Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 18:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe
Resource
win7-20240708-en
6 signatures
150 seconds
General
-
Target
140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe
-
Size
375KB
-
MD5
23779c20238caef25c751a6277600f23
-
SHA1
e6900bfbd1d4154d0360b132ee8286b1370fe61a
-
SHA256
140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68
-
SHA512
e389a23037aa6f4f710786f82dac53fd3f5c65ea2fb650ef979622ba81fef8c15ea1cd3efe9e3c89aa47151f209bab0330129fc98dc43644f338678735c037ec
-
SSDEEP
6144:n3C9BRIG0asYFm71mJl3/X8mak5gNv9rC8IwLaYNUvtTxTKMM3:n3C9uYA7i3/stR9HGYyvtTxTKMU
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
resource yara_rule behavioral2/memory/2348-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1336-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4928-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2924-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2612-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2920-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/728-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3644 vvvjd.exe 2532 ffxlfxr.exe 1336 7hnbth.exe 2628 1djdv.exe 3616 jddvv.exe 4928 7dvpj.exe 4960 xrlrlfx.exe 1856 btthtn.exe 4472 3ppdv.exe 2264 bnnbnn.exe 1868 djdvp.exe 3068 bhnhnt.exe 2924 nbbthb.exe 3144 frxrfxx.exe 1436 9xxlxxl.exe 4776 hhhnhb.exe 3468 3xlfrlf.exe 2612 nttnbh.exe 3356 lrlfxrl.exe 796 rlfxrlx.exe 2064 dpvjj.exe 4552 5xlxllf.exe 724 rfxrffx.exe 2624 ddpdv.exe 2604 rflflfr.exe 2920 hbbttn.exe 512 pdpdp.exe 728 xlrfllx.exe 3824 rrrxfll.exe 1032 frfxxrf.exe 4228 jjjdd.exe 3420 rfflxlx.exe 4728 hhbthb.exe 3196 bthnhn.exe 4140 jvvpj.exe 2128 xrxfrxl.exe 4280 thhhbb.exe 4336 jpddv.exe 1416 3lxffrx.exe 4444 7ttnbh.exe 4564 hnthtt.exe 4532 vpppp.exe 1336 ffxxflr.exe 4788 hbntbn.exe 392 5nnbth.exe 3616 vpvjj.exe 3532 lxfrfxr.exe 4972 9llfrrr.exe 4112 nbtnhh.exe 4864 pjjjv.exe 4368 fxrfrlf.exe 4116 nthhnh.exe 1744 pvjdd.exe 3484 vpjjp.exe 2932 lffxxrl.exe 1440 bttnnn.exe 852 7pvvp.exe 5060 pppjj.exe 3588 xffxfff.exe 2456 3hhbhh.exe 4524 hhnhhh.exe 1436 pdjjd.exe 4776 xxlffll.exe 3456 rlxrlrr.exe -
resource yara_rule behavioral2/memory/2348-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1336-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2924-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2612-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2920-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/728-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5rrrrxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language httbbh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxlfxrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7xrlfxr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tnbbtt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3pvpp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3jdvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nhnnhh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rlfxrlx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7jjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fffllrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5pvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7tbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhthnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rflrlrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjdd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3644 2348 140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe 