Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 05:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe
Resource
win7-20240903-en
6 signatures
120 seconds
General
-
Target
e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe
-
Size
82KB
-
MD5
e8b5ea779ca5e7cbf75b5ff3bed56f00
-
SHA1
5e4bd02e61af4e1c619a77ae29bf3d561214f341
-
SHA256
da0c1163a660f18346745a9c20f2bf00530bd86661d076a1af8e3b2b65c1d6d1
-
SHA512
4df2e0a10f51b56adf5d7bb17d78515456cc626d9224b01f82573b3dc4e257a8bfe017b01182a5cec576f3544a50e882741abb64ae9326f0353807730479d856
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIIpIo60L9QrrA89QB:ymb3NkkiQ3mdBjFIIp9L9QrrA8Y
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
resource yara_rule behavioral1/memory/2176-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1268-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2800-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2760-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2752-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3044-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2620-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1160-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2900-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1896-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1332-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3012-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2072-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1144-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2888-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2532-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-294-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2324-312-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2388 pdjjj.exe 1268 ddpjv.exe 2800 thhtth.exe 2760 1dddv.exe 2752 jvddd.exe 3044 lfrrxrr.exe 1192 htbtbb.exe 2620 vjjpv.exe 2792 xrlxxll.exe 1160 tnnhht.exe 2984 bthhnh.exe 1640 pjpjv.exe 2692 9vvdp.exe 2900 llxxfxx.exe 1896 nhhntt.exe 1332 nhbbnt.exe 3012 jvpdd.exe 2060 9frllll.exe 2072 nbhhhh.exe 2028 hthtbb.exe 1144 pjvdv.exe 2032 lflrxlr.exe 2888 frfffxx.exe 1764 tnttbt.exe 1884 nthbbb.exe 2532 3vpvj.exe 2392 dvpvd.exe 1876 frfrxxx.exe 1664 frxxxxf.exe 2504 bnhbhb.exe 2324 vpdvd.exe 1680 xrllxfr.exe 540 lxlxflr.exe 2884 bnnthh.exe 2336 5tntth.exe 2760 3jdvv.exe 2856 jdpvp.exe 2708 xlfxffl.exe 2840 flxlfff.exe 2940 tnbbhh.exe 2600 jpdpv.exe 2724 dddjv.exe 1800 rfxxffl.exe 1272 xfrlrlr.exe 1440 hbntbb.exe 3008 nhhtnb.exe 1688 vpdvj.exe 2372 jddpp.exe 2796 frxrlfl.exe 1232 tnbhnt.exe 1248 bthbhh.exe 1756 jddjj.exe 2956 pdvvv.exe 2996 xrlflfl.exe 788 xllrflr.exe 1508 nntbbh.exe 2072 7lflrrx.exe 3064 lfxrxxf.exe 2584 hbbnnh.exe 348 hbbhhh.exe 2644 dvpvv.exe 1256 ddpjj.exe 1340 xxxfrrf.exe 2532 fffllrf.exe -
resource yara_rule behavioral1/memory/2176-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1268-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2800-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2760-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2752-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3044-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1192-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2620-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1160-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2692-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2900-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1896-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1332-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3012-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2072-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1144-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2888-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2532