of 3060 3368 vpdjj.exe 92 PID 3368 wrote to memory of 3060 3368 vpdjj.exe 92 PID 3368 wrote to memory of 3060 3368 vpdjj.exe 92 PID 3060 wrote to memory of 4880 3060 dpvpj.exe 93 PID 3060 wrote to memory of 4880 3060 dpvpj.exe 93 PID 3060 wrote to memory of 4880 3060 dpvpj.exe 93 PID 4880 wrote to memory of 2668 4880 9frlllf.exe 94 PID 4880 wrote to memory of 2668 4880 9frlllf.exe 94 PID 4880 wrote to memory of 2668 4880 9frlllf.exe 94 PID 2668 wrote to memory of 2024 2668 nnnhnn.exe 95 PID 2668 wrote to memory of 2024 2668 nnnhnn.exe 95 PID 2668 wrote to memory of 2024 2668 nnnhnn.exe 95 PID 2024 wrote to memory of 4888 2024 7vddv.exe 96 PID 2024 wrote to memory of 4888 2024 7vddv.exe 96 PID 2024 wrote to memory of 4888 2024 7vddv.exe 96 PID 4888 wrote to memory of 972 4888 1pjdd.exe 97 PID 4888 wrote to memory of 972 4888 1pjdd.exe 97 PID 4888 wrote to memory of 972 4888 1pjdd.exe 97 PID 972 wrote to memory of 2888 972 xrrlffx.exe 98 PID 972 wrote to memory of 2888 972 xrrlffx.exe 98 PID 972 wrote to memory of 2888 972 xrrlffx.exe 98 PID 2888 wrote to memory of 3760 2888 hhttnn.exe 99 PID 2888 wrote to memory of 3760 2888 hhttnn.exe 99 PID 2888 wrote to memory of 3760 2888 hhttnn.exe 99 PID 3760 wrote to memory of 3824 3760 5nbbtt.exe 100 PID 3760 wrote to memory of 3824 3760 5nbbtt.exe 100 PID 3760 wrote to memory of 3824 3760 5nbbtt.exe 100 PID 3824 wrote to memory of 1604 3824 vpppj.exe 101 PID 3824 wrote to memory of 1604 3824 vpppj.exe 101 PID 3824 wrote to memory of 1604 3824 vpppj.exe 101 PID 1604 wrote to memory of 1504 1604 pjpdv.exe 102 PID 1604 wrote to memory of 1504 1604 pjpdv.exe 102 PID 1604 wrote to memory of 1504 1604 pjpdv.exe 102 PID 1504 wrote to memory of 2844 1504 rlxrffx.exe 103 PID 1504 wrote to memory of 2844 1504 rlxrffx.exe 103 PID 1504 wrote to memory of 2844 1504 rlxrffx.exe 103 PID 2844 wrote to memory of 2588 2844 bnbbnh.exe 104 PID 2844 wrote to memory of 2588 2844 bnbbnh.exe 104 PID 2844 wrote to memory of 2588 2844 bnbbnh.exe 104 PID 2588 wrote to memory of 3952 2588 pjpjj.exe 105 PID 2588 wrote to memory of 3952 2588 pjpjj.exe 105 PID 2588 wrote to memory of 3952 2588 pjpjj.exe 105 PID 3952 wrote to memory of 2912 3952 lrlffxx.exe 106 PID 3952 wrote to memory of 2912 3952 lrlffxx.exe 106 PID 3952 wrote to memory of 2912 3952 lrlffxx.exe 106 PID 2912 wrote to memory of 408 2912 nhttnh.exe 108 PID 2912 wrote to memory of 408 2912 nhttnh.exe 108 PID 2912 wrote to memory of 408 2912 nhttnh.exe 108 PID 408 wrote to memory of 4808 408 pdvjd.exe 109 PID 408 wrote to memory of 4808 408 pdvjd.exe 109 PID 408 wrote to memory of 4808 408 pdvjd.exe 109 PID 4808 wrote to memory of 4204 4808 lffrffx.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee457e67753939bda8ea9961442dcba0N.exe"C:\Users\Admin\AppData\Local\Temp\ee457e67753939bda8ea9961442dcba0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\pdvvj.exec:\pdvvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\xrrfxrl.exec:\xrrfxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\tnttth.exec:\tnttth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\vpdjj.exec:\vpdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\dpvpj.exec:\dpvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\9frlllf.exec:\9frlllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\nnnhnn.exec:\nnnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