Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
83011b160c7bfc88d03921004e96b5e0N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
83011b160c7bfc88d03921004e96b5e0N.exe
-
Size
106KB
-
MD5
83011b160c7bfc88d03921004e96b5e0
-
SHA1
5340b8052aa012ad54bd62f106179e0763e00c63
-
SHA256
3b50f23b35aab14e233330180f740f7664cb8a5d85fd5df8ac0cb4b71162b2b8
-
SHA512
b4d0d55024151cc48ba9a88b3bce12041ffd1c226dd5034844a1db708b221e3bd1e6077c5a9edf0db7cfda324af6dfdb39972a816b87ff78c2048ff55fa7506b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3Cm5:n3C9BRo7MlrWKVT+buBGu3PH5
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2388-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3564-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1292-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2244-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3920-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/404-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3608 rlxlxrf.exe 3564 nhntbh.exe 2148 pvdpj.exe 4960 9dvvp.exe 2256 ffxrrrr.exe 5036 1hhbbb.exe 1292 ppdvj.exe 2264 5rlxrrl.exe 4020 9nttnn.exe 1864 5fxffxx.exe 1560 5btnhn.exe 3788 hbbbbh.exe 2244 jjdvv.exe 3920 fxlfxxx.exe 3064 bttttt.exe 4140 9ddvp.exe 404 lfxrllf.exe 1048 tbbtnn.exe 888 vpvpj.exe 3104 dvddv.exe 1196 1rrxxxx.exe 2912 3nnhbb.exe 1924 nbtnhb.exe 4500 1djjv.exe 2180 jddpd.exe 2940 xrrfxxr.exe 4900 ttbtbb.exe 1136 bbbttn.exe 4444 jjvpj.exe 4772 pddvp.exe 2176 3xxxrrl.exe 4408 tbbnbt.exe 4404 htttnn.exe 64 pjdvv.exe 4304 pvddp.exe 2564 rlxrrrx.exe 3708 lxxrrrl.exe 1176 9bbbtb.exe 1936 nhtnnn.exe 3564 dvpjd.exe 3840 vppjj.exe 3672 fllffxx.exe 4052 lfrlrrl.exe 3484 7bhbhb.exe 3872 tnnhbt.exe 1376 djdpp.exe 3212 5ppvj.exe 3356 llrrlll.exe 2264 frfxllx.exe 5024 thtbtn.exe 640 1jjdv.exe 1864 pvdvp.exe 440 1lrlllr.exe 3788 rfrlrlr.exe 5020 htbthh.exe 1860 hnnhhh.exe 2972 djppp.exe 1660 rrffrfx.exe 4484 rrrrllf.exe 4572 7nhhbb.exe 3648 1pvpd.exe 3284 jdjjd.exe 2444 xflfrrl.exe 1744 flflfxr.exe -
resource yara_rule behavioral2/memory/2388-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3564-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1292-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3788-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2244-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3920-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/404-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rlxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vvvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrffrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrrlxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrxrfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjjj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language htbhnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rfxlfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddddp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1hntnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xflfxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2388 wrote to memory of 3608 2388 83011b160c7bfc88d03921004e96b5e0N.exe 86 PID 2388 wrote to memory of 3608 2388 83011b160c7bfc88d03921004e96b5e0N.exe 86 PID 2388 wrote to memory of 3608 2388 83011b160c7bfc88d03921004e96b5e0N.exe 86 PID 3608 wrote to memory of 3564 3608 rlxlxrf.exe 87 PID 3608 wrote to memory of 3564 3608 rlxlxrf.exe 87 PID 3608 wrote to memory of 3564 3608 rlxlxrf.exe 87 