Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 18:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
-
Target
060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe
-
Size
64KB
-
MD5
b4988fec4542896684d24990aef04412
-
SHA1
e98f6dcd7121bbf51cbdea53418d1acd647a1ae7
-
SHA256
060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60
-
SHA512
6eaeb84effff8c600c8751bd45843e635f330380ded234ae149a3e5ff19eceb6b239125de2eaf5a61e4be374539fb1a2fdfb74a1c510b98d203392bdffce6ebd
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDI9L27mS:ymb3NkkiQ3mdBjFI9W
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/4772-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/732-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2392 rfxlxrl.exe 4324 nbhbtt.exe 3500 jvvjv.exe 3136 1vpdd.exe 4784 fxffrlf.exe 2488 7bttnh.exe 3632 7nnbnh.exe 2860 5vddp.exe 4032 thnbtn.exe 1444 vjpdd.exe 3552 jvdvp.exe 3484 frrlfxl.exe 4512 7thhbb.exe 1092 nnhbhb.exe 3280 5jvpj.exe 2964 ffxlffx.exe 1888 htnntt.exe 1828 hnntht.exe 8 vpvpj.exe 1032 xlxlxxl.exe 4580 nbnbhb.exe 3940 1hnbbh.exe 732 dvjdp.exe 4316 1flfllr.exe 1320 bbnntt.exe 3340 ppdvv.exe 2952 jpddv.exe 4000 9ffxrrl.exe 4100 xxxrffx.exe 1132 nhtnbb.exe 900 vpvdv.exe 3720 llfllrr.exe 2644 lfllfxr.exe 4504 nnnhhb.exe 4768 djppj.exe 1968 rflfrlx.exe 4952 ntbntn.exe 4680 nhnbbb.exe 3968 pjvpd.exe 4392 lfxlfff.exe 4436 lffffxf.exe 4992 tbtnbt.exe 4268 tntnbh.exe 456 jdpjd.exe 4912 3vpjv.exe 804 3xffrrl.exe 1652 fxxrllf.exe 1964 hhhbtt.exe 2488 nnhhtt.exe 2824 dvdpj.exe 1728 3vpjv.exe 5072 ffllrrx.exe 872 rffxrlx.exe 2872 3tbnhb.exe 2528 hhbnhn.exe 3664 jjpjv.exe 4672 1vvvj.exe 4084 3llfrrf.exe 3460 rlrxxxx.exe 756 nnhhbb.exe 2608 bbbbhn.exe 2536 ppdvj.exe 4696 ppjjd.exe 1888 5rrlfxr.exe -
resource yara_rule behavioral2/memory/4772-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/732-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-196-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pjpjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlxxxxx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxrrxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxllrrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhtbnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntbntn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language btbtbn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bnhtnh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnhhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxxxrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pppdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbbbhn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hbhbhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ffllffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jppvv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvdpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhbtbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 2392 4772 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 83 PID 4772 wrote to memory of 2392 4772 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 83 PID 4772 wrote to memory of 2392 4772 060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe 83 PID 2392 wrote to memory of 4324 2392 rfxlxrl.exe 84 PID 2392 wrote to memory of 4324 2392 rfxlxrl.exe 84 PID 2392 wrote to memory of 4324 2392 rfxlxrl.exe 84 PID 4324 wrote to memory of 3500 4324 nbhbtt.exe 85 PID 