Analysis
-
max time kernel
120s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/08/2024, 21:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
08a1fa009bbb4cf79f48d8a7afa88560N.exe
Resource
win7-20240708-en
6 signatures
120 seconds
General
-
Target
08a1fa009bbb4cf79f48d8a7afa88560N.exe
-
Size
721KB
-
MD5
08a1fa009bbb4cf79f48d8a7afa88560
-
SHA1
8395229af1ac1b3ae9dea71d79990c271edeb8f7
-
SHA256
8684c8e944262fec8f51f1a2eb4ed82b89f546afc92ccb22fa7bf7426c68019c
-
SHA512
c3743c9230435a995fc3bce4e8235c00c1c4391c83e964eea77a0797285f2cdca6dc81e41d092594c9ba8125925af54341a27e8918395d16ff751666764c6649
-
SSDEEP
12288:n3C9yMCxqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTsxPJp6aasUdlH7O:Sg5qYLS7w4x
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/4752-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1332-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4872-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3476-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3228 vpvpd.exe 3224 jvjjv.exe 2196 rrffxxl.exe 2532 7djjd.exe 2000 jpddv.exe 1332 jdvvp.exe 3596 vpvpp.exe 3200 fxxrlxx.exe 4872 frlfflf.exe 4496 3rrrllr.exe 5068 vvvpj.exe 3476 hbtttb.exe 3380 vvvvv.exe 3764 lffxrrl.exe 1932 bthbtn.exe 1584 tbnhbh.exe 3364 hhhbtt.exe 4604 jdjdd.exe 4536 nnbbnt.exe 1724 dpdvp.exe 4664 vpvpp.exe 3664 ddvpj.exe 4776 rflxrrl.exe 1840 hbbttn.exe 1064 lxlfffl.exe 3384 xrllfxr.exe 1892 5vvpj.exe 4860 ppvvd.exe 2816 hhhhtt.exe 3088 bnbtnh.exe 5012 rfrlllr.exe 1668 bbnnhh.exe 2368 hbhbhh.exe 2876 vppjj.exe 2196 1jjjj.exe 3428 xrlfxrl.exe 4868 hbhbtt.exe 3680 ddjdp.exe 916 9tbttt.exe 4580 3ttnht.exe 3968 xrrrrll.exe 4060 btbtbt.exe 3004 jddvp.exe 3012 5flfxrl.exe 2428 nhnhbh.exe 4348 ddvpp.exe 4248 llxrrrx.exe 3348 nttbhn.exe 2508 1pjdj.exe 1960 vvdvp.exe 3468 lflfllf.exe 2256 hhhttn.exe 536 djvpj.exe 1692 rrllrrx.exe 2456 1bhtnh.exe 5048 djppp.exe 1564 1lfxrrl.exe 3472 hnnnnn.exe 2984 tbbttt.exe 4820 vjppp.exe 2924 hbtnhb.exe 4284 9nhbbt.exe 3112 vpdvp.exe 668 lxrrlff.exe -
resource yara_rule behavioral2/memory/4752-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1332-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4872-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3476-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxfxrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5thhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllfxfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ntnhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tttbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfffrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxffllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxlfffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxrrxrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxllx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9tbttt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfrlllr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btnbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9ffxrll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4752 wrote to memory of 3228 4752 08a1fa009bbb4cf79f48d8a7afa88560N.exe 84 PID 4752 wrote to memory of 3228 4752 08a1fa009bbb4cf79f48d8a7afa88560N.exe 84 PID 4752 wrote to memory of 3228 4752 08a1fa009bbb4cf79f48d8a7afa88560N.exe 84 PID 3228 wrote to memory of 3224 3228 vpvpd.exe 85 PID 3228 wrote to memory of 3224 3228 vpvpd.exe 85 PID 3228 wrote to