Analysis
-
max time kernel
120s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 13:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
95cc35dc4b0467c6803c09f0511bff20N.exe
Resource
win7-20240704-en
6 signatures
120 seconds
General
-
Target
95cc35dc4b0467c6803c09f0511bff20N.exe
-
Size
82KB
-
MD5
95cc35dc4b0467c6803c09f0511bff20
-
SHA1
7e450267b168828cf70dc957c9df1ebdec08a9a0
-
SHA256
8112ff3c2918f04c162df37fc1fc7026d0512e321659e4568319d7149d266d2f
-
SHA512
ca2b556b396e40a26bccd22497ff62d9e8f6094dcd7181bac713ead18186cf6eda30328c6a4aa926a70e1ecfc40aa2eb1b39bafcbfa2af69ac4a2196a273b45e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QD:ymb3NkkiQ3mdBjFIIp9L9QrrA8S
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
resource yara_rule behavioral2/memory/5048-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2996-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3000 1pjjd.exe 920 fffflxx.exe 4456 tthhht.exe 3916 vvddd.exe 4956 7rxrlrr.exe 2612 hhnnhh.exe 1020 vvjjp.exe 2116 xfrlffx.exe 5100 htbbhn.exe 4176 nhnttt.exe 4136 9xxrllf.exe 764 xflrllr.exe 1156 hbhhnn.exe 5004 tntthn.exe 3888 7xffxxx.exe 4116 rxrxxfx.exe 860 jjpjp.exe 648 5rrlrrl.exe 3500 5fxrrrr.exe 1328 tbhbbb.exe 4268 9vdvp.exe 4912 xfxrrlf.exe 1316 btbttt.exe 3604 9btnnn.exe 2008 rllfllf.exe 3620 bthhbh.exe 2996 5bhhtb.exe 3080 ddddv.exe 3268 vjddv.exe 2736 xrfrllf.exe 3272 hhtnnn.exe 1192 jvpvp.exe 2708 lflfxxf.exe 1220 btttnn.exe 1680 3vpjd.exe 2148 9fxrllf.exe 2360 3fxrfxr.exe 2952 hbnhbh.exe 4076 tbhhtb.exe 4496 jvdpj.exe 4704 frxrrrr.exe 2308 rlllffx.exe 3740 lflflfx.exe 2384 nhnnbb.exe 2428 1ttthh.exe 4792 djjjj.exe 2884 vdvpj.exe 4044 frffrxx.exe 1488 ffxrlll.exe 3012 bbtnnn.exe 4784 nhhhbt.exe 3304 9jddv.exe 3796 fxrrffx.exe 2988 xrrlxxx.exe 1400 bnnhhh.exe 916 tntnnn.exe 3568 vjddj.exe 1968 jvjjv.exe 4452 lfllxxr.exe 2380 nhbbtn.exe 3784 7nhhtb.exe 2296 ppvpj.exe 5116 dpjdv.exe 404 rxfrllf.exe -
resource yara_rule behavioral2/memory/5048-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3916-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2996-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-212-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppppj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ttbbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3frlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vjpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lfllrff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrfrllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjddj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language djjpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3000 5048 95cc35dc4b0467c6803c09f0511bff20N.exe 83 PID 5048 wrote to memory of 3000 5048 95cc35dc4b0467c6803c09f0511bff20N.exe 83 PID 5048 wrote to memory of 3000 5048 95cc35dc4b0467c6803c09f0511bff20N.exe 83 PID 3000 wrote to memory of 920 3000 1pjjd.exe 84 PID 3000 wrote to memory of 920 3000 1pjjd.exe 84 PID 3000 wrote to memory of 920 3000 1pjjd.exe 84 PID 920 wrote to memory of 4456 920 fffflxx.exe 85 PID 920 wrote to memory of 4456 920 fffflxx.exe 85 PID 920 wrote to memory of 4456 920 fffflxx.exe 85 PID 4456 wrote to memory of 3916 4456 tthhht.exe 86 PID 4456 wrote to memory of 3916 4456 tthhht.exe 86 PID 4456 wrote to memory of 3916 4456 tthhht.exe 86 PID 3916 wrote to memory of 4956 