83 PID 2348 wrote to memory of 3644 2348 140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe 83 PID 2348 wrote to memory of 3644 2348 140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe 83 PID 3644 wrote to memory of 2532 3644 vvvjd.exe 84 PID 3644 wrote to memory of 2532 3644 vvvjd.exe 84 PID 3644 wrote to memory of 2532 3644 vvvjd.exe 84 PID 2532 wrote to memory of 1336 2532 ffxlfxr.exe 85 PID 2532 wrote to memory of 1336 2532 ffxlfxr.exe 85 PID 2532 wrote to memory of 1336 2532 ffxlfxr.exe 85 PID 1336 wrote to memory of 2628 1336 7hnbth.exe 86 PID 1336 wrote to memory of 2628 1336 7hnbth.exe 86 PID 1336 wrote to memory of 2628 1336 7hnbth.exe 86 PID 2628 wrote to memory of 3616 2628 1djdv.exe 87 PID 2628 wrote to memory of 3616 2628 1djdv.exe 87 PID 2628 wrote to memory of 3616 2628 1djdv.exe 87 PID 3616 wrote to memory of 4928 3616 jddvv.exe 89 PID 3616 wrote to memory of 4928 3616 jddvv.exe 89 PID 3616 wrote to memory of 4928 3616 jddvv.exe 89 PID 4928 wrote to memory of 4960 4928 7dvpj.exe 91 PID 4928 wrote to memory of 4960 4928 7dvpj.exe 91 PID 4928 wrote to memory of 4960 4928 7dvpj.exe 91 PID 4960 wrote to memory of 1856 4960 xrlrlfx.exe 92 PID 4960 wrote to memory of 1856 4960 xrlrlfx.exe 92 PID 4960 wrote to memory of 1856 4960 xrlrlfx.exe 92 PID 1856 wrote to memory of 4472 1856 btthtn.exe 93 PID 1856 wrote to memory of 4472 1856 btthtn.exe 93 PID 1856 wrote to memory of 4472 1856 btthtn.exe 93 PID 4472 wrote to memory of 2264 4472 3ppdv.exe 94 PID 4472 wrote to memory of 2264 4472 3ppdv.exe 94 PID 4472 wrote to memory of 2264 4472 3ppdv.exe 94 PID 2264 wrote to memory of 1868 2264 bnnbnn.exe 95 PID 2264 wrote to memory of 1868 2264 bnnbnn.exe 95 PID 2264 wrote to memory of 1868 2264 bnnbnn.exe 95 PID 1868 wrote to memory of 3068 1868 djdvp.exe 97 PID 1868 wrote to memory of 3068 1868 djdvp.exe 97 PID 1868 wrote to memory of 3068 1868 djdvp.exe 97 PID 3068 wrote to memory of 2924 3068 bhnhnt.exe 98 PID 3068 wrote to memory of 2924 3068 bhnhnt.exe 98 PID 3068 wrote to memory of 2924 3068 bhnhnt.exe 98 PID 2924 wrote to memory of 3144 2924 nbbthb.exe 99 PID 2924 wrote to memory of 3144 2924 nbbthb.exe 99 PID 2924 wrote to memory of 3144 2924 nbbthb.exe 99 PID 3144 wrote to memory of 1436 3144 frxrfxx.exe 100 PID 3144 wrote to memory of 1436 3144 frxrfxx.exe 100 PID 3144 wrote to memory of 1436 3144 frxrfxx.exe 100 PID 1436 wrote to memory of 4776 1436 9xxlxxl.exe 101 PID 1436 wrote to memory of 4776 1436 9xxlxxl.exe 101 PID 1436 wrote to memory of 4776 1436 9xxlxxl.exe 101 PID 4776 wrote to memory of 3468 4776 hhhnhb.exe 102 PID 4776 wrote to memory of 3468 4776 hhhnhb.exe 102 PID 4776 wrote to memory of 3468 4776 hhhnhb.exe 102 PID 3468 wrote to memory of 2612 3468 3xlfrlf.exe 103 PID 3468 wrote to memory of 2612 3468 3xlfrlf.exe 103 PID 3468 wrote to memory of 2612 3468 3xlfrlf.exe 103 PID 2612 wrote to memory of 3356 2612 nttnbh.exe 104 PID 2612 wrote to memory of 3356 2612 nttnbh.exe 104 PID 2612 wrote to memory of 3356 2612 nttnbh.exe 104 PID 3356 wrote to memory of 796 3356 lrlfxrl.exe 105 PID 3356 wrote to memory of 796 3356 lrlfxrl.exe 105 PID 3356 wrote to memory of 796 3356 lrlfxrl.exe 105 PID 796 wrote to memory of 2064 796 rlfxrlx.exe 106 PID 796 wrote to memory of 2064 796 rlfxrlx.exe 106 PID 796 wrote to memory of 2064 796 rlfxrlx.exe 106 PID 2064 wrote to memory of 4552 2064 dpvjj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe"C:\Users\Admin\AppData\Local\Temp\140338db2d66aa80f69d73ee491134dc8e28c0656ae2a9886c201825f9fc5a68.