memory of 3224 3228 vpvpd.exe 85 PID 3224 wrote to memory of 2196 3224 jvjjv.exe 86 PID 3224 wrote to memory of 2196 3224 jvjjv.exe 86 PID 3224 wrote to memory of 2196 3224 jvjjv.exe 86 PID 2196 wrote to memory of 2532 2196 rrffxxl.exe 89 PID 2196 wrote to memory of 2532 2196 rrffxxl.exe 89 PID 2196 wrote to memory of 2532 2196 rrffxxl.exe 89 PID 2532 wrote to memory of 2000 2532 7djjd.exe 90 PID 2532 wrote to memory of 2000 2532 7djjd.exe 90 PID 2532 wrote to memory of 2000 2532 7djjd.exe 90 PID 2000 wrote to memory of 1332 2000 jpddv.exe 92 PID 2000 wrote to memory of 1332 2000 jpddv.exe 92 PID 2000 wrote to memory of 1332 2000 jpddv.exe 92 PID 1332 wrote to memory of 3596 1332 jdvvp.exe 93 PID 1332 wrote to memory of 3596 1332 jdvvp.exe 93 PID 1332 wrote to memory of 3596 1332 jdvvp.exe 93 PID 3596 wrote to memory of 3200 3596 vpvpp.exe 94 PID 3596 wrote to memory of 3200 3596 vpvpp.exe 94 PID 3596 wrote to memory of 3200 3596 vpvpp.exe 94 PID 3200 wrote to memory of 4872 3200 fxxrlxx.exe 95 PID 3200 wrote to memory of 4872 3200 fxxrlxx.exe 95 PID 3200 wrote to memory of 4872 3200 fxxrlxx.exe 95 PID 4872 wrote to memory of 4496 4872 frlfflf.exe 96 PID 4872 wrote to memory of 4496 4872 frlfflf.exe 96 PID 4872 wrote to memory of 4496 4872 frlfflf.exe 96 PID 4496 wrote to memory of 5068 4496 3rrrllr.exe 97 PID 4496 wrote to memory of 5068 4496 3rrrllr.exe 97 PID 4496 wrote to memory of 5068 4496 3rrrllr.exe 97 PID 5068 wrote to memory of 3476 5068 vvvpj.exe 98 PID 5068 wrote to memory of 3476 5068 vvvpj.exe 98 PID 5068 wrote to memory of 3476 5068 vvvpj.exe 98 PID 3476 wrote to memory of 3380 3476 hbtttb.exe 99 PID 3476 wrote to memory of 3380 3476 hbtttb.exe 99 PID 3476 wrote to memory of 3380 3476 hbtttb.exe 99 PID 3380 wrote to memory of 3764 3380 vvvvv.exe 100 PID 3380 wrote to memory of 3764 3380 vvvvv.exe 100 PID 3380 wrote to memory of 3764 3380 vvvvv.exe 100 PID 3764 wrote to memory of 1932 3764 lffxrrl.exe 101 PID 3764 wrote to memory of 1932 3764 lffxrrl.exe 101 PID 3764 wrote to memory of 1932 3764 lffxrrl.exe 101 PID 1932 wrote to memory of 1584 1932 bthbtn.exe 102 PID 1932 wrote to memory of 1584 1932 bthbtn.exe 102 PID 1932 wrote to memory of 1584 1932 bthbtn.exe 102 PID 1584 wrote to memory of 3364 1584 tbnhbh.exe 103 PID 1584 wrote to memory of 3364 1584 tbnhbh.exe 103 PID 1584 wrote to memory of 3364 1584 tbnhbh.exe 103 PID 3364 wrote to memory of 4604 3364 hhhbtt.exe 104 PID 3364 wrote to memory of 4604 3364 hhhbtt.exe 104 PID 3364 wrote to memory of 4604 3364 hhhbtt.exe 104 PID 4604 wrote to memory of 4536 4604 jdjdd.exe 105 PID 4604 wrote to memory of 4536 4604 jdjdd.exe 105 PID 4604 wrote to memory of 4536 4604 jdjdd.exe 105 PID 4536 wrote to memory of 1724 4536 nnbbnt.exe 106 PID 4536 wrote to memory of 1724 4536 nnbbnt.exe 106 PID 4536 wrote to memory of 1724 4536 nnbbnt.exe 106 PID 1724 wrote to memory of 4664 1724 dpdvp.exe 107 PID 1724 wrote to memory of 4664 1724 dpdvp.exe 107 PID 1724 wrote to memory of 4664 1724 dpdvp.exe 107 PID 4664 wrote to memory of 3664 4664 vpvpp.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\08a1fa009bbb4cf79f48d8a7afa88560N.exe"C:\Users\Admin\AppData\Local\Temp\08a1fa009bbb4cf79f48d8a7afa88560N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\vpvpd.exec:\vpvpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\jvjjv.exec:\jvjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\rrffxxl.exec:\rrffxxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\7djjd.exec:\7djjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\jpddv.exec:\jpddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\jdvvp.exec:\jdvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