3916 vvddd.exe 87 PID 3916 wrote to memory of 4956 3916 vvddd.exe 87 PID 3916 wrote to memory of 4956 3916 vvddd.exe 87 PID 4956 wrote to memory of 2612 4956 7rxrlrr.exe 88 PID 4956 wrote to memory of 2612 4956 7rxrlrr.exe 88 PID 4956 wrote to memory of 2612 4956 7rxrlrr.exe 88 PID 2612 wrote to memory of 1020 2612 hhnnhh.exe 90 PID 2612 wrote to memory of 1020 2612 hhnnhh.exe 90 PID 2612 wrote to memory of 1020 2612 hhnnhh.exe 90 PID 1020 wrote to memory of 2116 1020 vvjjp.exe 91 PID 1020 wrote to memory of 2116 1020 vvjjp.exe 91 PID 1020 wrote to memory of 2116 1020 vvjjp.exe 91 PID 2116 wrote to memory of 5100 2116 xfrlffx.exe 92 PID 2116 wrote to memory of 5100 2116 xfrlffx.exe 92 PID 2116 wrote to memory of 5100 2116 xfrlffx.exe 92 PID 5100 wrote to memory of 4176 5100 htbbhn.exe 93 PID 5100 wrote to memory of 4176 5100 htbbhn.exe 93 PID 5100 wrote to memory of 4176 5100 htbbhn.exe 93 PID 4176 wrote to memory of 4136 4176 nhnttt.exe 94 PID 4176 wrote to memory of 4136 4176 nhnttt.exe 94 PID 4176 wrote to memory of 4136 4176 nhnttt.exe 94 PID 4136 wrote to memory of 764 4136 9xxrllf.exe 95 PID 4136 wrote to memory of 764 4136 9xxrllf.exe 95 PID 4136 wrote to memory of 764 4136 9xxrllf.exe 95 PID 764 wrote to memory of 1156 764 xflrllr.exe 96 PID 764 wrote to memory of 1156 764 xflrllr.exe 96 PID 764 wrote to memory of 1156 764 xflrllr.exe 96 PID 1156 wrote to memory of 5004 1156 hbhhnn.exe 97 PID 1156 wrote to memory of 5004 1156 hbhhnn.exe 97 PID 1156 wrote to memory of 5004 1156 hbhhnn.exe 97 PID 5004 wrote to memory of 3888 5004 tntthn.exe 98 PID 5004 wrote to memory of 3888 5004 tntthn.exe 98 PID 5004 wrote to memory of 3888 5004 tntthn.exe 98 PID 3888 wrote to memory of 4116 3888 7xffxxx.exe 99 PID 3888 wrote to memory of 4116 3888 7xffxxx.exe 99 PID 3888 wrote to memory of 4116 3888 7xffxxx.exe 99 PID 4116 wrote to memory of 860 4116 rxrxxfx.exe 100 PID 4116 wrote to memory of 860 4116 rxrxxfx.exe 100 PID 4116 wrote to memory of 860 4116 rxrxxfx.exe 100 PID 860 wrote to memory of 648 860 jjpjp.exe 102 PID 860 wrote to memory of 648 860 jjpjp.exe 102 PID 860 wrote to memory of 648 860 jjpjp.exe 102 PID 648 wrote to memory of 3500 648 5rrlrrl.exe 103 PID 648 wrote to memory of 3500 648 5rrlrrl.exe 103 PID 648 wrote to memory of 3500 648 5rrlrrl.exe 103 PID 3500 wrote to memory of 1328 3500 5fxrrrr.exe 104 PID 3500 wrote to memory of 1328 3500 5fxrrrr.exe 104 PID 3500 wrote to memory of 1328 3500 5fxrrrr.exe 104 PID 1328 wrote to memory of 4268 1328 tbhbbb.exe 105 PID 1328 wrote to memory of 4268 1328 tbhbbb.exe 105 PID 1328 wrote to memory of 4268 1328 tbhbbb.exe 105 PID 4268 wrote to memory of 4912 4268 9vdvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\95cc35dc4b0467c6803c09f0511bff20N.exe"C:\Users\Admin\AppData\Local\Temp\95cc35dc4b0467c6803c09f0511bff20N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\1pjjd.exec:\1pjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\fffflxx.exec:\fffflxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\tthhht.exec:\tthhht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vvddd.exec:\vvddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\7rxrlrr.exec:\7rxrlrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\hhnnhh.exec:\hhnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\vvjjp.exec:\vvjjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