Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 11:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
287eae748a696cd262efbe8dc0d2d3d0N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
287eae748a696cd262efbe8dc0d2d3d0N.exe
-
Size
71KB
-
MD5
287eae748a696cd262efbe8dc0d2d3d0
-
SHA1
0a1d9de1f2e73dfea6478c2ffd142d7143eff9b1
-
SHA256
35159a836f17acee26e0354e2bac2067056ab3594271319f83f796a80747fdd4
-
SHA512
1e3891a3ed8ae6fd5932e76952477c44329012b79d187d63cf7d871291a8d23f9c41d95902c43fa1fd09a69dc8c3248c05588fa9b83b5aa3e33eea21779d1b7c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfUcicP/fZ:ymb3NkkiQ3mdBjFI4V4ci2/fZ
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
resource yara_rule behavioral2/memory/4524-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/948-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4672-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1856 bntttn.exe 4952 jpvvj.exe 3172 vvppv.exe 948 1bhhbb.exe 2824 djjjd.exe 4692 jdjjd.exe 1316 xrffllx.exe 4136 pvjjd.exe 232 xfflllr.exe 1288 rfrllfr.exe 3640 bnnnhn.exe 1860 jdpvd.exe 3076 rrxrrrf.exe 3716 nbbbnt.exe 4020 3nnnhh.exe 1032 vpdvd.exe 4928 9rrlffl.exe 4840 rrfflll.exe 2216 bnhhbh.exe 2524 pjvpv.exe 5036 7ppjv.exe 2488 lffxffr.exe 4972 bbtnhh.exe 3556 9ppjd.exe 4672 vjppp.exe 4232 vpppd.exe 4168 7llxrrl.exe 2564 htbbtt.exe 4660 1nnhtt.exe 4216 jdddj.exe 2016 vdjjd.exe 3548 frffxff.exe 1816 rfllrrr.exe 4636 hnhhhh.exe 4448 hnhnhn.exe 3148 pjvpd.exe 1104 5nnhtt.exe 4308 1pddv.exe 2236 jdvpd.exe 736 rllfxxr.exe 1456 lfrrxlr.exe 2508 tnttnn.exe 3500 thbbtt.exe 808 vvjjv.exe 1164 9jpvp.exe 2188 frxxrrl.exe 4520 frxxffl.exe 1368 tbhbtt.exe 1924 1btbnn.exe 1772 jvvpj.exe 1932 jjppp.exe 1236 5fxrllr.exe 1092 xffffxx.exe 2792 thnhbt.exe 2024 thbtnn.exe 5060 vjppv.exe 4052 pdjjd.exe 4024 xrrfffx.exe 4068 fxfxxxx.exe 4876 hbbbbb.exe 3716 ddddj.exe 4956 ppppj.exe 4020 rxlxxxx.exe 3332 lffllll.exe -
resource yara_rule behavioral2/memory/4524-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/948-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4672-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhthb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language llrfflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3vppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjdvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfxxrxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9bbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxflrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrxrrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rllrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 1856 4524 287eae748a696cd262efbe8dc0d2d3d0N.exe 84 PID 4524 wrote to memory of 1856 4524 287eae748a696cd262efbe8dc0d2d3d0N.exe 84 PID 4524 wrote to memory of 1856 4524 287eae748a696cd262efbe8dc0d2d3d0N.exe 84 PID 1856 wrote to memory of 4952 1856 bntttn.exe 86 PID 1856 wrote to memory of 4952 1856 bntttn.exe 86 PID 1856 wrote to memory of 4952 1856 bntttn.exe 86 PID 4952 wrote to memory of 3172 4952 jpvvj.exe 87 PID 4952 wrote to memory of 3172 4952 jpvvj.exe 87 PID 4952 wrote to memory of 3172 4952 jpvvj.exe 87 PID 3172 wrote to memory of 948 3172 vvppv.exe 88 PID 3172 wrote to memory of 948 3172 vvppv.exe 88 PID 3172 wrote to memory of 948 3172 vvppv.exe 88 