\??\c:\vpvpp.exec:\vpvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\fxxrlxx.exec:\fxxrlxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\frlfflf.exec:\frlfflf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\3rrrllr.exec:\3rrrllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vvvpj.exec:\vvvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\hbtttb.exec:\hbtttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
\??\c:\vvvvv.exec:\vvvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\lffxrrl.exec:\lffxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\bthbtn.exec:\bthbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\tbnhbh.exec:\tbnhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\hhhbtt.exec:\hhhbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\jdjdd.exec:\jdjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\nnbbnt.exec:\nnbbnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\dpdvp.exec:\dpdvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\vpvpp.exec:\vpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\ddvpj.exec:\ddvpj.exe23⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rflxrrl.exec:\rflxrrl.exe24⤵
- Executes dropped EXE
PID:4776 -
\??\c:\hbbttn.exec:\hbbttn.exe25⤵
- Executes dropped EXE
PID:1840 -
\??\c:\lxlfffl.exec:\lxlfffl.exe26⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xrllfxr.exec:\xrllfxr.exe27⤵
- Executes dropped EXE
PID:3384 -
\??\c:\5vvpj.exec:\5vvpj.exe28⤵
- Executes dropped EXE
PID:1892 -
\??\c:\ppvvd.exec:\ppvvd.exe29⤵
- Executes dropped EXE
PID:4860 -
\??\c:\hhhhtt.exec:\hhhhtt.exe30⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bnbtnh.exec:\bnbtnh.exe31⤵
- Executes dropped EXE
PID:3088 -
\??\c:\rfrlllr.exec:\rfrlllr.exe32⤵
- Executes dropped EXE
PID:5012 -
\??\c:\bbnnhh.exec:\bbnnhh.exe33⤵
- Executes dropped EXE
PID:1668 -
\??\c:\hbhbhh.exec:\hbhbhh.exe34⤵
- Executes dropped EXE
PID:2368 -
\??\c:\vppjj.exec:\vppjj.exe35⤵
- Executes dropped EXE
PID:2876 -
\??\c:\1jjjj.exec:\1jjjj.exe36⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe37⤵
- Executes dropped EXE
PID:3428 -
\??\c:\hbhbtt.exec:\hbhbtt.exe38⤵
- Executes dropped EXE
PID:4868 -
\??\c:\ddjdp.exec:\ddjdp.exe39⤵
- Executes dropped EXE
PID:3680 -
\??\c:\9tbttt.exec:\9tbttt.exe40⤵
- Executes dropped EXE
PID:916 -
\??\c:\3ttnht.exec:\3ttnht.exe41⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xrrrrll.exec:\xrrrrll.exe42⤵
- Executes dropped EXE
PID:3968 -
\??\c:\btbtbt.exec:\btbtbt.exe43⤵
- Executes dropped EXE
PID:4060 -
\??\c:\jddvp.exec:\jddvp.exe44⤵
- Executes dropped EXE
PID:3004 -
\??\c:\5flfxrl.exec:\5flfxrl.exe45⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhnhbh.exec:\nhnhbh.exe46⤵
- Executes dropped EXE
PID:2428 -
\??\c:\ddvpp.exec:\ddvpp.exe47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4348 -
\??\c:\llxrrrx.exec:\llxrrrx.exe48⤵
- Executes dropped EXE
PID:4248 -
\??\c:\nttbhn.exec:\nttbhn.exe49⤵
- Executes dropped EXE
PID:3348 -
\??\c:\1pjdj.exec:\1pjdj.exe50⤵
- Executes dropped EXE
PID:2508 -
\??\c:\vvdvp.exec:\vvdvp.exe51⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lflfllf.exec:\lflfllf.exe52⤵
- Executes dropped EXE
PID:3468 -
\??\c:\hhhttn.exec:\hhhttn.exe53⤵