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\vvvjd.exec:\vvvjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\ffxlfxr.exec:\ffxlfxr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\7hnbth.exec:\7hnbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\1djdv.exec:\1djdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\jddvv.exec:\jddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\7dvpj.exec:\7dvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\xrlrlfx.exec:\xrlrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\btthtn.exec:\btthtn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\3ppdv.exec:\3ppdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\bnnbnn.exec:\bnnbnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
\??\c:\djdvp.exec:\djdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\bhnhnt.exec:\bhnhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nbbthb.exec:\nbbthb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\frxrfxx.exec:\frxrfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\9xxlxxl.exec:\9xxlxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\hhhnhb.exec:\hhhnhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\3xlfrlf.exec:\3xlfrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\nttnbh.exec:\nttnbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\rlfxrlx.exec:\rlfxrlx.exe21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:796 -
\??\c:\dpvjj.exec:\dpvjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\5xlxllf.exec:\5xlxllf.exe23⤵
- Executes dropped EXE
PID:4552 -
\??\c:\rfxrffx.exec:\rfxrffx.exe24⤵
- Executes dropped EXE
PID:724 -
\??\c:\ddpdv.exec:\ddpdv.exe25⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rflflfr.exec:\rflflfr.exe26⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hbbttn.exec:\hbbttn.exe27⤵
- Executes dropped EXE
PID:2920 -
\??\c:\pdpdp.exec:\pdpdp.exe28⤵
- Executes dropped EXE
PID:512 -
\??\c:\xlrfllx.exec:\xlrfllx.exe29⤵
- Executes dropped EXE
PID:728 -
\??\c:\rrrxfll.exec:\rrrxfll.exe30⤵
- Executes dropped EXE
PID:3824 -
\??\c:\frfxxrf.exec:\frfxxrf.exe31⤵
- Executes dropped EXE
PID:1032 -
\??\c:\jjjdd.exec:\jjjdd.exe32⤵
- Executes dropped EXE
PID:4228 -
\??\c:\rfflxlx.exec:\rfflxlx.exe33⤵
- Executes dropped EXE
PID:3420 -
\??\c:\hhbthb.exec:\hhbthb.exe34⤵
- Executes dropped EXE
PID:4728 -
\??\c:\bthnhn.exec:\bthnhn.exe35⤵
- Executes dropped EXE
PID:3196 -
\??\c:\jvvpj.exec:\jvvpj.exe36⤵
- Executes dropped EXE
PID:4140 -
\??\c:\xrxfrxl.exec:\xrxfrxl.exe37⤵
- Executes dropped EXE
PID:2128 -
\??\c:\thhhbb.exec:\thhhbb.exe38⤵
- Executes dropped EXE
PID:4280 -
\??\c:\jpddv.exec:\jpddv.exe39⤵
- Executes dropped EXE
PID:4336 -
\??\c:\3lxffrx.exec:\3lxffrx.exe40⤵
- Executes dropped EXE
PID:1416 -
\??\c:\7ttnbh.exec:\7ttnbh.exe41⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hnthtt.exec:\hnthtt.exe42⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vpppp.exec:\vpppp.exe43⤵
- Executes dropped EXE
PID:4532 -
\??\c:\ffxxflr.exec:\ffxxflr.exe44⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hbntbn.exec:\hbntbn.exe45⤵
- Executes dropped EXE
PID:4788 -
\??\c:\5nnbth.exec:\5nnbth.exe46⤵
- Executes dropped EXE
PID:392 -
\??\c:\vpvjj.exec:\vpvjj.exe47⤵
- Executes dropped EXE
PID:3616 -
\??\c:\lxfrfxr.exec:\lxfrfxr.exe48⤵
- Executes dropped EXE
PID:3532 -
\??\c:\9llfrrr.exec:\9llfrrr.exe49⤵
- Executes dropped EXE
PID:4972 -
\??\c:\nbtnhh.exec:\nbtnhh.exe50⤵
- Executes dropped EXE
PID:4112 -
\??\c:\pjjjv.exec:\pjjjv.exe51⤵
- Executes dropped EXE
PID:4864 -