-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-294-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2324-312-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3rxlrxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvddd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jvdvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bthtbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1bhhhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxfllfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbhnth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxrrxxl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2388 2176 e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe 30 PID 2176 wrote to memory of 2388 2176 e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe 30 PID 2176 wrote to memory of 2388 2176 e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe 30 PID 2176 wrote to memory of 2388 2176 e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe 30 PID 2388 wrote to memory of 1268 2388 pdjjj.exe 31 PID 2388 wrote to memory of 1268 2388 pdjjj.exe 31 PID 2388 wrote to memory of 1268 2388 pdjjj.exe 31 PID 2388 wrote to memory of 1268 2388 pdjjj.exe 31 PID 1268 wrote to memory of 2800 1268 ddpjv.exe 32 PID 1268 wrote to memory of 2800 1268 ddpjv.exe 32 PID 1268 wrote to memory of 2800 1268 ddpjv.exe 32 PID 1268 wrote to memory of 2800 1268 ddpjv.exe 32 PID 2800 wrote to memory of 2760 2800 thhtth.exe 33 PID 2800 wrote to memory of 2760 2800 thhtth.exe 33 PID 2800 wrote to memory of 2760 2800 thhtth.exe 33 PID 2800 wrote to memory of 2760 2800 thhtth.exe 33 PID 2760 wrote to memory of 2752 2760 1dddv.exe 34 PID 2760 wrote to memory of 2752 2760 1dddv.exe 34 PID 2760 wrote to memory of 2752 2760 1dddv.exe 34 PID 2760 wrote to memory of 2752 2760 1dddv.exe 34 PID 2752 wrote to memory of 3044 2752 jvddd.exe 35 PID 2752 wrote to memory of 3044 2752 jvddd.exe 35 PID 2752 wrote to memory of 3044 2752 jvddd.exe 35 PID 2752 wrote to memory of 3044 2752 jvddd.exe 35 PID 3044 wrote to memory of 1192 3044 lfrrxrr.exe 36 PID 3044 wrote to memory of 1192 3044 lfrrxrr.exe 36 PID 3044 wrote to memory of 1192 3044 lfrrxrr.exe 36 PID 3044 wrote to memory of 1192 3044 lfrrxrr.exe 36 PID 1192 wrote to memory of 2620 1192 htbtbb.exe 37 PID 1192 wrote to memory of 2620 1192 htbtbb.exe 37 PID 1192 wrote to memory of 2620 1192 htbtbb.exe 37 PID 1192 wrote to memory of 2620 1192 htbtbb.exe 37 PID 2620 wrote to memory of 2792 2620 vjjpv.exe 38 PID 2620 wrote to memory of 2792 2620 vjjpv.exe 38 PID 2620 wrote to memory of 2792 2620 vjjpv.exe 38 PID 2620 wrote to memory of 2792 2620 vjjpv.exe 38 PID 2792 wrote to memory of 1160 2792 xrlxxll.exe 39 PID 2792 wrote to memory of 1160 2792 xrlxxll.exe 39 PID 2792 wrote to memory of 1160 2792 xrlxxll.exe 39 PID 2792 wrote to memory of 1160 2792 xrlxxll.exe 39 PID 1160 wrote to memory of 2984 1160 tnnhht.exe 40 PID 1160 wrote to memory of 2984 1160 tnnhht.exe 40 PID 1160 wrote to memory of 2984 1160 tnnhht.exe 40 PID 1160 wrote to memory of 2984 1160 tnnhht.exe 40 PID 2984 wrote to memory of 1640 2984 bthhnh.exe 41 PID 2984 wrote to memory of 1640 2984 bthhnh.exe 41 PID 2984 wrote to memory of 1640 2984 bthhnh.exe 41 PID 2984 wrote to memory of 1640 2984 bthhnh.exe 41 PID 1640 wrote to memory of 2692 1640 pjpjv.exe 42 PID 1640 wrote to memory of 2692 1640 pjpjv.exe 42 PID 1640 wrote to memory of 2692 1640 pjpjv.exe 42 PID 1640 wrote to memory of 2692 1640 pjpjv.exe 42 PID 2692 wrote to memory of 2900 2692 9vvdp.exe 43 PID 2692 wrote to memory of 2900 2692 9vvdp.exe 43 PID 2692 wrote to memory of 2900 2692 9vvdp.exe 43 PID 2692 wrote to memory of 2900 2692 9vvdp.exe 43 PID 2900 wrote to memory of 1896 2900 llxxfxx.exe 44 PID 2900 wrote to memory of 1896 2900 llxxfxx.exe 44 PID 2900 wrote to memory of 1896 2900 llxxfxx.exe 44 PID 2900 wrote to memory of 1896 2900 llxxfxx.exe 44 PID 1896 wrote to memory of 1332 1896 nhhntt.exe 45 PID 1896 wrote to memory of 1332 1896 nhhntt.exe 45 PID 1896 wrote to memory of 1332 1896 nhhntt.exe 45 PID 1896 wrote to memory of 1332 1896 nhhntt.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe"C:\Users\Admin\AppData\Local\Temp\e8b5ea779ca5e7cbf75b5ff3bed56f00N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pdjjj.exec:\pdjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
