Analysis
-
max time kernel
120s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system -
submitted
11-09-2024 21:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c3f32f78534112015cf4d699f5b04710N.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
120 seconds
General
-
Target
c3f32f78534112015cf4d699f5b04710N.exe
-
Size
70KB
-
MD5
c3f32f78534112015cf4d699f5b04710
-
SHA1
4a74121c472eef06276f865230593a02beb0fc96
-
SHA256
6429b64f6c646bd62be3c16f90547fd09697f52db30ba13ba606592e01660af8
-
SHA512
bd16b68dbf9d8301aaf05da86da21f10daad4d3b7520a0bae4ebc3e4642c5d015156b9cef41e2a62eedcf4ec33cebe091d309d16f138ecf8bdbaa7d737029453
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6MTSqfjR:ymb3NkkiQ3mdBjFI4Vh
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
resource yara_rule behavioral2/memory/1196-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4912-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1124-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1864-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2780-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2392-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2420-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2420 xlrllff.exe 1924 1bnhhh.exe 4616 nnbnnb.exe 2392 pdvpj.exe 4024 fflffxx.exe 2948 llrxfff.exe 5060 hnbbnn.exe 912 ttbtnh.exe 632 vpppp.exe 4312 llxrlff.exe 3364 frlfxxr.exe 4912 7tnnhb.exe 3596 pddvp.exe 4980 xffxrlf.exe 1412 thhtbb.exe 2780 htttnn.exe 4760 ppdvp.exe 3448 vpjdd.exe 220 llllfll.exe 1864 rlxxrff.exe 2472 bnnhbt.exe 3972 btnhbb.exe 4084 vjjdp.exe 1900 pvpdd.exe 1192 ffrrxxf.exe 1852 3bbtnh.exe 4668 nhbbtb.exe 60 vpdjd.exe 1124 pjpvj.exe 3744 xxrlxxr.exe 4584 rrxrfff.exe 1068 nnnhbb.exe 760 nnhhtn.exe 4884 pddpd.exe 4408 vvvpj.exe 2404 rfrffff.exe 1188 nnhhtb.exe 1036 5vpjp.exe 1924 vdppj.exe 3572 vpjjd.exe 2544 lfrrffl.exe 4292 xffxrrl.exe 1712 nnhntt.exe 2348 nhbttt.exe 5024 jdpjp.exe 3668 jdpdv.exe 3532 9lrfrll.exe 440 7lrllfx.exe 668 tnhnbh.exe 2888 nntttt.exe 3708 pjdvv.exe 3364 pddvp.exe 2180 pjpvv.exe 1744 xxxfrfx.exe 3596 lrxrlll.exe 4980 bththb.exe 4160 tnbbnn.exe 3216 7jppj.exe 3168 dpdjd.exe 4124 vddvd.exe 1340 xlxlrll.exe 3240 rxxrllf.exe 4740 tnttnn.exe 2192 hntnhn.exe -
resource yara_rule behavioral2/memory/1196-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4912-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1124-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1864-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2780-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/632-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2420-10-0x0000000000400000-0x0000000000429000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dppjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vvpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlfll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lxrrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jjjvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlxrlfl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9flrrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnhhtn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language frrlxlf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fllxllf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5dvjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdjdv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvpvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rfllrrl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2420 1196 c3f32f78534112015cf4d699f5b04710N.exe 83 PID 1196 wrote to memory of 2420 1196 