4324 wrote to memory of 3500 4324 nbhbtt.exe 85 PID 4324 wrote to memory of 3500 4324 nbhbtt.exe 85 PID 3500 wrote to memory of 3136 3500 jvvjv.exe 86 PID 3500 wrote to memory of 3136 3500 jvvjv.exe 86 PID 3500 wrote to memory of 3136 3500 jvvjv.exe 86 PID 3136 wrote to memory of 4784 3136 1vpdd.exe 88 PID 3136 wrote to memory of 4784 3136 1vpdd.exe 88 PID 3136 wrote to memory of 4784 3136 1vpdd.exe 88 PID 4784 wrote to memory of 2488 4784 fxffrlf.exe 89 PID 4784 wrote to memory of 2488 4784 fxffrlf.exe 89 PID 4784 wrote to memory of 2488 4784 fxffrlf.exe 89 PID 2488 wrote to memory of 3632 2488 7bttnh.exe 90 PID 2488 wrote to memory of 3632 2488 7bttnh.exe 90 PID 2488 wrote to memory of 3632 2488 7bttnh.exe 90 PID 3632 wrote to memory of 2860 3632 7nnbnh.exe 91 PID 3632 wrote to memory of 2860 3632 7nnbnh.exe 91 PID 3632 wrote to memory of 2860 3632 7nnbnh.exe 91 PID 2860 wrote to memory of 4032 2860 5vddp.exe 92 PID 2860 wrote to memory of 4032 2860 5vddp.exe 92 PID 2860 wrote to memory of 4032 2860 5vddp.exe 92 PID 4032 wrote to memory of 1444 4032 thnbtn.exe 93 PID 4032 wrote to memory of 1444 4032 thnbtn.exe 93 PID 4032 wrote to memory of 1444 4032 thnbtn.exe 93 PID 1444 wrote to memory of 3552 1444 vjpdd.exe 94 PID 1444 wrote to memory of 3552 1444 vjpdd.exe 94 PID 1444 wrote to memory of 3552 1444 vjpdd.exe 94 PID 3552 wrote to memory of 3484 3552 jvdvp.exe 95 PID 3552 wrote to memory of 3484 3552 jvdvp.exe 95 PID 3552 wrote to memory of 3484 3552 jvdvp.exe 95 PID 3484 wrote to memory of 4512 3484 frrlfxl.exe 96 PID 3484 wrote to memory of 4512 3484 frrlfxl.exe 96 PID 3484 wrote to memory of 4512 3484 frrlfxl.exe 96 PID 4512 wrote to memory of 1092 4512 7thhbb.exe 97 PID 4512 wrote to memory of 1092 4512 7thhbb.exe 97 PID 4512 wrote to memory of 1092 4512 7thhbb.exe 97 PID 1092 wrote to memory of 3280 1092 nnhbhb.exe 99 PID 1092 wrote to memory of 3280 1092 nnhbhb.exe 99 PID 1092 wrote to memory of 3280 1092 nnhbhb.exe 99 PID 3280 wrote to memory of 2964 3280 5jvpj.exe 100 PID 3280 wrote to memory of 2964 3280 5jvpj.exe 100 PID 3280 wrote to memory of 2964 3280 5jvpj.exe 100 PID 2964 wrote to memory of 1888 2964 ffxlffx.exe 101 PID 2964 wrote to memory of 1888 2964 ffxlffx.exe 101 PID 2964 wrote to memory of 1888 2964 ffxlffx.exe 101 PID 1888 wrote to memory of 1828 1888 htnntt.exe 102 PID 1888 wrote to memory of 1828 1888 htnntt.exe 102 PID 1888 wrote to memory of 1828 1888 htnntt.exe 102 PID 1828 wrote to memory of 8 1828 hnntht.exe 103 PID 1828 wrote to memory of 8 1828 hnntht.exe 103 PID 1828 wrote to memory of 8 1828 hnntht.exe 103 PID 8 wrote to memory of 1032 8 vpvpj.exe 104 PID 8 wrote to memory of 1032 8 vpvpj.exe 104 PID 8 wrote to memory of 1032 8 vpvpj.exe 104 PID 1032 wrote to memory of 4580 1032 xlxlxxl.exe 105 PID 1032 wrote to memory of 4580 1032 xlxlxxl.exe 105 PID 1032 wrote to memory of 4580 1032 xlxlxxl.exe 105 PID 4580 wrote to memory of 3940 4580 nbnbhb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe"C:\Users\Admin\AppData\Local\Temp\060391c7188c22580ae9278525b6a427746c4629cdf5c393f6e2b5d24f585c60.