PID 3564 wrote to memory of 2148 3564 nhntbh.exe 88 PID 3564 wrote to memory of 2148 3564 nhntbh.exe 88 PID 3564 wrote to memory of 2148 3564 nhntbh.exe 88 PID 2148 wrote to memory of 4960 2148 pvdpj.exe 89 PID 2148 wrote to memory of 4960 2148 pvdpj.exe 89 PID 2148 wrote to memory of 4960 2148 pvdpj.exe 89 PID 4960 wrote to memory of 2256 4960 9dvvp.exe 90 PID 4960 wrote to memory of 2256 4960 9dvvp.exe 90 PID 4960 wrote to memory of 2256 4960 9dvvp.exe 90 PID 2256 wrote to memory of 5036 2256 ffxrrrr.exe 91 PID 2256 wrote to memory of 5036 2256 ffxrrrr.exe 91 PID 2256 wrote to memory of 5036 2256 ffxrrrr.exe 91 PID 5036 wrote to memory of 1292 5036 1hhbbb.exe 92 PID 5036 wrote to memory of 1292 5036 1hhbbb.exe 92 PID 5036 wrote to memory of 1292 5036 1hhbbb.exe 92 PID 1292 wrote to memory of 2264 1292 ppdvj.exe 94 PID 1292 wrote to memory of 2264 1292 ppdvj.exe 94 PID 1292 wrote to memory of 2264 1292 ppdvj.exe 94 PID 2264 wrote to memory of 4020 2264 5rlxrrl.exe 95 PID 2264 wrote to memory of 4020 2264 5rlxrrl.exe 95 PID 2264 wrote to memory of 4020 2264 5rlxrrl.exe 95 PID 4020 wrote to memory of 1864 4020 9nttnn.exe 97 PID 4020 wrote to memory of 1864 4020 9nttnn.exe 97 PID 4020 wrote to memory of 1864 4020 9nttnn.exe 97 PID 1864 wrote to memory of 1560 1864 5fxffxx.exe 98 PID 1864 wrote to memory of 1560 1864 5fxffxx.exe 98 PID 1864 wrote to memory of 1560 1864 5fxffxx.exe 98 PID 1560 wrote to memory of 3788 1560 5btnhn.exe 99 PID 1560 wrote to memory of 3788 1560 5btnhn.exe 99 PID 1560 wrote to memory of 3788 1560 5btnhn.exe 99 PID 3788 wrote to memory of 2244 3788 hbbbbh.exe 100 PID 3788 wrote to memory of 2244 3788 hbbbbh.exe 100 PID 3788 wrote to memory of 2244 3788 hbbbbh.exe 100 PID 2244 wrote to memory of 3920 2244 jjdvv.exe 101 PID 2244 wrote to memory of 3920 2244 jjdvv.exe 101 PID 2244 wrote to memory of 3920 2244 jjdvv.exe 101 PID 3920 wrote to memory of 3064 3920 fxlfxxx.exe 102 PID 3920 wrote to memory of 3064 3920 fxlfxxx.exe 102 PID 3920 wrote to memory of 3064 3920 fxlfxxx.exe 102 PID 3064 wrote to memory of 4140 3064 bttttt.exe 103 PID 3064 wrote to memory of 4140 3064 bttttt.exe 103 PID 3064 wrote to memory of 4140 3064 bttttt.exe 103 PID 4140 wrote to memory of 404 4140 9ddvp.exe 105 PID 4140 wrote to memory of 404 4140 9ddvp.exe 105 PID 4140 wrote to memory of 404 4140 9ddvp.exe 105 PID 404 wrote to memory of 1048 404 lfxrllf.exe 106 PID 404 wrote to memory of 1048 404 lfxrllf.exe 106 PID 404 wrote to memory of 1048 404 lfxrllf.exe 106 PID 1048 wrote to memory of 888 1048 tbbtnn.exe 107 PID 1048 wrote to memory of 888 1048 tbbtnn.exe 107 PID 1048 wrote to memory of 888 1048 tbbtnn.exe 107 PID 888 wrote to memory of 3104 888 vpvpj.exe 108 PID 888 wrote to memory of 3104 888 vpvpj.exe 108 PID 888 wrote to memory of 3104 888 vpvpj.exe 108 PID 3104 wrote to memory of 1196 3104 dvddv.exe 109 PID 3104 wrote to memory of 1196 3104 dvddv.exe 109 PID 3104 wrote to memory of 1196 3104 dvddv.exe 109 PID 1196 wrote to memory of 2912 1196 1rrxxxx.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\83011b160c7bfc88d03921004e96b5e0N.exe"C:\Users\Admin\AppData\Local\Temp\83011b160c7bfc88d03921004e96b5e0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\rlxlxrf.exec:\rlxlxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\nhntbh.exec:\nhntbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
