Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 16:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
490e934f46974786dab38398928dc4f0N.exe
Resource
win7-20240704-en
windows7-x64
6 signatures
120 seconds
General
-
Target
490e934f46974786dab38398928dc4f0N.exe
-
Size
106KB
-
MD5
490e934f46974786dab38398928dc4f0
-
SHA1
ed18d4739888f3844bcaf8a372c405b7414013a2
-
SHA256
aff61582365b4b40262a068c03faf58711e3c58febc67a8009c2c4c7c0c11da3
-
SHA512
954f945ca0ad67512d132463ca48667d8fae70d40e2a8884dcfb789a2bcc499c1541fbe9f4a0fb2c7b43c891c0f728fc0f2410fdd52654d8ea73f7c074d8b9b3
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KVT+buwUGu3P3CmC+:n3C9BRo7MlrWKVT+buBGu3PHC+
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
resource yara_rule behavioral2/memory/2356-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/972-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/800-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4668 jdpdj.exe 2852 w82086.exe 1972 04648.exe 1068 9xxlxxl.exe 4644 06604.exe 2272 6082648.exe 2704 rlxrlxr.exe 1220 1xflflx.exe 4064 bnnntt.exe 3996 fffxlfx.exe 4284 40004.exe 972 fllrxff.exe 800 ffxxllx.exe 3748 0062644.exe 3296 ntnhbh.exe 3096 dvpjd.exe 2756 btnbtt.exe 3840 nhbbtt.exe 4628 jjjvj.exe 4968 820000.exe 3188 jjddd.exe 1448 q44826.exe 4804 rlxxxrf.exe 4984 w68444.exe 4460 884646.exe 2976 2860044.exe 2932 4644888.exe 1976 0426224.exe 5000 hhnnbb.exe 1740 0068288.exe 1408 606222.exe 2456 i406668.exe 3024 440822.exe 2628 bhhnbb.exe 3508 0066000.exe 3044 2448260.exe 4064 i026666.exe 4408 rrrfrxl.exe 984 44622.exe 1392 e24844.exe 4916 684428.exe 4716 6888888.exe 4540 rllllrr.exe 4660 fxrlxxf.exe 3984 02822.exe 1088 i000444.exe 416 82882.exe 2728 vdjdj.exe 2756 tbnnhh.exe 3352 bthbbb.exe 4052 220840.exe 2036 20082.exe 4012 ttbthh.exe 656 s0000.exe 4484 pdddv.exe 4000 602288.exe 1108 08660.exe 2320 c000884.exe 4860 680222.exe 2860 g8000.exe 5096 hbhhnn.exe 924 6004822.exe 1416 ddddd.exe 5000 hbtttt.exe -
resource yara_rule behavioral2/memory/2356-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/972-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/800-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lffffrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbbthh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xllfxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language w68444.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 02822.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7rlfrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jdddv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxrlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rffffff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9xxlxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnthhb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1lflxxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrlffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 828828.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 44622.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ththb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6244226.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4826404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24086.