Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
26/08/2024, 03:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1f7363470c3bce86c3f463a3d1d0f980N.exe
Resource
win7-20240729-en
6 signatures
120 seconds
General
-
Target
1f7363470c3bce86c3f463a3d1d0f980N.exe
-
Size
85KB
-
MD5
1f7363470c3bce86c3f463a3d1d0f980
-
SHA1
f7fefeafbad453a4e25372b7fccbd774497c76be
-
SHA256
c69851805e7a1e39b43576404553a57958a5ae08921d46e6094695735983cfcf
-
SHA512
3c3e54cc32a2a5d62bd4b69c9ba642a9869c6ba85d1b05e4e9e71d328897b50ae1f2f44c0c26f15c301776747ac22090bb9a68eace5d3d69f4a4db103ff64678
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoAXPfgr2hKmdbcPi2vzK:ymb3NkkiQ3mdBjFo6Pfgy3dbc/zK
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2412-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3048-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3720-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/964-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 624 5jppp.exe 1116 rrlfffl.exe 2368 nhnhhb.exe 3108 vdjjj.exe 1656 dvjjp.exe 2076 rrrllrr.exe 3048 btbhbt.exe 2680 7jvpj.exe 1816 3xrxlrr.exe 3120 flrlfff.exe 2836 hhhbbb.exe 3720 jpddv.exe 5088 rlxrlll.exe 744 bntnnn.exe 2816 jjddv.exe 964 frlfxfx.exe 540 1ffxrll.exe 4712 nhttnb.exe 4728 vjjvp.exe 3956 lrrlrlr.exe 5020 hbhbtt.exe 1480 hthhbb.exe 5068 9djvp.exe 3356 7rrxrxr.exe 3964 tnhthh.exe 4040 5ddvj.exe 836 djppv.exe 4544 7rffrrr.exe 4984 xfxfxll.exe 3656 nhtnbt.exe 4192 vpjvv.exe 2332 5llfrfx.exe 332 xxxrlrl.exe 4636 9tbtnb.exe 1264 nnhhhb.exe 2388 vdjdv.exe 4324 dvjdd.exe 2412 1frlfxx.exe 2760 1ffffll.exe 4760 ttbtbt.exe 1116 pjpjd.exe 3456 9djdv.exe 1136 dpjdp.exe 1656 bttnhb.exe 3648 pjppd.exe 3416 5vvvv.exe 4960 ffllrrl.exe 1464 fxfxfff.exe 1416 thbtnn.exe 992 hhnhhh.exe 2932 pjvpp.exe 4188 9flfrrl.exe 216 tnbtnn.exe 4988 nbhbtt.exe 1280 dvpjj.exe 2392 frxlxxx.exe 4500 lffxxxr.exe 864 fxxrxxf.exe 964 bbbtnn.exe 540 bbbbnn.exe 3080 5djjj.exe 4944 rlxrrlr.exe 1212 5rlxrff.exe 4872 7tnhhh.exe -
resource yara_rule behavioral2/memory/2412-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3048-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3720-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/964-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrllrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvjdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllffl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxfflx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1ffffll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhttht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pddvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xrlxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9nnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnhbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2412 wrote to memory of 624 2412 1f7363470c3bce86c3f463a3d1d0f980N.exe 86 PID 2412 wrote to memory of 624 2412 1f7363470c3bce86c3f463a3d1d0f980N.exe 86 PID 2412 wrote to memory of 624 2412 1f7363470c3bce86c3f463a3d1d0f980N.exe 86 PID 624 wrote to memory of 1116 624 5jppp.exe 87 PID 624 wrote to memory of 1116 624 5jppp.exe 87 PID 624 wrote to memory of 1116 624 5jppp.exe 87 PID 1116 wrote to memory of 2368 1116 rrlfffl.exe 88 PID 1116 wrote to memory of 2368 1116 rrlfffl.exe 88 PID 1116 wrote to memory of 2368 1116 rrlfffl.exe 88 PID 2368 wrote to memory of 3108 2368 nhnhhb.exe 89 PID 