7vddv.exec:\7vddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1pjdd.exec:\1pjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\xrrlffx.exec:\xrrlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\hhttnn.exec:\hhttnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\5nbbtt.exec:\5nbbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\vpppj.exec:\vpppj.exe14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\pjpdv.exec:\pjpdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rlxrffx.exec:\rlxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\bnbbnh.exec:\bnbbnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pjpjj.exec:\pjpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\lrlffxx.exec:\lrlffxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\nhttnh.exec:\nhttnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\pdvjd.exec:\pdvjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\lffrffx.exec:\lffrffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\fxfxrfx.exec:\fxfxrfx.exe23⤵
- Executes dropped EXE
PID:4204 -
\??\c:\hhnntn.exec:\hhnntn.exe24⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dvvpv.exec:\dvvpv.exe25⤵
- Executes dropped EXE
PID:4040 -
\??\c:\ppjpj.exec:\ppjpj.exe26⤵
- Executes dropped EXE
PID:3216 -
\??\c:\rfxrrrr.exec:\rfxrrrr.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\xxxxxxr.exec:\xxxxxxr.exe28⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ttbhnn.exec:\ttbhnn.exe29⤵
- Executes dropped EXE
PID:4472 -
\??\c:\frxrrxf.exec:\frxrrxf.exe30⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rxffrrr.exec:\rxffrrr.exe31⤵
- Executes dropped EXE
PID:2428 -
\??\c:\thtnnn.exec:\thtnnn.exe32⤵
- Executes dropped EXE
PID:1960 -
\??\c:\vddvj.exec:\vddvj.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\dpdvp.exec:\dpdvp.exe34⤵
- Executes dropped EXE
PID:4500 -
\??\c:\rxfrllf.exec:\rxfrllf.exe35⤵
- Executes dropped EXE
PID:4288 -
\??\c:\rxxrlll.exec:\rxxrlll.exe36⤵
- Executes dropped EXE
PID:4168 -
\??\c:\btbttb.exec:\btbttb.exe37⤵
- Executes dropped EXE
PID:2988 -
\??\c:\7bhhhh.exec:\7bhhhh.exe38⤵
- Executes dropped EXE
PID:1508 -
\??\c:\jjdvv.exec:\jjdvv.exe39⤵
- Executes dropped EXE
PID:3348 -
\??\c:\vppdd.exec:\vppdd.exe40⤵
- Executes dropped EXE
PID:216 -
\??\c:\rlrlfxl.exec:\rlrlfxl.exe41⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe42⤵
- Executes dropped EXE
PID:3972 -
\??\c:\dddpj.exec:\dddpj.exe43⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ddjjj.exec:\ddjjj.exe44⤵
- Executes dropped EXE
PID:2212 -
\??\c:\xffrfxl.exec:\xffrfxl.exe45⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lrxrlfl.exec:\lrxrlfl.exe46⤵
- Executes dropped EXE
PID:2668 -
\??\c:\7hbnhh.exec:\7hbnhh.exe47⤵
- Executes dropped EXE
PID:4524 -
\??\c:\btbbth.exec:\btbbth.exe48⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vdjvv.exec:\vdjvv.exe49⤵
- Executes dropped EXE
PID:3088 -
\??\c:\fflxrlr.exec:\fflxrlr.exe50⤵
- Executes dropped EXE
PID:4360 -
\??\c:\rfxlxfx.exec:\rfxlxfx.exe51⤵
- Executes dropped EXE
PID:4736 -
\??\c:\btbnbn.exec:\btbnbn.exe52⤵
- Executes dropped EXE
PID:4876 -
\??\c:\hbtntn.exec:\hbtntn.exe53⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1pjdp.exec:\1pjdp.exe54⤵
- Executes dropped EXE
PID:3720 -
\??\c:\flllxlf.exec:\flllxlf.exe55⤵
- Executes dropped EXE
PID:1688 -