\??\c:\ddpjv.exec:\ddpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\thhtth.exec:\thhtth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\1dddv.exec:\1dddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\jvddd.exec:\jvddd.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\lfrrxrr.exec:\lfrrxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\htbtbb.exec:\htbtbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\vjjpv.exec:\vjjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\xrlxxll.exec:\xrlxxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\tnnhht.exec:\tnnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\bthhnh.exec:\bthhnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\pjpjv.exec:\pjpjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\9vvdp.exec:\9vvdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\llxxfxx.exec:\llxxfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\nhhntt.exec:\nhhntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\nhbbnt.exec:\nhbbnt.exe17⤵
- Executes dropped EXE
PID:1332 -
\??\c:\jvpdd.exec:\jvpdd.exe18⤵
- Executes dropped EXE
PID:3012 -
\??\c:\9frllll.exec:\9frllll.exe19⤵
- Executes dropped EXE
PID:2060 -
\??\c:\nbhhhh.exec:\nbhhhh.exe20⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hthtbb.exec:\hthtbb.exe21⤵
- Executes dropped EXE
PID:2028 -
\??\c:\pjvdv.exec:\pjvdv.exe22⤵
- Executes dropped EXE
PID:1144 -
\??\c:\lflrxlr.exec:\lflrxlr.exe23⤵
- Executes dropped EXE
PID:2032 -
\??\c:\frfffxx.exec:\frfffxx.exe24⤵
- Executes dropped EXE
PID:2888 -
\??\c:\tnttbt.exec:\tnttbt.exe25⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nthbbb.exec:\nthbbb.exe26⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3vpvj.exec:\3vpvj.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dvpvd.exec:\dvpvd.exe28⤵
- Executes dropped EXE
PID:2392 -
\??\c:\frfrxxx.exec:\frfrxxx.exe29⤵
- Executes dropped EXE
PID:1876 -
\??\c:\frxxxxf.exec:\frxxxxf.exe30⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bnhbhb.exec:\bnhbhb.exe31⤵
- Executes dropped EXE
PID:2504 -
\??\c:\vpdvd.exec:\vpdvd.exe32⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xrllxfr.exec:\xrllxfr.exe33⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lxlxflr.exec:\lxlxflr.exe34⤵
- Executes dropped EXE
PID:540 -
\??\c:\bnnthh.exec:\bnnthh.exe35⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5tntth.exec:\5tntth.exe36⤵
- Executes dropped EXE
PID:2336 -
\??\c:\3jdvv.exec:\3jdvv.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jdpvp.exec:\jdpvp.exe38⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xlfxffl.exec:\xlfxffl.exe39⤵
- Executes dropped EXE
PID:2708 -
\??\c:\flxlfff.exec:\flxlfff.exe40⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tnbbhh.exec:\tnbbhh.exe41⤵
- Executes dropped EXE
PID:2940 -
\??\c:\jpdpv.exec:\jpdpv.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\dddjv.exec:\dddjv.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\rfxxffl.exec:\rfxxffl.exe44⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xfrlrlr.exec:\xfrlrlr.exe45⤵
- Executes dropped EXE
PID:1272 -
\??\c:\hbntbb.exec:\hbntbb.exe46⤵
- Executes dropped EXE
PID:1440 -
\??\c:\nhhtnb.exec:\nhhtnb.exe47⤵
- Executes dropped EXE
PID:3008 -
\??\c:\vpdvj.exec:\vpdvj.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\jddpp.exec:\jddpp.exe49⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372 -