2368 wrote to memory of 3108 2368 nhnhhb.exe 89 PID 2368 wrote to memory of 3108 2368 nhnhhb.exe 89 PID 3108 wrote to memory of 1656 3108 vdjjj.exe 90 PID 3108 wrote to memory of 1656 3108 vdjjj.exe 90 PID 3108 wrote to memory of 1656 3108 vdjjj.exe 90 PID 1656 wrote to memory of 2076 1656 dvjjp.exe 91 PID 1656 wrote to memory of 2076 1656 dvjjp.exe 91 PID 1656 wrote to memory of 2076 1656 dvjjp.exe 91 PID 2076 wrote to memory of 3048 2076 rrrllrr.exe 92 PID 2076 wrote to memory of 3048 2076 rrrllrr.exe 92 PID 2076 wrote to memory of 3048 2076 rrrllrr.exe 92 PID 3048 wrote to memory of 2680 3048 btbhbt.exe 93 PID 3048 wrote to memory of 2680 3048 btbhbt.exe 93 PID 3048 wrote to memory of 2680 3048 btbhbt.exe 93 PID 2680 wrote to memory of 1816 2680 7jvpj.exe 94 PID 2680 wrote to memory of 1816 2680 7jvpj.exe 94 PID 2680 wrote to memory of 1816 2680 7jvpj.exe 94 PID 1816 wrote to memory of 3120 1816 3xrxlrr.exe 95 PID 1816 wrote to memory of 3120 1816 3xrxlrr.exe 95 PID 1816 wrote to memory of 3120 1816 3xrxlrr.exe 95 PID 3120 wrote to memory of 2836 3120 flrlfff.exe 96 PID 3120 wrote to memory of 2836 3120 flrlfff.exe 96 PID 3120 wrote to memory of 2836 3120 flrlfff.exe 96 PID 2836 wrote to memory of 3720 2836 hhhbbb.exe 97 PID 2836 wrote to memory of 3720 2836 hhhbbb.exe 97 PID 2836 wrote to memory of 3720 2836 hhhbbb.exe 97 PID 3720 wrote to memory of 5088 3720 jpddv.exe 98 PID 3720 wrote to memory of 5088 3720 jpddv.exe 98 PID 3720 wrote to memory of 5088 3720 jpddv.exe 98 PID 5088 wrote to memory of 744 5088 rlxrlll.exe 99 PID 5088 wrote to memory of 744 5088 rlxrlll.exe 99 PID 5088 wrote to memory of 744 5088 rlxrlll.exe 99 PID 744 wrote to memory of 2816 744 bntnnn.exe 100 PID 744 wrote to memory of 2816 744 bntnnn.exe 100 PID 744 wrote to memory of 2816 744 bntnnn.exe 100 PID 2816 wrote to memory of 964 2816 jjddv.exe 101 PID 2816 wrote to memory of 964 2816 jjddv.exe 101 PID 2816 wrote to memory of 964 2816 jjddv.exe 101 PID 964 wrote to memory of 540 964 frlfxfx.exe 102 PID 964 wrote to memory of 540 964 frlfxfx.exe 102 PID 964 wrote to memory of 540 964 frlfxfx.exe 102 PID 540 wrote to memory of 4712 540 1ffxrll.exe 103 PID 540 wrote to memory of 4712 540 1ffxrll.exe 103 PID 540 wrote to memory of 4712 540 1ffxrll.exe 103 PID 4712 wrote to memory of 4728 4712 nhttnb.exe 104 PID 4712 wrote to memory of 4728 4712 nhttnb.exe 104 PID 4712 wrote to memory of 4728 4712 nhttnb.exe 104 PID 4728 wrote to memory of 3956 4728 vjjvp.exe 105 PID 4728 wrote to memory of 3956 4728 vjjvp.exe 105 PID 4728 wrote to memory of 3956 4728 vjjvp.exe 105 PID 3956 wrote to memory of 5020 3956 lrrlrlr.exe 106 PID 3956 wrote to memory of 5020 3956 lrrlrlr.exe 106 PID 3956 wrote to memory of 5020 3956 lrrlrlr.exe 106 PID 5020 wrote to memory of 1480 5020 hbhbtt.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f7363470c3bce86c3f463a3d1d0f980N.exe"C:\Users\Admin\AppData\Local\Temp\1f7363470c3bce86c3f463a3d1d0f980N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\5jppp.exec:\5jppp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\rrlfffl.exec:\rrlfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\nhnhhb.exec:\nhnhhb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vdjjj.exec:\vdjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\dvjjp.exec:\dvjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\rrrllrr.exec:\rrrllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\btbhbt.exec:\btbhbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\7jvpj.exec:\7jvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3xrxlrr.exec:\3xrxlrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\flrlfff.exec:\flrlfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\hhhbbb.exec:\hhhbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\jpddv.exec:\jpddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