\??\c:\fxrfrlf.exec:\fxrfrlf.exe52⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nthhnh.exec:\nthhnh.exe53⤵
- Executes dropped EXE
PID:4116 -
\??\c:\pvjdd.exec:\pvjdd.exe54⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vpjjp.exec:\vpjjp.exe55⤵
- Executes dropped EXE
PID:3484 -
\??\c:\lffxxrl.exec:\lffxxrl.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\bttnnn.exec:\bttnnn.exe57⤵
- Executes dropped EXE
PID:1440 -
\??\c:\7pvvp.exec:\7pvvp.exe58⤵
- Executes dropped EXE
PID:852 -
\??\c:\pppjj.exec:\pppjj.exe59⤵
- Executes dropped EXE
PID:5060 -
\??\c:\xffxfff.exec:\xffxfff.exe60⤵
- Executes dropped EXE
PID:3588 -
\??\c:\3hhbhh.exec:\3hhbhh.exe61⤵
- Executes dropped EXE
PID:2456 -
\??\c:\hhnhhh.exec:\hhnhhh.exe62⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pdjjd.exec:\pdjjd.exe63⤵
- Executes dropped EXE
PID:1436 -
\??\c:\xxlffll.exec:\xxlffll.exe64⤵
- Executes dropped EXE
PID:4776 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe65⤵
- Executes dropped EXE
PID:3456 -
\??\c:\9hnhbt.exec:\9hnhbt.exe66⤵PID:4516
-
\??\c:\pjpjp.exec:\pjpjp.exe67⤵PID:3840
-
\??\c:\ppppp.exec:\ppppp.exe68⤵PID:3392
-
\??\c:\3fxrlfx.exec:\3fxrlfx.exe69⤵PID:3960
-
\??\c:\hnttbb.exec:\hnttbb.exe70⤵PID:4136
-
\??\c:\tbhhbt.exec:\tbhhbt.exe71⤵PID:2384
-
\??\c:\pppvp.exec:\pppvp.exe72⤵PID:1940
-
\??\c:\pjvpp.exec:\pjvpp.exe73⤵PID:2956
-
\??\c:\xlllfff.exec:\xlllfff.exe74⤵PID:2448
-
\??\c:\nnnhbb.exec:\nnnhbb.exe75⤵PID:4032
-
\??\c:\hbnhbn.exec:\hbnhbn.exe76⤵PID:3852
-
\??\c:\pvddj.exec:\pvddj.exe77⤵PID:740
-
\??\c:\3lfrllf.exec:\3lfrllf.exe78⤵PID:4956
-
\??\c:\tntnnn.exec:\tntnnn.exe79⤵PID:3280
-
\??\c:\3nhhnn.exec:\3nhhnn.exe80⤵PID:3768
-
\??\c:\7pjdd.exec:\7pjdd.exe81⤵PID:1536
-
\??\c:\dvvpd.exec:\dvvpd.exe82⤵PID:4652
-
\??\c:\rlllffx.exec:\rlllffx.exe83⤵PID:2128
-
\??\c:\hthbbt.exec:\hthbbt.exe84⤵PID:4376
-
\??\c:\5vpjd.exec:\5vpjd.exe85⤵PID:2348
-
\??\c:\ffrrxff.exec:\ffrrxff.exe86⤵PID:3472
-
\??\c:\5llllrr.exec:\5llllrr.exe87⤵PID:4060
-
\??\c:\3ttnnb.exec:\3ttnnb.exe88⤵PID:3324
-
\??\c:\jvvdv.exec:\jvvdv.exe89⤵PID:4996
-
\??\c:\pdjdd.exec:\pdjdd.exe90⤵PID:3928
-
\??\c:\xfrfrrr.exec:\xfrfrrr.exe91⤵PID:4036
-
\??\c:\1hnnnn.exec:\1hnnnn.exe92⤵PID:4784
-
\??\c:\nnhbtt.exec:\nnhbtt.exe93⤵PID:4788
-
\??\c:\7vddd.exec:\7vddd.exe94⤵PID:1788
-
\??\c:\3bbtnn.exec:\3bbtnn.exe95⤵PID:212
-
\??\c:\btnnhb.exec:\btnnhb.exe96⤵PID:3532
-
\??\c:\1pvpd.exec:\1pvpd.exe97⤵PID:4972
-
\??\c:\rxxflrf.exec:\rxxflrf.exe98⤵PID:1728
-
\??\c:\nhhbtt.exec:\nhhbtt.exe99⤵PID:4864
-
\??\c:\tnthth.exec:\tnthth.exe100⤵PID:4180
-
\??\c:\pdjjp.exec:\pdjjp.exe101⤵PID:3916
-
\??\c:\xlllffx.exec:\xlllffx.exe102⤵PID:1744
-
\??\c:\nbbtnn.exec:\nbbtnn.exe103⤵PID:3996
-
\??\c:\htbtnn.exec:\htbtnn.exe104⤵PID:5016
-
\??\c:\dvdvp.exec:\dvdvp.exe105⤵PID:4944
-
\??\c:\9xxrrll.exec:\9xxrrll.exe106⤵PID:2780
-
\??\c:\rfrlrrx.exec:\rfrlrrx.exe107⤵PID:4460
-
\??\c:\hbbttt.exec:\hbbttt.exe108⤵PID:3588
-
\??\c:\dvdvj.exec:\dvdvj.exe109⤵PID:4804
-
\??\c:\xffxffx.exec:\xffxffx.exe110⤵PID:208
-
\??\c:\rlrrrrl.exec:\rlrrrrl.exe111⤵PID:4748
-
\??\c:\nnnnhh.exec:\nnnnhh.exe112⤵PID:3536
-
\??\c:\jjvpv.exec:\jjvpv.exe113⤵PID:3456
-
\??\c:\vvppp.exec:\vvppp.exe114⤵PID:3408
-
\??\c:\flfrllx.exec:\flfrllx.exe115⤵PID:692
-
\??\c:\7tbttt.exec:\7tbttt.exe116⤵PID:4836
-
\??\c:\ntbttt.exec:\ntbttt.exe117⤵PID:2064
-
\??\c:\jpdvj.exec:\jpdvj.exe118⤵PID:4016
-
\??\c:\pjvvp.exec:\pjvvp.exe119⤵PID:724
-
\??\c:\lffxrlf.exec:\lffxrlf.exe120⤵PID:2500
-
\??\c:\thhhbt.exec:\thhhbt.exe121⤵PID:2520
-
\??\c:\bnhhtb.exec:\bnhhtb.exe122⤵PID:1976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-