PID 948 wrote to memory of 2824 948 1bhhbb.exe 89 PID 948 wrote to memory of 2824 948 1bhhbb.exe 89 PID 948 wrote to memory of 2824 948 1bhhbb.exe 89 PID 2824 wrote to memory of 4692 2824 djjjd.exe 90 PID 2824 wrote to memory of 4692 2824 djjjd.exe 90 PID 2824 wrote to memory of 4692 2824 djjjd.exe 90 PID 4692 wrote to memory of 1316 4692 jdjjd.exe 91 PID 4692 wrote to memory of 1316 4692 jdjjd.exe 91 PID 4692 wrote to memory of 1316 4692 jdjjd.exe 91 PID 1316 wrote to memory of 4136 1316 xrffllx.exe 92 PID 1316 wrote to memory of 4136 1316 xrffllx.exe 92 PID 1316 wrote to memory of 4136 1316 xrffllx.exe 92 PID 4136 wrote to memory of 232 4136 pvjjd.exe 93 PID 4136 wrote to memory of 232 4136 pvjjd.exe 93 PID 4136 wrote to memory of 232 4136 pvjjd.exe 93 PID 232 wrote to memory of 1288 232 xfflllr.exe 94 PID 232 wrote to memory of 1288 232 xfflllr.exe 94 PID 232 wrote to memory of 1288 232 xfflllr.exe 94 PID 1288 wrote to memory of 3640 1288 rfrllfr.exe 95 PID 1288 wrote to memory of 3640 1288 rfrllfr.exe 95 PID 1288 wrote to memory of 3640 1288 rfrllfr.exe 95 PID 3640 wrote to memory of 1860 3640 bnnnhn.exe 96 PID 3640 wrote to memory of 1860 3640 bnnnhn.exe 96 PID 3640 wrote to memory of 1860 3640 bnnnhn.exe 96 PID 1860 wrote to memory of 3076 1860 jdpvd.exe 98 PID 1860 wrote to memory of 3076 1860 jdpvd.exe 98 PID 1860 wrote to memory of 3076 1860 jdpvd.exe 98 PID 3076 wrote to memory of 3716 3076 rrxrrrf.exe 99 PID 3076 wrote to memory of 3716 3076 rrxrrrf.exe 99 PID 3076 wrote to memory of 3716 3076 rrxrrrf.exe 99 PID 3716 wrote to memory of 4020 3716 nbbbnt.exe 100 PID 3716 wrote to memory of 4020 3716 nbbbnt.exe 100 PID 3716 wrote to memory of 4020 3716 nbbbnt.exe 100 PID 4020 wrote to memory of 1032 4020 3nnnhh.exe 101 PID 4020 wrote to memory of 1032 4020 3nnnhh.exe 101 PID 4020 wrote to memory of 1032 4020 3nnnhh.exe 101 PID 1032 wrote to memory of 4928 1032 vpdvd.exe 102 PID 1032 wrote to memory of 4928 1032 vpdvd.exe 102 PID 1032 wrote to memory of 4928 1032 vpdvd.exe 102 PID 4928 wrote to memory of 4840 4928 9rrlffl.exe 103 PID 4928 wrote to memory of 4840 4928 9rrlffl.exe 103 PID 4928 wrote to memory of 4840 4928 9rrlffl.exe 103 PID 4840 wrote to memory of 2216 4840 rrfflll.exe 104 PID 4840 wrote to memory of 2216 4840 rrfflll.exe 104 PID 4840 wrote to memory of 2216 4840 rrfflll.exe 104 PID 2216 wrote to memory of 2524 2216 bnhhbh.exe 105 PID 2216 wrote to memory of 2524 2216 bnhhbh.exe 105 PID 2216 wrote to memory of 2524 2216 bnhhbh.exe 105 PID 2524 wrote to memory of 5036 2524 pjvpv.exe 106 PID 2524 wrote to memory of 5036 2524 pjvpv.exe 106 PID 2524 wrote to memory of 5036 2524 pjvpv.exe 106 PID 5036 wrote to memory of 2488 5036 7ppjv.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\287eae748a696cd262efbe8dc0d2d3d0N.exe"C:\Users\Admin\AppData\Local\Temp\287eae748a696cd262efbe8dc0d2d3d0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\bntttn.exec:\bntttn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\jpvvj.exec:\jpvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\vvppv.exec:\vvppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\1bhhbb.exec:\1bhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\djjjd.exec:\djjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\jdjjd.exec:\jdjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