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 4668 2356 490e934f46974786dab38398928dc4f0N.exe 90 PID 2356 wrote to memory of 4668 2356 490e934f46974786dab38398928dc4f0N.exe 90 PID 2356 wrote to memory of 4668 2356 490e934f46974786dab38398928dc4f0N.exe 90 PID 4668 wrote to memory of 2852 4668 jdpdj.exe 91 PID 4668 wrote to memory of 2852 4668 jdpdj.exe 91 PID 4668 wrote to memory of 2852 4668 jdpdj.exe 91 PID 2852 wrote to memory of 1972 2852 w82086.exe 92 PID 2852 wrote to memory of 1972 2852 w82086.exe 92 PID 2852 wrote to memory of 1972 2852 w82086.exe 92 PID 1972 wrote to memory of 1068 1972 04648.exe 93 PID 1972 wrote to memory of 1068 1972 04648.exe 93 PID 1972 wrote to memory of 1068 1972 04648.exe 93 PID 1068 wrote to memory of 4644 1068 9xxlxxl.exe 94 PID 1068 wrote to memory of 4644 1068 9xxlxxl.exe 94 PID 1068 wrote to memory of 4644 1068 9xxlxxl.exe 94 PID 4644 wrote to memory of 2272 4644 06604.exe 95 PID 4644 wrote to memory of 2272 4644 06604.exe 95 PID 4644 wrote to memory of 2272 4644 06604.exe 95 PID 2272 wrote to memory of 2704 2272 6082648.exe 97 PID 2272 wrote to memory of 2704 2272 6082648.exe 97 PID 2272 wrote to memory of 2704 2272 6082648.exe 97 PID 2704 wrote to memory of 1220 2704 rlxrlxr.exe 98 PID 2704 wrote to memory of 1220 2704 rlxrlxr.exe 98 PID 2704 wrote to memory of 1220 2704 rlxrlxr.exe 98 PID 1220 wrote to memory of 4064 1220 1xflflx.exe 99 PID 1220 wrote to memory of 4064 1220 1xflflx.exe 99 PID 1220 wrote to memory of 4064 1220 1xflflx.exe 99 PID 4064 wrote to memory of 3996 4064 bnnntt.exe 100 PID 4064 wrote to memory of 3996 4064 bnnntt.exe 100 PID 4064 wrote to memory of 3996 4064 bnnntt.exe 100 PID 3996 wrote to memory of 4284 3996 fffxlfx.exe 101 PID 3996 wrote to memory of 4284 3996 fffxlfx.exe 101 PID 3996 wrote to memory of 4284 3996 fffxlfx.exe 101 PID 4284 wrote to memory of 972 4284 40004.exe 103 PID 4284 wrote to memory of 972 4284 40004.exe 103 PID 4284 wrote to memory of 972 4284 40004.exe 103 PID 972 wrote to memory of 800 972 fllrxff.exe 104 PID 972 wrote to memory of 800 972 fllrxff.exe 104 PID 972 wrote to memory of 800 972 fllrxff.exe 104 PID 800 wrote to memory of 3748 800 ffxxllx.exe 105 PID 800 wrote to memory of 3748 800 ffxxllx.exe 105 PID 800 wrote to memory of 3748 800 ffxxllx.exe 105 PID 3748 wrote to memory of 3296 3748 0062644.exe 106 PID 3748 wrote to memory of 3296 3748 0062644.exe 106 PID 3748 wrote to memory of 3296 3748 0062644.exe 106 PID 3296 wrote to memory of 3096 3296 ntnhbh.exe 108 PID 3296 wrote to memory of 3096 3296 ntnhbh.exe 108 PID 3296 wrote to memory of 3096 3296 ntnhbh.exe 108 PID 3096 wrote to memory of 2756 3096 dvpjd.exe 109 PID 3096 wrote to memory of 2756 3096 dvpjd.exe 109 PID 3096 wrote to memory of 2756 3096 dvpjd.exe 109 PID 2756 wrote to memory of 3840 2756 btnbtt.exe 110 PID 2756 wrote to memory of 3840 2756 btnbtt.exe 110 PID 2756 wrote to memory of 3840 2756 btnbtt.exe 110 PID 3840 wrote to memory of 4628 3840 nhbbtt.exe 111 PID 3840 wrote to memory of 4628 3840 nhbbtt.exe 111 PID 3840 wrote to memory of 4628 3840 nhbbtt.exe 111 PID 4628 wrote to memory of 4968 4628 jjjvj.exe 112 PID 4628 wrote to memory of 4968 4628 jjjvj.exe 112 PID 4628 wrote to memory of 4968 4628 jjjvj.exe 112 PID 4968 wrote to memory of 3188 4968 820000.exe 113 PID 4968 wrote to memory of 3188 4968 820000.exe 113 PID 4968 wrote to memory of 3188 4968 820000.exe 113 PID 3188 wrote to memory of 1448 3188 jjddd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\490e934f46974786dab38398928dc4f0N.exe"C:\Users\Admin\AppData\Local\Temp\490e934f46974786dab38398928dc4f0N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\jdpdj.exec:\jdpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\w82086.exec:\w82086.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\04648.exec:\04648.