\??\c:\pvdpj.exec:\pvdpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\9dvvp.exec:\9dvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\ffxrrrr.exec:\ffxrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\1hhbbb.exec:\1hhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\ppdvj.exec:\ppdvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\5rlxrrl.exec:\5rlxrrl.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\9nttnn.exec:\9nttnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\5fxffxx.exec:\5fxffxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\5btnhn.exec:\5btnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\hbbbbh.exec:\hbbbbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\jjdvv.exec:\jjdvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
\??\c:\bttttt.exec:\bttttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\9ddvp.exec:\9ddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\lfxrllf.exec:\lfxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\tbbtnn.exec:\tbbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\vpvpj.exec:\vpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\dvddv.exec:\dvddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\1rrxxxx.exec:\1rrxxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\3nnhbb.exec:\3nnhbb.exe23⤵
- Executes dropped EXE
PID:2912 -
\??\c:\nbtnhb.exec:\nbtnhb.exe24⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1djjv.exec:\1djjv.exe25⤵
- Executes dropped EXE
PID:4500 -
\??\c:\jddpd.exec:\jddpd.exe26⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xrrfxxr.exec:\xrrfxxr.exe27⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ttbtbb.exec:\ttbtbb.exe28⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bbbttn.exec:\bbbttn.exe29⤵
- Executes dropped EXE
PID:1136 -
\??\c:\jjvpj.exec:\jjvpj.exe30⤵
- Executes dropped EXE
PID:4444 -
\??\c:\pddvp.exec:\pddvp.exe31⤵
- Executes dropped EXE
PID:4772 -
\??\c:\3xxxrrl.exec:\3xxxrrl.exe32⤵
- Executes dropped EXE
PID:2176 -
\??\c:\tbbnbt.exec:\tbbnbt.exe33⤵
- Executes dropped EXE
PID:4408 -
\??\c:\htttnn.exec:\htttnn.exe34⤵
- Executes dropped EXE
PID:4404 -
\??\c:\pjdvv.exec:\pjdvv.exe35⤵
- Executes dropped EXE
PID:64 -
\??\c:\pvddp.exec:\pvddp.exe36⤵
- Executes dropped EXE
PID:4304 -
\??\c:\rlxrrrx.exec:\rlxrrrx.exe37⤵
- Executes dropped EXE
PID:2564 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe38⤵
- Executes dropped EXE
PID:3708 -
\??\c:\9bbbtb.exec:\9bbbtb.exe39⤵
- Executes dropped EXE
PID:1176 -
\??\c:\nhtnnn.exec:\nhtnnn.exe40⤵
- Executes dropped EXE
PID:1936 -
\??\c:\dvpjd.exec:\dvpjd.exe41⤵
- Executes dropped EXE
PID:3564 -
\??\c:\vppjj.exec:\vppjj.exe42⤵
- Executes dropped EXE
PID:3840 -
\??\c:\fllffxx.exec:\fllffxx.exe43⤵
- Executes dropped EXE
PID:3672 -
\??\c:\lfrlrrl.exec:\lfrlrrl.exe44⤵
- Executes dropped EXE
PID:4052 -
\??\c:\7bhbhb.exec:\7bhbhb.exe45⤵
- Executes dropped EXE
PID:3484 -
\??\c:\tnnhbt.exec:\tnnhbt.exe46⤵
- Executes dropped EXE
PID:3872 -
\??\c:\djdpp.exec:\djdpp.exe47⤵
- Executes dropped EXE
PID:1376 -
\??\c:\5ppvj.exec:\5ppvj.exe48⤵
- Executes dropped EXE
PID:3212 -
\??\c:\llrrlll.exec:\llrrlll.exe49⤵
- Executes dropped EXE
PID:3356 -
\??\c:\frfxllx.exec:\frfxllx.exe50⤵
- Executes dropped EXE
PID:2264 -
\??\c:\thtbtn.exec:\thtbtn.exe51⤵
- Executes dropped EXE
PID:5024 -
\??\c:\1jjdv.exec:\1jjdv.exe52⤵
- Executes dropped EXE
PID:640 -
\??\c:\pvdvp.exec:\pvdvp.exe53⤵
- Executes dropped EXE
PID:1864 -
\??\c:\1lrlllr.exec:\1lrlllr.exe54⤵
- Executes dropped EXE
PID:440 -
\??\c:\rfrlrlr.exec:\rfrlrlr.exe55⤵