\xfrlffx.exec:\xfrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\htbbhn.exec:\htbbhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\nhnttt.exec:\nhnttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\9xxrllf.exec:\9xxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\xflrllr.exec:\xflrllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\hbhhnn.exec:\hbhhnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\tntthn.exec:\tntthn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\7xffxxx.exec:\7xffxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\rxrxxfx.exec:\rxrxxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\jjpjp.exec:\jjpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\5rrlrrl.exec:\5rrlrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\5fxrrrr.exec:\5fxrrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\tbhbbb.exec:\tbhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\9vdvp.exec:\9vdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\xfxrrlf.exec:\xfxrrlf.exe23⤵
- Executes dropped EXE
PID:4912 -
\??\c:\btbttt.exec:\btbttt.exe24⤵
- Executes dropped EXE
PID:1316 -
\??\c:\9btnnn.exec:\9btnnn.exe25⤵
- Executes dropped EXE
PID:3604 -
\??\c:\rllfllf.exec:\rllfllf.exe26⤵
- Executes dropped EXE
PID:2008 -
\??\c:\bthhbh.exec:\bthhbh.exe27⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5bhhtb.exec:\5bhhtb.exe28⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ddddv.exec:\ddddv.exe29⤵
- Executes dropped EXE
PID:3080 -
\??\c:\vjddv.exec:\vjddv.exe30⤵
- Executes dropped EXE
PID:3268 -
\??\c:\xrfrllf.exec:\xrfrllf.exe31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2736 -
\??\c:\hhtnnn.exec:\hhtnnn.exe32⤵
- Executes dropped EXE
PID:3272 -
\??\c:\jvpvp.exec:\jvpvp.exe33⤵
- Executes dropped EXE
PID:1192 -
\??\c:\lflfxxf.exec:\lflfxxf.exe34⤵
- Executes dropped EXE
PID:2708 -
\??\c:\btttnn.exec:\btttnn.exe35⤵
- Executes dropped EXE
PID:1220 -
\??\c:\3vpjd.exec:\3vpjd.exe36⤵
- Executes dropped EXE
PID:1680 -
\??\c:\9fxrllf.exec:\9fxrllf.exe37⤵
- Executes dropped EXE
PID:2148 -
\??\c:\3fxrfxr.exec:\3fxrfxr.exe38⤵
- Executes dropped EXE
PID:2360 -
\??\c:\hbnhbh.exec:\hbnhbh.exe39⤵
- Executes dropped EXE
PID:2952 -
\??\c:\tbhhtb.exec:\tbhhtb.exe40⤵
- Executes dropped EXE
PID:4076 -
\??\c:\jvdpj.exec:\jvdpj.exe41⤵
- Executes dropped EXE
PID:4496 -
\??\c:\frxrrrr.exec:\frxrrrr.exe42⤵
- Executes dropped EXE
PID:4704 -
\??\c:\rlllffx.exec:\rlllffx.exe43⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lflflfx.exec:\lflflfx.exe44⤵
- Executes dropped EXE
PID:3740 -
\??\c:\nhnnbb.exec:\nhnnbb.exe45⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1ttthh.exec:\1ttthh.exe46⤵
- Executes dropped EXE
PID:2428 -
\??\c:\djjjj.exec:\djjjj.exe47⤵
- Executes dropped EXE
PID:4792 -
\??\c:\vdvpj.exec:\vdvpj.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\frffrxx.exec:\frffrxx.exe49⤵
- Executes dropped EXE
PID:4044 -
\??\c:\ffxrlll.exec:\ffxrlll.exe50⤵
- Executes dropped EXE
PID:1488 -
\??\c:\bbtnnn.exec:\bbtnnn.exe51⤵
- Executes dropped EXE
PID:3012 -
\??\c:\nhhhbt.exec:\nhhhbt.exe52⤵
- Executes dropped EXE
PID:4784 -
\??\c:\9jddv.exec:\9jddv.exe53⤵
- Executes dropped EXE
PID:3304 -
\??\c:\fxrrffx.exec:\fxrrffx.exe54⤵
- Executes dropped EXE
PID:3796 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe55⤵
- Executes dropped EXE