- Executes dropped EXE
PID:2256 -
\??\c:\djvpj.exec:\djvpj.exe54⤵
- Executes dropped EXE
PID:536 -
\??\c:\rrllrrx.exec:\rrllrrx.exe55⤵
- Executes dropped EXE
PID:1692 -
\??\c:\1bhtnh.exec:\1bhtnh.exe56⤵
- Executes dropped EXE
PID:2456 -
\??\c:\djppp.exec:\djppp.exe57⤵
- Executes dropped EXE
PID:5048 -
\??\c:\1lfxrrl.exec:\1lfxrrl.exe58⤵
- Executes dropped EXE
PID:1564 -
\??\c:\hnnnnn.exec:\hnnnnn.exe59⤵
- Executes dropped EXE
PID:3472 -
\??\c:\tbbttt.exec:\tbbttt.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\vjppp.exec:\vjppp.exe61⤵
- Executes dropped EXE
PID:4820 -
\??\c:\hbtnhb.exec:\hbtnhb.exe62⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9nhbbt.exec:\9nhbbt.exe63⤵
- Executes dropped EXE
PID:4284 -
\??\c:\vpdvp.exec:\vpdvp.exe64⤵
- Executes dropped EXE
PID:3112 -
\??\c:\lxrrlff.exec:\lxrrlff.exe65⤵
- Executes dropped EXE
PID:668 -
\??\c:\nbhbtt.exec:\nbhbtt.exe66⤵PID:4368
-
\??\c:\pdpjv.exec:\pdpjv.exe67⤵PID:1868
-
\??\c:\lxxxflr.exec:\lxxxflr.exe68⤵PID:2012
-
\??\c:\ttnnhn.exec:\ttnnhn.exe69⤵PID:3712
-
\??\c:\tnbbbb.exec:\tnbbbb.exe70⤵PID:1132
-
\??\c:\frxllff.exec:\frxllff.exe71⤵PID:4024
-
\??\c:\htbbtb.exec:\htbbtb.exe72⤵PID:4660
-
\??\c:\7jdvv.exec:\7jdvv.exe73⤵PID:3828
-
\??\c:\5rxrrrf.exec:\5rxrrrf.exe74⤵PID:4652
-
\??\c:\httttt.exec:\httttt.exe75⤵PID:2144
-
\??\c:\3vdvj.exec:\3vdvj.exe76⤵PID:2968
-
\??\c:\xlxrlrf.exec:\xlxrlrf.exe77⤵PID:4328
-
\??\c:\hbbnnh.exec:\hbbnnh.exe78⤵PID:1776
-
\??\c:\ddvpp.exec:\ddvpp.exe79⤵PID:3000
-
\??\c:\xrxxrlf.exec:\xrxxrlf.exe80⤵PID:4852
-
\??\c:\3hnbbt.exec:\3hnbbt.exe81⤵PID:5012
-
\??\c:\ddppj.exec:\ddppj.exe82⤵PID:4092
-
\??\c:\rlrrlrx.exec:\rlrrlrx.exe83⤵PID:3420
-
\??\c:\tnbnnh.exec:\tnbnnh.exe84⤵PID:3708
-
\??\c:\dpjvp.exec:\dpjvp.exe85⤵PID:4588
-
\??\c:\9llxlfx.exec:\9llxlfx.exe86⤵PID:3428
-
\??\c:\bnnhtn.exec:\bnnhtn.exe87⤵PID:3008
-
\??\c:\jvdpd.exec:\jvdpd.exe88⤵PID:396
-
\??\c:\9xxrllx.exec:\9xxrllx.exe89⤵PID:1876
-
\??\c:\thbtnn.exec:\thbtnn.exe90⤵PID:3848
-
\??\c:\7pppp.exec:\7pppp.exe91⤵PID:3976
-
\??\c:\7ffxrrl.exec:\7ffxrrl.exe92⤵PID:2504
-
\??\c:\7htnbt.exec:\7htnbt.exe93⤵PID:768
-
\??\c:\vpppj.exec:\vpppj.exe94⤵PID:404
-
\??\c:\rflfrrr.exec:\rflfrrr.exe95⤵PID:3076
-
\??\c:\hbnhbb.exec:\hbnhbb.exe96⤵PID:2952
-
\??\c:\dpvpj.exec:\dpvpj.exe97⤵PID:4292
-
\??\c:\lrllrrr.exec:\lrllrrr.exe98⤵PID:4304
-
\??\c:\hhbtnn.exec:\hhbtnn.exe99⤵PID:4216
-
\??\c:\vvvjd.exec:\vvvjd.exe100⤵PID:436
-
\??\c:\flrlxxf.exec:\flrlxxf.exe101⤵PID:3476
-
\??\c:\7hnhnh.exec:\7hnhnh.exe102⤵PID:1936
-
\??\c:\hbbtnn.exec:\hbbtnn.exe103⤵PID:1164
-
\??\c:\9jvpj.exec:\9jvpj.exe104⤵PID:4936
-
\??\c:\lxxxrll.exec:\lxxxrll.exe105⤵PID:4388
-
\??\c:\5hhhbb.exec:\5hhhbb.exe106⤵PID:2008
-
\??\c:\1jjdv.exec:\1jjdv.exe107⤵PID:1328
-
\??\c:\frffxxx.exec:\frffxxx.exe108⤵PID:5040
-
\??\c:\hhnhhb.exec:\hhnhhb.exe109⤵PID:2984
-
\??\c:\vpvpp.exec:\vpvpp.exe110⤵PID:3844
-
\??\c:\7xfxffl.exec:\7xfxffl.exe111⤵PID:4472
-
\??\c:\ntbtnh.exec:\ntbtnh.exe112⤵PID:4592
-
\??\c:\pvvvp.exec:\pvvvp.exe113⤵PID:3396
-
\??\c:\flfrlfx.exec:\flfrlfx.exe114⤵PID:4500
-
\??\c:\tnnbnh.exec:\tnnbnh.exe115⤵PID:2268
-
\??\c:\pddvj.exec:\pddvj.exe116⤵PID:4880
-
\??\c:\rrflxff.exec:\rrflxff.exe117⤵PID:2680
-
\??\c:\9hnhnh.exec:\9hnhnh.exe118⤵PID:3712
-
\??\c:\dppjv.exec:\dppjv.exe119⤵PID:1428
-
\??\c:\llfxxxx.exec:\llfxxxx.exe120⤵PID:4568
-
\??\c:\btnhnh.exec:\btnhnh.exe121⤵PID:4524
-
\??\c:\pvvpp.exec:\pvvpp.exe122⤵PID:4812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-