\??\c:\rlxrlll.exec:\rlxrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\bntnnn.exec:\bntnnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:744 -
\??\c:\jjddv.exec:\jjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\frlfxfx.exec:\frlfxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
\??\c:\1ffxrll.exec:\1ffxrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\nhttnb.exec:\nhttnb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\vjjvp.exec:\vjjvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\lrrlrlr.exec:\lrrlrlr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\hbhbtt.exec:\hbhbtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\hthhbb.exec:\hthhbb.exe23⤵
- Executes dropped EXE
PID:1480 -
\??\c:\9djvp.exec:\9djvp.exe24⤵
- Executes dropped EXE
PID:5068 -
\??\c:\7rrxrxr.exec:\7rrxrxr.exe25⤵
- Executes dropped EXE
PID:3356 -
\??\c:\tnhthh.exec:\tnhthh.exe26⤵
- Executes dropped EXE
PID:3964 -
\??\c:\5ddvj.exec:\5ddvj.exe27⤵
- Executes dropped EXE
PID:4040 -
\??\c:\djppv.exec:\djppv.exe28⤵
- Executes dropped EXE
PID:836 -
\??\c:\7rffrrr.exec:\7rffrrr.exe29⤵
- Executes dropped EXE
PID:4544 -
\??\c:\xfxfxll.exec:\xfxfxll.exe30⤵
- Executes dropped EXE
PID:4984 -
\??\c:\nhtnbt.exec:\nhtnbt.exe31⤵
- Executes dropped EXE
PID:3656 -
\??\c:\vpjvv.exec:\vpjvv.exe32⤵
- Executes dropped EXE
PID:4192 -
\??\c:\5llfrfx.exec:\5llfrfx.exe33⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xxxrlrl.exec:\xxxrlrl.exe34⤵
- Executes dropped EXE
PID:332 -
\??\c:\9tbtnb.exec:\9tbtnb.exe35⤵
- Executes dropped EXE
PID:4636 -
\??\c:\nnhhhb.exec:\nnhhhb.exe36⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vdjdv.exec:\vdjdv.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dvjdd.exec:\dvjdd.exe38⤵
- Executes dropped EXE
PID:4324 -
\??\c:\1frlfxx.exec:\1frlfxx.exe39⤵
- Executes dropped EXE
PID:2412 -
\??\c:\1ffffll.exec:\1ffffll.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2760 -
\??\c:\ttbtbt.exec:\ttbtbt.exe41⤵
- Executes dropped EXE
PID:4760 -
\??\c:\pjpjd.exec:\pjpjd.exe42⤵
- Executes dropped EXE
PID:1116 -
\??\c:\9djdv.exec:\9djdv.exe43⤵
- Executes dropped EXE
PID:3456 -
\??\c:\dpjdp.exec:\dpjdp.exe44⤵
- Executes dropped EXE
PID:1136 -
\??\c:\bttnhb.exec:\bttnhb.exe45⤵
- Executes dropped EXE
PID:1656 -
\??\c:\pjppd.exec:\pjppd.exe46⤵
- Executes dropped EXE
PID:3648 -
\??\c:\5vvvv.exec:\5vvvv.exe47⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ffllrrl.exec:\ffllrrl.exe48⤵
- Executes dropped EXE
PID:4960 -
\??\c:\fxfxfff.exec:\fxfxfff.exe49⤵
- Executes dropped EXE
PID:1464 -
\??\c:\thbtnn.exec:\thbtnn.exe50⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hhnhhh.exec:\hhnhhh.exe51⤵
- Executes dropped EXE
PID:992 -
\??\c:\pjvpp.exec:\pjvpp.exe52⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9flfrrl.exec:\9flfrrl.exe53⤵
- Executes dropped EXE
PID:4188 -
\??\c:\tnbtnn.exec:\tnbtnn.exe54⤵
- Executes dropped EXE
PID:216 -
\??\c:\nbhbtt.exec:\nbhbtt.exe55⤵
- Executes dropped EXE