c3f32f78534112015cf4d699f5b04710N.exe 83 PID 1196 wrote to memory of 2420 1196 c3f32f78534112015cf4d699f5b04710N.exe 83 PID 2420 wrote to memory of 1924 2420 xlrllff.exe 84 PID 2420 wrote to memory of 1924 2420 xlrllff.exe 84 PID 2420 wrote to memory of 1924 2420 xlrllff.exe 84 PID 1924 wrote to memory of 4616 1924 1bnhhh.exe 86 PID 1924 wrote to memory of 4616 1924 1bnhhh.exe 86 PID 1924 wrote to memory of 4616 1924 1bnhhh.exe 86 PID 4616 wrote to memory of 2392 4616 nnbnnb.exe 87 PID 4616 wrote to memory of 2392 4616 nnbnnb.exe 87 PID 4616 wrote to memory of 2392 4616 nnbnnb.exe 87 PID 2392 wrote to memory of 4024 2392 pdvpj.exe 88 PID 2392 wrote to memory of 4024 2392 pdvpj.exe 88 PID 2392 wrote to memory of 4024 2392 pdvpj.exe 88 PID 4024 wrote to memory of 2948 4024 fflffxx.exe 89 PID 4024 wrote to memory of 2948 4024 fflffxx.exe 89 PID 4024 wrote to memory of 2948 4024 fflffxx.exe 89 PID 2948 wrote to memory of 5060 2948 llrxfff.exe 90 PID 2948 wrote to memory of 5060 2948 llrxfff.exe 90 PID 2948 wrote to memory of 5060 2948 llrxfff.exe 90 PID 5060 wrote to memory of 912 5060 hnbbnn.exe 91 PID 5060 wrote to memory of 912 5060 hnbbnn.exe 91 PID 5060 wrote to memory of 912 5060 hnbbnn.exe 91 PID 912 wrote to memory of 632 912 ttbtnh.exe 92 PID 912 wrote to memory of 632 912 ttbtnh.exe 92 PID 912 wrote to memory of 632 912 ttbtnh.exe 92 PID 632 wrote to memory of 4312 632 vpppp.exe 93 PID 632 wrote to memory of 4312 632 vpppp.exe 93 PID 632 wrote to memory of 4312 632 vpppp.exe 93 PID 4312 wrote to memory of 3364 4312 llxrlff.exe 94 PID 4312 wrote to memory of 3364 4312 llxrlff.exe 94 PID 4312 wrote to memory of 3364 4312 llxrlff.exe 94 PID 3364 wrote to memory of 4912 3364 frlfxxr.exe 95 PID 3364 wrote to memory of 4912 3364 frlfxxr.exe 95 PID 3364 wrote to memory of 4912 3364 frlfxxr.exe 95 PID 4912 wrote to memory of 3596 4912 7tnnhb.exe 97 PID 4912 wrote to memory of 3596 4912 7tnnhb.exe 97 PID 4912 wrote to memory of 3596 4912 7tnnhb.exe 97 PID 3596 wrote to memory of 4980 3596 pddvp.exe 98 PID 3596 wrote to memory of 4980 3596 pddvp.exe 98 PID 3596 wrote to memory of 4980 3596 pddvp.exe 98 PID 4980 wrote to memory of 1412 4980 xffxrlf.exe 99 PID 4980 wrote to memory of 1412 4980 xffxrlf.exe 99 PID 4980 wrote to memory of 1412 4980 xffxrlf.exe 99 PID 1412 wrote to memory of 2780 1412 thhtbb.exe 100 PID 1412 wrote to memory of 2780 1412 thhtbb.exe 100 PID 1412 wrote to memory of 2780 1412 thhtbb.exe 100 PID 2780 wrote to memory of 4760 2780 htttnn.exe 101 PID 2780 wrote to memory of 4760 2780 htttnn.exe 101 PID 2780 wrote to memory of 4760 2780 htttnn.exe 101 PID 4760 wrote to memory of 3448 4760 ppdvp.exe 102 PID 4760 wrote to memory of 3448 4760 ppdvp.exe 102 PID 4760 wrote to memory of 3448 4760 ppdvp.exe 102 PID 3448 wrote to memory of 220 3448 vpjdd.exe 103 PID 3448 wrote to memory of 220 3448 vpjdd.exe 103 PID 3448 wrote to memory of 220 3448 vpjdd.exe 103 PID 220 wrote to memory of 1864 220 llllfll.exe 104 PID 220 wrote to memory of 1864 220 llllfll.exe 104 PID 220 wrote to memory of 1864 220 llllfll.exe 104 PID 1864 wrote to memory of 2472 1864 rlxxrff.exe 105 PID 1864 wrote to memory of 2472 1864 rlxxrff.exe 105 PID 1864 wrote to memory of 2472 1864 rlxxrff.exe 105 PID 2472 wrote to memory of 3972 2472 bnnhbt.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3f32f78534112015cf4d699f5b04710N.exe"C:\Users\Admin\AppData\Local\Temp\c3f32f78534112015cf4d699f5b04710N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\xlrllff.exec:\xlrllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\1bnhhh.exec:\1bnhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\nnbnnb.exec:\nnbnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\pdvpj.exec:\pdvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\fflffxx.exec:\fflffxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\llrxfff.exec:\llrxfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\hnbbnn.exec:\hnbbnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\ttbtnh.exec:\ttbtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\vpppp.exec:\vpppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:632 -