\??\c:\frlrfrl.exec:\frlrfrl.exe56⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nbbnbt.exec:\nbbnbt.exe57⤵
- Executes dropped EXE
PID:3276 -
\??\c:\ntbbnh.exec:\ntbbnh.exe58⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vdjpp.exec:\vdjpp.exe59⤵
- Executes dropped EXE
PID:3168 -
\??\c:\jdddd.exec:\jdddd.exe60⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lffrxrx.exec:\lffrxrx.exe61⤵
- Executes dropped EXE
PID:3436 -
\??\c:\ffflrfr.exec:\ffflrfr.exe62⤵
- Executes dropped EXE
PID:3932 -
\??\c:\tbbnht.exec:\tbbnht.exe63⤵
- Executes dropped EXE
PID:1592 -
\??\c:\thnbnh.exec:\thnbnh.exe64⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pdvpv.exec:\pdvpv.exe65⤵
- Executes dropped EXE
PID:4948 -
\??\c:\dddpv.exec:\dddpv.exe66⤵PID:1840
-
\??\c:\xfxrffx.exec:\xfxrffx.exe67⤵PID:2328
-
\??\c:\3xfxfxr.exec:\3xfxfxr.exe68⤵PID:1088
-
\??\c:\tbhtnh.exec:\tbhtnh.exe69⤵PID:4560
-
\??\c:\nhhttt.exec:\nhhttt.exe70⤵PID:452
-
\??\c:\jppjv.exec:\jppjv.exe71⤵PID:212
-
\??\c:\jdvjv.exec:\jdvjv.exe72⤵PID:3204
-
\??\c:\flrlxxr.exec:\flrlxxr.exe73⤵PID:1792
-
\??\c:\bhbbhb.exec:\bhbbhb.exe74⤵PID:1052
-
\??\c:\htthtn.exec:\htthtn.exe75⤵PID:4512
-
\??\c:\vdvjd.exec:\vdvjd.exe76⤵PID:2364
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe77⤵PID:4496
-
\??\c:\ffffrrl.exec:\ffffrrl.exe78⤵PID:3208
-
\??\c:\bthnth.exec:\bthnth.exe79⤵PID:2956
-
\??\c:\jpvpd.exec:\jpvpd.exe80⤵PID:4412
-
\??\c:\vvjjd.exec:\vvjjd.exe81⤵PID:2768
-
\??\c:\9llxlfx.exec:\9llxlfx.exe82⤵PID:1252
-
\??\c:\rrfxfxl.exec:\rrfxfxl.exe83⤵PID:3196
-
\??\c:\rfxlfxx.exec:\rfxlfxx.exe84⤵PID:1740
-
\??\c:\ttbnbt.exec:\ttbnbt.exe85⤵PID:4372
-
\??\c:\vvvjv.exec:\vvvjv.exe86⤵PID:3852
-
\??\c:\jdvpp.exec:\jdvpp.exe87⤵PID:1432
-
\??\c:\fxrrflx.exec:\fxrrflx.exe88⤵PID:4000
-
\??\c:\hbnbtb.exec:\hbnbtb.exe89⤵PID:3756
-
\??\c:\hnhthb.exec:\hnhthb.exe90⤵PID:3692
-
\??\c:\vpdvp.exec:\vpdvp.exe91⤵PID:880
-
\??\c:\vdjdv.exec:\vdjdv.exe92⤵PID:4468
-
\??\c:\xrlfxxl.exec:\xrlfxxl.exe93⤵PID:4524
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe94⤵PID:2420
-
\??\c:\tbthtn.exec:\tbthtn.exe95⤵PID:972
-
\??\c:\nbbthb.exec:\nbbthb.exe96⤵PID:4360
-
\??\c:\vjvjd.exec:\vjvjd.exe97⤵PID:3284
-
\??\c:\dvpjv.exec:\dvpjv.exe98⤵PID:1332
-
\??\c:\dppjv.exec:\dppjv.exe99⤵PID:4976
-
\??\c:\rxrlxrf.exec:\rxrlxrf.exe100⤵PID:1256
-
\??\c:\frlxrlx.exec:\frlxrlx.exe101⤵PID:3824
-
\??\c:\3bnbhb.exec:\3bnbhb.exe102⤵PID:4916
-
\??\c:\9dvjd.exec:\9dvjd.exe103⤵PID:468
-
\??\c:\dppdp.exec:\dppdp.exe104⤵PID:3212
-
\??\c:\pdvpj.exec:\pdvpj.exe105⤵PID:4828
-
\??\c:\frlfllx.exec:\frlfllx.exe106⤵PID:1708
-
\??\c:\hbhbhb.exec:\hbhbhb.exe107⤵PID:4140
-
\??\c:\ttthtn.exec:\ttthtn.exe108⤵PID:2576
-
\??\c:\jvvdv.exec:\jvvdv.exe109⤵PID:4832
-
\??\c:\ddjvp.exec:\ddjvp.exe110⤵PID:4752
-
\??\c:\rffxlfr.exec:\rffxlfr.exe111⤵PID:3872
-
\??\c:\nthbnb.exec:\nthbnb.exe112⤵PID:1872
-
\??\c:\bhhtnh.exec:\bhhtnh.exe113⤵PID:2328
-
\??\c:\djdvd.exec:\djdvd.exe114⤵
- System Location Discovery: System Language Discovery
PID:3708 -
\??\c:\vvdpv.exec:\vvdpv.exe115⤵PID:4320
-
\??\c:\xrxrlfr.exec:\xrxrlfr.exe116⤵PID:3528
-
\??\c:\5fflxfx.exec:\5fflxfx.exe117⤵PID:3676
-
\??\c:\9ntnhh.exec:\9ntnhh.exe118⤵PID:2468
-
\??\c:\hnhtht.exec:\hnhtht.exe119⤵PID:4444
-
\??\c:\pjjdv.exec:\pjjdv.exe120⤵PID:3516
-
\??\c:\9lrfxlx.exec:\9lrfxlx.exe121⤵PID:3128
-
\??\c:\fllfrlf.exec:\fllfrlf.exe122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-