PID:4988 -
\??\c:\dvpjj.exec:\dvpjj.exe56⤵
- Executes dropped EXE
PID:1280 -
\??\c:\frxlxxx.exec:\frxlxxx.exe57⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lffxxxr.exec:\lffxxxr.exe58⤵
- Executes dropped EXE
PID:4500 -
\??\c:\fxxrxxf.exec:\fxxrxxf.exe59⤵
- Executes dropped EXE
PID:864 -
\??\c:\bbbtnn.exec:\bbbtnn.exe60⤵
- Executes dropped EXE
PID:964 -
\??\c:\bbbbnn.exec:\bbbbnn.exe61⤵
- Executes dropped EXE
PID:540 -
\??\c:\5djjj.exec:\5djjj.exe62⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rlxrrlr.exec:\rlxrrlr.exe63⤵
- Executes dropped EXE
PID:4944 -
\??\c:\5rlxrff.exec:\5rlxrff.exe64⤵
- Executes dropped EXE
PID:1212 -
\??\c:\7tnhhh.exec:\7tnhhh.exe65⤵
- Executes dropped EXE
PID:4872 -
\??\c:\hbtnnh.exec:\hbtnnh.exe66⤵PID:1504
-
\??\c:\vvdvv.exec:\vvdvv.exe67⤵PID:1480
-
\??\c:\vjvpj.exec:\vjvpj.exe68⤵PID:372
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe69⤵PID:544
-
\??\c:\rfrlffx.exec:\rfrlffx.exe70⤵PID:1500
-
\??\c:\thhbbh.exec:\thhbbh.exe71⤵PID:4764
-
\??\c:\nnhtnn.exec:\nnhtnn.exe72⤵PID:2060
-
\??\c:\7bbbtb.exec:\7bbbtb.exe73⤵PID:796
-
\??\c:\vdjjv.exec:\vdjjv.exe74⤵PID:4168
-
\??\c:\7pppd.exec:\7pppd.exe75⤵PID:4384
-
\??\c:\rlffllf.exec:\rlffllf.exe76⤵PID:2572
-
\??\c:\rxrrrxr.exec:\rxrrrxr.exe77⤵PID:3656
-
\??\c:\bhbthb.exec:\bhbthb.exe78⤵PID:4528
-
\??\c:\5hhbtt.exec:\5hhbtt.exe79⤵PID:3880
-
\??\c:\7pdvv.exec:\7pdvv.exe80⤵PID:2732
-
\??\c:\pdjjp.exec:\pdjjp.exe81⤵PID:3788
-
\??\c:\7rfxffl.exec:\7rfxffl.exe82⤵PID:3368
-
\??\c:\fxlllfr.exec:\fxlllfr.exe83⤵PID:2736
-
\??\c:\7btntn.exec:\7btntn.exe84⤵PID:1924
-
\??\c:\jdpjp.exec:\jdpjp.exe85⤵PID:1380
-
\??\c:\dvdvv.exec:\dvdvv.exe86⤵PID:3032
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe87⤵PID:2748
-
\??\c:\3lllllr.exec:\3lllllr.exe88⤵PID:1968
-
\??\c:\nhbtnn.exec:\nhbtnn.exe89⤵PID:4784
-
\??\c:\hbbbtb.exec:\hbbbtb.exe90⤵PID:2468
-
\??\c:\ddvdv.exec:\ddvdv.exe91⤵PID:2832
-
\??\c:\pjdvp.exec:\pjdvp.exe92⤵PID:2920
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe93⤵PID:4228
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe94⤵PID:4240
-
\??\c:\9rxxllr.exec:\9rxxllr.exe95⤵PID:4584
-
\??\c:\bnhbtt.exec:\bnhbtt.exe96⤵PID:3180
-
\??\c:\ntnnhn.exec:\ntnnhn.exe97⤵PID:872
-
\??\c:\dpvvj.exec:\dpvvj.exe98⤵PID:2976
-
\??\c:\jpdvv.exec:\jpdvv.exe99⤵PID:3120
-
\??\c:\lfxrffx.exec:\lfxrffx.exe100⤵PID:2932
-
\??\c:\xxxrrrr.exec:\xxxrrrr.exe101⤵PID:4188
-
\??\c:\htntnt.exec:\htntnt.exe102⤵PID:216
-
\??\c:\bbttht.exec:\bbttht.exe103⤵PID:5088
-
\??\c:\vpppj.exec:\vpppj.exe104⤵PID:1340
-
\??\c:\jdppj.exec:\jdppj.exe105⤵PID:2880
-
\??\c:\lxxrllf.exec:\lxxrllf.exe106⤵PID:1320
-
\??\c:\nnnnhh.exec:\nnnnhh.exe107⤵PID:4972
-
\??\c:\dpjdd.exec:\dpjdd.exe108⤵PID:964
-
\??\c:\djddd.exec:\djddd.exe109⤵PID:540
-
\??\c:\rlxxlll.exec:\rlxxlll.exe110⤵PID:4996
-
\??\c:\rrffxxx.exec:\rrffxxx.exe111⤵PID:2272
-
\??\c:\nbnnnn.exec:\nbnnnn.exe112⤵PID:5072
-
\??\c:\thbbtt.exec:\thbbtt.exe113⤵PID:4672
-
\??\c:\3dvpd.exec:\3dvpd.exe114⤵PID:2792
-
\??\c:\vjvpj.exec:\vjvpj.exe115⤵PID:4592
-
\??\c:\3flfrrl.exec:\3flfrrl.exe116⤵PID:2260
-
\??\c:\frllffx.exec:\frllffx.exe117⤵PID:4244
-
\??\c:\9hhbbb.exec:\9hhbbb.exe118⤵PID:836
-
\??\c:\7vpvv.exec:\7vpvv.exe119⤵PID:1148
-
\??\c:\ppddj.exec:\ppddj.exe120⤵PID:2152
-
\??\c:\xfxxxfx.exec:\xfxxxfx.exe121⤵PID:1916
-
\??\c:\frrlrxr.exec:\frrlrxr.exe122⤵
- System Location Discovery: System Language Discovery
PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-