\??\c:\llxrlff.exec:\llxrlff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\frlfxxr.exec:\frlfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\7tnnhb.exec:\7tnnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\pddvp.exec:\pddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\xffxrlf.exec:\xffxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\thhtbb.exec:\thhtbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\htttnn.exec:\htttnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\ppdvp.exec:\ppdvp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\vpjdd.exec:\vpjdd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\llllfll.exec:\llllfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\rlxxrff.exec:\rlxxrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\bnnhbt.exec:\bnnhbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\btnhbb.exec:\btnhbb.exe23⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vjjdp.exec:\vjjdp.exe24⤵
- Executes dropped EXE
PID:4084 -
\??\c:\pvpdd.exec:\pvpdd.exe25⤵
- Executes dropped EXE
PID:1900 -
\??\c:\ffrrxxf.exec:\ffrrxxf.exe26⤵
- Executes dropped EXE
PID:1192 -
\??\c:\3bbtnh.exec:\3bbtnh.exe27⤵
- Executes dropped EXE
PID:1852 -
\??\c:\nhbbtb.exec:\nhbbtb.exe28⤵
- Executes dropped EXE
PID:4668 -
\??\c:\vpdjd.exec:\vpdjd.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\pjpvj.exec:\pjpvj.exe30⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xxrlxxr.exec:\xxrlxxr.exe31⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rrxrfff.exec:\rrxrfff.exe32⤵
- Executes dropped EXE
PID:4584 -
\??\c:\nnnhbb.exec:\nnnhbb.exe33⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nnhhtn.exec:\nnhhtn.exe34⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:760 -
\??\c:\pddpd.exec:\pddpd.exe35⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vvvpj.exec:\vvvpj.exe36⤵
- Executes dropped EXE
PID:4408 -
\??\c:\rfrffff.exec:\rfrffff.exe37⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7tnnnh.exec:\7tnnnh.exe38⤵PID:1908
-
\??\c:\nnhhtb.exec:\nnhhtb.exe39⤵
- Executes dropped EXE
PID:1188 -
\??\c:\5vpjp.exec:\5vpjp.exe40⤵
- Executes dropped EXE
PID:1036 -
\??\c:\vdppj.exec:\vdppj.exe41⤵
- Executes dropped EXE
PID:1924 -
\??\c:\vpjjd.exec:\vpjjd.exe42⤵
- Executes dropped EXE
PID:3572 -
\??\c:\lfrrffl.exec:\lfrrffl.exe43⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xffxrrl.exec:\xffxrrl.exe44⤵
- Executes dropped EXE
PID:4292 -
\??\c:\nnhntt.exec:\nnhntt.exe45⤵
- Executes dropped EXE
PID:1712 -
\??\c:\nhbttt.exec:\nhbttt.exe46⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jdpjp.exec:\jdpjp.exe47⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jdpdv.exec:\jdpdv.exe48⤵
- Executes dropped EXE
PID:3668 -
\??\c:\9lrfrll.exec:\9lrfrll.exe49⤵
- Executes dropped EXE
PID:3532 -
\??\c:\7lrllfx.exec:\7lrllfx.exe50⤵
- Executes dropped EXE
PID:440 -
\??\c:\tnhnbh.exec:\tnhnbh.exe51⤵
- Executes dropped EXE
PID:668 -
\??\c:\nntttt.exec:\nntttt.exe52⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pjdvv.exec:\pjdvv.exe53⤵
- Executes dropped EXE
PID:3708 -
\??\c:\pddvp.exec:\pddvp.exe54⤵