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\9xxlxxl.exec:\9xxlxxl.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\06604.exec:\06604.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\6082648.exec:\6082648.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\rlxrlxr.exec:\rlxrlxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\1xflflx.exec:\1xflflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\bnnntt.exec:\bnnntt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\fffxlfx.exec:\fffxlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\40004.exec:\40004.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\fllrxff.exec:\fllrxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\ffxxllx.exec:\ffxxllx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
\??\c:\0062644.exec:\0062644.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\ntnhbh.exec:\ntnhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
\??\c:\dvpjd.exec:\dvpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\btnbtt.exec:\btnbtt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\nhbbtt.exec:\nhbbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\jjjvj.exec:\jjjvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\820000.exec:\820000.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\jjddd.exec:\jjddd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\q44826.exec:\q44826.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rlxxxrf.exec:\rlxxxrf.exe24⤵
- Executes dropped EXE
PID:4804 -
\??\c:\w68444.exec:\w68444.exe25⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4984 -
\??\c:\884646.exec:\884646.exe26⤵
- Executes dropped EXE
PID:4460 -
\??\c:\2860044.exec:\2860044.exe27⤵
- Executes dropped EXE
PID:2976 -
\??\c:\4644888.exec:\4644888.exe28⤵
- Executes dropped EXE
PID:2932 -
\??\c:\0426224.exec:\0426224.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\hhnnbb.exec:\hhnnbb.exe30⤵
- Executes dropped EXE
PID:5000 -
\??\c:\0068288.exec:\0068288.exe31⤵
- Executes dropped EXE
PID:1740 -
\??\c:\606222.exec:\606222.exe32⤵
- Executes dropped EXE
PID:1408 -
\??\c:\i406668.exec:\i406668.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\440822.exec:\440822.exe34⤵
- Executes dropped EXE
PID:3024 -
\??\c:\bhhnbb.exec:\bhhnbb.exe35⤵
- Executes dropped EXE
PID:2628 -
\??\c:\0066000.exec:\0066000.exe36⤵
- Executes dropped EXE
PID:3508 -
\??\c:\2448260.exec:\2448260.exe37⤵
- Executes dropped EXE
PID:3044 -
\??\c:\i026666.exec:\i026666.exe38⤵
- Executes dropped EXE
PID:4064 -
\??\c:\rrrfrxl.exec:\rrrfrxl.exe39⤵
- Executes dropped EXE
PID:4408 -
\??\c:\44622.exec:\44622.exe40⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:984 -
\??\c:\e24844.exec:\e24844.exe41⤵
- Executes dropped EXE
PID:1392 -
\??\c:\684428.exec:\684428.exe42⤵
- Executes dropped EXE
PID:4916 -
\??\c:\6888888.exec:\6888888.exe43⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllllrr.exec:\rllllrr.exe44⤵
- Executes dropped EXE
PID:4540 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe45⤵
- Executes dropped EXE
PID:4660 -
\??\c:\02822.exec:\02822.exe46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3984 -
\??\c:\i000444.exec:\i000444.exe47⤵
- Executes dropped EXE
PID:1088 -
\??\c:\82882.exec:\82882.exe48⤵
- Executes dropped EXE
PID:416 -
\??\c:\vdjdj.exec:\vdjdj.exe49⤵
- Executes dropped EXE
PID:2728 -
\??\c:\tbnnhh.exec:\tbnnhh.exe50⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bthbbb.exec:\bthbbb.exe51⤵
- Executes dropped EXE
PID:3352 -
\??\c:\220840.exec:\220840.exe52⤵