\xrffllx.exec:\xrffllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\pvjjd.exec:\pvjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\xfflllr.exec:\xfflllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\rfrllfr.exec:\rfrllfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\bnnnhn.exec:\bnnnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\jdpvd.exec:\jdpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\nbbbnt.exec:\nbbbnt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\3nnnhh.exec:\3nnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\vpdvd.exec:\vpdvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\9rrlffl.exec:\9rrlffl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\rrfflll.exec:\rrfflll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\bnhhbh.exec:\bnhhbh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\pjvpv.exec:\pjvpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7ppjv.exec:\7ppjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\lffxffr.exec:\lffxffr.exe23⤵
- Executes dropped EXE
PID:2488 -
\??\c:\bbtnhh.exec:\bbtnhh.exe24⤵
- Executes dropped EXE
PID:4972 -
\??\c:\9ppjd.exec:\9ppjd.exe25⤵
- Executes dropped EXE
PID:3556 -
\??\c:\vjppp.exec:\vjppp.exe26⤵
- Executes dropped EXE
PID:4672 -
\??\c:\vpppd.exec:\vpppd.exe27⤵
- Executes dropped EXE
PID:4232 -
\??\c:\7llxrrl.exec:\7llxrrl.exe28⤵
- Executes dropped EXE
PID:4168 -
\??\c:\htbbtt.exec:\htbbtt.exe29⤵
- Executes dropped EXE
PID:2564 -
\??\c:\1nnhtt.exec:\1nnhtt.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jdddj.exec:\jdddj.exe31⤵
- Executes dropped EXE
PID:4216 -
\??\c:\vdjjd.exec:\vdjjd.exe32⤵
- Executes dropped EXE
PID:2016 -
\??\c:\frffxff.exec:\frffxff.exe33⤵
- Executes dropped EXE
PID:3548 -
\??\c:\rfllrrr.exec:\rfllrrr.exe34⤵
- Executes dropped EXE
PID:1816 -
\??\c:\hnhhhh.exec:\hnhhhh.exe35⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hnhnhn.exec:\hnhnhn.exe36⤵
- Executes dropped EXE
PID:4448 -
\??\c:\pjvpd.exec:\pjvpd.exe37⤵
- Executes dropped EXE
PID:3148 -
\??\c:\5nnhtt.exec:\5nnhtt.exe38⤵
- Executes dropped EXE
PID:1104 -
\??\c:\1pddv.exec:\1pddv.exe39⤵
- Executes dropped EXE
PID:4308 -
\??\c:\jdvpd.exec:\jdvpd.exe40⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rllfxxr.exec:\rllfxxr.exe41⤵
- Executes dropped EXE
PID:736 -
\??\c:\lfrrxlr.exec:\lfrrxlr.exe42⤵
- Executes dropped EXE
PID:1456 -
\??\c:\tnttnn.exec:\tnttnn.exe43⤵
- Executes dropped EXE
PID:2508 -
\??\c:\thbbtt.exec:\thbbtt.exe44⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vvjjv.exec:\vvjjv.exe45⤵
- Executes dropped EXE
PID:808 -
\??\c:\9jpvp.exec:\9jpvp.exe46⤵
- Executes dropped EXE
PID:1164 -
\??\c:\frxxrrl.exec:\frxxrrl.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\frxxffl.exec:\frxxffl.exe48⤵
- Executes dropped EXE
PID:4520 -
\??\c:\tbhbtt.exec:\tbhbtt.exe49⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1btbnn.exec:\1btbnn.exe50⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jvvpj.exec:\jvvpj.exe51⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jjppp.exec:\jjppp.exe52⤵
- Executes dropped EXE
PID:1932 -
\??\c:\5fxrllr.exec:\5fxrllr.exe53⤵
- Executes dropped EXE
PID:1236 -
\??\c:\xffffxx.exec:\xffffxx.exe54⤵
- Executes dropped EXE
PID:1092 -
\??\c:\thnhbt.exec:\thnhbt.exe55⤵
- Executes dropped EXE
PID:2792 -