- Executes dropped EXE
PID:3788 -
\??\c:\htbthh.exec:\htbthh.exe56⤵
- Executes dropped EXE
PID:5020 -
\??\c:\hnnhhh.exec:\hnnhhh.exe57⤵
- Executes dropped EXE
PID:1860 -
\??\c:\djppp.exec:\djppp.exe58⤵
- Executes dropped EXE
PID:2972 -
\??\c:\rrffrfx.exec:\rrffrfx.exe59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1660 -
\??\c:\rrrrllf.exec:\rrrrllf.exe60⤵
- Executes dropped EXE
PID:4484 -
\??\c:\7nhhbb.exec:\7nhhbb.exe61⤵
- Executes dropped EXE
PID:4572 -
\??\c:\1pvpd.exec:\1pvpd.exe62⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jdjjd.exec:\jdjjd.exe63⤵
- Executes dropped EXE
PID:3284 -
\??\c:\xflfrrl.exec:\xflfrrl.exe64⤵
- Executes dropped EXE
PID:2444 -
\??\c:\flflfxr.exec:\flflfxr.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\thtthb.exec:\thtthb.exe66⤵PID:3060
-
\??\c:\hbbttn.exec:\hbbttn.exe67⤵PID:5084
-
\??\c:\jdvpj.exec:\jdvpj.exe68⤵PID:1652
-
\??\c:\5fxxlll.exec:\5fxxlll.exe69⤵PID:2912
-
\??\c:\llxrrrf.exec:\llxrrrf.exe70⤵PID:5060
-
\??\c:\nbtnbb.exec:\nbtnbb.exe71⤵PID:3440
-
\??\c:\bttnnn.exec:\bttnnn.exe72⤵PID:3432
-
\??\c:\jvvdv.exec:\jvvdv.exe73⤵PID:2088
-
\??\c:\rfxrrrl.exec:\rfxrrrl.exe74⤵PID:1388
-
\??\c:\nntntt.exec:\nntntt.exe75⤵PID:1264
-
\??\c:\nbbtnn.exec:\nbbtnn.exe76⤵PID:2836
-
\??\c:\dvdjj.exec:\dvdjj.exe77⤵PID:1136
-
\??\c:\pjjdp.exec:\pjjdp.exe78⤵PID:1856
-
\??\c:\djjdd.exec:\djjdd.exe79⤵PID:1256
-
\??\c:\rffxrrl.exec:\rffxrrl.exe80⤵PID:3504
-
\??\c:\xrrrllf.exec:\xrrrllf.exe81⤵PID:4176
-
\??\c:\7bhhbb.exec:\7bhhbb.exe82⤵PID:2196
-
\??\c:\pjvpj.exec:\pjvpj.exe83⤵PID:4308
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe84⤵PID:4504
-
\??\c:\xlfxrfx.exec:\xlfxrfx.exe85⤵PID:2388
-
\??\c:\hbbbtt.exec:\hbbbtt.exe86⤵PID:3608
-
\??\c:\jddvj.exec:\jddvj.exe87⤵PID:1772
-
\??\c:\jvvvp.exec:\jvvvp.exe88⤵PID:2732
-
\??\c:\5fxrffx.exec:\5fxrffx.exe89⤵PID:1876
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe90⤵PID:3528
-
\??\c:\tntnht.exec:\tntnht.exe91⤵PID:3532
-
\??\c:\bnthnn.exec:\bnthnn.exe92⤵PID:4992
-
\??\c:\dpjdv.exec:\dpjdv.exe93⤵PID:1180
-
\??\c:\lllfrrr.exec:\lllfrrr.exe94⤵PID:4256
-
\??\c:\nhtttt.exec:\nhtttt.exe95⤵PID:1484
-
\??\c:\bnnhtb.exec:\bnnhtb.exe96⤵PID:2536
-
\??\c:\djjjd.exec:\djjjd.exe97⤵PID:4796
-
\??\c:\vjjdp.exec:\vjjdp.exe98⤵PID:3312
-
\??\c:\flffrxr.exec:\flffrxr.exe99⤵PID:2616
-
\??\c:\llfflll.exec:\llfflll.exe100⤵PID:5104
-
\??\c:\bntntn.exec:\bntntn.exe101⤵PID:3752
-
\??\c:\btbttt.exec:\btbttt.exe102⤵PID:2668
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe103⤵PID:1724
-
\??\c:\bnnhbb.exec:\bnnhbb.exe104⤵PID:4544
-
\??\c:\bntnnn.exec:\bntnnn.exe105⤵PID:3496
-
\??\c:\jjvvd.exec:\jjvvd.exe106⤵PID:2312
-
\??\c:\3vvvp.exec:\3vvvp.exe107⤵PID:1032
-
\??\c:\7xfxllr.exec:\7xfxllr.exe108⤵PID:5040
-
\??\c:\xfrxrlr.exec:\xfrxrlr.exe109⤵PID:3940
-
\??\c:\bthhtt.exec:\bthhtt.exe110⤵PID:376
-
\??\c:\pvvvv.exec:\pvvvv.exe111⤵PID:4048
-
\??\c:\pjpjj.exec:\pjpjj.exe112⤵PID:2448
-
\??\c:\xfxrrrf.exec:\xfxrrrf.exe113⤵PID:3004
-
\??\c:\lfllfll.exec:\lfllfll.exe114⤵PID:3104
-
\??\c:\3hbbth.exec:\3hbbth.exe115⤵PID:2460
-
\??\c:\nhnhnh.exec:\nhnhnh.exe116⤵PID:1260
-
\??\c:\1pdpj.exec:\1pdpj.exe117⤵PID:3952
-
\??\c:\7pvvv.exec:\7pvvv.exe118⤵PID:2772
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe119⤵PID:4024
-
\??\c:\xrxrfxf.exec:\xrxrfxf.exe120⤵
- System Location Discovery: System Language Discovery
PID:4704 -
\??\c:\tnntnt.exec:\tnntnt.exe121⤵PID:4236
-
\??\c:\bththb.exec:\bththb.exe122⤵PID:4276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-