- Executes dropped EXE
PID:4052 -
\??\c:\20082.exec:\20082.exe53⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ttbthh.exec:\ttbthh.exe54⤵
- Executes dropped EXE
PID:4012 -
\??\c:\s0000.exec:\s0000.exe55⤵
- Executes dropped EXE
PID:656 -
\??\c:\pdddv.exec:\pdddv.exe56⤵
- Executes dropped EXE
PID:4484 -
\??\c:\602288.exec:\602288.exe57⤵
- Executes dropped EXE
PID:4000 -
\??\c:\08660.exec:\08660.exe58⤵
- Executes dropped EXE
PID:1108 -
\??\c:\c000884.exec:\c000884.exe59⤵
- Executes dropped EXE
PID:2320 -
\??\c:\680222.exec:\680222.exe60⤵
- Executes dropped EXE
PID:4860 -
\??\c:\g8000.exec:\g8000.exe61⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hbhhnn.exec:\hbhhnn.exe62⤵
- Executes dropped EXE
PID:5096 -
\??\c:\6004822.exec:\6004822.exe63⤵
- Executes dropped EXE
PID:924 -
\??\c:\ddddd.exec:\ddddd.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hbtttt.exec:\hbtttt.exe65⤵
- Executes dropped EXE
PID:5000 -
\??\c:\40648.exec:\40648.exe66⤵PID:1740
-
\??\c:\4680444.exec:\4680444.exe67⤵PID:2692
-
\??\c:\k22260.exec:\k22260.exe68⤵PID:4680
-
\??\c:\rlrlllx.exec:\rlrlllx.exe69⤵PID:3344
-
\??\c:\2888222.exec:\2888222.exe70⤵PID:4516
-
\??\c:\9dpvp.exec:\9dpvp.exe71⤵PID:3480
-
\??\c:\262828.exec:\262828.exe72⤵PID:4352
-
\??\c:\7ddjd.exec:\7ddjd.exe73⤵PID:1256
-
\??\c:\800260.exec:\800260.exe74⤵PID:4160
-
\??\c:\nthhbb.exec:\nthhbb.exe75⤵PID:4488
-
\??\c:\9lrrrrf.exec:\9lrrrrf.exe76⤵PID:4076
-
\??\c:\462260.exec:\462260.exe77⤵PID:1316
-
\??\c:\pjdvp.exec:\pjdvp.exe78⤵PID:5116
-
\??\c:\lfffxxf.exec:\lfffxxf.exe79⤵PID:520
-
\??\c:\02826.exec:\02826.exe80⤵PID:2992
-
\??\c:\5ffxxxf.exec:\5ffxxxf.exe81⤵PID:1388
-
\??\c:\lfxfxll.exec:\lfxfxll.exe82⤵PID:1552
-
\??\c:\ntbtnn.exec:\ntbtnn.exe83⤵PID:3396
-
\??\c:\2022222.exec:\2022222.exe84⤵PID:4472
-
\??\c:\842862.exec:\842862.exe85⤵PID:536
-
\??\c:\xrlrlxr.exec:\xrlrlxr.exe86⤵PID:2756
-
\??\c:\jjpdp.exec:\jjpdp.exe87⤵PID:3352
-
\??\c:\nhhbtt.exec:\nhhbtt.exe88⤵PID:4052
-
\??\c:\e64628.exec:\e64628.exe89⤵PID:4884
-
\??\c:\nhhhnn.exec:\nhhhnn.exe90⤵PID:4012
-
\??\c:\fffflfl.exec:\fffflfl.exe91⤵PID:3500
-
\??\c:\48448.exec:\48448.exe92⤵PID:4484
-
\??\c:\rlllxxf.exec:\rlllxxf.exe93⤵PID:2920
-
\??\c:\a2222.exec:\a2222.exe94⤵PID:1560
-
\??\c:\8426222.exec:\8426222.exe95⤵PID:2428
-
\??\c:\hhbbbb.exec:\hhbbbb.exe96⤵PID:4860
-
\??\c:\vjppp.exec:\vjppp.exe97⤵PID:2860
-
\??\c:\htnnhn.exec:\htnnhn.exe98⤵PID:1976
-
\??\c:\i222646.exec:\i222646.exe99⤵PID:924
-
\??\c:\7btnht.exec:\7btnht.exe100⤵PID:1744
-
\??\c:\dvpjp.exec:\dvpjp.exe101⤵PID:1068
-
\??\c:\ppddd.exec:\ppddd.exe102⤵PID:1408
-
\??\c:\bttnhh.exec:\bttnhh.exe103⤵PID:1328
-
\??\c:\8066060.exec:\8066060.exe104⤵PID:4464
-
\??\c:\ttnhhh.exec:\ttnhhh.exe105⤵PID:3344
-
\??\c:\bhtbnn.exec:\bhtbnn.exe106⤵PID:4516
-
\??\c:\jjvvd.exec:\jjvvd.exe107⤵PID:3480
-
\??\c:\xxllffx.exec:\xxllffx.exe108⤵PID:4708
-
\??\c:\rfrlfrl.exec:\rfrlfrl.exe109⤵PID:3520
-
\??\c:\rlxxffl.exec:\rlxxffl.exe110⤵PID:696
-
\??\c:\rfrrxfx.exec:\rfrrxfx.exe111⤵PID:4488
-
\??\c:\2222444.exec:\2222444.exe112⤵PID:3052
-
\??\c:\w40480.exec:\w40480.exe113⤵PID:1316
-
\??\c:\2028666.exec:\2028666.exe114⤵PID:3924
-
\??\c:\bnnnnn.exec:\bnnnnn.exe115⤵PID:520
-
\??\c:\bnbtnn.exec:\bnbtnn.exe116⤵PID:2992
-
\??\c:\vvvpj.exec:\vvvpj.exe117⤵PID:1860
-
\??\c:\dvvpv.exec:\dvvpv.exe118⤵PID:1596
-
\??\c:\jjddv.exec:\jjddv.exe119⤵PID:5088
-
\??\c:\jdvpp.exec:\jdvpp.exe120⤵PID:988
-
\??\c:\i660882.exec:\i660882.exe121⤵PID:4712
-
\??\c:\bntbbt.exec:\bntbbt.exe122⤵PID:3992
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-