- Executes dropped EXE
PID:3364 -
\??\c:\pjpvv.exec:\pjpvv.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\xxxfrfx.exec:\xxxfrfx.exe56⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lrxrlll.exec:\lrxrlll.exe57⤵
- Executes dropped EXE
PID:3596 -
\??\c:\bththb.exec:\bththb.exe58⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tnbbnn.exec:\tnbbnn.exe59⤵
- Executes dropped EXE
PID:4160 -
\??\c:\7jppj.exec:\7jppj.exe60⤵
- Executes dropped EXE
PID:3216 -
\??\c:\dpdjd.exec:\dpdjd.exe61⤵
- Executes dropped EXE
PID:3168 -
\??\c:\vddvd.exec:\vddvd.exe62⤵
- Executes dropped EXE
PID:4124 -
\??\c:\xlxlrll.exec:\xlxlrll.exe63⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rxxrllf.exec:\rxxrllf.exe64⤵
- Executes dropped EXE
PID:3240 -
\??\c:\tnttnn.exec:\tnttnn.exe65⤵
- Executes dropped EXE
PID:4740 -
\??\c:\hntnhn.exec:\hntnhn.exe66⤵
- Executes dropped EXE
PID:2192 -
\??\c:\vpvvj.exec:\vpvvj.exe67⤵PID:2416
-
\??\c:\jppdp.exec:\jppdp.exe68⤵PID:4900
-
\??\c:\xlxrlfl.exec:\xlxrlfl.exe69⤵
- System Location Discovery: System Language Discovery
PID:2144 -
\??\c:\xxlffxf.exec:\xxlffxf.exe70⤵PID:1368
-
\??\c:\xrrfxrl.exec:\xrrfxrl.exe71⤵PID:2564
-
\??\c:\9bbttn.exec:\9bbttn.exe72⤵PID:2484
-
\??\c:\hbhbnn.exec:\hbhbnn.exe73⤵PID:880
-
\??\c:\djjdv.exec:\djjdv.exe74⤵PID:3052
-
\??\c:\pjdpd.exec:\pjdpd.exe75⤵PID:1660
-
\??\c:\vppdp.exec:\vppdp.exe76⤵PID:3804
-
\??\c:\1xxrfxr.exec:\1xxrfxr.exe77⤵PID:4480
-
\??\c:\lxrlffx.exec:\lxrlffx.exe78⤵PID:2872
-
\??\c:\nbbhbh.exec:\nbbhbh.exe79⤵PID:1108
-
\??\c:\1nbtbt.exec:\1nbtbt.exe80⤵PID:2812
-
\??\c:\dpddv.exec:\dpddv.exe81⤵PID:3500
-
\??\c:\dvpvp.exec:\dvpvp.exe82⤵
- System Location Discovery: System Language Discovery
PID:1584 -
\??\c:\7fxrlxr.exec:\7fxrlxr.exe83⤵PID:4416
-
\??\c:\lllxrlx.exec:\lllxrlx.exe84⤵PID:1788
-
\??\c:\rflffxx.exec:\rflffxx.exe85⤵PID:5044
-
\??\c:\thbnhh.exec:\thbnhh.exe86⤵PID:3176
-
\??\c:\bbtnnn.exec:\bbtnnn.exe87⤵PID:988
-
\??\c:\5tbtnn.exec:\5tbtnn.exe88⤵PID:4752
-
\??\c:\dvdpp.exec:\dvdpp.exe89⤵PID:1048
-
\??\c:\vvvpp.exec:\vvvpp.exe90⤵PID:2828
-
\??\c:\jdjdp.exec:\jdjdp.exe91⤵PID:1820
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe92⤵PID:644
-
\??\c:\xxxrffx.exec:\xxxrffx.exe93⤵PID:4440
-
\??\c:\9rxrffx.exec:\9rxrffx.exe94⤵PID:1724
-
\??\c:\bnntnt.exec:\bnntnt.exe95⤵PID:912
-
\??\c:\hhtbnb.exec:\hhtbnb.exe96⤵PID:2012
-
\??\c:\ppddv.exec:\ppddv.exe97⤵PID:1032
-
\??\c:\dvdpj.exec:\dvdpj.exe98⤵PID:4516
-
\??\c:\vdpjp.exec:\vdpjp.exe99⤵PID:4312
-
\??\c:\9rrlxrr.exec:\9rrlxrr.exe100⤵PID:1984
-
\??\c:\rxxxrrx.exec:\rxxxrrx.exe101⤵PID:2888
-
\??\c:\7tnhhn.exec:\7tnhhn.exe102⤵PID:1420
-
\??\c:\9bnhtt.exec:\9bnhtt.exe103⤵PID:4912
-
\??\c:\bhnhhh.exec:\bhnhhh.exe104⤵PID:5048
-
\??\c:\tbbntn.exec:\tbbntn.exe105⤵PID:1744
-
\??\c:\tnhhtt.exec:\tnhhtt.exe106⤵PID:2016
-
\??\c:\jpvjv.exec:\jpvjv.exe107⤵PID:1208
-
\??\c:\ddpdp.exec:\ddpdp.exe108⤵PID:2804
-
\??\c:\vvjdv.exec:\vvjdv.exe109⤵PID:3216
-
\??\c:\9flrrrl.exec:\9flrrrl.exe110⤵
- System Location Discovery: System Language Discovery
PID:3168 -
\??\c:\fllxrrl.exec:\fllxrrl.exe111⤵PID:220
-
\??\c:\hbtnbb.exec:\hbtnbb.exe112⤵PID:4860
-
\??\c:\bbbnbb.exec:\bbbnbb.exe113⤵PID:3864
-
\??\c:\ppdpd.exec:\ppdpd.exe114⤵PID:2472
-
\??\c:\vjdpj.exec:\vjdpj.exe115⤵PID:3908
-
\??\c:\3jjdp.exec:\3jjdp.exe116⤵PID:3148
-
\??\c:\frlfrfl.exec:\frlfrfl.exe117⤵PID:1904
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe118⤵PID:4560
-
\??\c:\ntttnn.exec:\ntttnn.exe119⤵PID:4780
-
\??\c:\7bbthh.exec:\7bbthh.exe120⤵PID:1968
-
\??\c:\9bnhhh.exec:\9bnhhh.exe121⤵PID:3468
-
\??\c:\3djvj.exec:\3djvj.exe122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-