\??\c:\frxrlfl.exec:\frxrlfl.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tnbhnt.exec:\tnbhnt.exe51⤵
- Executes dropped EXE
PID:1232 -
\??\c:\bthbhh.exec:\bthbhh.exe52⤵
- Executes dropped EXE
PID:1248 -
\??\c:\jddjj.exec:\jddjj.exe53⤵
- Executes dropped EXE
PID:1756 -
\??\c:\pdvvv.exec:\pdvvv.exe54⤵
- Executes dropped EXE
PID:2956 -
\??\c:\xrlflfl.exec:\xrlflfl.exe55⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xllrflr.exec:\xllrflr.exe56⤵
- Executes dropped EXE
PID:788 -
\??\c:\nntbbh.exec:\nntbbh.exe57⤵
- Executes dropped EXE
PID:1508 -
\??\c:\7lflrrx.exec:\7lflrrx.exe58⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lfxrxxf.exec:\lfxrxxf.exe59⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbbnnh.exec:\hbbnnh.exe60⤵
- Executes dropped EXE
PID:2584 -
\??\c:\hbbhhh.exec:\hbbhhh.exe61⤵
- Executes dropped EXE
PID:348 -
\??\c:\dvpvv.exec:\dvpvv.exe62⤵
- Executes dropped EXE
PID:2644 -
\??\c:\ddpjj.exec:\ddpjj.exe63⤵
- Executes dropped EXE
PID:1256 -
\??\c:\xxxfrrf.exec:\xxxfrrf.exe64⤵
- Executes dropped EXE
PID:1340 -
\??\c:\fffllrf.exec:\fffllrf.exe65⤵
- Executes dropped EXE
PID:2532 -
\??\c:\hbnntn.exec:\hbnntn.exe66⤵PID:2404
-
\??\c:\3htnnt.exec:\3htnnt.exe67⤵PID:1820
-
\??\c:\3htttt.exec:\3htttt.exe68⤵PID:1048
-
\??\c:\3pddj.exec:\3pddj.exe69⤵PID:2260
-
\??\c:\9rllrrf.exec:\9rllrrf.exe70⤵PID:1708
-
\??\c:\1ffrxxr.exec:\1ffrxxr.exe71⤵PID:1260
-
\??\c:\bthtbh.exec:\bthtbh.exe72⤵
- System Location Discovery: System Language Discovery
PID:2480 -
\??\c:\btthnn.exec:\btthnn.exe73⤵PID:2328
-
\??\c:\ppjdj.exec:\ppjdj.exe74⤵PID:2128
-
\??\c:\pdpvd.exec:\pdpvd.exe75⤵PID:2460
-
\??\c:\9lxfffl.exec:\9lxfffl.exe76⤵PID:2816
-
\??\c:\xrffrrx.exec:\xrffrrx.exe77⤵PID:3052
-
\??\c:\5ntntn.exec:\5ntntn.exe78⤵PID:2200
-
\??\c:\5bttbh.exec:\5bttbh.exe79⤵PID:2872
-
\??\c:\dpddj.exec:\dpddj.exe80⤵PID:2776
-
\??\c:\pjvvd.exec:\pjvvd.exe81⤵PID:2788
-
\??\c:\3fxlxrx.exec:\3fxlxrx.exe82⤵PID:1192
-
\??\c:\3rlrxfl.exec:\3rlrxfl.exe83⤵PID:2620
-
\??\c:\5thhnt.exec:\5thhnt.exe84⤵PID:1132
-
\??\c:\3httnt.exec:\3httnt.exe85⤵PID:1328
-
\??\c:\vpjpp.exec:\vpjpp.exe86⤵PID:1348
-
\??\c:\jdddd.exec:\jdddd.exe87⤵PID:2140
-
\??\c:\lxlfflr.exec:\lxlfflr.exe88⤵PID:2916
-
\??\c:\5rlrxfr.exec:\5rlrxfr.exe89⤵PID:2844
-
\??\c:\9bbtnt.exec:\9bbtnt.exe90⤵PID:2960
-
\??\c:\1nhntt.exec:\1nhntt.exe91⤵PID:3024
-
\??\c:\pdpdj.exec:\pdpdj.exe92⤵PID:2044
-
\??\c:\dpvvp.exec:\dpvvp.exe93⤵PID:2016
-
\??\c:\lfrllfl.exec:\lfrllfl.exe94⤵PID:1972
-
\??\c:\3rfrxxf.exec:\3rfrxxf.exe95⤵PID:1824
-
\??\c:\tntttt.exec:\tntttt.exe96⤵PID:2196
-
\??\c:\bthntn.exec:\bthntn.exe97⤵PID:2076
-
\??\c:\9nhhhh.exec:\9nhhhh.exe98⤵PID:2028
-
\??\c:\dvjvp.exec:\dvjvp.exe99⤵PID:1720
-
\??\c:\pjdvv.exec:\pjdvv.exe100⤵PID:1600
-
\??\c:\lxffflr.exec:\lxffflr.exe101⤵PID:1744
-
\??\c:\lxlxllr.exec:\lxlxllr.exe102⤵PID:2572
-
\??\c:\7bhntt.exec:\7bhntt.exe103⤵PID:1500
-
\??\c:\bbhbbh.exec:\bbhbbh.exe104⤵PID:1884
-
\??\c:\9bnnbh.exec:\9bnnbh.exe105⤵PID:2508
-
\??\c:\dvjpv.exec:\dvjpv.exe106⤵PID:2280
-
\??\c:\dvddd.exec:\dvddd.exe107⤵PID:884
-
\??\c:\5rlfllr.exec:\5rlfllr.exe108⤵PID:1620
-
\??\c:\3rfffrf.exec:\3rfffrf.exe109⤵PID:1668
-
\??\c:\bthhnt.exec:\bthhnt.exe110⤵PID:2408
-
\??\c:\tnnnbh.exec:\tnnnbh.exe111⤵PID:356
-
\??\c:\vpjjp.exec:\vpjjp.exe112⤵PID:2580
-
\??\c:\1pjdj.exec:\1pjdj.exe113⤵PID:1680
-
\??\c:\1xrrfxl.exec:\1xrrfxl.exe114⤵PID:2184
-
\??\c:\9lrffrr.exec:\9lrffrr.exe115⤵PID:2820
-
\??\c:\nnnnnt.exec:\nnnnnt.exe116⤵PID:2800
-
\??\c:\hhhhth.exec:\hhhhth.exe117⤵PID:2860
-
\??\c:\1jddd.exec:\1jddd.exe118⤵PID:2736
-
\??\c:\5jdvv.exec:\5jdvv.exe119⤵PID:2752
-
\??\c:\7xfxrrx.exec:\7xfxrrx.exe120⤵PID:2640
-
\??\c:\llllllr.exec:\llllllr.exe121⤵PID:2940
-
\??\c:\hhtbhn.exec:\hhtbhn.exe122⤵PID:2616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-