PID:2988 -
\??\c:\bnnhhh.exec:\bnnhhh.exe56⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tntnnn.exec:\tntnnn.exe57⤵
- Executes dropped EXE
PID:916 -
\??\c:\vjddj.exec:\vjddj.exe58⤵
- Executes dropped EXE
PID:3568 -
\??\c:\jvjjv.exec:\jvjjv.exe59⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lfllxxr.exec:\lfllxxr.exe60⤵
- Executes dropped EXE
PID:4452 -
\??\c:\nhbbtn.exec:\nhbbtn.exe61⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7nhhtb.exec:\7nhhtb.exe62⤵
- Executes dropped EXE
PID:3784 -
\??\c:\ppvpj.exec:\ppvpj.exe63⤵
- Executes dropped EXE
PID:2296 -
\??\c:\dpjdv.exec:\dpjdv.exe64⤵
- Executes dropped EXE
PID:5116 -
\??\c:\rxfrllf.exec:\rxfrllf.exe65⤵
- Executes dropped EXE
PID:404 -
\??\c:\7bbbbb.exec:\7bbbbb.exe66⤵PID:4892
-
\??\c:\nhnhbh.exec:\nhnhbh.exe67⤵PID:648
-
\??\c:\llrxrlr.exec:\llrxrlr.exe68⤵PID:1540
-
\??\c:\7tbthn.exec:\7tbthn.exe69⤵PID:4544
-
\??\c:\dvdvp.exec:\dvdvp.exe70⤵PID:4868
-
\??\c:\7vvvp.exec:\7vvvp.exe71⤵PID:4460
-
\??\c:\1rxrrrr.exec:\1rxrrrr.exe72⤵PID:4912
-
\??\c:\hhhbnn.exec:\hhhbnn.exe73⤵PID:208
-
\??\c:\7djdj.exec:\7djdj.exe74⤵PID:4760
-
\??\c:\rxrlffl.exec:\rxrlffl.exe75⤵PID:464
-
\??\c:\lrrrllr.exec:\lrrrllr.exe76⤵PID:3764
-
\??\c:\bnhbbb.exec:\bnhbbb.exe77⤵PID:2936
-
\??\c:\bnnbnn.exec:\bnnbnn.exe78⤵PID:388
-
\??\c:\jjjdp.exec:\jjjdp.exe79⤵PID:1688
-
\??\c:\frfrrlf.exec:\frfrrlf.exe80⤵PID:3496
-
\??\c:\rllfxxl.exec:\rllfxxl.exe81⤵PID:3864
-
\??\c:\hbntht.exec:\hbntht.exe82⤵PID:2984
-
\??\c:\pjppd.exec:\pjppd.exe83⤵PID:1716
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe84⤵PID:4236
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe85⤵PID:1092
-
\??\c:\tntthb.exec:\tntthb.exe86⤵PID:1600
-
\??\c:\jvvpp.exec:\jvvpp.exe87⤵PID:3828
-
\??\c:\1pvpp.exec:\1pvpp.exe88⤵PID:316
-
\??\c:\fxffllx.exec:\fxffllx.exe89⤵PID:996
-
\??\c:\9llffxx.exec:\9llffxx.exe90⤵PID:2472
-
\??\c:\7nnnnn.exec:\7nnnnn.exe91⤵PID:2944
-
\??\c:\jjjjp.exec:\jjjjp.exe92⤵PID:4348
-
\??\c:\frrrrrr.exec:\frrrrrr.exe93⤵PID:1712
-
\??\c:\1rfxxfx.exec:\1rfxxfx.exe94⤵PID:2624
-
\??\c:\btbtht.exec:\btbtht.exe95⤵PID:4840
-
\??\c:\hbhbtt.exec:\hbhbtt.exe96⤵PID:1080
-
\??\c:\pvvvp.exec:\pvvvp.exe97⤵PID:2444
-
\??\c:\vppdp.exec:\vppdp.exe98⤵PID:4856
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe99⤵PID:1548
-
\??\c:\ffrlffx.exec:\ffrlffx.exe100⤵PID:3916
-
\??\c:\hhnhhh.exec:\hhnhhh.exe101⤵PID:3216
-
\??\c:\tbbtnn.exec:\tbbtnn.exe102⤵PID:3560
-
\??\c:\pdvpp.exec:\pdvpp.exe103⤵PID:3688
-
\??\c:\1djjv.exec:\1djjv.exe104⤵PID:372
-
\??\c:\llrrlll.exec:\llrrlll.exe105⤵PID:3232
-
\??\c:\xrffffx.exec:\xrffffx.exe106⤵PID:3848
-
\??\c:\btnhth.exec:\btnhth.exe107⤵PID:3024
-
\??\c:\hhbthh.exec:\hhbthh.exe108⤵PID:5104
-
\??\c:\dvvjv.exec:\dvvjv.exe109⤵PID:3616
-
\??\c:\5djdp.exec:\5djdp.exe110⤵PID:548
-
\??\c:\flfrlfr.exec:\flfrlfr.exe111⤵PID:632
-
\??\c:\btbtnn.exec:\btbtnn.exe112⤵PID:4884
-
\??\c:\3tnnnn.exec:\3tnnnn.exe113⤵PID:2844
-
\??\c:\pvdvv.exec:\pvdvv.exe114⤵PID:3784
-
\??\c:\vvvpv.exec:\vvvpv.exe115⤵PID:4820
-
\??\c:\fffxrlf.exec:\fffxrlf.exe116⤵PID:768
-
\??\c:\fffxrrl.exec:\fffxrrl.exe117⤵PID:676
-
\??\c:\nhbhnb.exec:\nhbhnb.exe118⤵PID:3016
-
\??\c:\ffflflf.exec:\ffflflf.exe119⤵PID:3584
-
\??\c:\nnnnnh.exec:\nnnnnh.exe120⤵PID:1472
-
\??\c:\bbbtnn.exec:\bbbtnn.exe121⤵PID:4960
-
\??\c:\jdddv.exec:\jdddv.exe122⤵PID:4580
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-