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\nbhbtt.exec:\nbhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\jvvjv.exec:\jvvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\1vpdd.exec:\1vpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\fxffrlf.exec:\fxffrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\7bttnh.exec:\7bttnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\7nnbnh.exec:\7nnbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\5vddp.exec:\5vddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\thnbtn.exec:\thnbtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\vjpdd.exec:\vjpdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\jvdvp.exec:\jvdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\frrlfxl.exec:\frrlfxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\7thhbb.exec:\7thhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\nnhbhb.exec:\nnhbhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\5jvpj.exec:\5jvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\ffxlffx.exec:\ffxlffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\htnntt.exec:\htnntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\hnntht.exec:\hnntht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\vpvpj.exec:\vpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\xlxlxxl.exec:\xlxlxxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\nbnbhb.exec:\nbnbhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\1hnbbh.exec:\1hnbbh.exe23⤵
- Executes dropped EXE
PID:3940 -
\??\c:\dvjdp.exec:\dvjdp.exe24⤵
- Executes dropped EXE
PID:732 -
\??\c:\1flfllr.exec:\1flfllr.exe25⤵
- Executes dropped EXE
PID:4316 -
\??\c:\bbnntt.exec:\bbnntt.exe26⤵
- Executes dropped EXE
PID:1320 -
\??\c:\ppdvv.exec:\ppdvv.exe27⤵
- Executes dropped EXE
PID:3340 -
\??\c:\jpddv.exec:\jpddv.exe28⤵
- Executes dropped EXE
PID:2952 -
\??\c:\9ffxrrl.exec:\9ffxrrl.exe29⤵
- Executes dropped EXE
PID:4000 -
\??\c:\xxxrffx.exec:\xxxrffx.exe30⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nhtnbb.exec:\nhtnbb.exe31⤵
- Executes dropped EXE
PID:1132 -
\??\c:\vpvdv.exec:\vpvdv.exe32⤵
- Executes dropped EXE
PID:900 -
\??\c:\llfllrr.exec:\llfllrr.exe33⤵
- Executes dropped EXE
PID:3720 -
\??\c:\lfllfxr.exec:\lfllfxr.exe34⤵
- Executes dropped EXE
PID:2644 -
\??\c:\nnnhhb.exec:\nnnhhb.exe35⤵
- Executes dropped EXE
PID:4504 -
\??\c:\djppj.exec:\djppj.exe36⤵
- Executes dropped EXE
PID:4768 -
\??\c:\rflfrlx.exec:\rflfrlx.exe37⤵
- Executes dropped EXE
PID:1968 -
\??\c:\ntbntn.exec:\ntbntn.exe38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952 -
\??\c:\nhnbbb.exec:\nhnbbb.exe39⤵
- Executes dropped EXE
PID:4680 -
\??\c:\pjvpd.exec:\pjvpd.exe40⤵
- Executes dropped EXE
PID:3968 -
\??\c:\lfxlfff.exec:\lfxlfff.exe41⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lffffxf.exec:\lffffxf.exe42⤵
- Executes dropped EXE
PID:4436 -
\??\c:\tbtnbt.exec:\tbtnbt.exe43⤵
- Executes dropped EXE
PID:4992 -
\??\c:\tntnbh.exec:\tntnbh.exe44⤵
- Executes dropped EXE
PID:4268 -
\??\c:\jdpjd.exec:\jdpjd.exe45⤵
- Executes dropped EXE
PID:456 -
\??\c:\3vpjv.exec:\3vpjv.exe46⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3xffrrl.exec:\3xffrrl.exe47⤵
- Executes dropped EXE
PID:804 -
\??\c:\fxxrllf.exec:\fxxrllf.exe48⤵
- Executes dropped EXE
PID:1652 -
\??\c:\hhhbtt.exec:\hhhbtt.exe49⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nnhhtt.exec:\nnhhtt.exe50⤵
- Executes dropped EXE
PID:2488 -
\??\c:\dvdpj.exec:\dvdpj.exe51⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3vpjv.exec:\3vpjv.exe52⤵
- Executes dropped EXE
PID:1728 -
\??\c:\ffllrrx.exec:\ffllrrx.exe53⤵
- Executes dropped EXE
PID:5072 -
\??\c:\rffxrlx.exec:\rffxrlx.exe54⤵
- Executes dropped EXE
PID:872 -
\??\c:\3tbnhb.exec:\3tbnhb.exe55⤵
- Executes dropped EXE