\??\c:\thbtnn.exec:\thbtnn.exe56⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjppv.exec:\vjppv.exe57⤵
- Executes dropped EXE
PID:5060 -
\??\c:\pdjjd.exec:\pdjjd.exe58⤵
- Executes dropped EXE
PID:4052 -
\??\c:\xrrfffx.exec:\xrrfffx.exe59⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe60⤵
- Executes dropped EXE
PID:4068 -
\??\c:\hbbbbb.exec:\hbbbbb.exe61⤵
- Executes dropped EXE
PID:4876 -
\??\c:\ddddj.exec:\ddddj.exe62⤵
- Executes dropped EXE
PID:3716 -
\??\c:\ppppj.exec:\ppppj.exe63⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rxlxxxx.exec:\rxlxxxx.exe64⤵
- Executes dropped EXE
PID:4020 -
\??\c:\lffllll.exec:\lffllll.exe65⤵
- Executes dropped EXE
PID:3332 -
\??\c:\thnnht.exec:\thnnht.exe66⤵
- System Location Discovery: System Language Discovery
PID:4368 -
\??\c:\tnnnhh.exec:\tnnnhh.exe67⤵PID:1756
-
\??\c:\jvddv.exec:\jvddv.exe68⤵PID:2480
-
\??\c:\vjddv.exec:\vjddv.exe69⤵PID:2220
-
\??\c:\xxlrlrr.exec:\xxlrlrr.exe70⤵PID:1936
-
\??\c:\fflfllf.exec:\fflfllf.exe71⤵PID:1188
-
\??\c:\htbhbb.exec:\htbhbb.exe72⤵PID:772
-
\??\c:\nntthh.exec:\nntthh.exe73⤵PID:2488
-
\??\c:\dvppj.exec:\dvppj.exe74⤵PID:3224
-
\??\c:\1ppvp.exec:\1ppvp.exe75⤵PID:1496
-
\??\c:\vvpjv.exec:\vvpjv.exe76⤵PID:1352
-
\??\c:\lxfffrl.exec:\lxfffrl.exe77⤵PID:2240
-
\??\c:\lflllll.exec:\lflllll.exe78⤵PID:1648
-
\??\c:\hbhbtt.exec:\hbhbtt.exe79⤵PID:3208
-
\??\c:\hbthbb.exec:\hbthbb.exe80⤵PID:1688
-
\??\c:\jpvpj.exec:\jpvpj.exe81⤵PID:2548
-
\??\c:\pdjjv.exec:\pdjjv.exe82⤵PID:3424
-
\??\c:\1lfxffl.exec:\1lfxffl.exe83⤵PID:4216
-
\??\c:\lfrrrrx.exec:\lfrrrrx.exe84⤵PID:2228
-
\??\c:\xxffffr.exec:\xxffffr.exe85⤵PID:4032
-
\??\c:\ttnnhn.exec:\ttnnhn.exe86⤵PID:4536
-
\??\c:\jdjpj.exec:\jdjpj.exe87⤵PID:4880
-
\??\c:\flrxxxr.exec:\flrxxxr.exe88⤵PID:3052
-
\??\c:\htbhhh.exec:\htbhhh.exe89⤵PID:4352
-
\??\c:\tbnhhb.exec:\tbnhhb.exe90⤵PID:3320
-
\??\c:\9djvj.exec:\9djvj.exe91⤵PID:2600
-
\??\c:\vpvvj.exec:\vpvvj.exe92⤵PID:4420
-
\??\c:\lllfrrr.exec:\lllfrrr.exe93⤵PID:3964
-
\??\c:\hbntbb.exec:\hbntbb.exe94⤵PID:1976
-
\??\c:\pdjdv.exec:\pdjdv.exe95⤵PID:4416
-
\??\c:\frrllrl.exec:\frrllrl.exe96⤵PID:2244
-
\??\c:\3lllllf.exec:\3lllllf.exe97⤵PID:1480
-
\??\c:\nnbtbh.exec:\nnbtbh.exe98⤵PID:4004
-
\??\c:\nhnnhh.exec:\nhnnhh.exe99⤵PID:4208
-
\??\c:\vpddd.exec:\vpddd.exe100⤵PID:3484
-
\??\c:\lffxxxr.exec:\lffxxxr.exe101⤵PID:1644
-
\??\c:\rlffrrf.exec:\rlffrrf.exe102⤵PID:5020
-
\??\c:\hbbbbb.exec:\hbbbbb.exe103⤵PID:1444
-
\??\c:\ppddd.exec:\ppddd.exe104⤵PID:912
-
\??\c:\7vdvp.exec:\7vdvp.exe105⤵PID:4620
-
\??\c:\rlfxlll.exec:\rlfxlll.exe106⤵PID:5116
-
\??\c:\lrfrlll.exec:\lrfrlll.exe107⤵PID:1288
-
\??\c:\ntttnn.exec:\ntttnn.exe108⤵PID:2268
-
\??\c:\hthhhh.exec:\hthhhh.exe109⤵PID:3516
-
\??\c:\vddjd.exec:\vddjd.exe110⤵PID:2692
-
\??\c:\jvvdj.exec:\jvvdj.exe111⤵PID:2688
-
\??\c:\lrrfxff.exec:\lrrfxff.exe112⤵PID:692
-
\??\c:\btnnnn.exec:\btnnnn.exe113⤵PID:2952
-
\??\c:\btbtnn.exec:\btbtnn.exe114⤵PID:3580
-
\??\c:\nbbtnh.exec:\nbbtnh.exe115⤵PID:972
-
\??\c:\pjvvd.exec:\pjvvd.exe116⤵PID:4432
-
\??\c:\dvjjv.exec:\dvjjv.exe117⤵PID:2224
-
\??\c:\rllrrrr.exec:\rllrrrr.exe118⤵PID:2676
-
\??\c:\fffffff.exec:\fffffff.exe119⤵PID:3936
-
\??\c:\thhtnn.exec:\thhtnn.exe120⤵PID:4532
-
\??\c:\tnnhbt.exec:\tnnhbt.exe121⤵PID:1056
-
\??\c:\vdjdv.exec:\vdjdv.exe122⤵PID:3688
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-