PID:2872 -
\??\c:\hhbnhn.exec:\hhbnhn.exe56⤵
- Executes dropped EXE
PID:2528 -
\??\c:\jjpjv.exec:\jjpjv.exe57⤵
- Executes dropped EXE
PID:3664 -
\??\c:\1vvvj.exec:\1vvvj.exe58⤵
- Executes dropped EXE
PID:4672 -
\??\c:\3llfrrf.exec:\3llfrrf.exe59⤵
- Executes dropped EXE
PID:4084 -
\??\c:\rlrxxxx.exec:\rlrxxxx.exe60⤵
- Executes dropped EXE
PID:3460 -
\??\c:\nnhhbb.exec:\nnhhbb.exe61⤵
- Executes dropped EXE
PID:756 -
\??\c:\bbbbhn.exec:\bbbbhn.exe62⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608 -
\??\c:\ppdvj.exec:\ppdvj.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ppjjd.exec:\ppjjd.exe64⤵
- Executes dropped EXE
PID:4696 -
\??\c:\5rrlfxr.exec:\5rrlfxr.exe65⤵
- Executes dropped EXE
PID:1888 -
\??\c:\fxxrlxr.exec:\fxxrlxr.exe66⤵PID:3836
-
\??\c:\thbthh.exec:\thbthh.exe67⤵PID:1500
-
\??\c:\bbthbb.exec:\bbthbb.exe68⤵PID:3040
-
\??\c:\7jdjd.exec:\7jdjd.exe69⤵PID:4548
-
\??\c:\vvjjd.exec:\vvjjd.exe70⤵PID:4400
-
\??\c:\rlfflll.exec:\rlfflll.exe71⤵PID:2012
-
\??\c:\rrllrrx.exec:\rrllrrx.exe72⤵PID:948
-
\??\c:\btbthh.exec:\btbthh.exe73⤵PID:4440
-
\??\c:\httnnn.exec:\httnnn.exe74⤵PID:4024
-
\??\c:\pjvjd.exec:\pjvjd.exe75⤵PID:1604
-
\??\c:\djjdv.exec:\djjdv.exe76⤵PID:888
-
\??\c:\3fxlffx.exec:\3fxlffx.exe77⤵PID:2176
-
\??\c:\btbtbn.exec:\btbtbn.exe78⤵
- System Location Discovery: System Language Discovery
PID:3636 -
\??\c:\3bhtnh.exec:\3bhtnh.exe79⤵PID:4460
-
\??\c:\ppjdp.exec:\ppjdp.exe80⤵PID:3148
-
\??\c:\vpvjj.exec:\vpvjj.exe81⤵PID:368
-
\??\c:\7lfxrlf.exec:\7lfxrlf.exe82⤵PID:4164
-
\??\c:\tthhhh.exec:\tthhhh.exe83⤵PID:1592
-
\??\c:\vjdpj.exec:\vjdpj.exe84⤵PID:1132
-
\??\c:\7xrlxxl.exec:\7xrlxxl.exe85⤵PID:4056
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe86⤵PID:1164
-
\??\c:\hnhhbt.exec:\hnhhbt.exe87⤵PID:2644
-
\??\c:\3tntht.exec:\3tntht.exe88⤵PID:4504
-
\??\c:\hbbthb.exec:\hbbthb.exe89⤵PID:4768
-
\??\c:\9jpjj.exec:\9jpjj.exe90⤵PID:4280
-
\??\c:\vvvpj.exec:\vvvpj.exe91⤵PID:3144
-
\??\c:\3lllxlf.exec:\3lllxlf.exe92⤵PID:4800
-
\??\c:\5rxllll.exec:\5rxllll.exe93⤵PID:4516
-
\??\c:\bbtttt.exec:\bbtttt.exe94⤵PID:2552
-
\??\c:\pjvjv.exec:\pjvjv.exe95⤵PID:4436
-
\??\c:\jjjdp.exec:\jjjdp.exe96⤵PID:712
-
\??\c:\5jpjd.exec:\5jpjd.exe97⤵PID:1044
-
\??\c:\lrrlffx.exec:\lrrlffx.exe98⤵PID:2188
-
\??\c:\9flfrrl.exec:\9flfrrl.exe99⤵PID:1352
-
\??\c:\btnnhh.exec:\btnnhh.exe100⤵PID:4104
-
\??\c:\nhhbtt.exec:\nhhbtt.exe101⤵PID:5052
-
\??\c:\pdddv.exec:\pdddv.exe102⤵PID:3532
-
\??\c:\9vvpd.exec:\9vvpd.exe103⤵PID:4016
-
\??\c:\xrrlllf.exec:\xrrlllf.exe104⤵PID:2232
-
\??\c:\tthhnn.exec:\tthhnn.exe105⤵PID:1728
-
\??\c:\nhhbtt.exec:\nhhbtt.exe106⤵PID:2892
-
\??\c:\5jjjj.exec:\5jjjj.exe107⤵PID:2668
-
\??\c:\ffxrrrl.exec:\ffxrrrl.exe108⤵PID:2880
-
\??\c:\xrxffrf.exec:\xrxffrf.exe109⤵PID:3640
-
\??\c:\bnhtnh.exec:\bnhtnh.exe110⤵
- System Location Discovery: System Language Discovery
PID:2396 -
\??\c:\jdvpj.exec:\jdvpj.exe111⤵PID:4672
-
\??\c:\pjpdd.exec:\pjpdd.exe112⤵PID:5060
-
\??\c:\dpjdp.exec:\dpjdp.exe113⤵PID:3952
-
\??\c:\llrrxxf.exec:\llrrxxf.exe114⤵PID:2748
-
\??\c:\xrlrfrl.exec:\xrlrfrl.exe115⤵PID:1932
-
\??\c:\bnnhbt.exec:\bnnhbt.exe116⤵PID:1548
-
\??\c:\vpjvp.exec:\vpjvp.exe117⤵PID:4452
-
\??\c:\1jpjd.exec:\1jpjd.exe118⤵PID:936
-
\??\c:\3rfxffl.exec:\3rfxffl.exe119⤵PID:4924
-
\??\c:\xfllffx.exec:\xfllffx.exe120⤵PID:1032
-
\??\c:\1tbnhn.exec:\1tbnhn.exe121⤵PID:2640
-
\??\c:\pjjdv.exec:\pjjdv.exe122⤵PID:3716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-